@go-to-k/cdkd 0.288.0 → 0.288.2

package/dist/{program-CizHCByV.js → program-BRon74Fc.js}

@@ -1,8 +1,8 @@
-import { $ as createMaskedRetryLogger, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as replayWarn, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketWebsiteUrl, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as normalizeAwsTagsToCfn, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as configBooleanRefusal, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as coerceCfnBoolean, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as producerRegionsFromState, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as findSilentDropProperties, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as DiffCalculator, I as cyan, In as isCrossRegionRedirect, It as s3BucketArn, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as s3BucketDomainName, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as requireConfigObject, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigString, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as configStringRefusal, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as classifyReplaySecretRegion, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketDualStackDomainName, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as WAFv2WebACLProvider, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as assertRegionMatch, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as INTRINSIC_KEYS, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as applyRoleArnIfSet, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as findActionableSilentDrops, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as coerceParameterTypedValue, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as isInterruptedWaitError, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as parameterTypeMayLoseSecretIdentity, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as slowCcOperationTimeoutMs, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as deleteSkipReason, en as createSecretMasker, er as escapeRegExp, et as maskDeep, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as disableInstanceApiTermination, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as cfnRefValueFromPhysicalId, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as carriesDynamicReference, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as interruptWatchListenerCount, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as requireConfigArray, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as readConfigString, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as UNSPECIFIED_SKIP_REASON, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as IntrinsicFunctionResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as beginCommandInterruptScope, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as startInterruptWatch, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as isTerminationProtectionPropagationError, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as endCommandInterruptScope, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as maskerOrIdentity, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as deleteIndeterminateGuards, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as getAccountInfo, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as resolveExplicitPhysicalId, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as refStateLookupFromResource, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as isUnboundTemplateParameter, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketRegionalDomainName } from "./deploy-engine-DF3fAY6q.js";
+import { $ as createMaskedRetryLogger, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as replayWarn, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketWebsiteUrl, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as normalizeAwsTagsToCfn, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as configBooleanRefusal, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as coerceCfnBoolean, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as producerRegionsFromState, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as findSilentDropProperties, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as DiffCalculator, I as cyan, In as isCrossRegionRedirect, It as s3BucketArn, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as s3BucketDomainName, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as requireConfigObject, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigString, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as configStringRefusal, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as classifyReplaySecretRegion, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketDualStackDomainName, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as WAFv2WebACLProvider, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as assertRegionMatch, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as INTRINSIC_KEYS, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as applyRoleArnIfSet, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as findActionableSilentDrops, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as coerceParameterTypedValue, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as isInterruptedWaitError, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as parameterTypeMayLoseSecretIdentity, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as slowCcOperationTimeoutMs, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as deleteSkipReason, en as createSecretMasker, er as escapeRegExp, et as maskDeep, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as disableInstanceApiTermination, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as cfnRefValueFromPhysicalId, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as carriesDynamicReference, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as interruptWatchListenerCount, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as requireConfigArray, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as readConfigString, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as UNSPECIFIED_SKIP_REASON, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as IntrinsicFunctionResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as beginCommandInterruptScope, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as startInterruptWatch, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as isTerminationProtectionPropagationError, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as endCommandInterruptScope, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as maskerOrIdentity, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as deleteIndeterminateGuards, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as getAccountInfo, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as resolveExplicitPhysicalId, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as refStateLookupFromResource, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as isUnboundTemplateParameter, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketRegionalDomainName } from "./deploy-engine-Cxt3gn8N.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BQMDIEQY.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-DQCVYO5-.js";
+import { t as getCdkdVersion } from "./version-BRByznpy.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-DUlRn84u.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1780,15 +1780,16 @@ async function bootstrapCommand(options) {
 			});
 		}
 		let skipStateBucketConfig = false;
-		if (bucketExists) if (!options.force) {
-			if (!options.assets) {
-				logger.warn(`Bucket ${bucketName} already exists. Use --force to reconfigure (this will not delete existing state)`);
-				return;
-			}
-			logger.info(`State bucket ${bucketName} already exists — skipping reconfiguration (use --force to reconfigure)`);
-			skipStateBucketConfig = true;
-		} else logger.info("--force specified, continuing with existing bucket");
-		else {
+		if (bucketExists) {
+			if (!options.force) {
+				if (!options.assets) {
+					logger.warn(`Bucket ${bucketName} already exists. Use --force to reconfigure (this will not delete existing state)`);
+					return;
+				}
+				logger.info(`State bucket ${bucketName} already exists — skipping reconfiguration (use --force to reconfigure)`);
+				skipStateBucketConfig = true;
+			} else logger.info("--force specified, continuing with existing bucket");
+		} else {
 			logger.info(`Creating S3 bucket: ${bucketName} in region ${region}`);
 			const createBucketParams = { Bucket: bucketName };
 			if (region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: region };
@@ -4173,7 +4174,8 @@ var IAMPolicyProvider = class {
 			};
 		}
 		const onNotFound = async (target) => {
-			assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, `${physicalId} (${target})`);
+			const clientRegion = await this.iamClient.config.region();
+			assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, `${physicalId} (${target})`);
 		};
 		try {
 			if (legacyRoleFromPhysicalId) {
@@ -4493,7 +4495,8 @@ var IAMManagedPolicyProvider = class {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Managed policy ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -4970,7 +4973,8 @@ var IAMInstanceProfileProvider = class {
 				roles = (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: physicalId }))).InstanceProfile?.Roles?.map((r) => r.RoleName).filter((name) => !!name) || [];
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -4989,7 +4993,8 @@ var IAMInstanceProfileProvider = class {
 			this.logger.debug(`Successfully deleted IAM instance profile ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
-				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.iamClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -5390,7 +5395,8 @@ var IAMAccessKeyProvider = class {
 			this.logger.debug(`Successfully deleted IAM access key ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
-				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.iamClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Access key ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -5719,7 +5725,8 @@ var IAMUserGroupProvider = class {
 				await this.iamClient.send(new GetUserCommand({ UserName: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`User ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -5983,7 +5990,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM group ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
-				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.iamClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Group ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -6829,7 +6837,8 @@ const EVENTBRIDGE_DEFAULT_ENABLED = true;
 * correct once every declared-but-unusable value has been refused.
 */
 function eventBridgeEnabledOf(eb) {
-	return coerceCfnBoolean(isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0) ?? EVENTBRIDGE_DEFAULT_ENABLED;
+	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
+	return coerceCfnBoolean(declared) ?? EVENTBRIDGE_DEFAULT_ENABLED;
 }
 /** The notification families whose empty declaration is never SENT (issue #1759). */
 const NOTIFICATION_LIST_KEYS = [
@@ -9424,15 +9433,18 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
-		if (notifConfig) if (!await this.applyNotificationConfiguration(bucketName, notifConfig, replayOnUnusable)) overrides.set("NotificationConfiguration", void 0);
-		else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
+		if (notifConfig) {
+			if (!await this.applyNotificationConfiguration(bucketName, notifConfig, replayOnUnusable)) overrides.set("NotificationConfiguration", void 0);
+			else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
+		}
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		else if (corsConfig != null) this.announceCreateEmptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules");
 		const lifecycleConfig = properties["LifecycleConfiguration"];
-		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
-		else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(lifecycleConfig));
-		else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
+		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) {
+			if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
+			else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(lifecycleConfig));
+		} else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
 		const loggingConfig = properties["LoggingConfiguration"];
 		const loggingRefusal = replayOnUnusable ? configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") : void 0;
 		if (loggingRefusal !== void 0) {
@@ -9839,7 +9851,8 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
 			if (error instanceof NoSuchBucket) {
-				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.s3Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -10081,7 +10094,8 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async readTags(bucket) {
 		try {
-			return normalizeAwsTagsToCfn((await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: bucket }))).TagSet);
+			const resp = await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: bucket }));
+			return normalizeAwsTagsToCfn(resp.TagSet);
 		} catch (err) {
 			if (err.name === "NoSuchTagSet") return [];
 			throw err;
@@ -10773,12 +10787,14 @@ var S3BucketPolicyProvider = class {
 				this.logger.debug(`Successfully deleted S3 bucket policy ${logicalId}`);
 			} catch (error) {
 				if (error instanceof NoSuchBucket) {
-					assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.s3Client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Bucket ${physicalId} does not exist, skipping policy deletion`);
 					return;
 				}
 				if (error instanceof Error && (error.name === "NoSuchBucketPolicy" || error.message.includes("does not have"))) {
-					assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.s3Client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Bucket policy for ${physicalId} does not exist, skipping`);
 					return;
 				}
@@ -11252,7 +11268,8 @@ var SQSQueueProvider = class {
 			this.logger.debug(`Successfully deleted SQS queue ${logicalId}`);
 		} catch (error) {
 			if (error instanceof QueueDoesNotExist) {
-				assertRegionMatch(await this.sqsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.sqsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SQS queue ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -11416,7 +11433,8 @@ var SQSQueueProvider = class {
 			result["RedriveAllowPolicy"] = attributes["RedriveAllowPolicy"];
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: physicalId }))).Tags);
+			const tagsResp = await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof QueueDoesNotExist) return void 0;
 			throw err;
@@ -11548,7 +11566,8 @@ var SQSQueuePolicyProvider = class {
 			this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "QueueDoesNotExist" || error.message.includes("does not exist"))) {
-				assertRegionMatch(await this.sqsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.sqsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Queue ${physicalId} does not exist, skipping policy deletion`);
 				return;
 			}
@@ -11997,7 +12016,8 @@ var SNSTopicProvider = class {
 			this.logger.debug(`Successfully deleted SNS topic ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException) {
-				assertRegionMatch(await this.snsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.snsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SNS topic ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -12098,7 +12118,8 @@ var SNSTopicProvider = class {
 		}
 		result["DeliveryStatusLogging"] = mapDeliveryStatusLogging(attrs, stateProtocolCaseMap(properties?.["DeliveryStatusLogging"]));
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: physicalId }))).Tags);
+			const tagsResp = await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof NotFoundException) return void 0;
 			throw err;
@@ -12628,7 +12649,8 @@ var SNSSubscriptionProvider = class {
 			this.logger.debug(`Successfully deleted SNS subscription ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException) {
-				assertRegionMatch(await this.snsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.snsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Subscription ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -12820,7 +12842,8 @@ var SNSTopicPolicyProvider = class {
 			this.logger.debug(`Removed policy from topic ${topicArn}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "NotFoundException" || error.name === "NotFound" || error.message.includes("not found") || error.message.includes("does not exist") || error.message.includes("Invalid parameter"))) {
-				assertRegionMatch(await getAwsClients().sns.config.region(), context?.expectedRegion, resourceType, logicalId, topicArn);
+				const clientRegion = await getAwsClients().sns.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, topicArn);
 				this.logger.debug(`Topic ${topicArn} not found or policy already removed, skipping`);
 				continue;
 			}
@@ -13047,12 +13070,12 @@ var LambdaFunctionProvider = class {
 	*/
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Map([["PublishToLatestPublished", "CloudFormation-only version-publishing directive with no AWS SDK equivalent"]])]]);
 	cleanupDeleteRetryDelayMs = 2e3;
-	eniWaitTimeoutMs = 600 * 1e3;
+	eniWaitTimeoutMs = 6e5;
 	eniWaitInitialDelayMs = 1e4;
 	eniWaitMaxDelayMs = 1e4;
 	functionUpdateMaxWaitSeconds = 600;
 	eniInitialSleepMs = 1e4;
-	eniDeleteRetryBudgetMs = 1800 * 1e3;
+	eniDeleteRetryBudgetMs = 18e5;
 	eniDeleteRetryIntervalMs = 15e3;
 	constructor() {
 		const awsClients = getAwsClients();
@@ -13189,7 +13212,7 @@ var LambdaFunctionProvider = class {
 				const deleteMessage = deleteError instanceof Error ? deleteError.message : String(deleteError);
