@go-to-k/cdkd 0.290.22 → 0.290.24

package/dist/{program-BKuJRiz3.js → program-DaoJ7P4H.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $i as normalizeAwsError, $n as scrubResourceRecord, $r as synthesisStatusMessage, $t as s3BucketArn, A as extractDeploymentEventError, An as repairMalformedResourcesForReadOnly, Ar as isCrossRegionRedirect, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bn as TEMPLATE_SOURCED_RULES, Br as describeDockerFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as processStackMessages, Cn as refuseMalformedOutputs, Cr as loadPublishableAssetManifest, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as getAwsClients, Dn as refuseMalformedState, Dr as assertAssetBucketRegion, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as AwsClients, En as refuseMalformedResourcesForDestroy, Er as BOOTSTRAP_MARKER_PREFIX, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as DeployCancelledError, Fn as DagBuilder, Fr as buildDenyExternalAccessPolicy, Ft as isSettledInstanceState, G as gray, Gi as ResourceTimeoutError, Gn as identityKeyFor, Gr as redactDockerArgvValues, Gt as readConfigString, H as formatResourceLine, Hi as NestedStackChildDirectDestroyError, Hn as createSecretMasker, Hr as formatDockerLoginError, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DynamicReferenceRegionAmbiguousError, In as TemplateParser, Ir as describeAwsFailure, It as WAFv2WebACLProvider, J as yellow, Ji as StackTerminationProtectionError, Jn as maskSecretsInError, Jr as escapeRegExp, Jt as requireConfigObject, K as green, Ki as ResourceUpdateNotSupportedError, Kn as isSingleDynamicReferenceToken, Kr as runDockerForeground, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as IntrinsicResolutionRefusalError, Ln as STATE_SOURCED_BASELINE_RULES, Lr as buildDockerImage, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as findSilentDropProperties, Mr as readBootstrapMarkerBody, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CrossAccountSecretRefusalError, Nn as describeTypeWithThrottleRetry, Nr as validateAssetBucketName, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resetAwsClients, On as repairMalformedOutputsForReadOnly, Or as ensureAssetStorage, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as withRetry, Pr as validateContainerRepoName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as redactSecretsForState, Qr as Synthesizer, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as LocalInvokeBuildError$1, Rn as STATE_SOURCED_CROSS_GENERATION_RULES, Rr as describeDockerCapturedOutput, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as AssemblyReader, Sn as refuseMalformedNestedChildOutputs, Sr as createAssetRedirectResolver, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as resolveBucketRegion, Tn as refuseMalformedResourcePropertiesForOrphan, Tr as AssetModeResolver, Tt as carriesDynamicReference, U as bold, Ui as PartialFailureError, Un as dynamicReferenceTokens, Ur as getDockerCmd, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as MalformedProducerRecordRefusalError, Vn as carriesSecretMask, Vr as dockerSpawnEnvWithSensitive, Vt as coerceCfnInteger, W as cyan, Wi as ProvisioningError, Wn as errorCauseChain, Wr as partitionSensitiveEnv, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as recordMaskOnlyValue, Xr as AssetManifestLoader, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yn as maskSecretsInText, Yr as stripControlChars, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recoverMaskedOutput, Zr as getDockerImageBySourceHash, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as decodeListingKey, _n as malformedRenderedContainersWarning, _r as shouldRetainResource, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as markNonRetryable, ai as resolveSkipPrefix, an as applyCallerIdentityCredentials, ar as forceQuitRecoveryClause, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as canonicalizeRegion, bn as malformedStateRefusalMessage, br as WorkGraph, bt as deleteIndeterminateGuards, c as replayFailedOperations, ci as resolveUseCdkBootstrapAssets, cn as INTRINSIC_KEYS, cr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ct as createMaskedRetryLogger, d as updatePartialReason, di as CFN_TEMPLATE_BODY_LIMIT, dn as hasReadableResources, dr as hasReadableExportSet, dt as beginCommandInterruptScope, ea as withErrorHandling, ei as getDefaultStateBucketName, en as s3BucketDomainName, er as LockManager, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_URL_LIMIT, fn as malformedExportNamesWarning, fr as importableOutputKeys, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gn as malformedOutputsWarning, gr as orphansCarriedFrom, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as uploadCfnTemplate, hn as malformedOutputsRefusalMessage, hr as orphansAfterRollback, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isTransientServerError, ii as resolveCaptureObservedState, in as applyRoleArnIfSet, ir as buildLockContentionMessage, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as CdkdError, jn as findActionableSilentDrops, jr as parseBootstrapMarker, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as setAwsClients, kn as repairMalformedResourcePropertiesForReadOnly, kr as getBootstrapMarkerKey, kt as getAccountInfo, l as replayRollback, li as stateBucketExistenceConfirmed, ln as STATE_RESOURCES_MALFORMED, lr as DEFAULT_STATE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as findLargeInlineResources, mn as malformedLocalOutputsWarning, mr as isReadableBag, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isRetryableTransientError, ni as resolveApp, nn as s3BucketRegionalDomainName, nr as rebuildClientForBucketRegion, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markRedactedCause, oi as resolveStateBucketWithDefault, on as callerEnvCredentials, or as formatLockExpiry, ot as ProviderRegistry, p as maskingRetryLogger, pi as MIGRATE_TMP_PREFIX, pn as malformedExportSourceWarning, pr as importableOutputs, pt as interruptWatchListenerCount, q as red, qi as StackHasActiveImportsError, qn as markSameGenerationBag, qr as runDockerStreaming, qt as requireConfigArray, r as DeployEngine, ra as isThrottlingError, ri as resolveAutoAssetStorage, rn as s3BucketWebsiteUrl, rr as buildForceUnlockCommand, rt as IAMRoleProvider, s as planRollback, sa as retryClassificationText, si as resolveStateBucketWithDefaultAndSource, sn as DiffCalculator, sr as shellQuote, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as isMarkedNonRetryable, ti as getLegacyStateBucketName, tn as s3BucketDualStackDomainName, tr as S3StateBackend, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as warnDeprecatedNoPrefixCliFlag, un as hasReadableOutputs, ur as exportNamesCarriedFrom, ut as maskerOrIdentity, v as keptWholeReasonText, vi as expectedOwnerParam, vn as malformedResourcePropertiesWarning, vr as AssetPublisher, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wn as refuseMalformedOutputsForDestroy, wr as rewriteTemplateAssetReferences, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as derivePartitionAndUrlSuffix, xn as producerRecordKey, xr as buildAssetRedirectMap, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as PARTITION_TABLE, yn as malformedResourcesWarning, yr as stringifyValue, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalStartServiceError, zn as STATE_SOURCED_READBACK_RULES, zr as describeDockerExecFailure, zt as assertRegionMatch } from "./deploy-engine-Dbmoo4FQ.js";
-import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-C17H06QA.js";
+import { $ as secretBearing, $n as scrubResourceRecord, $r as Synthesizer, $t as s3BucketArn, A as extractDeploymentEventError, Ai as setAwsClients, An as repairMalformedResourcesForReadOnly, Ar as isCrossRegionRedirect, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalStartServiceError, Bn as TEMPLATE_SOURCED_RULES, Br as describeDockerExecFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as AssemblyReader, Cn as refuseMalformedOutputs, Cr as loadPublishableAssetManifest, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as AwsClients, Dn as refuseMalformedState, Dr as assertAssetBucketRegion, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as resolveBucketRegion, En as refuseMalformedResourcesForDestroy, Er as BOOTSTRAP_MARKER_PREFIX, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as DagBuilder, Fr as buildDenyExternalAccessPolicy, Ft as isSettledInstanceState, G as gray, Gi as ProvisioningError, Gn as identityKeyFor, Gr as partitionSensitiveEnv, Gt as readConfigString, H as formatResourceLine, Hi as MalformedProducerRecordRefusalError, Hn as createSecretMasker, Hr as dockerSpawnEnvWithSensitive, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DeployCancelledError, In as TemplateParser, Ir as describeAwsFailure, It as WAFv2WebACLProvider, J as yellow, Ji as StackHasActiveImportsError, Jn as maskSecretsInError, Jr as runDockerStreaming, Jt as requireConfigObject, K as green, Ki as ResourceTimeoutError, Kn as isSingleDynamicReferenceToken, Kr as redactDockerArgvValues, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DynamicReferenceRegionAmbiguousError, Ln as STATE_SOURCED_BASELINE_RULES, Lr as safeStringify, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as CdkdError, Mn as findSilentDropProperties, Mr as readBootstrapMarkerBody, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as describeTypeWithThrottleRetry, Nr as validateAssetBucketName, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as getAwsClients, On as repairMalformedOutputsForReadOnly, Or as ensureAssetStorage, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CrossAccountSecretRefusalError, Pn as withRetry, Pr as validateContainerRepoName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as redactSecretsForState, Qr as getDockerImageBySourceHash, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as IntrinsicResolutionRefusalError, Rn as STATE_SOURCED_CROSS_GENERATION_RULES, Rr as buildDockerImage, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as derivePartitionAndUrlSuffix, Sn as refuseMalformedNestedChildOutputs, Sr as createAssetRedirectResolver, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Tn as refuseMalformedResourcePropertiesForOrphan, Tr as AssetModeResolver, Tt as carriesDynamicReference, U as bold, Ui as NestedStackChildDirectDestroyError, Un as dynamicReferenceTokens, Ur as formatDockerLoginError, Ut as configIntegerRefusal, V as toFiniteNumber, Vn as carriesSecretMask, Vr as describeDockerFailure, Vt as coerceCfnInteger, W as cyan, Wi as PartialFailureError, Wn as errorCauseChain, Wr as getDockerCmd, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as recordMaskOnlyValue, Xr as stripControlChars, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackTerminationProtectionError, Yn as maskSecretsInText, Yr as escapeRegExp, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recoverMaskedOutput, Zr as AssetManifestLoader, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _n as malformedRenderedContainersWarning, _r as shouldRetainResource, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isTransientServerError, ai as resolveCaptureObservedState, an as applyCallerIdentityCredentials, ar as forceQuitRecoveryClause, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as PARTITION_TABLE, bn as malformedStateRefusalMessage, br as WorkGraph, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as retryClassificationText, ci as resolveStateBucketWithDefaultAndSource, cn as INTRINSIC_KEYS, cr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ct as createMaskedRetryLogger, d as updatePartialReason, di as warnDeprecatedNoPrefixCliFlag, dn as hasReadableResources, dr as hasReadableExportSet, dt as beginCommandInterruptScope, ea as normalizeAwsError, ei as synthesisStatusMessage, en as s3BucketDomainName, er as LockManager, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_BODY_LIMIT, fn as malformedExportNamesWarning, fr as importableOutputKeys, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as uploadCfnTemplate, gn as malformedOutputsWarning, gr as orphansCarriedFrom, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as findLargeInlineResources, hn as malformedOutputsRefusalMessage, hr as orphansAfterRollback, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isThrottlingError, ii as resolveAutoAssetStorage, in as applyRoleArnIfSet, ir as buildLockContentionMessage, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as findActionableSilentDrops, jr as parseBootstrapMarker, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as resetAwsClients, kn as repairMalformedResourcePropertiesForReadOnly, kr as getBootstrapMarkerKey, kt as getAccountInfo, l as replayRollback, li as resolveUseCdkBootstrapAssets, ln as STATE_RESOURCES_MALFORMED, lr as DEFAULT_STATE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as MIGRATE_TMP_PREFIX, mn as malformedLocalOutputsWarning, mr as isReadableBag, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isMarkedNonRetryable, ni as getLegacyStateBucketName, nn as s3BucketRegionalDomainName, nr as rebuildClientForBucketRegion, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markNonRetryable, oi as resolveSkipPrefix, on as callerEnvCredentials, or as formatLockExpiry, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_URL_LIMIT, pn as malformedExportSourceWarning, pr as importableOutputs, pt as interruptWatchListenerCount, q as red, qi as ResourceUpdateNotSupportedError, qn as markSameGenerationBag, qr as runDockerForeground, qt as requireConfigArray, r as DeployEngine, ra as isRetryableTransientError, ri as resolveApp, rn as s3BucketWebsiteUrl, rr as buildForceUnlockCommand, rt as IAMRoleProvider, s as planRollback, sa as markRedactedCause, si as resolveStateBucketWithDefault, sn as DiffCalculator, sr as shellQuote, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as withErrorHandling, ti as getDefaultStateBucketName, tn as s3BucketDualStackDomainName, tr as S3StateBackend, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as stateBucketExistenceConfirmed, un as hasReadableOutputs, ur as exportNamesCarriedFrom, ut as maskerOrIdentity, v as keptWholeReasonText, vi as decodeListingKey, vn as malformedResourcePropertiesWarning, vr as AssetPublisher, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as processStackMessages, wn as refuseMalformedOutputsForDestroy, wr as rewriteTemplateAssetReferences, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as canonicalizeRegion, xn as producerRecordKey, xr as buildAssetRedirectMap, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as expectedOwnerParam, yn as malformedResourcesWarning, yr as stringifyValue, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalInvokeBuildError$1, zn as STATE_SOURCED_READBACK_RULES, zr as describeDockerCapturedOutput, zt as assertRegionMatch } from "./deploy-engine-BcNBidfy.js";
+import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CpOEkAtB.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DTzndMHB.js";
+import { t as getCdkdVersion } from "./version-PsB8OjhM.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CHeJf5zw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4777,7 +4777,7 @@ var IAMManagedPolicyProvider = class {
 					await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: policyArn }));
 					this.logger.debug(`Cleaned up partially-created managed policy ${logicalId} (${policyArn}) after attachment failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created managed policy ${logicalId} (${policyArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required: detach principals (aws iam list-entities-for-policy --policy-arn ${policyArn}), delete versions (aws iam list-policy-versions --policy-arn ${policyArn} then aws iam delete-policy-version), then aws iam delete-policy --policy-arn ${policyArn}`);
+					this.logger.warn(`Failed to clean up partially-created managed policy ${logicalId} (${policyArn}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required: detach principals (aws iam list-entities-for-policy --policy-arn ${policyArn}), delete versions (aws iam list-policy-versions --policy-arn ${policyArn} then aws iam delete-policy-version), then aws iam delete-policy --policy-arn ${policyArn}`);
 				}
 				throw innerError;
 			}
@@ -4811,8 +4811,8 @@ var IAMManagedPolicyProvider = class {
 					this.logger.warn(`Skipped deleting old managed policy ${physicalId} during replacement: ${deleteResult.reason}. The old policy may be orphaned and require manual cleanup.`);
 				}
 			} catch (error) {
-				orphanReason = `old managed policy ${physicalId} could not be deleted: ${String(error)}`;
-				this.logger.warn(`Failed to delete old managed policy ${physicalId} during replacement: ${String(error)}. The old policy may be orphaned and require manual cleanup.`);
+				orphanReason = `old managed policy ${physicalId} could not be deleted: ${safeStringify(error)}`;
+				this.logger.warn(`Failed to delete old managed policy ${physicalId} during replacement: ${safeStringify(error)}. The old policy may be orphaned and require manual cleanup.`);
 			}
 			const base = {
 				physicalId: createResult.physicalId,
@@ -5272,7 +5272,7 @@ var IAMInstanceProfileProvider = class {
 					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
 					this.logger.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${instanceProfileName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created IAM instance profile ${logicalId} (${instanceProfileName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove every role (aws iam remove-role-from-instance-profile --instance-profile-name ${instanceProfileName} --role-name <name>) then aws iam delete-instance-profile --instance-profile-name ${instanceProfileName}`);
+					this.logger.warn(`Failed to clean up partially-created IAM instance profile ${logicalId} (${instanceProfileName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: remove every role (aws iam remove-role-from-instance-profile --instance-profile-name ${instanceProfileName} --role-name <name>) then aws iam delete-instance-profile --instance-profile-name ${instanceProfileName}`);
 				}
 				throw innerError;
 			}
@@ -5548,7 +5548,7 @@ var IAMAccessKeyProvider = class {
 						AccessKeyId: accessKeyId
 					}));
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up IAM access key ${logicalId} (${accessKeyId}) minted by a partial CreateAccessKey response: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+					this.logger.warn(`Failed to clean up IAM access key ${logicalId} (${accessKeyId}) minted by a partial CreateAccessKey response: ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
 				}
 				throw new Error("CreateAccessKey returned no AccessKeyId/SecretAccessKey");
 			}
@@ -5566,7 +5566,7 @@ var IAMAccessKeyProvider = class {
 					}));