 				cleanupFailure = deleteMessage;
 				if (!/currently in the following state|ResourceConflict/i.test(deleteMessage)) break;
-				if (attempt < LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS - 1) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
+				if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
 			}
 			if (cleanupFailure !== void 0) this.logger.error(`Cleanup DeleteFunction failed for ${ctx.logicalId} after ${ctx.apiName} failure — function may be orphaned: ${cleanupFailure}`);
 			throw new ProvisioningError(`Failed to set ${ctx.propertyName} on Lambda function ${ctx.logicalId} (function was deleted to maintain atomicity): ${message}`, ctx.resourceType, ctx.logicalId, ctx.functionName, error instanceof Error ? error : void 0);
@@ -13306,15 +13329,17 @@ var LambdaFunctionProvider = class {
 				this.logger.debug(`Updated RecursiveLoop for Lambda function ${physicalId} to '${newRecursiveLoop}'`);
 			}
 			const newReservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
-			if (newReservedConcurrentExecutions !== previousProperties["ReservedConcurrentExecutions"]) if (newReservedConcurrentExecutions === void 0) {
-				await this.lambdaClient.send(new DeleteFunctionConcurrencyCommand({ FunctionName: physicalId }));
-				this.logger.debug(`Cleared ReservedConcurrentExecutions for Lambda function ${physicalId} (template removed the property)`);
-			} else {
-				await this.lambdaClient.send(new PutFunctionConcurrencyCommand({
-					FunctionName: physicalId,
-					ReservedConcurrentExecutions: newReservedConcurrentExecutions
-				}));
-				this.logger.debug(`Updated ReservedConcurrentExecutions for Lambda function ${physicalId} to ${newReservedConcurrentExecutions}`);
+			if (newReservedConcurrentExecutions !== previousProperties["ReservedConcurrentExecutions"]) {
+				if (newReservedConcurrentExecutions === void 0) {
+					await this.lambdaClient.send(new DeleteFunctionConcurrencyCommand({ FunctionName: physicalId }));
+					this.logger.debug(`Cleared ReservedConcurrentExecutions for Lambda function ${physicalId} (template removed the property)`);
+				} else {
+					await this.lambdaClient.send(new PutFunctionConcurrencyCommand({
+						FunctionName: physicalId,
+						ReservedConcurrentExecutions: newReservedConcurrentExecutions
+					}));
+					this.logger.debug(`Updated ReservedConcurrentExecutions for Lambda function ${physicalId} to ${newReservedConcurrentExecutions}`);
+				}
 			}
 			if (codeSigningChanged && newCodeSigningConfigArn !== void 0) {
 				await this.lambdaClient.send(new PutFunctionCodeSigningConfigCommand({
@@ -13373,7 +13398,8 @@ var LambdaFunctionProvider = class {
 				this.logger.debug(`Detached VPC config from Lambda ${physicalId} before deletion`);
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException) {
-					assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.lambdaClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					return;
 				}
 				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)} — continuing with delete`);
@@ -13385,7 +13411,8 @@ var LambdaFunctionProvider = class {
 			this.logger.debug(`Successfully deleted Lambda function ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda function ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -14119,7 +14146,8 @@ var LambdaPermissionProvider = class {
 			this.logger.debug(`Successfully deleted Lambda permission ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda permission ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -14345,7 +14373,8 @@ var LambdaUrlProvider = class {
 			this.logger.debug(`Successfully deleted Lambda URL ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda URL ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -14839,7 +14868,8 @@ var LambdaEventSourceMappingProvider = class {
 				await this.lambdaClient.send(new GetEventSourceMappingCommand({ UUID: physicalId }));
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException) {
-					assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.lambdaClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Event source mapping ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -14849,7 +14879,8 @@ var LambdaEventSourceMappingProvider = class {
 			this.logger.debug(`Successfully deleted event source mapping ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Event source mapping ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -15112,7 +15143,8 @@ var LambdaLayerVersionProvider = class {
 			this.logger.debug(`Successfully deleted Lambda layer version ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda layer version ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -15312,8 +15344,10 @@ function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecr
 */
 function packCompositeId(resourceType, logicalId, segments, options) {
 	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
-	if (refusal !== void 0) if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
-	else throw new ProvisioningError(refusal, resourceType, logicalId);
+	if (refusal !== void 0) {
+		if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
+		else throw new ProvisioningError(refusal, resourceType, logicalId);
+	}
 	return segments.map((segment) => String(segment.value)).join("|");
 }
 /** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
@@ -15556,7 +15590,8 @@ var LambdaEventInvokeConfigProvider = class {
 			this.logger.debug(`Successfully deleted Lambda EventInvokeConfig ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda EventInvokeConfig ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -15799,7 +15834,8 @@ var LambdaMicrovmImageProvider = class {
 				await this.client.send(new DeleteMicrovmImageCommand({ imageIdentifier: physicalId }));
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException$8) {
-					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`MicroVM image ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -15874,7 +15910,8 @@ var LambdaMicrovmImageProvider = class {
 		}
 		const result = {};
 		if (name !== void 0) result["Name"] = name;
-		result["Tags"] = normalizeAwsTagsToCfn((await this.client.send(new ListTagsCommand$1({ Resource: physicalId }))).Tags);
+		const tagsResp = await this.client.send(new ListTagsCommand$1({ Resource: physicalId }));
+		result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		return result;
 	}
 	/**
@@ -16726,7 +16763,7 @@ const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
 * having spent different amounts; this is the ceiling on the total, and a total
 * does not need to know which terms produced it.
 */
-const DYNAMODB_DELETE_BUDGET_MS = 26 * 6e4;
+const DYNAMODB_DELETE_BUDGET_MS = 156e4;
 /**
 * What both DynamoDB providers self-report through `getMinResourceTimeoutMs()`.
 *
@@ -16911,7 +16948,7 @@ function autoScalingRetriesWithinDeleteBudget(budget, defaultMaxRetries) {
 * to ~6 min of retry backoff, which at ~8s a retry is ~45 retries spread across
 * however many calls the table's index and replica count produce.
 */
-const AUTO_SCALING_TEARDOWN_RESERVE_MS = 20 * 6e4;
+const AUTO_SCALING_TEARDOWN_RESERVE_MS = 12e5;
 /** `withRetry`'s capped backoff step (`maxDelayMs`), the cost of one retry. */
 const AUTO_SCALING_RETRY_STEP_MS = 8e3;
 /**
@@ -17882,7 +17919,10 @@ var DynamoDBTableProvider = class {
 			} });
 			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
-			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : ""} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) {
+				const absentNote = properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : "";
+				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			}
 			const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
 			const desiredIndexByName = /* @__PURE__ */ new Map();
 			for (const entry of Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : []) {
@@ -18172,7 +18212,8 @@ var DynamoDBTableProvider = class {
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
-				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.dynamoDBClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -19146,7 +19187,8 @@ var DynamoDBTableProvider = class {
 			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
 			if (table.TableArn) try {
-				result["Tags"] = normalizeAwsTagsToCfn((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }))).Tags);
+				const tagsResp = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }));
+				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 			} catch (err) {
 				if (err instanceof ResourceNotFoundException$1) return void 0;
 				throw err;
@@ -20219,10 +20261,14 @@ var DynamoDBGlobalTableProvider = class {
 				const onDemand = { ...gsi.OnDemandThroughput };
 				const unresolvedMembers = [];
 				if (!billingFlipped && previousOnDemand) {
-					if (previousOnDemand.MaxReadRequestUnits !== void 0 && onDemand.MaxReadRequestUnits === void 0) if (declared?.readDeclared) unresolvedMembers.push("MaxReadRequestUnits");
-					else onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
-					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) if (declared?.writeDeclared) unresolvedMembers.push("MaxWriteRequestUnits");
-					else onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
+					if (previousOnDemand.MaxReadRequestUnits !== void 0 && onDemand.MaxReadRequestUnits === void 0) {
+						if (declared?.readDeclared) unresolvedMembers.push("MaxReadRequestUnits");
+						else onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
+					}
+					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) {
+						if (declared?.writeDeclared) unresolvedMembers.push("MaxWriteRequestUnits");
+						else onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
+					}
 				}
 				if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
 				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
@@ -20811,7 +20857,8 @@ var DynamoDBGlobalTableProvider = class {
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
-				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.dynamoDBClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -20922,7 +20969,8 @@ var DynamoDBGlobalTableProvider = class {
 				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel);
 				Object.assign(entry, subs);
 				if (replicaArn) try {
-					entry["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }))).Tags);
+					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
+					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 				} catch (tagErr) {
 					if (tagErr instanceof ResourceNotFoundException$1) {
 						if (isLocal) throw tagErr;
@@ -23152,7 +23200,8 @@ var LogsLogGroupProvider = class {
 		const nextClass = normalizeClass(properties["LogGroupClass"]);
 		if (prevClass !== nextClass) {
 			const replaceFlags = "--replace --force-stateful-recreation";
-			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
+			const remedy = isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`;
+			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${remedy} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		}
 		const rawRetention = properties["RetentionInDays"];
 		const rawPreviousRetention = previousProperties["RetentionInDays"];
@@ -23170,18 +23219,22 @@ var LogsLogGroupProvider = class {
 			else await this.logsClient.send(new DisassociateKmsKeyCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Updated KMS key association for log group ${physicalId}`);
 		}
-		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
-			logGroupName: physicalId,
-			retentionInDays
-		}));
-		else await this.logsClient.send(new DeleteRetentionPolicyCommand({ logGroupName: physicalId }));
-		if (JSON.stringify(properties["DataProtectionPolicy"]) !== JSON.stringify(previousProperties["DataProtectionPolicy"])) if (properties["DataProtectionPolicy"]) {
-			const policyDocument = typeof properties["DataProtectionPolicy"] === "string" ? properties["DataProtectionPolicy"] : JSON.stringify(properties["DataProtectionPolicy"]);
-			await this.logsClient.send(new PutDataProtectionPolicyCommand({
-				logGroupIdentifier: physicalId,
-				policyDocument
+		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) {
+			if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
+				logGroupName: physicalId,
+				retentionInDays
 			}));
-		} else await this.logsClient.send(new DeleteDataProtectionPolicyCommand({ logGroupIdentifier: physicalId }));
+			else await this.logsClient.send(new DeleteRetentionPolicyCommand({ logGroupName: physicalId }));
+		}
+		if (JSON.stringify(properties["DataProtectionPolicy"]) !== JSON.stringify(previousProperties["DataProtectionPolicy"])) {
+			if (properties["DataProtectionPolicy"]) {
+				const policyDocument = typeof properties["DataProtectionPolicy"] === "string" ? properties["DataProtectionPolicy"] : JSON.stringify(properties["DataProtectionPolicy"]);
+				await this.logsClient.send(new PutDataProtectionPolicyCommand({
+					logGroupIdentifier: physicalId,
+					policyDocument
+				}));
+			} else await this.logsClient.send(new DeleteDataProtectionPolicyCommand({ logGroupIdentifier: physicalId }));
+		}
 		if (properties["DeletionProtectionEnabled"] !== previousProperties["DeletionProtectionEnabled"]) {
 			const next = properties["DeletionProtectionEnabled"];
 			if (next !== void 0) await this.logsClient.send(new PutLogGroupDeletionProtectionCommand({
@@ -23206,18 +23259,20 @@ var LogsLogGroupProvider = class {
 		}
 		const newFieldIndex = properties["FieldIndexPolicies"];
 		const oldFieldIndex = previousProperties["FieldIndexPolicies"];
-		if (JSON.stringify(newFieldIndex) !== JSON.stringify(oldFieldIndex)) if (newFieldIndex && newFieldIndex.length > 0) {
-			if (newFieldIndex.length > 1) this.logger.debug(`Log group ${physicalId} declares ${newFieldIndex.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`);
-			const first = newFieldIndex[0];
-			const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
-			await this.logsClient.send(new PutIndexPolicyCommand({
-				logGroupIdentifier: physicalId,
-				policyDocument
-			}));
-		} else try {
-			await this.logsClient.send(new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId }));
-		} catch (err) {
-			if (!(err instanceof ResourceNotFoundException$5)) throw err;
+		if (JSON.stringify(newFieldIndex) !== JSON.stringify(oldFieldIndex)) {
+			if (newFieldIndex && newFieldIndex.length > 0) {
+				if (newFieldIndex.length > 1) this.logger.debug(`Log group ${physicalId} declares ${newFieldIndex.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`);
+				const first = newFieldIndex[0];
+				const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
+				await this.logsClient.send(new PutIndexPolicyCommand({
+					logGroupIdentifier: physicalId,
+					policyDocument
+				}));
+			} else try {
+				await this.logsClient.send(new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId }));
+			} catch (err) {
+				if (!(err instanceof ResourceNotFoundException$5)) throw err;
+			}
 		}
 		const newTags = properties["Tags"];
 		const oldTags = previousProperties["Tags"];
@@ -23264,7 +23319,8 @@ var LogsLogGroupProvider = class {
 			this.logger.debug(`Successfully deleted log group ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$5) {
-				assertRegionMatch(await this.logsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.logsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Log group ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -23363,7 +23419,8 @@ var LogsLogGroupProvider = class {
 			if (found.arn) {
 				const arnForTags = found.arn.replace(/:\*$/, "");
 				try {
-					tags = normalizeAwsTagsToCfn((await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }))).tags);
+					const tagsResp = await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
+					tags = normalizeAwsTagsToCfn(tagsResp.tags);
 				} catch (err) {
 					if (err instanceof ResourceNotFoundException$5) return void 0;
 					throw err;
@@ -23527,7 +23584,8 @@ var CloudWatchAlarmProvider = class {
 			this.logger.debug(`Successfully deleted CloudWatch alarm ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && error.name === "ResourceNotFound") {
-				assertRegionMatch(await this.cloudWatchClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudWatchClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Alarm ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -23718,7 +23776,8 @@ var CloudWatchAlarmProvider = class {
 		if (alarm.EvaluateLowSampleCountPercentile !== void 0) result["EvaluateLowSampleCountPercentile"] = alarm.EvaluateLowSampleCountPercentile;
 		if (alarm.ThresholdMetricId !== void 0) result["ThresholdMetricId"] = alarm.ThresholdMetricId;
 		if (alarm.AlarmArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }))).Tags);
+			const tagsResp = await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			this.logger.debug(`CloudWatch ListTagsForResource(${alarm.AlarmArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -23856,7 +23915,8 @@ var CloudWatchAnomalyDetectorProvider = class {
 			this.logger.debug(`Successfully deleted CloudWatch anomaly detector ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$4) {
-				assertRegionMatch(await this.cloudWatchClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudWatchClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Anomaly detector ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -24136,7 +24196,8 @@ var SecretsManagerSecretProvider = class {
 			this.logger.debug(`Successfully deleted secret ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$3) {
-				assertRegionMatch(await this.smClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.smClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Secret ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -24530,7 +24591,8 @@ var SSMParameterProvider = class {
 	* `import()` now refuses it — and not here. Do not re-add it.