 					this.logger.debug(`Cleaned up partially-created IAM access key ${logicalId} (${accessKeyId}) after status wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created IAM access key ${logicalId} (${accessKeyId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+					this.logger.warn(`Failed to clean up partially-created IAM access key ${logicalId} (${accessKeyId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
 				}
 				throw innerError;
 			}
@@ -5671,7 +5671,7 @@ var IAMAccessKeyProvider = class {
 					AccessKeyId: accessKeyId
 				}));
 			} catch (error) {
-				this.logger.warn(`Failed to delete the orphaned IAM access key ${accessKeyId} for user ${userName}: ${error instanceof Error ? error.message : String(error)}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+				this.logger.warn(`Failed to delete the orphaned IAM access key ${accessKeyId} for user ${userName}: ${describeAwsFailure(error).detail}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
 			}
 		}
 	}
@@ -5703,7 +5703,7 @@ var IAMAccessKeyProvider = class {
 				marker = page.IsTruncated ? page.Marker : void 0;
 			} while (marker);
 		} catch (error) {
-			this.logger.warn(`Could not list existing access keys for user ${userName} while creating ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Orphan detection is DISABLED for this create, so a retried attempt may leave an unusable but ACTIVE access key on the user. Grant iam:ListAccessKeys, or check the user's keys after the deploy: aws iam list-access-keys --user-name ${userName}`);
+			this.logger.warn(`Could not list existing access keys for user ${userName} while creating ${logicalId}: ${describeAwsFailure(error).detail}. Orphan detection is DISABLED for this create, so a retried attempt may leave an unusable but ACTIVE access key on the user. Grant iam:ListAccessKeys, or check the user's keys after the deploy: aws iam list-access-keys --user-name ${userName}`);
 			return;
 		}
 		return keys;
@@ -6015,7 +6015,7 @@ var IAMUserGroupProvider = class {
 					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
 					this.logger.debug(`Cleaned up partially-created IAM user ${logicalId} (${userName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created IAM user ${logicalId} (${userName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove from groups, detach managed policies, delete inline policies, delete login profile (aws iam delete-login-profile --user-name ${userName}), remove permissions boundary (aws iam delete-user-permissions-boundary --user-name ${userName}), then aws iam delete-user --user-name ${userName}`);
+					this.logger.warn(`Failed to clean up partially-created IAM user ${logicalId} (${userName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: remove from groups, detach managed policies, delete inline policies, delete login profile (aws iam delete-login-profile --user-name ${userName}), remove permissions boundary (aws iam delete-user-permissions-boundary --user-name ${userName}), then aws iam delete-user --user-name ${userName}`);
 				}
 				throw innerError;
 			}
@@ -6313,7 +6313,7 @@ var IAMUserGroupProvider = class {
 					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
 					this.logger.debug(`Cleaned up partially-created IAM group ${logicalId} (${groupName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created IAM group ${logicalId} (${groupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies + delete inline policies, then aws iam delete-group --group-name ${groupName}`);
+					this.logger.warn(`Failed to clean up partially-created IAM group ${logicalId} (${groupName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: detach managed policies + delete inline policies, then aws iam delete-group --group-name ${groupName}`);
 				}
 				throw innerError;
 			}
@@ -10059,7 +10059,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			return {
 				kind: "indeterminate",
-				reason: probeError instanceof Error ? probeError.message : String(probeError),
+				reason: describeAwsFailure(probeError).detail,
 				errorName: probeError instanceof Error ? probeError.name : typeof probeError
 			};
 		}
@@ -10223,7 +10223,7 @@ var S3BucketProvider = class S3BucketProvider {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${describeAwsFailure(cleanupError).detail}`);
 					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
 					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
@@ -11037,7 +11037,7 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Successfully deleted S3 bucket ${logicalId}`);
 			return;
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
 				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
 				this.logger.info(`Bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
@@ -11361,7 +11361,7 @@ var S3BucketPolicyProvider = class {
 		try {
 			canonical = (await getAwsClients().cloudFront.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: oaiId }))).CloudFrontOriginAccessIdentity?.S3CanonicalUserId ?? null;
 		} catch (err) {
-			this.logger.debug(`Could not resolve CloudFront OAI ${oaiId} canonical user id for bucket-policy drift normalization: ${err instanceof Error ? err.message : String(err)} — leaving the principal unchanged.`);
+			this.logger.debug(`Could not resolve CloudFront OAI ${oaiId} canonical user id for bucket-policy drift normalization: ${describeAwsFailure(err).detail} — leaving the principal unchanged.`);
 			canonical = null;
 		}
 		oaiCanonicalUserIdCache.set(oaiId, canonical);
@@ -12244,7 +12244,7 @@ var SNSTopicProvider = class {
 					await this.snsClient.send(new DeleteTopicCommand({ TopicArn: topicArn }));
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
-					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws sns delete-topic --topic-arn ${topicArn}`);
+					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws sns delete-topic --topic-arn ${topicArn}`);
 				}
 				throw innerError;
 			}
@@ -12974,6 +12974,88 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 	return result;
 }
 
+//#endregion
+//#region src/provisioning/attribute-map.ts
+/**
+* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
+* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
+* shape `docs/provider-development.md` forbids under "Never store an
+* empty-string placeholder"):
+*
+*   an attribute cdkd could not read back is ABSENT from the map — never
+*   recorded as the empty string, and never as a present-but-`undefined` key.
+*
+* The consumers of `ResourceState.attributes` all key off exactly that
+* distinction, and a sentinel puts every one of them on the wrong branch:
+*
+*  - the deploy engine persists the map as-is, so `''` becomes the recorded
+*    value of a field AWS never assigned;
+*  - the intrinsic resolver serves a stored attribute whenever it is not
+*    `undefined`, so `''` shadows `constructAttribute` forever — the
+*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
+*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
+*    only on a MISS;
+*  - the Outputs export pass publishes whatever the resolver returned, so a
+*    stored `''` is exported to every `Fn::ImportValue` consumer.
+*
+* It exists as a MODULE rather than a per-provider idiom because the rule was
+* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
+* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
+* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
+* that DROPS the key is the one form a provider cannot spell wrong by habit.
+*
+* Two values are treated as "not read back":
+*
+*  - `undefined`: the SDK's spelling of an unassigned optional member.
+*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
+*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
+*    like `''` does.
+*
+* Every other value is kept verbatim — INCLUDING an empty string AWS itself
+* reported (`false`, `0`, an empty array and an object likewise). The helper
+* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
+* off the wire is a known value with a meaning the provider owns. The EC2
+* Instance provider is where that distinction is load-bearing: a `running`
+* instance with no public address is described with `PublicDnsName: ''` and
+* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
+* empty, recorded as such so a reference does not degrade to the instance id
+* on every resolution — while the same `''` on a `pending` instance means
+* "not yet", which that provider maps to `undefined` BEFORE calling this
+* helper (its `describedInstanceAttributes`). A caller that knows a `''`
+* means "unknown" is the one that must say so; this helper cannot tell.
+*
+* Deliberately NOT a general "compact this record" utility: it is scoped to
+* attribute maps. A property bag keeps its `undefined`-valued keys out by other
+* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
+* than setting it to `undefined`").
+*
+* A LEAF module (imports nothing) so every provider can take it without adding
+* an edge to the provider import ring.
+*/
+/**
+* Build an attribute map from read-back values, omitting every key whose value
+* is `undefined` or `null`.
+*/
+function definedAttributes(entries) {
+	const out = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (value === void 0 || value === null) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* `String(value)` for a numeric read-back whose CloudFormation attribute is a
+* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
+* `definedAttributes` drops the key instead of recording the literal
+* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
+* `?? ''` is merely deleted.