 	*/
 	async buildParameterArnUnguarded(name, mask) {
-		const accountInfo = await getAccountInfo(await this.ssmClient.config.region());
+		const region = await this.ssmClient.config.region();
+		const accountInfo = await getAccountInfo(region);
 		if (accountInfo.fabricated) {
 			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
 			return;
@@ -24664,7 +24726,8 @@ var SSMParameterProvider = class {
 			this.logger.debug(`Successfully deleted SSM parameter ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ParameterNotFound) {
-				assertRegionMatch(await this.ssmClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ssmClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Parameter ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -24748,10 +24811,11 @@ var SSMParameterProvider = class {
 		} catch {}
 		if (!policiesEmitted) result["Policies"] = [];
 		try {
-			const tagArr = normalizeAwsTagsToCfn((await this.ssmClient.send(new ListTagsForResourceCommand$2({
+			const tagsResp = await this.ssmClient.send(new ListTagsForResourceCommand$2({
 				ResourceType: "Parameter",
 				ResourceId: physicalId
-			}))).TagList);
+			}));
+			const tagArr = normalizeAwsTagsToCfn(tagsResp.TagList);
 			result["Tags"] = Object.fromEntries(tagArr.map((t) => [t.Key, t.Value]));
 		} catch {}
 		return result;
@@ -25113,7 +25177,8 @@ var EventBridgeRuleProvider = class {
 				}))).Targets || []).map((t) => t.Id).filter((id) => id !== void 0);
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException$2) {
-					assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.eventBridgeClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Rule ${ruleName} does not exist, skipping deletion`);
 					return;
 				}
@@ -25134,7 +25199,8 @@ var EventBridgeRuleProvider = class {
 			this.logger.debug(`Successfully deleted EventBridge rule ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$2) {
-				assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.eventBridgeClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Rule ${ruleName} does not exist, skipping deletion`);
 				return;
 			}
@@ -25206,7 +25272,8 @@ var EventBridgeRuleProvider = class {
 			if (!(err instanceof ResourceNotFoundException$2)) throw err;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: physicalId }))).Tags);
+			const tagsResp = await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (!(err instanceof ResourceNotFoundException$2)) throw err;
 		}
@@ -25443,13 +25510,15 @@ var EventBridgeBusProvider = class {
 			this.logger.debug(`Successfully deleted EventBus ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$2) {
-				assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.eventBridgeClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EventBus ${physicalId} does not exist, skipping`);
 				return;
 			}
 			const msg = error instanceof Error ? error.message : String(error);
 			if (msg.includes("does not exist")) {
-				assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.eventBridgeClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EventBus ${physicalId} does not exist, skipping`);
 				return;
 			}
@@ -25534,7 +25603,8 @@ var EventBridgeBusProvider = class {
 				result["Policy"] = resp.Policy;
 			}
 			if (resp.Arn) try {
-				result["Tags"] = normalizeAwsTagsToCfn((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: resp.Arn }))).Tags);
+				const tagsResp = await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: resp.Arn }));
+				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 			} catch (err) {
 				if (err instanceof ResourceNotFoundException$2) return void 0;
 				throw err;
@@ -26297,7 +26367,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`VPC ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26470,7 +26541,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Subnet ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26556,7 +26628,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted InternetGateway ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`InternetGateway ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26608,13 +26681,15 @@ var EC2Provider = class {
 			publicIp = response.PublicIp;
 			await this.applyTags(allocationId, properties, logicalId);
 			const instanceId = properties["InstanceId"];
-			if (instanceId) if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${instanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`);
-			else {
-				await this.ec2Client.send(new AssociateAddressCommand({
-					AllocationId: allocationId,
-					InstanceId: instanceId
-				}));
-				this.logger.debug(`Associated EIP ${logicalId} (${allocationId}) to ${instanceId}`);
+			if (instanceId) {
+				if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${instanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`);
+				else {
+					await this.ec2Client.send(new AssociateAddressCommand({
+						AllocationId: allocationId,
+						InstanceId: instanceId
+					}));
+					this.logger.debug(`Associated EIP ${logicalId} (${allocationId}) to ${instanceId}`);
+				}
 			}
 			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
 		} catch (error) {
@@ -26639,19 +26714,21 @@ var EC2Provider = class {
 			await this.applyTagDiff(allocationId, previousProperties["Tags"], properties["Tags"]);
 			const oldInstanceId = previousProperties["InstanceId"];
 			const newInstanceId = properties["InstanceId"];
-			if (oldInstanceId !== newInstanceId) if (newInstanceId) try {
-				await this.ec2Client.send(new AssociateAddressCommand({
-					AllocationId: allocationId,
-					InstanceId: newInstanceId,
-					AllowReassociation: true
-				}));
-			} catch (error) {
-				if (process.env["CDKD_NO_WAIT"] === "true" && this.isIncorrectInstanceStateError(error)) this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${newInstanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${newInstanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${newInstanceId} --allow-reassociation`);
-				else throw error;
-			}
-			else {
-				const associationId = (await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }))).Addresses?.[0]?.AssociationId;
-				if (associationId) await this.ec2Client.send(new DisassociateAddressCommand({ AssociationId: associationId }));
+			if (oldInstanceId !== newInstanceId) {
+				if (newInstanceId) try {
+					await this.ec2Client.send(new AssociateAddressCommand({
+						AllocationId: allocationId,
+						InstanceId: newInstanceId,
+						AllowReassociation: true
+					}));
+				} catch (error) {
+					if (process.env["CDKD_NO_WAIT"] === "true" && this.isIncorrectInstanceStateError(error)) this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${newInstanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${newInstanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${newInstanceId} --allow-reassociation`);
+					else throw error;
+				}
+				else {
+					const associationId = (await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }))).Addresses?.[0]?.AssociationId;
+					if (associationId) await this.ec2Client.send(new DisassociateAddressCommand({ AssociationId: associationId }));
+				}
 			}
 		}
 		return {
@@ -26675,7 +26752,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted EIP ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26742,7 +26820,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted VPCGatewayAttachment ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`VPCGatewayAttachment ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26800,7 +26879,8 @@ var EC2Provider = class {
 			await this.ec2Client.send(new DeleteNatGatewayCommand({ NatGatewayId: physicalId }));
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`NatGateway ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26855,7 +26935,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted RouteTable ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`RouteTable ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26953,7 +27034,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted Route ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Route ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26991,7 +27073,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted SubnetRouteTableAssociation ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SubnetRouteTableAssociation ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -27142,7 +27225,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SecurityGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -27372,7 +27456,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted SecurityGroupIngress ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SecurityGroupIngress ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -27431,10 +27516,12 @@ var EC2Provider = class {
 						maxDelay: 5
 					}, { InstanceIds: [instanceId] });
 				} else this.logger.debug(`Instance ${instanceId} launched (skipping running-state wait per --no-wait)`);
-				if (iamInstanceProfile) if (process.env["CDKD_NO_WAIT"] === "true") {
-					const profileRef = iamInstanceProfile.arn ?? iamInstanceProfile.name;
-					this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId} — and if it is missing, re-associate with: aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? `Arn=${profileRef}` : `Name=${profileRef}`}`);
-				} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
+				if (iamInstanceProfile) {
+					if (process.env["CDKD_NO_WAIT"] === "true") {
+						const profileRef = iamInstanceProfile.arn ?? iamInstanceProfile.name;
+						this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId} — and if it is missing, re-associate with: aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? `Arn=${profileRef}` : `Name=${profileRef}`}`);
+					} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
+				}
 				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
 				const attributes = {
 					InstanceId: instanceId,
@@ -27644,8 +27731,10 @@ var EC2Provider = class {
 		}));
 		const newMonitoring = this.coerceBool(properties["Monitoring"]);
 		const oldMonitoring = this.coerceBool(previousProperties["Monitoring"]);
-		if (newMonitoring !== void 0 && newMonitoring !== oldMonitoring) if (newMonitoring) await this.ec2Client.send(new MonitorInstancesCommand({ InstanceIds: [physicalId] }));
-		else await this.ec2Client.send(new UnmonitorInstancesCommand({ InstanceIds: [physicalId] }));
+		if (newMonitoring !== void 0 && newMonitoring !== oldMonitoring) {
+			if (newMonitoring) await this.ec2Client.send(new MonitorInstancesCommand({ InstanceIds: [physicalId] }));
+			else await this.ec2Client.send(new UnmonitorInstancesCommand({ InstanceIds: [physicalId] }));
+		}
 		const newMetadata = this.buildMetadataOptions(properties);
 		const oldMetadata = this.buildMetadataOptions(previousProperties);
 		if (newMetadata !== void 0 && !this.shallowEqual(newMetadata, oldMetadata)) await this.ec2Client.send(new ModifyInstanceMetadataOptionsCommand({
@@ -27691,7 +27780,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EC2 Instance ${physicalId} already terminated (not found), treating as success`);
 				return;
 			}
@@ -27996,7 +28086,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted NetworkAcl ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`NetworkAcl ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -28080,7 +28171,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted NetworkAclEntry ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`NetworkAclEntry ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -28722,8 +28814,10 @@ var EC2Provider = class {
 		if (route.DestinationCidrBlock !== void 0) result["DestinationCidrBlock"] = route.DestinationCidrBlock;
 		else if (route.DestinationIpv6CidrBlock !== void 0) result["DestinationIpv6CidrBlock"] = route.DestinationIpv6CidrBlock;
 		else if (route.DestinationPrefixListId !== void 0) result["DestinationPrefixListId"] = route.DestinationPrefixListId;
-		if (route.GatewayId !== void 0) if (route.GatewayId.startsWith("vpce-")) result["VpcEndpointId"] = route.GatewayId;
-		else result["GatewayId"] = route.GatewayId;
+		if (route.GatewayId !== void 0) {
+			if (route.GatewayId.startsWith("vpce-")) result["VpcEndpointId"] = route.GatewayId;
+			else result["GatewayId"] = route.GatewayId;
+		}
 		if (route.NatGatewayId !== void 0) result["NatGatewayId"] = route.NatGatewayId;
 		if (route.InstanceId !== void 0) result["InstanceId"] = route.InstanceId;
 		if (route.NetworkInterfaceId !== void 0) result["NetworkInterfaceId"] = route.NetworkInterfaceId;
@@ -29577,7 +29671,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Authorizer ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Authorizer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -29669,7 +29764,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Resource ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Resource ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -29731,7 +29827,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Deployment ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Deployment ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -29982,7 +30079,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Stage ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Stage ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -30291,7 +30389,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Method ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Method ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31009,7 +31108,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Api ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Api ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31061,7 +31161,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Stage ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Stage ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31121,7 +31222,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Integration ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Integration ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31174,7 +31276,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Route ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Route ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31227,7 +31330,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Authorizer ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Authorizer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -32368,7 +32472,8 @@ var CloudFrontOAIProvider = class {
 				etag = (await this.cloudFrontClient.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: physicalId }))).ETag;
 			} catch (error) {
 				if (error instanceof NoSuchCloudFrontOriginAccessIdentity) {
-					assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.cloudFrontClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`OAI ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -32381,7 +32486,8 @@ var CloudFrontOAIProvider = class {
 			this.logger.debug(`Successfully deleted CloudFront OAI ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchCloudFrontOriginAccessIdentity) {
-				assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudFrontClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`OAI ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -32705,7 +32811,8 @@ var CloudFrontOACProvider = class {
 	* region matches the region the resource was recorded in.