+*/
+function stringifyIfAssigned(value) {
+	if (value === void 0 || value === null) return void 0;
+	return String(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 /**
@@ -13046,17 +13128,18 @@ var SNSSubscriptionProvider = class {
 			if (replayPolicy !== void 0) attributes["ReplayPolicy"] = typeof replayPolicy === "string" ? replayPolicy : JSON.stringify(replayPolicy);
 			const subscriptionRoleArn = properties["SubscriptionRoleArn"];
 			if (subscriptionRoleArn !== void 0) attributes["SubscriptionRoleArn"] = stringifyValue(subscriptionRoleArn);
-			const subscriptionArn = (await this.snsClient.send(new SubscribeCommand({
+			const response = await this.snsClient.send(new SubscribeCommand({
 				TopicArn: topicArn,
 				Protocol: protocol,
 				Endpoint: endpoint,
 				ReturnSubscriptionArn: true,
 				...Object.keys(attributes).length > 0 && { Attributes: attributes }
-			}))).SubscriptionArn || `${topicArn}:${logicalId}`;
+			}));
+			const subscriptionArn = response.SubscriptionArn || `${topicArn}:${logicalId}`;
 			this.logger.debug(`Successfully created SNS subscription ${logicalId}: ${subscriptionArn}`);
 			return {
 				physicalId: subscriptionArn,
-				attributes: {}
+				attributes: definedAttributes({ Arn: response.SubscriptionArn?.startsWith("arn:") ? response.SubscriptionArn : void 0 })
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -13077,7 +13160,7 @@ var SNSSubscriptionProvider = class {
 			deleteResult = await this.delete(logicalId, physicalId, resourceType);
 		} catch (error) {
 			deleteThrew = true;
-			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${String(error)}`);
+			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${safeStringify(error)}`);
 		}
 		const notDeletedReason = deleteThrew ? SNS_SUBSCRIPTION_DELETE_THREW_REASON : deleteResult?.outcome === "skipped" ? deleteResult.reason : void 0;
 		if (notDeletedReason !== void 0) {
@@ -13657,7 +13740,7 @@ var LambdaFunctionProvider = class {
 		try {
 			await send();
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			this.logger.warn(`${ctx.apiName} failed for ${ctx.logicalId}: ${message} — deleting partially-created function to maintain atomicity`);
 			let cleanupFailure;
 			for (let attempt = 0; attempt < LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS; attempt++) try {
@@ -13665,7 +13748,7 @@ var LambdaFunctionProvider = class {
 				cleanupFailure = void 0;
 				break;
 			} catch (deleteError) {
-				const deleteMessage = deleteError instanceof Error ? deleteError.message : String(deleteError);
+				const deleteMessage = describeAwsFailure(deleteError).detail;
 				cleanupFailure = deleteMessage;
 				if (!/currently in the following state|ResourceConflict/i.test(deleteMessage)) break;
 				if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
@@ -13858,7 +13941,7 @@ var LambdaFunctionProvider = class {
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					return;
 				}
-				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)} — continuing with delete`);
+				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${describeAwsFailure(error).detail} — continuing with delete`);
 			}
 			await this.waitForLambdaUpdateCompleted(physicalId);
 		}
@@ -14060,7 +14143,7 @@ var LambdaFunctionProvider = class {
 				status = (await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: functionName }))).Configuration?.LastUpdateStatus;
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException) return;
-				this.logger.debug(`GetFunction failed while waiting for ${functionName} update: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.debug(`GetFunction failed while waiting for ${functionName} update: ${describeAwsFailure(error).detail}`);
 			}
 			if (status && status !== "InProgress") {
 				this.logger.debug(`Lambda ${functionName} update completed (LastUpdateStatus=${status}) after ${Date.now() - start}ms`);
@@ -14084,7 +14167,7 @@ var LambdaFunctionProvider = class {
 		try {
 			enis = await this.listLambdaEnis(functionName);
 		} catch (error) {
-			this.logger.warn(`DescribeNetworkInterfaces failed for ${functionName}: ${error instanceof Error ? error.message : String(error)} — downstream Subnet/SG deletion will fall back to its own ENI cleanup`);
+			this.logger.warn(`DescribeNetworkInterfaces failed for ${functionName}: ${describeAwsFailure(error).detail} — downstream Subnet/SG deletion will fall back to its own ENI cleanup`);
 			return;
 		}
 		if (enis.length === 0) {
@@ -14100,7 +14183,7 @@ var LambdaFunctionProvider = class {
 			this.logger.debug(`Deleted Lambda ENI ${eniId} for ${functionName}`);
 			return;
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("InvalidNetworkInterfaceID.NotFound") || msg.includes("does not exist")) return;
 			const elapsed = Date.now() - start;
 			if (elapsed >= this.eniDeleteRetryBudgetMs) {
@@ -14348,13 +14431,13 @@ var LambdaFunctionProvider = class {
 				const rlResp = await this.lambdaClient.send(new GetFunctionRecursionConfigCommand({ FunctionName: physicalId }));
 				if (rlResp.RecursiveLoop !== void 0) result["RecursiveLoop"] = rlResp.RecursiveLoop;
 			} catch (rlErr) {
-				if (!(rlErr instanceof ResourceNotFoundException)) this.logger.debug(`GetFunctionRecursionConfig failed for ${physicalId}: ${rlErr instanceof Error ? rlErr.message : String(rlErr)}`);
+				if (!(rlErr instanceof ResourceNotFoundException)) this.logger.debug(`GetFunctionRecursionConfig failed for ${physicalId}: ${describeAwsFailure(rlErr).detail}`);
 			}
 			try {
 				const pcResp = await this.lambdaClient.send(new GetFunctionConcurrencyCommand({ FunctionName: physicalId }));
 				if (pcResp.ReservedConcurrentExecutions !== void 0) result["ReservedConcurrentExecutions"] = pcResp.ReservedConcurrentExecutions;
 			} catch (pcErr) {
-				if (!(pcErr instanceof ResourceNotFoundException)) this.logger.debug(`GetFunctionConcurrency failed for ${physicalId}: ${pcErr instanceof Error ? pcErr.message : String(pcErr)}`);
+				if (!(pcErr instanceof ResourceNotFoundException)) this.logger.debug(`GetFunctionConcurrency failed for ${physicalId}: ${describeAwsFailure(pcErr).detail}`);
 			}
 			if (cfg.PackageType !== "Image") {
 				try {
@@ -14365,13 +14448,13 @@ var LambdaFunctionProvider = class {
 						result["RuntimeManagementConfig"] = rm;
 					}
 				} catch (rmErr) {
-					if (!(rmErr instanceof ResourceNotFoundException)) this.logger.warn(`GetRuntimeManagementConfig failed for ${physicalId} — RuntimeManagementConfig omitted from the drift snapshot (may surface as a false removal): ${rmErr instanceof Error ? rmErr.message : String(rmErr)}`);
+					if (!(rmErr instanceof ResourceNotFoundException)) this.logger.warn(`GetRuntimeManagementConfig failed for ${physicalId} — RuntimeManagementConfig omitted from the drift snapshot (may surface as a false removal): ${describeAwsFailure(rmErr).detail}`);
 				}
 				try {
 					const csResp = await this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
 					if (csResp.CodeSigningConfigArn !== void 0) result["CodeSigningConfigArn"] = csResp.CodeSigningConfigArn;
 				} catch (csErr) {
-					if (!(csErr instanceof ResourceNotFoundException)) this.logger.warn(`GetFunctionCodeSigningConfig failed for ${physicalId} — CodeSigningConfigArn omitted from the drift snapshot (may surface as a false removal): ${csErr instanceof Error ? csErr.message : String(csErr)}`);
+					if (!(csErr instanceof ResourceNotFoundException)) this.logger.warn(`GetFunctionCodeSigningConfig failed for ${physicalId} — CodeSigningConfigArn omitted from the drift snapshot (may surface as a false removal): ${describeAwsFailure(csErr).detail}`);
 				}
 			}
 			return result;
@@ -16784,7 +16867,7 @@ async function waitForIndexesSettled(opts) {
 			try {
 				if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
 			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
+				const message = describeAwsFailure(err).detail;
 				if (isThrottlingError(err)) {
 					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
 					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
@@ -17603,7 +17686,7 @@ async function compensateRemovedDeletionProtection(opts) {
 		opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: the delete failed after --remove-protection had turned DeletionProtectionEnabled off, so it was re-enabled on ${opts.physicalId}. The delete failure below is the outcome.`);
 		return "restored";
 	} catch (reEnableError) {
-		const detail = reEnableError instanceof Error ? reEnableError.message : String(reEnableError);
+		const detail = describeAwsFailure(reEnableError).detail;
 		if (isResourceNotFoundError(reEnableError)) {
 			const regionArg = opts.region ? ` --region ${opts.region}` : "";
 			opts.logger.warn(`DynamoDB ${opts.typeLabel} ${opts.logicalId}: could not re-enable DeletionProtectionEnabled on ${opts.physicalId} after the delete failed — DynamoDB answered ResourceNotFound. That most commonly means the table is gone or its status is not ACTIVE, and it can also mean the table is not in this region or account. If it still exists, its deletion protection is OFF. Check with: aws dynamodb describe-table --table-name ${opts.physicalId}${regionArg} and if it is there, restore it with: aws dynamodb update-table --table-name ${opts.physicalId}${regionArg} --deletion-protection-enabled. (${detail})`);
@@ -18455,7 +18538,7 @@ var DynamoDBTableProvider = class {
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 				debug(`Rolled back partially-created DynamoDB table ${tableName}`);
 			} catch (cleanupError) {
-				warn(`Failed to roll back partially-created DynamoDB table ${tableName}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+				warn(`Failed to roll back partially-created DynamoDB table ${tableName}: ${describeAwsFailure(cleanupError).detail}`);
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
@@ -18732,7 +18815,7 @@ var DynamoDBTableProvider = class {
 			try {
 				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
 			} catch (observeError) {
-				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${observeError instanceof Error ? observeError.message : String(observeError)}`);
+				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${describeAwsFailure(observeError).detail}`);
 			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
@@ -18743,10 +18826,10 @@ var DynamoDBTableProvider = class {
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, 60, budget);
 			} catch (waitErr) {
-				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after disabling protection: ${waitErr instanceof Error ? waitErr.message : String(waitErr)}`);
+				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after disabling protection: ${describeAwsFailure(waitErr).detail}`);
 			}
 		} catch (flipError) {
-			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
 		}
 		try {
 			const reArmPolls = () => {
@@ -18883,7 +18966,7 @@ var DynamoDBTableProvider = class {
 		for (let attempt = 1;; attempt++) try {
 			return await op();
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			const name = error instanceof Error ? error.name : "";
 			if (!(/being enabled|being updated|please retry later|backups are being/i.test(msg) || name === "ResourceInUseException" || name === "LimitExceededException") || attempt >= maxAttempts) throw error;
 			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
@@ -19959,7 +20042,7 @@ var DynamoDBTableProvider = class {
 					result["PointInTimeRecoverySpecification"] = pitr;
 				}
 			} catch (err) {
-				this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
 			try {
 				const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
@@ -19968,7 +20051,7 @@ var DynamoDBTableProvider = class {
 					Enabled: true
 				};
 			} catch (err) {
-				this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
 			if (table.TableArn) try {
 				const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: table.TableArn }));
@@ -19980,7 +20063,7 @@ var DynamoDBTableProvider = class {
 					result["ResourcePolicy"] = { PolicyDocument: doc };
 				}
 			} catch (err) {
-				if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
 			try {
 				const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
@@ -19990,7 +20073,7 @@ var DynamoDBTableProvider = class {
 					result["KinesisStreamSpecification"] = kspec;
 				}
 			} catch (err) {
-				this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
 			try {
 				const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
@@ -20001,7 +20084,7 @@ var DynamoDBTableProvider = class {
 					result["ContributorInsightsSpecification"] = cspec;
 				}
 			} catch (err) {
-				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
 			return result;
 		} catch (err) {
@@ -20500,7 +20583,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (billingMode === "PROVISIONED") try {
 				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(properties, currentRegion), currentRegion, void 0, maskSecrets);
 			} catch (autoScalingErr) {
-				warn(`Auto-scaling registration failed for ${tableName}: ${autoScalingErr instanceof Error ? autoScalingErr.message : String(autoScalingErr)}. The table was created successfully; re-run the deploy to register the scaling targets.`);
+				warn(`Auto-scaling registration failed for ${tableName}: ${describeAwsFailure(autoScalingErr).detail}. The table was created successfully; re-run the deploy to register the scaling targets.`);
 			}
 			this.logger.debug(`Successfully created DynamoDB GlobalTable ${logicalId}: ${tableName}`);
 			return {
@@ -20527,12 +20610,14 @@ var DynamoDBGlobalTableProvider = class {
 						}));
 						await this.waitForReplicaGone(tableName, region, logicalId);
 					} catch (replicaCleanupErr) {
-						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${replicaCleanupErr instanceof Error ? replicaCleanupErr.message : String(replicaCleanupErr)}. Run: aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName=${region}}' --region ${currentRegion}`);
+						const msg = describeAwsFailure(replicaCleanupErr).detail;
+						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${msg}. Run: aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName=${region}}' --region ${currentRegion}`);
 					}
 				}
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 			} catch (cleanupErr) {
-				warn(`Partial-create cleanup failed for ${tableName}: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}. Run: aws dynamodb delete-table --table-name ${tableName} to remove the orphaned AWS-side table.`);
+				const cleanupMsg = describeAwsFailure(cleanupErr).detail;
+				warn(`Partial-create cleanup failed for ${tableName}: ${cleanupMsg}. Run: aws dynamodb delete-table --table-name ${tableName} to remove the orphaned AWS-side table.`);
 			}
 			const cause = wiringError instanceof Error ? wiringError : void 0;
 			throw new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${wiringError instanceof Error ? wiringError.message : String(wiringError)}`, resourceType, logicalId, tableName, cause);
@@ -21149,7 +21234,7 @@ var DynamoDBGlobalTableProvider = class {
 			const regionalClient = this.getRegionalClient(region);
 			await this.applyTagDiffOnClient(regionalClient, replicaArn, oldTags, newTags);
 		} catch (tagErr) {
-			warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalIdForLogs}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}. The replica's Tags state will surface as drift until the next successful deploy.`);
+			warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalIdForLogs}: ${describeAwsFailure(tagErr).detail}. The replica's Tags state will surface as drift until the next successful deploy.`);
 		}
 	}
 	/**
@@ -21261,7 +21346,7 @@ var DynamoDBGlobalTableProvider = class {
 					});
 				} catch (err) {
 					if (isInterruptedWaitError(err)) throw err;
-					warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
+					warn(`Could not register auto-scaling target on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --min-capacity ${minCapacity} --max-capacity ${maxCapacity}`);
 					return;
 				}
 				const tttCfg = newSettings["TargetTrackingScalingPolicyConfiguration"] ?? {};
@@ -21303,7 +21388,7 @@ var DynamoDBGlobalTableProvider = class {
 					this.logger.debug(`Upserted auto-scaling policy ${policyName} on ${tableName} (${dimension})`);
 				} catch (err) {
 					if (isInterruptedWaitError(err)) throw err;
-					warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
+					warn(`Could not put auto-scaling policy on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: aws application-autoscaling put-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension} --policy-type TargetTrackingScaling`);
 				}
 				return;
 			}
@@ -21328,7 +21413,7 @@ var DynamoDBGlobalTableProvider = class {
 				});
 			} catch (err) {
 				if (isInterruptedWaitError(err)) throw err;
-				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
 			try {
 				await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
@@ -21345,7 +21430,7 @@ var DynamoDBGlobalTableProvider = class {
 				this.logger.debug(`Deregistered auto-scaling target ${resourceId} (${dimension})`);
 			} catch (err) {
 				if (isInterruptedWaitError(err)) throw err;
-				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${err instanceof Error ? err.message : String(err)}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
+				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`);
 			}
 		} finally {
 			watch.dispose();
@@ -21426,7 +21511,7 @@ var DynamoDBGlobalTableProvider = class {
 						policyToken = res.NextToken;
 					} while (policyToken);
 				} catch (err) {
-					this.logger.debug(`Could not probe existing auto-scaling targets on ${tableName} in ${region}: ${err instanceof Error ? err.message : String(err)} — re-asserting every target instead.`);
+					this.logger.debug(`Could not probe existing auto-scaling targets on ${tableName} in ${region}: ${describeAwsFailure(err).detail} — re-asserting every target instead.`);
 					return null;
 				}
 			}
@@ -21527,7 +21612,7 @@ var DynamoDBGlobalTableProvider = class {
 			try {
 				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
 			} catch (observeError) {
-				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${observeError instanceof Error ? observeError.message : String(observeError)}`);
+				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${describeAwsFailure(observeError).detail}`);
 			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
@@ -21538,10 +21623,10 @@ var DynamoDBGlobalTableProvider = class {
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, 600, budget);
 			} catch (waitErr) {
-				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after protection flip: ${waitErr instanceof Error ? waitErr.message : String(waitErr)}`);
+				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after protection flip: ${describeAwsFailure(waitErr).detail}`);
 			}
 		} catch (flipError) {
-			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
 		}
 		let currentRegion;
 		try {
@@ -21583,7 +21668,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (isInterruptedWaitError(describeErr)) throw describeErr;
 			if (!(describeErr instanceof ResourceNotFoundException$1)) {
 				const cause = describeErr instanceof Error ? describeErr : void 0;
-				throw new ProvisioningError(`Failed to describe DynamoDB GlobalTable ${logicalId} before delete: ${describeErr instanceof Error ? describeErr.message : String(describeErr)}`, resourceType, logicalId, physicalId, cause);
+				throw new ProvisioningError(`Failed to describe DynamoDB GlobalTable ${logicalId} before delete: ${describeAwsFailure(describeErr).detail}`, resourceType, logicalId, physicalId, cause);