 	*/
 	async assertDeleteRegion(resourceType, logicalId, physicalId, context) {
-		assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+		const clientRegion = await this.cloudFrontClient.config.region();
+		assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 	}
 };
 
@@ -33012,7 +33119,8 @@ var CloudFrontDistributionProvider = class {
 				config = getConfigResponse.DistributionConfig;
 			} catch (error) {
 				if (error instanceof NoSuchDistribution) {
-					assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.cloudFrontClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Distribution ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -33039,7 +33147,8 @@ var CloudFrontDistributionProvider = class {
 			this.logger.debug(`Successfully deleted CloudFront Distribution ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchDistribution) {
-				assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudFrontClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Distribution ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -33178,7 +33287,7 @@ var CloudFrontDistributionProvider = class {
 	* warning applies), `false` on budget exhaustion.
 	*/
 	async waitForDistributionStable(distributionId, expectedEnabled) {
-		const budgetMs = Math.max(1200 * 1e3, resolvedResourceTimeoutMs("AWS::CloudFront::Distribution") ?? 0);
+		const budgetMs = Math.max(12e5, resolvedResourceTimeoutMs("AWS::CloudFront::Distribution") ?? 0);
 		const deadline = Date.now() + budgetMs;
 		let delay = 5e3;
 		const maxDelay = 1e4;
@@ -33943,7 +34052,8 @@ var AgentCoreRuntimeProvider = class {
 			this.logger.debug(`Successfully deleted BedrockAgentCore Runtime ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$6) {
-				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Runtime ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -34513,7 +34623,8 @@ var AgentCoreEvaluatorProvider = class {
 			this.logger.debug(`Successfully deleted BedrockAgentCore Evaluator ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$6) {
-				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Evaluator ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -34728,7 +34839,8 @@ var StepFunctionsProvider = class {
 			this.logger.debug(`Successfully deleted Step Functions state machine ${logicalId}`);
 		} catch (error) {
 			if (error instanceof StateMachineDoesNotExist) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Step Functions state machine ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -34797,7 +34909,8 @@ var StepFunctionsProvider = class {
 			result["EncryptionConfiguration"] = ec;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (!(err instanceof StateMachineDoesNotExist)) throw err;
 		}
@@ -35376,7 +35489,8 @@ var ECSProvider = class {
 			this.logger.debug(`Successfully deleted ECS cluster ${logicalId}`);
 		} catch (error) {
 			if (this.isClusterNotFoundException(error)) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS cluster ${physicalId} not found, skipping deletion`);
 				return;
 			}
@@ -35437,7 +35551,8 @@ var ECSProvider = class {
 			this.logger.debug(`Successfully deregistered ECS task definition ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundException(error)) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS task definition ${physicalId} not found, skipping deletion`);
 				return;
 			}
@@ -35659,7 +35774,8 @@ var ECSProvider = class {
 				this.logger.debug(`Scaled down ECS service ${physicalId} to 0`);
 			} catch (error) {
 				if (this.isServiceNotFoundException(error)) {
-					assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`ECS service ${physicalId} not found during scale down, skipping deletion`);
 					return;
 				}
@@ -35673,7 +35789,8 @@ var ECSProvider = class {
 			this.logger.debug(`Successfully deleted ECS service ${logicalId}`);
 		} catch (error) {
 			if (this.isServiceNotFoundException(error)) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS service ${physicalId} not found, skipping deletion`);
 				return;
 			}
@@ -37267,15 +37384,18 @@ var ELBv2Provider = class {
 			for (const [k, v] of Object.entries(p)) if (!handledKeys.has(k)) out[k] = v;
 			return out;
 		};
-		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + (this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]).some((a) => a.Key === "deletion_protection.enabled" && isTruthyCfnBoolean(a.Value)) ? protectedReplacementAdvice({
-			evidence: "cdkd's recorded properties for this load balancer carry LoadBalancerAttributes deletion_protection.enabled=true",
-			replaceFlags: "cdkd deploy --replace",
-			disable: {
-				before: "aws elbv2 modify-load-balancer-attributes --load-balancer-arn",
-				identifier: physicalId,
-				after: "--attributes Key=deletion_protection.enabled,Value=false"
-			}
-		}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack."));
+		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) {
+			const remedy = this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]).some((a) => a.Key === "deletion_protection.enabled" && isTruthyCfnBoolean(a.Value)) ? protectedReplacementAdvice({
+				evidence: "cdkd's recorded properties for this load balancer carry LoadBalancerAttributes deletion_protection.enabled=true",
+				replaceFlags: "cdkd deploy --replace",
+				disable: {
+					before: "aws elbv2 modify-load-balancer-attributes --load-balancer-arn",
+					identifier: physicalId,
+					after: "--attributes Key=deletion_protection.enabled,Value=false"
+				}
+			}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.";
+			throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + remedy);
+		}
 		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
@@ -37409,7 +37529,8 @@ var ELBv2Provider = class {
 			this.logger.debug(`Successfully deleted LoadBalancer ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`LoadBalancer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -37574,7 +37695,8 @@ var ELBv2Provider = class {
 			this.logger.debug(`Successfully deleted TargetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`TargetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -37694,7 +37816,8 @@ var ELBv2Provider = class {
 			this.logger.debug(`Successfully deleted Listener ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Listener ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38424,7 +38547,8 @@ var RDSProvider = class {
 			this.logger.debug(`Successfully deleted DBSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38582,7 +38706,8 @@ var RDSProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38709,7 +38834,8 @@ var RDSProvider = class {
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38980,7 +39106,8 @@ var RDSProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -39032,7 +39159,7 @@ var RDSProvider = class {
 //#endregion
 //#region src/provisioning/providers/rds-dbproxy-provider.ts
 const POLL_INTERVAL_MS$1 = 5e3;
-const POLL_TIMEOUT_MS$1 = 1800 * 1e3;
+const POLL_TIMEOUT_MS$1 = 18e5;
 /**
 * AWS RDS DBProxy Provider
 *
@@ -39195,7 +39322,8 @@ var RDSDBProxyProvider = class {
 			await client.send(new DeleteDBProxyCommand({ DBProxyName: physicalId }));
 		} catch (error) {
 			if (error instanceof DBProxyNotFoundFault) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBProxy ${physicalId} already gone, treating as success`);
 				return;
 			}
@@ -39278,7 +39406,8 @@ var RDSDBProxyProvider = class {
 			}))
 		};
 		if (p.DBProxyArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }))).TagList ?? []);
+			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagResp.TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -39370,7 +39499,7 @@ var RDSDBProxyProvider = class {
 //#endregion
 //#region src/provisioning/providers/rds-dbproxy-endpoint-provider.ts
 const POLL_INTERVAL_MS = 5e3;
-const POLL_TIMEOUT_MS = 1800 * 1e3;
+const POLL_TIMEOUT_MS = 18e5;
 /**
 * AWS RDS DBProxyEndpoint Provider
 *
@@ -39518,7 +39647,8 @@ var RDSDBProxyEndpointProvider = class {
 			await client.send(new DeleteDBProxyEndpointCommand({ DBProxyEndpointName: physicalId }));
 		} catch (error) {
 			if (error instanceof DBProxyEndpointNotFoundFault || error instanceof DBProxyNotFoundFault) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBProxyEndpoint ${physicalId} or parent already gone, treating as success`);
 				return;
 			}
@@ -39587,7 +39717,8 @@ var RDSDBProxyEndpointProvider = class {
 			TargetRole: e.TargetRole ?? "READ_WRITE"
 		};
 		if (e.DBProxyEndpointArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }))).TagList ?? []);
+			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagResp.TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -39880,7 +40011,8 @@ var RDSDBProxyTargetGroupProvider = class {
 			}));
 		} catch (error) {
 			if (error instanceof DBProxyNotFoundFault || error instanceof DBProxyTargetGroupNotFoundFault || error instanceof DBProxyTargetNotFoundFault) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`${dbProxyName}/${targetGroupName} or its target is already gone, treating as success`);
 				return;
 			}
@@ -40129,7 +40261,8 @@ var DocDBProvider = class {
 			this.logger.debug(`Successfully deleted DocDB DBSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DocDB DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40245,7 +40378,8 @@ var DocDBProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DocDB DBCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40323,7 +40457,8 @@ var DocDBProvider = class {
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DocDB DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40564,7 +40699,8 @@ var DocDBProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -40765,7 +40901,8 @@ var NeptuneProvider = class {
 			this.logger.debug(`Successfully deleted Neptune DBSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Neptune DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40878,7 +41015,8 @@ var NeptuneProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Neptune DBCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40972,7 +41110,8 @@ var NeptuneProvider = class {
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Neptune DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -41203,7 +41342,8 @@ var NeptuneProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -41666,7 +41806,8 @@ var Route53Provider = class {
 			this.logger.debug(`Successfully deleted hosted zone ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && error.name === "NoSuchHostedZone") {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Hosted zone ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -41863,7 +42004,8 @@ var Route53Provider = class {
 			hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId, { requireUnambiguousZoneName: true });
 		} catch (error) {
 			if (error instanceof HostedZoneNameNotFoundError) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.warn(`Hosted zone "${String(properties?.["HostedZoneName"])}" for record set ${logicalId} (${physicalId}) no longer exists; treating the record as already deleted and dropping it from state.`);
 				return;
 			}
@@ -41889,7 +42031,8 @@ var Route53Provider = class {
 			this.logger.debug(`Successfully deleted record set ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "InvalidChangeBatch" || error.message.includes("it was not found"))) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Record set ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -42362,10 +42505,11 @@ var Route53Provider = class {
 		});
 		const idTail = physicalId.replace(/^\/hostedzone\//, "");
 		try {
-			result["HostedZoneTags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$8({
 				ResourceType: "hostedzone",
 				ResourceId: idTail
-			}))).ResourceTagSet?.Tags);
+			}));
+			result["HostedZoneTags"] = normalizeAwsTagsToCfn(tagsResp.ResourceTagSet?.Tags);
 		} catch (err) {
 			this.logger.debug(`Route53 ListTagsForResource(${idTail}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -44028,7 +44172,8 @@ var CognitoUserPoolProvider = class {
 					needsFlip = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool?.DeletionProtection === "ACTIVE";
 				} catch (descError) {
 					if (descError instanceof ResourceNotFoundException$9) {
-						assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+						const clientRegion = await this.getClient().config.region();
+						assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 						this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 						return;
 					}
@@ -44051,7 +44196,8 @@ var CognitoUserPoolProvider = class {
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$9) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -44302,7 +44448,8 @@ var ElastiCacheProvider = class {
 			this.logger.debug(`Successfully deleted CacheSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "CacheSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CacheSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -44428,7 +44575,8 @@ var ElastiCacheProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "CacheClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CacheCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -44635,7 +44783,8 @@ var ElastiCacheProvider = class {
 	/** Best-effort tag fetch — failures omit the key without breaking the read. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$7({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$7({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`ElastiCache ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -44969,7 +45118,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -45299,7 +45449,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			this.logger.debug(`Successfully deleted service discovery service ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ServiceNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Service ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -45430,7 +45581,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				if (targets) return targets["NAMESPACE"] || targets["SERVICE"] || operationId;
 				return operationId;
 			}
-			if (status === "FAIL") throw new ProvisioningError(`Operation failed for ${logicalId}: ${maskerOrIdentity(maskSecrets)(result.Operation?.ErrorMessage || "Unknown error")}`, resourceType, logicalId);
+			if (status === "FAIL") {
+				const errorMessage = maskerOrIdentity(maskSecrets)(result.Operation?.ErrorMessage || "Unknown error");
+				throw new ProvisioningError(`Operation failed for ${logicalId}: ${errorMessage}`, resourceType, logicalId);
+			}
 			await new Promise((resolve) => setTimeout(resolve, delay));
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -45596,7 +45750,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -45844,7 +45999,8 @@ var AppSyncProvider = class {
 	* at most one `GetCallerIdentity` per deploy.