 			}
 		}
 		try {
@@ -21742,7 +21827,7 @@ var DynamoDBGlobalTableProvider = class {
 						this.logger.debug(`Cross-region replica ${regionLabel} returned RNF on ListTagsOfResource; omitting Tags`);
 						entry["Tags"] = [];
 					} else {
-						this.logger.warn(`Could not fetch tags for DynamoDB GlobalTable ${tableNameForSubs} in ${regionLabel}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}`);
+						this.logger.warn(`Could not fetch tags for DynamoDB GlobalTable ${tableNameForSubs} in ${regionLabel}: ${describeAwsFailure(tagErr).detail}`);
 						entry["Tags"] = [];
 					}
 				}
@@ -21809,7 +21894,7 @@ var DynamoDBGlobalTableProvider = class {
 				};
 				else if (ttlStatus === "DISABLED") {}
 			} catch (ttlErr) {
-				this.logger.debug(`Could not read TimeToLive for ${tableNameForSubs}: ${ttlErr instanceof Error ? ttlErr.message : String(ttlErr)}`);
+				this.logger.debug(`Could not read TimeToLive for ${tableNameForSubs}: ${describeAwsFailure(ttlErr).detail}`);
 			}
 			return result;
 		} catch (err) {
@@ -21843,13 +21928,13 @@ var DynamoDBGlobalTableProvider = class {
 			const ci = await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }));
 			if (ci.ContributorInsightsStatus) out["ContributorInsightsSpecification"] = { Enabled: ci.ContributorInsightsStatus === "ENABLED" };
 		} catch (err) {
-			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
 			const pitrStatus = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus;
 			if (pitrStatus) out["PointInTimeRecoverySpecification"] = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
 		} catch (err) {
-			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
 			const active = ((await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
@@ -21859,7 +21944,7 @@ var DynamoDBGlobalTableProvider = class {
 				out["KinesisStreamSpecification"] = ksOut;
 			}
 		} catch (err) {
-			this.logger.debug(`Could not read KinesisStreamingDestination for ${tableName} in ${regionLabel}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read KinesisStreamingDestination for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		return out;
 	}
@@ -21955,7 +22040,7 @@ var DynamoDBGlobalTableProvider = class {
 				TargetTrackingScalingPolicyConfiguration: tttConfig
 			};
 		} catch (err) {
-			this.logger.debug(`Could not read application-autoscaling settings for ${resourceId} (${scalableDimension}): ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read application-autoscaling settings for ${resourceId} (${scalableDimension}): ${describeAwsFailure(err).detail}`);
 			return null;
 		}
 	}
@@ -23979,7 +24064,7 @@ var LogsLogGroupProvider = class {
 						identifier: logGroupName
 					});
 					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
-					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. ${manualStep}`);
+					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw innerError;
 			}
@@ -24163,7 +24248,7 @@ var LogsLogGroupProvider = class {
 			}));
 			this.logger.debug(`Disabled DeletionProtectionEnabled on log group ${logicalId} before delete`);
 		} catch (flipError) {
-			this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+			this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
 		}
 		try {
 			await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName: physicalId }));
@@ -24456,7 +24541,7 @@ var CloudWatchAlarmProvider = class {
 			const compositeArn = response.CompositeAlarms?.[0]?.AlarmArn;
 			if (compositeArn) return compositeArn;
 		} catch (error) {
-			this.logger.debug(`Failed to describe alarm ${alarmName}, constructing ARN from config: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to describe alarm ${alarmName}, constructing ARN from config: ${describeAwsFailure(error).detail}`);
 		}
 		try {
 			const region = await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
@@ -24630,7 +24715,7 @@ var CloudWatchAlarmProvider = class {
 			const tagsResp = await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			this.logger.debug(`CloudWatch ListTagsForResource(${alarm.AlarmArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`CloudWatch ListTagsForResource(${alarm.AlarmArn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -25662,7 +25747,7 @@ var SSMParameterProvider = class {
 		try {
 			return await this.buildParameterArnUnguarded(name, mask);
 		} catch (error) {
-			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
+			this.logger.warn(mask(`Could not build the Arn attribute for SSM parameter ${name}: ${describeAwsFailure(error).detail}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`));
 			return;
 		}
 	}
@@ -25739,7 +25824,7 @@ var SSMParameterProvider = class {
 						maskSecrets: mask
 					});
 					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line, and a command naming the sanitized form would delete a DIFFERENT parameter.";
-					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. ${manualStep}`);
+					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw innerError;
 			}
@@ -26185,7 +26270,7 @@ var EventBridgeRuleProvider = class {
 					}));
 					this.logger.debug(`Cleaned up partially-created EventBridge rule ${logicalId} (${ruleName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created EventBridge rule ${logicalId} (${ruleName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws events list-targets-by-rule --rule ${ruleName}${eventBusName ? ` --event-bus-name ${eventBusName}` : ""} | jq -r '.Targets[].Id' | xargs aws events remove-targets --rule ${ruleName}${eventBusName ? ` --event-bus-name ${eventBusName}` : ""} --ids; aws events delete-rule --name ${ruleName}${eventBusName ? ` --event-bus-name ${eventBusName}` : ""}`);
+					this.logger.warn(`Failed to clean up partially-created EventBridge rule ${logicalId} (${ruleName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws events list-targets-by-rule --rule ${ruleName}${eventBusName ? ` --event-bus-name ${eventBusName}` : ""} | jq -r '.Targets[].Id' | xargs aws events remove-targets --rule ${ruleName}${eventBusName ? ` --event-bus-name ${eventBusName}` : ""} --ids; aws events delete-rule --name ${ruleName}${eventBusName ? ` --event-bus-name ${eventBusName}` : ""}`);
 				}
 				throw innerError;
 			}
@@ -26466,88 +26551,6 @@ var EventBridgeRuleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
-/**
-* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
-* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
-* shape `docs/provider-development.md` forbids under "Never store an
-* empty-string placeholder"):
-*
-*   an attribute cdkd could not read back is ABSENT from the map — never
-*   recorded as the empty string, and never as a present-but-`undefined` key.
-*
-* The consumers of `ResourceState.attributes` all key off exactly that
-* distinction, and a sentinel puts every one of them on the wrong branch:
-*
-*  - the deploy engine persists the map as-is, so `''` becomes the recorded
-*    value of a field AWS never assigned;
-*  - the intrinsic resolver serves a stored attribute whenever it is not
-*    `undefined`, so `''` shadows `constructAttribute` forever — the
-*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
-*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
-*    only on a MISS;
-*  - the Outputs export pass publishes whatever the resolver returned, so a
-*    stored `''` is exported to every `Fn::ImportValue` consumer.
-*
-* It exists as a MODULE rather than a per-provider idiom because the rule was
-* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
-* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
-* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
-* that DROPS the key is the one form a provider cannot spell wrong by habit.
-*
-* Two values are treated as "not read back":
-*
-*  - `undefined`: the SDK's spelling of an unassigned optional member.
-*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
-*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
-*    like `''` does.
-*
-* Every other value is kept verbatim — INCLUDING an empty string AWS itself
-* reported (`false`, `0`, an empty array and an object likewise). The helper
-* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
-* off the wire is a known value with a meaning the provider owns. The EC2
-* Instance provider is where that distinction is load-bearing: a `running`
-* instance with no public address is described with `PublicDnsName: ''` and
-* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
-* empty, recorded as such so a reference does not degrade to the instance id
-* on every resolution — while the same `''` on a `pending` instance means
-* "not yet", which that provider maps to `undefined` BEFORE calling this
-* helper (its `describedInstanceAttributes`). A caller that knows a `''`
-* means "unknown" is the one that must say so; this helper cannot tell.
-*
-* Deliberately NOT a general "compact this record" utility: it is scoped to
-* attribute maps. A property bag keeps its `undefined`-valued keys out by other
-* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
-* than setting it to `undefined`").
-*
-* A LEAF module (imports nothing) so every provider can take it without adding
-* an edge to the provider import ring.
-*/
-/**
-* Build an attribute map from read-back values, omitting every key whose value
-* is `undefined` or `null`.
-*/
-function definedAttributes(entries) {
-	const out = {};
-	for (const [key, value] of Object.entries(entries)) {
-		if (value === void 0 || value === null) continue;
-		out[key] = value;
-	}
-	return out;
-}
-/**
-* `String(value)` for a numeric read-back whose CloudFormation attribute is a
-* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
-* `definedAttributes` drops the key instead of recording the literal
-* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
-* `?? ''` is merely deleted.