 	*/
 	async buildAppSyncArn(suffix, regionOverride) {
-		const accountInfo = await getAccountInfo(regionOverride ?? this.providerRegion ?? await this.getClient().config.region());
+		const region = regionOverride ?? this.providerRegion ?? await this.getClient().config.region();
+		const accountInfo = await getAccountInfo(region);
 		if (accountInfo.fabricated) throw new Error(`cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so an ARN for ${suffix} would be fabricated`);
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
 		return `arn:${partition}:appsync:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:${suffix}`;
@@ -46880,7 +47036,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted GraphQL API ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`GraphQL API ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -46972,7 +47129,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted DataSource ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DataSource ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -47040,7 +47198,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted Resolver ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resolver ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -47097,7 +47256,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted ApiKey ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ApiKey ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -47756,7 +47916,8 @@ var GlueProvider = class {
 			this.logger.debug(`Successfully deleted Glue Database ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				logCatalogScopedDeleteSkip(this.logger, target, "Database", logicalId, physicalId);
 				return;
 			}
@@ -47859,7 +48020,8 @@ var GlueProvider = class {
 			this.logger.debug(`Successfully deleted Glue Table ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				logCatalogScopedDeleteSkip(this.logger, target, "Table", logicalId, physicalId);
 				return;
 			}
@@ -48470,10 +48632,7 @@ var GlueProvider = class {
 				case "pipe-in-name":
 					this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot be imported because a name contains '|', which cdkd currently uses as the separator in this type's physical id (<databaseName>|<tableName>). Adopting it would record an id cdkd cannot decode back to the same table. CloudFormation manages such a table fine; this is a cdkd limitation tracked in https://github.com/go-to-k/cdkd/issues/1672. Until it is lifted, rename the table or database to omit '|', or manage this resource outside cdkd.`);
 					break;
-				case "unpairable":
-					this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot resolve a database for physical id '${input.knownPhysicalId}'. ` + (input.knownPhysicalId === "" ? `The supplied physical id is empty. ` : "The template's DatabaseName is absent or is an unresolved intrinsic, so the bare table name cannot be paired. ") + `Pass the composite form instead: --resource '${input.logicalId}=<databaseName>|<tableName>' (quote it — '|' is a shell pipe).`);
-					break;
-				case "unidentified": break;
+				case "unpairable": this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot resolve a database for physical id '${input.knownPhysicalId}'. ` + (input.knownPhysicalId === "" ? `The supplied physical id is empty. ` : "The template's DatabaseName is absent or is an unresolved intrinsic, so the bare table name cannot be paired. ") + `Pass the composite form instead: --resource '${input.logicalId}=<databaseName>|<tableName>' (quote it — '|' is a shell pipe).`);
 			}
 			return null;
 		}
@@ -48578,7 +48737,8 @@ var GlueWorkflowProvider = class {
 			this.logger.debug(`Successfully deleted Glue Workflow ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Workflow ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -48622,7 +48782,8 @@ var GlueWorkflowProvider = class {
 		const arn = await this.buildWorkflowArn(physicalId);
 		let tags = [];
 		try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }))).Tags);
+			const tagResp = await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }));
+			tags = normalizeAwsTagsToCfn(tagResp.Tags);
 		} catch (err) {
 			this.logger.debug(`GetTags failed for Glue Workflow ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -48716,7 +48877,8 @@ var GlueSecurityConfigurationProvider = class {
 			this.logger.debug(`Successfully deleted Glue SecurityConfiguration ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue SecurityConfiguration ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -48987,7 +49149,8 @@ async function resolveAccountId(stsClient) {
 async function fetchGlueTags(client, stsClient, resource, name, accountId, logger) {
 	try {
 		const arn = await buildGlueResourceArn(client, stsClient, resource, name, accountId);
-		return normalizeAwsTagsToCfn((await client.send(new GetTagsCommand({ ResourceArn: arn }))).Tags);
+		const resp = await client.send(new GetTagsCommand({ ResourceArn: arn }));
+		return normalizeAwsTagsToCfn(resp.Tags);
 	} catch (err) {
 		logger.debug(`GetTags failed for ${resource}/${name}: ${err instanceof Error ? err.message : String(err)}`);
 		return [];
@@ -49111,7 +49274,8 @@ var GlueJobProvider = class {
 			await this.getClient().send(new DeleteJobCommand({ JobName: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Job ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -49495,7 +49659,8 @@ var GlueCrawlerProvider = class {
 			await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Crawler ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -49792,7 +49957,8 @@ var GlueConnectionProvider = class {
 			}));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				logCatalogScopedDeleteSkip(this.logger, target, "Connection", logicalId, physicalId);
 				return;
 			}
@@ -50022,7 +50188,8 @@ var GlueTriggerProvider = class {
 			await this.getClient().send(new DeleteTriggerCommand({ Name: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Trigger ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -50214,24 +50381,28 @@ var KMSProvider = class {
 				}));
 			}
 			const newEnableKeyRotation = properties["EnableKeyRotation"];
-			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) if (newEnableKeyRotation) {
-				const rotationPeriodInDays = properties["RotationPeriodInDays"];
-				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
-				await this.getClient().send(new EnableKeyRotationCommand({
-					KeyId: physicalId,
-					...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
-				}));
-			} else {
-				this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
-				await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) {
+				if (newEnableKeyRotation) {
+					const rotationPeriodInDays = properties["RotationPeriodInDays"];
+					this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
+					await this.getClient().send(new EnableKeyRotationCommand({
+						KeyId: physicalId,
+						...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
+					}));
+				} else {
+					this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
+					await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+				}
 			}
 			const newEnabled = properties["Enabled"];
-			if (newEnabled !== previousProperties["Enabled"]) if (newEnabled === false) {
-				this.logger.debug(`Disabling KMS Key ${logicalId}`);
-				await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
-			} else {
-				this.logger.debug(`Enabling KMS Key ${logicalId}`);
-				await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+			if (newEnabled !== previousProperties["Enabled"]) {
+				if (newEnabled === false) {
+					this.logger.debug(`Disabling KMS Key ${logicalId}`);
+					await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
+				} else {
+					this.logger.debug(`Enabling KMS Key ${logicalId}`);
+					await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+				}
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const newKeyPolicy = properties["KeyPolicy"];
@@ -50266,7 +50437,8 @@ var KMSProvider = class {
 			this.logger.debug(`Successfully scheduled deletion for KMS Key ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$2) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`KMS Key ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -50356,7 +50528,8 @@ var KMSProvider = class {
 			this.logger.debug(`Successfully deleted KMS Alias ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$2) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`KMS Alias ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -50433,7 +50606,8 @@ var KMSProvider = class {
 				if (err instanceof NotFoundException$2) return void 0;
 			}
 			try {
-				result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListResourceTagsCommand({ KeyId: md.KeyId }))).Tags);
+				const tagsResp = await this.getClient().send(new ListResourceTagsCommand({ KeyId: md.KeyId }));
+				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 			} catch (err) {
 				if (err instanceof NotFoundException$2) return void 0;
 			}
@@ -50619,7 +50793,8 @@ var BudgetsBudgetProvider = class {
 	* unchanged byte for byte.
 	*/
 	async budgetArn(accountId, budgetName) {
-		const { partition } = derivePartitionAndUrlSuffix(await this.getClient().config.region() ?? "");
+		const region = await this.getClient().config.region();
+		const { partition } = derivePartitionAndUrlSuffix(region ?? "");
 		return `arn:${partition}:budgets::${accountId}:budget/${budgetName}`;
 	}
 	/**
@@ -50953,7 +51128,8 @@ var BudgetsBudgetProvider = class {
 			this.logger.debug(`Successfully deleted budget ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$5) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Budget ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -51196,11 +51372,15 @@ var KinesisStreamProvider = class {
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
 		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
-		if (desiredRead.kind === "unusable") if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
-		else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
+		if (desiredRead.kind === "unusable") {
+			if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
+			else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
+		}
 		const maxRecordRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"], mask);
-		if (maxRecordRead.kind === "unusable") if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
-		else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
+		if (maxRecordRead.kind === "unusable") {
+			if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
+			else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
+		}
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
@@ -51411,7 +51591,8 @@ var KinesisStreamProvider = class {
 			this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$10) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -51557,7 +51738,8 @@ var KinesisStreamProvider = class {
 			throw err;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -51765,7 +51947,8 @@ var KinesisStreamConsumerProvider = class {
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$10) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
 				return;
 			}
@@ -51818,7 +52001,8 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -52114,7 +52298,8 @@ var SchedulerScheduleProvider = class {
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$11) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
 				return;
 			}
@@ -52508,7 +52693,8 @@ var EFSProvider = class {
 			this.logger.debug(`Successfully deleted EFS FileSystem ${logicalId}`);
 		} catch (error) {
 			if (error instanceof FileSystemNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EFS FileSystem ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -52574,7 +52760,8 @@ var EFSProvider = class {
 			this.logger.debug(`Successfully deleted EFS MountTarget ${logicalId}`);
 		} catch (error) {
 			if (error instanceof MountTargetNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EFS MountTarget ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -52746,7 +52933,8 @@ var EFSProvider = class {
 			this.logger.debug(`Successfully deleted EFS AccessPoint ${logicalId}`);
 		} catch (error) {
 			if (error instanceof AccessPointNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EFS AccessPoint ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -52948,7 +53136,7 @@ var EFSProvider = class {
 * storage-capacity growth and deletes can take substantially longer —
 * mirror the Custom Resource provider's 1-hour ceiling.
 */
-const DEFAULT_MAX_WAIT_MS$3 = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS$3 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
 /**
 * Lustre sub-properties that `UpdateFileSystem` accepts (the mutable
@@ -53672,7 +53860,8 @@ var FSxFileSystemProvider = class {
 			await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: physicalId }));
 		} catch (error) {
 			if (error instanceof FileSystemNotFound$1) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`FSx FileSystem ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -53714,7 +53903,10 @@ var FSxFileSystemProvider = class {
 			const fs = await this.describeForPoll(fileSystemId, transientState);
 			const lifecycle = fs?.Lifecycle;
 			if (fs && lifecycle === "AVAILABLE") return fs;
-			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${fs?.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") {
+				const detail = fs?.FailureDetails?.Message ?? "no failure details reported";
+				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${detail}`, resourceType, logicalId, fileSystemId);
+			}
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${lifecycle ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -53753,7 +53945,10 @@ var FSxFileSystemProvider = class {
 				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
 				if (updateActions.length > 0) seenTrackedAction = true;
 				const failed = updateActions.find((a) => a.Status === "FAILED");
-				if (failed) throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${failed.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+				if (failed) {
+					const detail = failed.FailureDetails?.Message ?? "no failure details reported";
+					throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${detail}`, resourceType, logicalId, fileSystemId);
+				}
 				if (!updateActions.some((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS") && (!requireActionObservation || seenTrackedAction) && fs.Lifecycle === "AVAILABLE") return fs;
 				this.logger.debug(`FSx FileSystem ${fileSystemId} update in progress (lifecycle: ${fs.Lifecycle ?? "unknown"}), waiting...`);
 			}
@@ -53780,7 +53975,10 @@ var FSxFileSystemProvider = class {
 				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 				continue;
 			}
-			if (fs.Lifecycle === "FAILED") throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${fs.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+			if (fs.Lifecycle === "FAILED") {
+				const detail = fs.FailureDetails?.Message ?? "no failure details reported";
+				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${detail}`, resourceType, logicalId, fileSystemId);
+			}
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${fs.Lifecycle ?? "unknown"}, waiting for deletion...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -54041,9 +54239,7 @@ var FSxFileSystemProvider = class {
 			case "OpenZFSConfiguration":
 				result[variantKey] = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration ?? {});
 				break;
-			default:
-				this.logger.warn(`FSx FileSystem ${physicalId} has FileSystemType '${fs.FileSystemType ?? "(unset)"}', which cdkd does not recognize (expected one of ${Object.keys(VARIANT_CONFIG_KEY).join(" / ")}). Its variant configuration is NOT included in the drift snapshot, so drift in that block cannot be detected. Please report this at https://github.com/go-to-k/cdkd/issues`);
-				break;
+			default: this.logger.warn(`FSx FileSystem ${physicalId} has FileSystemType '${fs.FileSystemType ?? "(unset)"}', which cdkd does not recognize (expected one of ${Object.keys(VARIANT_CONFIG_KEY).join(" / ")}). Its variant configuration is NOT included in the drift snapshot, so drift in that block cannot be detected. Please report this at https://github.com/go-to-k/cdkd/issues`);
 		}
 		return result;
 	}
@@ -54159,7 +54355,7 @@ function toSdkInstanceTypeConfigs(value) {
 * FSx providers' 1-hour ceiling so the slowest realistic create/terminate
 * still fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS$2 = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS$2 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$2 = 15e3;
 /** Cluster states that mean "create succeeded, the cluster is up". */
 const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
@@ -54577,7 +54773,8 @@ var EMRClusterProvider = class {
 			current = (await this.getClient().send(new DescribeClusterCommand({ ClusterId: physicalId }))).Cluster;
 		} catch (error) {
 			if (error instanceof InvalidRequestException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EMR Cluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -54636,7 +54833,10 @@ var EMRClusterProvider = class {
 			const cluster = await this.describeForPoll(clusterId, transientState);
 			const state = cluster?.Status?.State;
 			if (cluster && state && CREATE_READY_STATES.has(state)) return cluster;
-			if (state && TERMINAL_STATES.has(state)) throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, clusterId);
+			if (state && TERMINAL_STATES.has(state)) {
+				const reason = cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+				throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${reason}`, resourceType, logicalId, clusterId);
+			}
 			this.logger.debug(`EMR Cluster ${clusterId} state: ${state ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -54888,9 +55088,7 @@ var EMRClusterProvider = class {
 				case "CORE":
 					instances["CoreInstanceGroup"] = cfn;
 					break;
-				case "TASK":
-					taskGroups.push(cfn);
-					break;
+				case "TASK": taskGroups.push(cfn);
 			}
 		}
 		if (taskGroups.length > 0) instances["TaskInstanceGroups"] = taskGroups;
@@ -54904,9 +55102,7 @@ var EMRClusterProvider = class {
 				case "CORE":
 					instances["CoreInstanceFleet"] = cfn;
 					break;
-				case "TASK":
-					taskFleets.push(cfn);
-					break;
+				case "TASK": taskFleets.push(cfn);
 			}
 		}
 		if (taskFleets.length > 0) instances["TaskInstanceFleets"] = taskFleets;
@@ -54951,7 +55147,7 @@ var EMRClusterProvider = class {
 * EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
 * fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS$1 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 /** Instance-group state that means "the group is up and idle/serving". */
 const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -55165,7 +55361,8 @@ var EMRInstanceGroupConfigProvider = class {
 				this.logger.debug(`Scaled EMR TASK instance group ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
 			} catch (error) {
 				if (error instanceof InvalidRequestException) {
-					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.getClient().config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`EMR instance group ${physicalId} scale-to-0 skipped (cluster/group gone): ${error.message}`);
 				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance group ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
 			}
@@ -55219,7 +55416,10 @@ var EMRInstanceGroupConfigProvider = class {
 			}
 			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
-			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) {
+				const reason = group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+				throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${reason}`, resourceType, logicalId, groupId);
+			}
 			if (state && !enforceFailedStates && FAILED_STATES$1.has(state)) this.logger.debug(`EMR instance group ${groupId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
@@ -55271,7 +55471,7 @@ var EMRInstanceGroupConfigProvider = class {
 * EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
 * fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS = 36e5;
 const DEFAULT_POLL_INTERVAL_MS = 15e3;
 /** Instance-fleet state that means "the fleet is up and idle/serving". */
 const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -55475,7 +55675,8 @@ var EMRInstanceFleetConfigProvider = class {
 				this.logger.debug(`Scaled EMR TASK instance fleet ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
 			} catch (error) {
 				if (error instanceof InvalidRequestException) {
-					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.getClient().config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`EMR instance fleet ${physicalId} scale-to-0 skipped (cluster/fleet gone): ${error.message}`);
 				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance fleet ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
 			}
@@ -55569,7 +55770,10 @@ var EMRInstanceFleetConfigProvider = class {
 			}
 			if (state && READY_STATES.has(state) && capacityReady) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
-			if (state && enforceFailedStates && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			if (state && enforceFailedStates && FAILED_STATES.has(state)) {
+				const reason = fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+				throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${reason}`, resourceType, logicalId, fleetId);
+			}
 			if (state && !enforceFailedStates && FAILED_STATES.has(state)) this.logger.debug(`EMR instance fleet ${fleetId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${onDemand}/${target.onDemand} on-demand + ${spot}/${target.spot} spot (${provisioned} total), waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
@@ -56085,7 +56289,8 @@ var FirehoseProvider = class {
 			this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$12) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -56650,7 +56855,8 @@ var FirehoseProvider = class {
 		if (enc?.KeyType !== void 0) encOut["KeyType"] = enc.KeyType;
 		result["DeliveryStreamEncryptionConfigurationInput"] = encOut;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return void 0;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -57145,12 +57351,14 @@ var CloudTrailProvider = class {
 				}));
 			}
 			const oldIsLogging = previousProperties["IsLogging"];
-			if (isLogging !== void 0 && isLogging !== oldIsLogging) if (isLogging === false) {
-				this.logger.debug(`Stopping logging for CloudTrail Trail ${logicalId}`);
-				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
-			} else {
-				this.logger.debug(`Starting logging for CloudTrail Trail ${logicalId}`);
-				await this.getClient().send(new StartLoggingCommand({ Name: physicalId }));
+			if (isLogging !== void 0 && isLogging !== oldIsLogging) {
+				if (isLogging === false) {
+					this.logger.debug(`Stopping logging for CloudTrail Trail ${logicalId}`);
+					await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
+				} else {
+					this.logger.debug(`Starting logging for CloudTrail Trail ${logicalId}`);
+					await this.getClient().send(new StartLoggingCommand({ Name: physicalId }));
+				}
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated CloudTrail Trail ${logicalId}`);
@@ -57173,7 +57381,8 @@ var CloudTrailProvider = class {
 			this.logger.debug(`Successfully deleted CloudTrail Trail ${logicalId}`);
 		} catch (error) {
 			if (error instanceof TrailNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CloudTrail Trail ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -57293,7 +57502,8 @@ var CloudTrailProvider = class {
 		result["InsightSelectors"] = insightSelectors;
 		let tags = [];
 		if (trail.TrailARN) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0]?.TagsList);
+			const tagsResp = await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }));
+			tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagList?.[0]?.TagsList);
 		} catch (err) {
 			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -57583,7 +57793,8 @@ var CodeBuildProvider = class {
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$13) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58109,7 +58320,8 @@ var CodeCommitRepositoryProvider = class {
 			deletedRepositoryId = (await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName: physicalId }))).repositoryId;
 		} catch (error) {
 			if (error instanceof RepositoryDoesNotExistException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58117,7 +58329,8 @@ var CodeCommitRepositoryProvider = class {
 			throw new ProvisioningError(`Failed to delete CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		if (!deletedRepositoryId) {
-			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			const clientRegion = await this.getClient().config.region();
+			assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 			this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
@@ -58191,7 +58404,8 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }));
+			tags = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return void 0;
 			throw err;
@@ -58543,7 +58757,8 @@ var DLMLifecyclePolicyProvider = class {
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$14) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58782,7 +58997,8 @@ var S3VectorsProvider = class {
 			this.logger.debug(`Successfully deleted S3 VectorBucket ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 VectorBucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58844,7 +59060,8 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -59101,7 +59318,8 @@ var S3DirectoryBucketProvider = class {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "NoSuchBucket" || error.name === "BucketNotFound")) {
-				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.s3Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -59205,10 +59423,11 @@ var S3DirectoryBucketProvider = class {
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
-		return normalizeAwsTagsToCfn((await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
+		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
 			AccountId: accountId,
 			ResourceArn: resourceArn
-		}))).Tags);
+		}));
+		return normalizeAwsTagsToCfn(resp.Tags);
 	}
 	/**
 	* Adopt an existing S3 Express Directory Bucket into cdkd state.
@@ -59407,7 +59626,8 @@ var S3TablesProvider = class {
 			this.logger.debug(`Successfully deleted S3 Table Bucket ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Table Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -59511,7 +59731,8 @@ var S3TablesProvider = class {
 			this.logger.debug(`Successfully deleted S3 Tables Namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Tables Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -59915,7 +60136,8 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`Failed to resolve S3 Tables Table ${logicalId} (${physicalId}): ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		if (resolved === "not-found") {
-			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			const clientRegion = await this.getClient().config.region();
+			assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 			this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
@@ -59930,7 +60152,8 @@ var S3TablesProvider = class {
 			this.logger.debug(`Successfully deleted S3 Tables Table ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -60375,7 +60598,8 @@ var ECRProvider = class {
 		} catch (error) {
 			if (error instanceof RepositoryNotEmptyException) throw new ProvisioningError(`Failed to delete ECR Repository ${logicalId}: repository ${physicalId} still contains images. Matching CloudFormation, cdkd does not force-delete an image-carrying repository unless it opted in via EmptyOnDelete: true (CDK's emptyOnDelete) or the '${ECR_AUTO_DELETE_IMAGES_TAG}' tag (CDK's autoDeleteImages). Either delete the images first (aws ecr batch-delete-image), or redeploy with emptyOnDelete: true and destroy again.`, resourceType, logicalId, physicalId, error);
 			if (error instanceof RepositoryNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECR Repository ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -60442,7 +60666,8 @@ var ECRProvider = class {
 			if (!(err instanceof LifecyclePolicyNotFoundException)) throw err;
 		}
 		if (r.repositoryArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: r.repositoryArn }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: r.repositoryArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (!(err instanceof RepositoryNotFoundException)) throw err;
 		}
@@ -60919,10 +61144,12 @@ async function runDestroyForStack(stackName, state, ctx) {
 				});
 				try {
 					let finalSnapshotIdentifier;
-					if (resource.deletionPolicy === "Snapshot" && ctx.skipFinalSnapshot !== true) if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
-					else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
-					else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, logger);
-					else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+					if (resource.deletionPolicy === "Snapshot" && ctx.skipFinalSnapshot !== true) {
+						if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
+						else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+						else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, logger);
+						else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+					}
 					const provider = destroyProviderRegistry.getProviderFor({
 						resourceType: resource.resourceType,
 						provisionedBy: resource.provisionedBy
@@ -61377,12 +61604,13 @@ var NestedStackProvider = class {
 		}
 		const resourceCount = Object.keys(childStateData.state.resources).length;
 		this.logger.info(`Destroying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
-		const childResult = await withNestedStackContext({
+		const childCtx = {
 			...ctx,
 			parentStackName: childStackName,
 			parentRegion: childRegion,
 			nestedTemplates: void 0
-		}, () => runDestroyForStack(childStackName, childStateData.state, {
+		};
+		const childResult = await withNestedStackContext(childCtx, () => runDestroyForStack(childStackName, childStateData.state, {
 			stateBackend: ctx.stateBackend,
 			lockManager: ctx.lockManager,
 			providerRegistry: ctx.providerRegistry,
@@ -61429,12 +61657,13 @@ var NestedStackProvider = class {
 				parentRegion: parentCtx.parentRegion
 			}
 		}, childRegion, parentCtx.exportIndexStore);
-		await withNestedStackContext({
+		const childCtx = {
 			...parentCtx,
 			parentStackName: childStackName,
 			parentRegion: childRegion,
 			nestedTemplates: grandchildTemplates
-		}, () => childEngine.deploy(childStackName, childTemplate));
+		};
+		await withNestedStackContext(childCtx, () => childEngine.deploy(childStackName, childTemplate));
 	}
 	/**
 	* The child's outputs, as `Outputs.<Key>` attributes for the parent's
@@ -61828,7 +62057,8 @@ var ACMCertificateProvider = class {
 				throw new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
+			const detail = error instanceof Error ? error.message : String(error);
+			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${detail}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
 		}
 	}
 	/**
@@ -61976,7 +62206,8 @@ var ACMCertificateProvider = class {
 				await this.acmClient.send(new DeleteCertificateCommand({ CertificateArn: physicalId }));
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException$7) {
-					assertRegionMatch(await this.acmClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.acmClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Certificate ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -62025,7 +62256,8 @@ var ACMCertificateProvider = class {
 		if (cert.Options?.CertificateTransparencyLoggingPreference !== void 0) result["CertificateTransparencyLoggingPreference"] = cert.Options.CertificateTransparencyLoggingPreference;
 		if (cert.Options?.Export !== void 0) result["CertificateExport"] = cert.Options.Export;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: physicalId }))).Tags);
+			const tagsResp = await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (!(err instanceof ResourceNotFoundException$7)) throw err;
 		}
@@ -62735,23 +62967,24 @@ async function deployCommand(stacks, options) {
 				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
+					const syncValidation = validateRecreateTargets({
+						template: stackInfo.template,
+						state: stateForRecreateCheck?.state ?? {
+							version: 9,
+							stackName: stackInfo.stackName,
+							region: stackRegion,
+							resources: {},
+							outputs: {},
+							lastModified: Date.now()
+						},
+						recreateViaCcApi: options.recreateViaCcApi ?? [],
+						recreateViaSdkProvider: options.recreateViaSdkProvider ?? [],
+						allowUnsupportedProperties: new Set(options.allowUnsupportedProperties ?? []),
+						forceStatefulRecreation: options.forceStatefulRecreation ?? false,
+						hasSdkProvider: (rt) => stackProviderRegistry.getProviderType(rt) === "sdk"
+					});
 					const validation = await probeAndRevalidateStateful({
-						validation: validateRecreateTargets({
-							template: stackInfo.template,
-							state: stateForRecreateCheck?.state ?? {
-								version: 9,
-								stackName: stackInfo.stackName,