-*/
-function stringifyIfAssigned(value) {
-	if (value === void 0 || value === null) return void 0;
-	return String(value);
-}
-
 //#endregion
 //#region src/provisioning/providers/eventbridge-bus-provider.ts
 /**
@@ -26701,7 +26704,7 @@ var EventBridgeBusProvider = class {
 				this.logger.debug(`EventBus ${physicalId} does not exist, skipping`);
 				return;
 			}
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("does not exist")) {
 				const clientRegion = await this.eventBridgeClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
@@ -26747,7 +26750,7 @@ var EventBridgeBusProvider = class {
 			}
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$2) return;
-			this.logger.debug(`Failed to list rules on bus ${busName}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to list rules on bus ${busName}: ${describeAwsFailure(error).detail}`);
 		}
 	}
 	/**
@@ -27558,7 +27561,7 @@ var EC2Provider = class {
 					await this.ec2Client.send(new DeleteVpcCommand({ VpcId: vpcId }));
 					this.logger.debug(`Cleaned up partially-created VPC ${logicalId} (${vpcId}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created VPC ${logicalId} (${vpcId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ec2 delete-vpc --vpc-id ${vpcId}`);
+					this.logger.warn(`Failed to clean up partially-created VPC ${logicalId} (${vpcId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws ec2 delete-vpc --vpc-id ${vpcId}`);
 				}
 				throw innerError;
 			}
@@ -27624,7 +27627,7 @@ var EC2Provider = class {
 				this.logger.debug(`VPC ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if ((msg.includes("DependencyViolation") || msg.includes("has dependencies")) && attempt < maxAttempts) {
 				this.logger.debug(`VPC ${physicalId} has dependencies (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`);
 				await new Promise((resolve) => setTimeout(resolve, attempt * 5e3));
@@ -27706,7 +27709,7 @@ var EC2Provider = class {
 					await this.ec2Client.send(new DeleteSubnetCommand({ SubnetId: subnetId }));
 					this.logger.debug(`Cleaned up partially-created Subnet ${logicalId} (${subnetId}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created Subnet ${logicalId} (${subnetId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ec2 delete-subnet --subnet-id ${subnetId}`);
+					this.logger.warn(`Failed to clean up partially-created Subnet ${logicalId} (${subnetId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws ec2 delete-subnet --subnet-id ${subnetId}`);
 				}
 				throw innerError;
 			}
@@ -27777,7 +27780,7 @@ var EC2Provider = class {
 			try {
 				if ((await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [subnetId] }))).Subnets?.[0]?.MapPublicIpOnLaunch === expected) return;
 			} catch (error) {
-				this.logger.debug(`MapPublicIpOnLaunch read-back for ${subnetId} failed (attempt ${attempt}/${maxAttempts}): ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.debug(`MapPublicIpOnLaunch read-back for ${subnetId} failed (attempt ${attempt}/${maxAttempts}): ${describeAwsFailure(error).detail}`);
 				return;
 			}
 			if (attempt < maxAttempts) await this.sleep(100 * 2 ** (attempt - 1));
@@ -27798,7 +27801,7 @@ var EC2Provider = class {
 				this.logger.debug(`Subnet ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if ((msg.includes("has dependencies") || msg.includes("DependencyViolation")) && attempt < maxAttempts) {
 				await this.cleanupSubnetLambdaEnis(physicalId);
 				this.logger.debug(`Subnet ${physicalId} has dependencies (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`);
@@ -27831,7 +27834,7 @@ var EC2Provider = class {
 				status: ni.Status ?? "unknown"
 			}));
 		} catch (err) {
-			this.logger.debug(`cleanupSubnetLambdaEnis: DescribeNetworkInterfaces failed for ${subnetId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`cleanupSubnetLambdaEnis: DescribeNetworkInterfaces failed for ${subnetId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 		if (enis.length === 0) return;
@@ -27840,7 +27843,7 @@ var EC2Provider = class {
 				await this.ec2Client.send(new DeleteNetworkInterfaceCommand({ NetworkInterfaceId: eni.id }));
 				this.logger.debug(`cleanupSubnetLambdaEnis: deleted Lambda ENI ${eni.id} in subnet ${subnetId}`);
 			} catch (err) {
-				this.logger.debug(`cleanupSubnetLambdaEnis: ENI ${eni.id} (status=${eni.status}) not yet deletable: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`cleanupSubnetLambdaEnis: ENI ${eni.id} (status=${eni.status}) not yet deletable: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 	}
@@ -28148,7 +28151,7 @@ var EC2Provider = class {
 				maxDelay: 10
 			}, { NatGatewayIds: [physicalId] });
 		} catch (error) {
-			this.logger.warn(`Wait for NatGateway ${physicalId} deletion did not complete cleanly: ${error instanceof Error ? error.message : String(error)} — proceeding with downstream delete steps`);
+			this.logger.warn(`Wait for NatGateway ${physicalId} deletion did not complete cleanly: ${describeAwsFailure(error).detail} — proceeding with downstream delete steps`);
 		}
 		this.logger.debug(`Successfully deleted NatGateway ${logicalId}`);
 	}
@@ -28358,7 +28361,7 @@ var EC2Provider = class {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
 					this.logger.debug(`Cleaned up partially-created SecurityGroup ${logicalId} (${groupId}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created SecurityGroup ${logicalId} (${groupId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ec2 delete-security-group --group-id ${groupId}`);
+					this.logger.warn(`Failed to clean up partially-created SecurityGroup ${logicalId} (${groupId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws ec2 delete-security-group --group-id ${groupId}`);
 				}
 				throw innerError;
 			}
@@ -28482,7 +28485,7 @@ var EC2Provider = class {
 				this.logger.debug(`SecurityGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("dependent object") && attempt < maxAttempts) {
 				await this.cleanupSecurityGroupLambdaEnis(physicalId);
 				this.logger.debug(`SecurityGroup ${physicalId} has dependent objects (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`);
@@ -28512,7 +28515,7 @@ var EC2Provider = class {
 				status: ni.Status ?? "unknown"
 			}));
 		} catch (err) {
-			this.logger.debug(`cleanupSecurityGroupLambdaEnis: DescribeNetworkInterfaces failed for ${groupId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`cleanupSecurityGroupLambdaEnis: DescribeNetworkInterfaces failed for ${groupId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 		if (enis.length === 0) return;
@@ -28521,7 +28524,7 @@ var EC2Provider = class {
 				await this.ec2Client.send(new DeleteNetworkInterfaceCommand({ NetworkInterfaceId: eni.id }));
 				this.logger.debug(`cleanupSecurityGroupLambdaEnis: deleted Lambda ENI ${eni.id} for SG ${groupId}`);
 			} catch (err) {
-				this.logger.debug(`cleanupSecurityGroupLambdaEnis: ENI ${eni.id} (status=${eni.status}) not yet deletable: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`cleanupSecurityGroupLambdaEnis: ENI ${eni.id} (status=${eni.status}) not yet deletable: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 	}
@@ -28583,7 +28586,7 @@ var EC2Provider = class {
 				}
 				continue;
 			}
-			this.logger.debug(`DescribeSecurityGroups for SecurityGroup ${groupId} failed (${errorClass}); omitting the VpcId attribute: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`DescribeSecurityGroups for SecurityGroup ${groupId} failed (${errorClass}); omitting the VpcId attribute: ${describeAwsFailure(error).detail}`);
 			return;
 		}
 	}
@@ -28720,7 +28723,7 @@ var EC2Provider = class {
 			}
 			return ids[0];
 		} catch (error) {
-			this.logger.debug(`SecurityGroupIngress ${logicalId}: could not look up the existing rule id on ${groupId} (${error instanceof Error ? error.message : String(error)}) — not recording an Id attribute`);
+			this.logger.debug(`SecurityGroupIngress ${logicalId}: could not look up the existing rule id on ${groupId} (${describeAwsFailure(error).detail}) — not recording an Id attribute`);
 			return;
 		}
 	}
@@ -28843,7 +28846,7 @@ var EC2Provider = class {
 					runInstancesToken.release();
 					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to terminate partially-created EC2 Instance ${logicalId} (${instanceId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. THE INSTANCE IS STILL RUNNING AND BILLING. Manual termination required: aws ec2 terminate-instances --instance-ids ${instanceId}`);
+					this.logger.warn(`Failed to terminate partially-created EC2 Instance ${logicalId} (${instanceId}): ${describeAwsFailure(cleanupError).detail}. THE INSTANCE IS STILL RUNNING AND BILLING. Manual termination required: aws ec2 terminate-instances --instance-ids ${instanceId}`);
 				}
 				throw innerError;
 			}
@@ -28934,7 +28937,7 @@ var EC2Provider = class {
 			associated = true;
 			break;
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("IncorrectState") || msg.includes("already associated")) {