-								region: stackRegion,
-								resources: {},
-								outputs: {},
-								lastModified: Date.now()
-							},
-							recreateViaCcApi: options.recreateViaCcApi ?? [],
-							recreateViaSdkProvider: options.recreateViaSdkProvider ?? [],
-							allowUnsupportedProperties: new Set(options.allowUnsupportedProperties ?? []),
-							forceStatefulRecreation: options.forceStatefulRecreation ?? false,
-							hasSdkProvider: (rt) => stackProviderRegistry.getProviderType(rt) === "sdk"
-						}),
+						validation: syncValidation,
 						clients: {
 							s3: stackAwsClients.s3,
 							cloudWatchLogs: stackAwsClients.cloudWatchLogs,
@@ -63174,21 +63407,23 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 				resolutionFailed = true;
 				continue;
 			}
-			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
-			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
-			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) if (storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, exportName)) {
-				outputs[exportName] = value;
-				exportNames.add(exportName);
-			} else {
-				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
-				failedKeys.add(exportName);
-				resolutionFailed = true;
-			}
-			else {
-				outputs[exportName] = value;
-				exportNames.add(exportName);
-			}
-			else resolutionFailed = true;
+			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
+				if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
+				else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) {
+					if (storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, exportName)) {
+						outputs[exportName] = value;
+						exportNames.add(exportName);
+					} else {
+						logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
+						failedKeys.add(exportName);
+						resolutionFailed = true;
+					}
+				} else {
+					outputs[exportName] = value;
+					exportNames.add(exportName);
+				}
+			} else resolutionFailed = true;
 		}
 	}
 	return {
@@ -64900,7 +65135,6 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		case "DELETE":
 			deleteCount++;
 			logFn(`  [-] ${logicalId} (${change.resourceType})`);
-			break;
 	}
 	return {
 		create: createCount,
@@ -64975,7 +65209,6 @@ function renderOutputChangeLines(outputChanges, logFn) {
 				counts.remove++;
 				logFn(`    [-] ${name}${exported}`);
 				logFn(`          old: ${renderOld(change)}`);
-				break;
 		}
 	}
 	return counts;
@@ -65290,10 +65523,11 @@ async function scrubCommand(stacks, options) {
 	if (!app) throw new Error("CDK app is required (scrub needs the template to identify secret references). Pass --app, set CDKD_APP, or add \"app\" to cdk.json.");
 	const region = namedCliRegion(options.region) ?? "us-east-1";
 	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
-	setAwsClients(new AwsClients({
+	const awsClients = new AwsClients({
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
-	}));
+	});
+	setAwsClients(awsClients);
 	logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
 	const synthesizer = new Synthesizer();
 	const context = parseContextOptions(options.context);
@@ -67020,7 +67254,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			parameters = await resolver.resolveParameters(stack.template);
 		} catch (err) {
-			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
 		const resolverContext = (recordedSecretValues) => ({
@@ -67044,7 +67278,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
 		} catch (err) {
-			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const templateResources = stack.template.Resources ?? {};
 		for (const logicalId of Object.keys(state.resources)) {
@@ -69332,18 +69566,19 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					unorderedPaths
 				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
 				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
-				if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
-					kind: "notCompared",
-					logicalId,
-					resourceType: resource.resourceType,
-					notComparedCause
-				});
-				else outcomes.push({
-					kind: "clean",
-					logicalId,
-					resourceType: resource.resourceType
-				});
-				else outcomes.push({
+				if (reported.changes.length === 0) {
+					if (notComparedCause !== void 0) outcomes.push({
+						kind: "notCompared",
+						logicalId,
+						resourceType: resource.resourceType,
+						notComparedCause
+					});
+					else outcomes.push({
+						kind: "clean",
+						logicalId,
+						resourceType: resource.resourceType
+					});
+				} else outcomes.push({
 					kind: "drifted",
 					logicalId,
 					resourceType: resource.resourceType,
@@ -70585,10 +70820,11 @@ function writeHumanReport(reports) {
 		const inspected = inspectedCount;
 		const notCompared = notComparedOutcomes(report);
 		const checked = inspected - notCompared.length;
-		if (drifted.length === 0) if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
-		else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
-		else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
-		else {
+		if (drifted.length === 0) {
+			if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
+			else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
+			else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
+		} else {
 			const word = drifted.length === 1 ? "resource" : "resources";
 			process.stdout.write(`\n⚠ ${report.stackName} (${report.region}): drift detected on ${drifted.length} ${word}\n\n`);
 			for (const o of drifted) {
@@ -70860,12 +71096,14 @@ async function destroyCommand(stackArgs, options) {
 			const refs = stateRefsByName.get(stackName) ?? [];
 			const synthStack = appStacks.find((s) => s.stackName === stackName);
 			const synthRegion = synthStack?.region;
-			if (synthStack?.terminationProtection === true) if (options.removeProtection) logger.warn(`Stack ${stackName} has terminationProtection: true — bypassing because --remove-protection set`);
-			else {
-				const err = new StackTerminationProtectionError(stackName);
-				logger.error(`  ✗ ${err.message}`);
-				totalErrors++;
-				continue;
+			if (synthStack?.terminationProtection === true) {
+				if (options.removeProtection) logger.warn(`Stack ${stackName} has terminationProtection: true — bypassing because --remove-protection set`);
+				else {
+					const err = new StackTerminationProtectionError(stackName);
+					logger.error(`  ✗ ${err.message}`);
+					totalErrors++;
+					continue;
+				}
 			}
 			let stackTargetRegion;
 			if (refs.length === 0) {
@@ -75121,7 +75359,7 @@ async function stateListCommand(options) {
 * shape; plain `tree` renders `tree(1)`-style box-drawing.
 */
 async function renderTreeMode(refs, stateBackend, asJson) {
-	const roots = buildStackTree(await Promise.all(refs.map(async (ref) => {
+	const entries = await Promise.all(refs.map(async (ref) => {
 		if (!ref.region) return { stackName: ref.stackName };
 		let state;
 		try {
@@ -75139,7 +75377,8 @@ async function renderTreeMode(refs, stateBackend, asJson) {
 			...state?.parentLogicalId !== void 0 && { parentLogicalId: state.parentLogicalId },
 			...state?.parentRegion !== void 0 && { parentRegion: state.parentRegion }
 		};
-	})));
+	}));
+	const roots = buildStackTree(entries);
 	if (asJson) {
 		process.stdout.write(`${JSON.stringify(stackTreeToJson(roots), null, 2)}\n`);
 		return;
@@ -75905,11 +76144,12 @@ async function listAssetStorageMarkers(s3, bucket) {
 	for (const key of keys) {
 		const region = key.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
 		try {
-			const marker = parseBootstrapMarker(await (await s3.send(new GetObjectCommand({
+			const body = await (await s3.send(new GetObjectCommand({
 				Bucket: bucket,
 				Key: key,
 				...await expectedOwnerParam(s3)
-			}))).Body?.transformToString() ?? "", key);
+			}))).Body?.transformToString() ?? "";
+			const marker = parseBootstrapMarker(body, key);
 			entries.push({
 				region,
 				assetBucket: marker.assetBucket,
@@ -76454,8 +76694,10 @@ async function rollbackCommand(stackArg, options) {
 	let stackAwsClients;
 	try {
 		let ref;
-		if (stackArg) ref = resolveSingleRegion(stackArg, await setup.stateBackend.listStacks(), options.stackRegion);
-		else {
+		if (stackArg) {
+			const refs = await setup.stateBackend.listStacks();
+			ref = resolveSingleRegion(stackArg, refs, options.stackRegion);
+		} else {
 			const candidates = await findJournalCandidates(setup.stateBackend, setup.prefix);
 			const scoped = options.stackRegion ? candidates.filter((c) => c.region === options.stackRegion) : candidates;
 			if (scoped.length === 0) {
@@ -76508,11 +76750,13 @@ async function rollbackCommand(stackArg, options) {
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
 				const segment = journal.segments[s];
 				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${segment.reason}${segment.runId ? `, run ${segment.runId}` : ""}):`);
-				if (segment.failedOperations && segment.failedOperations.length > 0) if (options.revertFailed) {
-					const failedPlan = planFailedOps(segment.failedOperations, planStateView);
-					for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
-					applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
-				} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+				if (segment.failedOperations && segment.failedOperations.length > 0) {
+					if (options.revertFailed) {
+						const failedPlan = planFailedOps(segment.failedOperations, planStateView);
+						for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
+						applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
+					} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+				}
 				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
 				for (const item of plan) logger.info(actionLabel(item, options.skipFinalSnapshot === true));
 				applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
@@ -76686,10 +76930,7 @@ function applyPlanToPreview(plan, previewState, skipFinalSnapshot) {
 				break;
 			case "revert":
 			case "reverse-replacement":
-			case "reverse-replacement-readopt":
-				if (op.previousState) previewState[op.logicalId] = op.previousState;
-				break;
-			default: break;
+			case "reverse-replacement-readopt": if (op.previousState) previewState[op.logicalId] = op.previousState;
 		}
 	}
 }
@@ -76709,10 +76950,7 @@ function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 			case "orphan-failed-create-retain":
 				delete previewState[op.logicalId];
 				break;
-			case "revert-failed-update":
-				if (op.previousState) previewState[op.logicalId] = op.previousState;
-				break;
-			default: break;
+			case "revert-failed-update": if (op.previousState) previewState[op.logicalId] = op.previousState;
 		}
 	}
 }
@@ -77491,7 +77729,7 @@ function looksLikeEcrHostWithForeignSuffix(imageUri) {
 *   a foreign-bucket refusal like the create / teardown sides.
 */
 /** Default `--older-than` when the flag is not passed. */
-const DEFAULT_OLDER_THAN_MS = 720 * 60 * 60 * 1e3;
+const DEFAULT_OLDER_THAN_MS = 2592e6;
 /** S3 `DeleteObjects` accepts at most 1,000 keys per call. */
 const S3_DELETE_BATCH_SIZE = 1e3;
 /** ECR `BatchDeleteImage` accepts at most 100 image ids per call. */
@@ -77512,7 +77750,7 @@ function parseOlderThan(value) {
 	if (!match) throw new Error(`Invalid --older-than "${value}": expected <number>d or <number>h (e.g. 30d, 12h)`);
 	const num = Number(match[1]);
 	if (!Number.isFinite(num) || num <= 0) throw new Error(`Invalid --older-than "${value}": must be greater than zero`);
-	const multiplier = match[2] === "d" ? 1440 * 60 * 1e3 : 3600 * 1e3;
+	const multiplier = match[2] === "d" ? 864e5 : 36e5;
 	return Math.round(num * multiplier);
 }
 /**
@@ -77879,7 +78117,8 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 		} catch (error) {
 			const described = describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
 			const regionMatch = /^(\S+) \((\S+)\)$/.exec(described);
-			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
+			const inspectHint = regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`;
+			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${inspectHint}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
 		}
 		collectAssetReferences(parsed, marker, refs);
 	}
@@ -78094,9 +78333,9 @@ function formatBytes(bytes) {
 /** Age of a timestamp relative to now, in whole days (or hours under 1d). */
 function formatAge(date) {
 	const ageMs = Date.now() - date.getTime();
-	const days = Math.floor(ageMs / (1440 * 60 * 1e3));
+	const days = Math.floor(ageMs / 864e5);
 	if (days >= 1) return `${days}d old`;
-	return `${Math.max(0, Math.floor(ageMs / (3600 * 1e3)))}h old`;
+	return `${Math.max(0, Math.floor(ageMs / 36e5))}h old`;
 }
 /**
 * Interactive confirmation for the deletion. Follows the repo's
@@ -78717,20 +78956,21 @@ async function rewriteSubTemplate(template, ownerLogicalId, pathPrefix, orphanSe
 			continue;
 		}
 		const dot = inner.indexOf(".");
-		if (dot < 0) if (orphanSet.has(inner)) {
-			const replaced = fetcher.ref(inner);
-			rewrites.push({
-				logicalId: ownerLogicalId,
-				path: pathPrefix,
-				kind: "sub",
-				before: m[0],
-				after: replaced,
-				orphanLogicalId: inner
-			});
-			out += replaced;
-			didChange = true;
-		} else out += m[0];
-		else {
+		if (dot < 0) {
+			if (orphanSet.has(inner)) {
+				const replaced = fetcher.ref(inner);
+				rewrites.push({
+					logicalId: ownerLogicalId,
+					path: pathPrefix,
+					kind: "sub",
+					before: m[0],
+					after: replaced,
+					orphanLogicalId: inner
+				});
+				out += replaced;
+				didChange = true;
+			} else out += m[0];
+		} else {
 			const target = inner.slice(0, dot);
 			const attribute = inner.slice(dot + 1);
 			if (orphanSet.has(target)) {
@@ -79118,13 +79358,14 @@ async function publishAssetsCommand(stacks, options) {
 			region: baseRegion,
 			...options.profile && { profile: options.profile }
 		});
-		const resolver = new AssetModeResolver(new S3StateBackend(markerClients.s3, {
+		const backend = new S3StateBackend(markerClients.s3, {
 			bucket,
 			prefix: options.statePrefix
 		}, {
 			region: baseRegion,
 			...options.profile && { profile: options.profile }
-		}), accountId, { ...options.profile && { profile: options.profile } });
+		});
+		const resolver = new AssetModeResolver(backend, accountId, { ...options.profile && { profile: options.profile } });
 		markerAccess = {
 			resolver,
 			dispose: () => markerClients.destroy()
@@ -79454,13 +79695,15 @@ async function importCommand(stackArg, options) {
 		const existingState = existingResult?.state ?? null;
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
-		if (existingState) if (!selectiveMode) {
-			if (!options.force) throw new Error(`State already exists for stack '${stackInfo.stackName}' (${targetRegion}). Auto / whole-stack import rebuilds the entire resource map from the template, which would drop any state entry not re-imported. Pass --force to confirm. To add specific resources without affecting unlisted ones, use --resource <id>=<physicalId> (selective merge — no --force needed).`);
-		} else {
-			const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
-			if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
-			const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
-			logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
+		if (existingState) {
+			if (!selectiveMode) {
+				if (!options.force) throw new Error(`State already exists for stack '${stackInfo.stackName}' (${targetRegion}). Auto / whole-stack import rebuilds the entire resource map from the template, which would drop any state entry not re-imported. Pass --force to confirm. To add specific resources without affecting unlisted ones, use --resource <id>=<physicalId> (selective merge — no --force needed).`);
+			} else {
+				const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
+				if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
+				const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
+				logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
+			}
 		}
 		for (const overrideId of overrides.keys()) if (!templateLogicalIds.has(overrideId)) throw new Error(`--resource / --resource-mapping references logical ID '${overrideId}' which is not in the synthesized template for stack '${stackInfo.stackName}'. Available IDs: ${[...templateLogicalIds].join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
@@ -79961,6 +80204,11 @@ function defaultOnlyParameterTemplate(template) {
 * weren't re-imported in this run — selective merge preserves them as
 * already-stored, which on the v3 baseline is already resolved-shape
 * from a prior import / deploy, so re-resolving is a no-op.
+*
+* Exported for unit testing — internal to the command flow otherwise. The
+* masking this walk applies (issue #2803) is only provable against the REAL
+* resolver, since the plaintext reaches the message through the resolver's
+* own throw rather than through anything this function writes.
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
 	const entries = Object.entries(stackState.resources);
@@ -79997,16 +80245,18 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		stateBackend,
 		stackName: stackState.stackName
 	};
-	for (const [logicalId, resource] of entries) try {
+	for (const [logicalId, resource] of entries) {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
-		const unresolvedProperties = resource.properties ?? {};
-		const resolved = await resolver.resolve(unresolvedProperties, {
-			...baseContext,
-			recordedSecretValues
-		});
-		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
-	} catch (err) {
-		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+		try {
+			const unresolvedProperties = resource.properties ?? {};
+			const resolved = await resolver.resolve(unresolvedProperties, {
+				...baseContext,
+				recordedSecretValues
+			});
+			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
+		} catch (err) {
+			logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+		}
 	}
 }
 function printSummary(rows) {
@@ -80544,10 +80794,11 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 			bucket: stateBucket,
 			prefix: opts.statePrefix
 		};
-		const { body, resolvedKey } = await readBootstrapMarkerBody(new S3StateBackend(awsClients.s3, stateConfig, {
+		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
 			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
-		}), rawRegion, { logPrefix: prefix });
+		});
+		const { body, resolvedKey } = await readBootstrapMarkerBody(stateBackend, rawRegion, { logPrefix: prefix });
 		if (body === null) {
 			const rawKey = getBootstrapMarkerKey(rawRegion);
 			logger.debug(`${prefix}: no bootstrap marker at '${resolvedKey}'${rawKey !== resolvedKey ? ` (nor '${rawKey}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
@@ -80720,14 +80971,15 @@ var S3LocalStateProvider = class {
 		this.opts = opts;
 	}
 	async load(stackName, synthRegion) {
-		const loaded = await loadStateForStack(stackName, synthRegion, {
+		const loadOpts = {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stackRegion !== void 0 && { stackRegion: this.opts.stackRegion },
 			...this.opts.rawStackRegion !== void 0 && { rawStackRegion: this.opts.rawStackRegion },
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
-		});
+		};
+		const loaded = await loadStateForStack(stackName, synthRegion, loadOpts);
 		if (!loaded) return void 0;
 		const outputs = {};
 		for (const [k, v] of Object.entries(loaded.state.outputs ?? {})) if (typeof v === "string") outputs[k] = v;
@@ -80740,12 +80992,13 @@ var S3LocalStateProvider = class {
 		};
 	}
 	async buildCrossStackResolver(consumerRegion) {
-		const built = await buildCrossStackResolver(consumerRegion, {
+		const buildOpts = {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
-		});
+		};
+		const built = await buildCrossStackResolver(consumerRegion, buildOpts);
 		if (!built) return void 0;
 		this.disposers.push(built.dispose);
 		return built.resolver;
@@ -82544,7 +82797,7 @@ async function runDetached(opts) {
 	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
-			maxBuffer: 10 * 1024 * 1024,
+			maxBuffer: 10485760,
 			env: dockerSpawnEnvWithSensitive(passthroughEnv)
 		});
 		return stdout.trim();
@@ -82778,7 +83031,7 @@ const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
 */
 const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
 /** 5-minute safety margin against the recorded STS expiration timestamp. */
-const STS_CREDENTIAL_SAFETY_MARGIN_MS = 300 * 1e3;
+const STS_CREDENTIAL_SAFETY_MARGIN_MS = 3e5;
 function isCredentialFresh(creds) {
 	if (!creds.expiration) return false;
 	return creds.expiration.getTime() - Date.now() > STS_CREDENTIAL_SAFETY_MARGIN_MS;
@@ -82886,7 +83139,8 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 		};
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${err instanceof Error ? err.message : String(err)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		const reason = err instanceof Error ? err.message : String(err);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -83506,7 +83760,8 @@ function attachWebSocketServer(opts) {
 * route table.
 */
 async function handleManagementRequest(req, res, registry) {
-	if (parseConnectionsPath(req.url ?? "") === null) return false;
+	const url = req.url ?? "";
+	if (parseConnectionsPath(url) === null) return false;
 	await handleConnectionsRequest({
 		req,
 		res,
@@ -83774,8 +84029,9 @@ function createContainerPool(specs, options) {
 				readOnly: true
 			}] : optMount;
 			const containerCodePath = resolveRuntimeCodeMountPath(spec.lambda.runtime);
+			const image = resolveRuntimeImage(spec.lambda.runtime);
 			containerId = await runDetached({
-				image: resolveRuntimeImage(spec.lambda.runtime),
+				image,
 				mounts: [{
 					hostPath: spec.codeDir,
 					containerPath: containerCodePath,
@@ -85675,7 +85931,7 @@ async function createNetworkAndSidecar(args) {
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
 		const { stdout } = await execFileAsync$2(getDockerCmd(), sidecarArgs, {
-			maxBuffer: 10 * 1024 * 1024,
+			maxBuffer: 10485760,
 			env: dockerSpawnEnvWithSensitive(sidecarSensitiveEnv)
 		});
 		return stdout.trim();
@@ -86048,7 +86304,7 @@ async function runEcsTask(task, options, state) {
 		try {
 			const sensitiveEnv = dockerEnvs.get(container.name);
 			const { stdout } = await execFileAsync$1(getDockerCmd(), args, {
-				maxBuffer: 10 * 1024 * 1024,
+				maxBuffer: 10485760,
 				env: dockerSpawnEnvWithSensitive(sensitiveEnv)
 			});
 			id = stdout.trim();
@@ -86139,9 +86395,7 @@ async function awaitDependencies(container, started) {
 				if (code !== 0) throw new EcsTaskRunnerError(`Container '${container.name}' requires dependency '${dep.containerName}' to exit 0, but it exited ${code}.`);
 				break;
 			}
-			case "HEALTHY":
-				await waitForContainerHealthy(entry.id, dep.containerName);
-				break;
+			case "HEALTHY": await waitForContainerHealthy(entry.id, dep.containerName);
 		}
 	}
 }
@@ -86154,7 +86408,7 @@ async function awaitDependencies(container, started) {
 */
 async function waitForContainerHealthy(containerId, displayName) {
 	const logger = getLogger().child("ecs-runner");
-	const deadline = Date.now() + 300 * 1e3;
+	const deadline = Date.now() + 3e5;
 	let lastStatus = "";
 	const inspectArgs = [
 		"inspect",
@@ -86183,7 +86437,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 async function waitForContainerExit(containerId) {
 	const waitArgs = ["wait", containerId];
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), waitArgs, { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$1(getDockerCmd(), waitArgs, { maxBuffer: 1048576 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -86382,11 +86636,12 @@ function buildDockerRunArgs(opts) {
 	for (const mp of container.mountPoints) {
 		const v = volumeByName.get(mp.sourceVolume);
 		if (!v) continue;
-		if (v.kind === "host") if (v.hostPath) {
-			const ro = mp.readOnly ? ":ro" : "";
-			args.push("-v", `${v.hostPath}:${mp.containerPath}${ro}`);
-		} else args.push("-v", mp.containerPath);
-		else {
+		if (v.kind === "host") {
+			if (v.hostPath) {
+				const ro = mp.readOnly ? ":ro" : "";
+				args.push("-v", `${v.hostPath}:${mp.containerPath}${ro}`);
+			} else args.push("-v", mp.containerPath);
+		} else {
 			const name = v.dockerVolumeName ?? v.name;
 			const ro = mp.readOnly ? ":ro" : "";
 			args.push("-v", `${name}:${mp.containerPath}${ro}`);
@@ -86411,7 +86666,8 @@ function buildDockerRunArgs(opts) {
 		applyOverrideMap(finalEnv, overrides["Parameters"]);
 		applyOverrideMap(finalEnv, overrides[container.name]);
 	}
-	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...secrets.map((s) => s.name)]));
+	const sensitiveKeys = /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...secrets.map((s) => s.name)]);
+	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys);
 	args.push(...flags);
 	if (container.user) args.push("--user", container.user);
 	if (container.privileged) args.push("--privileged");
@@ -86526,16 +86782,20 @@ async function localRunTaskCommand(target, options) {
 		const { context: imageContext, stateRecordRegion } = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(target, stacks, imageContext);
 		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
-		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
+		const taskStack = stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack;
+		const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
 			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
-			if (resolver) await applyCrossStackResolverToTask(task, {
-				resources: imageContext?.stateResources ?? {},
-				...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
-				consumerRegion,
-				crossStackResolver: resolver
-			});
+			if (resolver) {
+				const subContext = {
+					resources: imageContext?.stateResources ?? {},
+					...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
+					consumerRegion,
+					crossStackResolver: resolver
+				};
+				await applyCrossStackResolverToTask(task, subContext);
+			}
 		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state.");
 		sigintHandler = () => {
 			sigintCount += 1;
@@ -87075,7 +87335,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		`${containerId}:${workdirDest}`
 	];
 	try {
-		await execFileAsync(dockerCmd, cpArgs, { maxBuffer: 64 * 1024 * 1024 });
+		await execFileAsync(dockerCmd, cpArgs, { maxBuffer: 67108864 });
 	} catch (err) {
 		throw new CdkdError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeDockerExecFailure(err, cpArgs)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
@@ -87614,8 +87874,9 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 	}
 	const region = canonicalizeRegion(options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region);
 	if (!region) throw new CdkdError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
+	const credentials = await resolveHostCredentialsForSigV4(options, resolved, loaded, region);
 	const signed = await signAgentCoreInvocation({
-		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region),
+		credentials,
 		region,
 		host,
 		port,
@@ -88735,15 +88996,16 @@ async function localInvokeCommand(target, options) {
 		}
 		let resolvedAssumeRoleArn;
 		if (typeof options.assumeRole === "string") resolvedAssumeRoleArn = options.assumeRole;
-		else if (options.assumeRole === true) if (!stateForRoleHint) logger.warn("--assume-role passed without an ARN, but no cdkd state was loaded. Pair it with --from-state, or pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
-		else {
-			const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
-			if (arn) {
-				resolvedAssumeRoleArn = arn;
-				logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
-			} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
-		}
-		else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
+		else if (options.assumeRole === true) {
+			if (!stateForRoleHint) logger.warn("--assume-role passed without an ARN, but no cdkd state was loaded. Pair it with --from-state, or pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
+			else {
+				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
+				if (arn) {
+					resolvedAssumeRoleArn = arn;
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
+				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
+			}
+		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
 		const event = await readEvent(options);
 		const dockerEnv = {
 			AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
@@ -88800,7 +89062,8 @@ async function localInvokeCommand(target, options) {
 		};
 		process.on("SIGINT", sigintHandler);
 		await waitForRieReady(containerHost, hostPort, 5e3);
-		const result = await invokeRie(containerHost, hostPort, event, Math.max(3e4, lambda.timeoutSec * 2 * 1e3));
+		const invokeTimeoutMs = Math.max(3e4, lambda.timeoutSec * 2 * 1e3);
+		const result = await invokeRie(containerHost, hostPort, event, invokeTimeoutMs);
 		await new Promise((resolveDelay) => setTimeout(resolveDelay, 250));
 		process.stdout.write(`${result.raw}\n`);
 	} finally {
@@ -89519,4 +89782,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CizHCByV.js.map
+//# sourceMappingURL=program-BRon74Fc.js.map