 				this.logger.debug(`IAM instance profile already associated with instance ${instanceId} (${logicalId})`);
 				associated = true;
@@ -28975,7 +28978,7 @@ var EC2Provider = class {
 				Values: [instanceId]
 			}] }))).IamInstanceProfileAssociations?.some((a) => a.State === "associated") ?? false;
 		} catch (err) {
-			this.logger.debug(`DescribeIamInstanceProfileAssociations failed for ${instanceId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`DescribeIamInstanceProfileAssociations failed for ${instanceId}: ${describeAwsFailure(err).detail}`);
 			return false;
 		}
 	}
@@ -29078,7 +29081,7 @@ var EC2Provider = class {
 				this.logger.debug(`EC2 Instance ${physicalId} already terminated (not found), treating as success`);
 				return;
 			}
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (removeProtection && isTerminationProtectionPropagationError(msg) && attempt < maxTerminateAttempts) {
 				this.logger.debug(`Terminate of EC2 Instance ${logicalId} raced the DisableApiTermination flip-off (attempt ${attempt}/${maxTerminateAttempts}); re-flipping and retrying`);
 				await disableInstanceApiTermination(this.ec2Client, physicalId, this.logger);
@@ -29525,7 +29528,7 @@ var EC2Provider = class {
 			}));
 			this.logger.debug(`Applied ${tags.length} tag(s) to ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to apply tags to ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to apply tags to ${logicalId}: ${describeAwsFailure(error).detail}`);
 		}
 	}
 	/**
@@ -29556,7 +29559,7 @@ var EC2Provider = class {
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ${resourceId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to remove tags from ${resourceId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to remove tags from ${resourceId}: ${describeAwsFailure(error).detail}`);
 		}
 		if (tagsToAdd.length > 0) try {
 			await this.ec2Client.send(new CreateTagsCommand({
@@ -29565,7 +29568,7 @@ var EC2Provider = class {
 			}));
 			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ${resourceId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to add tags on ${resourceId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to add tags on ${resourceId}: ${describeAwsFailure(error).detail}`);
 		}
 	}
 	/**
@@ -29622,7 +29625,7 @@ var EC2Provider = class {
 			if (elapsed >= totalBudgetMs) throw error;
 			attempt += 1;
 			const sleepMs = Math.min(delay, totalBudgetMs - elapsed);
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			this.logger.debug(`${opts.description}: dependency still mapped (attempt ${attempt}, retrying in ${sleepMs}ms): ${message}`);
 			await this.sleep(sleepMs);
 			delay = Math.min(delay * 2, maxDelayMs);
@@ -30003,7 +30006,7 @@ var EC2Provider = class {
 			}] }))).IamInstanceProfileAssociations?.find((a) => a.State === "associated" || a.State === "associating");
 			if (live?.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = live.IamInstanceProfile.Arn;
 		} catch (error) {
-			this.logger.warn(`Could not backfill IamInstanceProfile for ${physicalId} during the --no-wait capture (${error instanceof Error ? error.message : String(error)}); the field is omitted from the observed snapshot`);
+			this.logger.warn(`Could not backfill IamInstanceProfile for ${physicalId} during the --no-wait capture (${describeAwsFailure(error).detail}); the field is omitted from the observed snapshot`);
 		}
 		const volumeIds = (instance.BlockDeviceMappings ?? []).filter((m) => m.Ebs?.VolumeId !== void 0).map((m) => m.Ebs.VolumeId);
 		let volumesById = /* @__PURE__ */ new Map();
@@ -30011,7 +30014,7 @@ var EC2Provider = class {
 			const volResp = await this.ec2Client.send(new DescribeVolumesCommand({ VolumeIds: volumeIds }));
 			for (const v of volResp.Volumes ?? []) if (v.VolumeId !== void 0) volumesById.set(v.VolumeId, v);
 		} catch (err) {
-			this.logger.debug(`DescribeVolumes(${volumeIds.join(",")}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`DescribeVolumes(${volumeIds.join(",")}) failed: ${describeAwsFailure(err).detail}`);
 			volumesById = /* @__PURE__ */ new Map();
 		}
 		const blockMappings = [];
@@ -30044,13 +30047,13 @@ var EC2Provider = class {
 			}));
 			if (attrResp.DisableApiTermination?.Value !== void 0) result["DisableApiTermination"] = attrResp.DisableApiTermination.Value;
 		} catch (err) {
-			this.logger.debug(`DescribeInstanceAttribute(disableApiTermination, ${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`DescribeInstanceAttribute(disableApiTermination, ${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		try {
 			const cpuCredits = (await this.ec2Client.send(new DescribeInstanceCreditSpecificationsCommand({ InstanceIds: [physicalId] }))).InstanceCreditSpecifications?.[0]?.CpuCredits;
 			if (cpuCredits !== void 0) result["CreditSpecification"] = { CPUCredits: cpuCredits };
 		} catch (err) {
-			this.logger.debug(`DescribeInstanceCreditSpecifications(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`DescribeInstanceCreditSpecifications(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -30818,7 +30821,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			await this.apiGatewayClient.send(new UpdateAccountCommand({ patchOperations }));
 			return;
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			if ((message.toLowerCase().includes("not authorized") || message.toLowerCase().includes("does not have required permissions") || message.toLowerCase().includes("the role arn does not have required trust") || message.toLowerCase().includes("too many requests")) && attempt < ApiGatewayProvider.MAX_IAM_RETRIES) {
 				this.logger.warn(`IAM propagation delay for ${logicalId} (attempt ${attempt}/${ApiGatewayProvider.MAX_IAM_RETRIES}), retrying in ${ApiGatewayProvider.IAM_RETRY_DELAY_MS / 1e3}s...`);
 				await this.sleep(ApiGatewayProvider.IAM_RETRY_DELAY_MS);
@@ -31029,8 +31032,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			try {
 				await this.deleteResource(logicalId, physicalId, resourceType, previousProperties);
 			} catch (error) {
-				orphanReason = `old API Gateway Resource ${physicalId} could not be deleted: ${String(error)}`;
-				this.logger.warn(`Failed to delete old API Gateway Resource ${physicalId} during replacement: ${String(error)}. The old resource may be orphaned and require manual cleanup.`);
+				orphanReason = `old API Gateway Resource ${physicalId} could not be deleted: ${safeStringify(error)}`;
+				this.logger.warn(`Failed to delete old API Gateway Resource ${physicalId} during replacement: ${safeStringify(error)}. The old resource may be orphaned and require manual cleanup.`);
 			}
 			const base = {
 				physicalId: createResult.physicalId,
@@ -31205,7 +31208,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						stageName
 					}));
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up stage ${stageName} after a post-create patch failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+					this.logger.warn(`Failed to clean up stage ${stageName} after a post-create patch failure: ${describeAwsFailure(cleanupError).detail}`);
 				}
 				throw patchError;
 			}
@@ -31552,7 +31555,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 					}));
 					this.logger.debug(`Cleaned up partially-created API Gateway Method ${logicalId} (${restApiId}/${resourceId}/${httpMethod}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created API Gateway Method ${logicalId} (${restApiId}/${resourceId}/${httpMethod}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws apigateway delete-method --rest-api-id ${restApiId} --resource-id ${resourceId} --http-method ${httpMethod}`);
+					this.logger.warn(`Failed to clean up partially-created API Gateway Method ${logicalId} (${restApiId}/${resourceId}/${httpMethod}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws apigateway delete-method --rest-api-id ${restApiId} --resource-id ${resourceId} --http-method ${httpMethod}`);
 				}
 				throw innerError;
 			}
@@ -34564,7 +34567,7 @@ var CloudFrontDistributionProvider = class {
 				if (cfnTags.length > 0) result["Tags"] = cfnTags;
 			}
 		} catch (error) {
-			this.logger.debug(`Tag read for CloudFront Distribution ${physicalId} failed during drift read: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Tag read for CloudFront Distribution ${physicalId} failed during drift read: ${describeAwsFailure(error).detail}`);
 		}
 		return result;
 	}
@@ -34674,7 +34677,7 @@ var CloudFrontDistributionProvider = class {
 					response = await this.cloudFrontClient.send(new GetDistributionCommand({ Id: distributionId }));
 				} catch (error) {
 					if (error instanceof NoSuchDistribution) throw error;
-					this.logger.debug(`Distribution ${distributionId} status read failed (${error instanceof Error ? error.message : String(error)}); retrying`);
+					this.logger.debug(`Distribution ${distributionId} status read failed (${describeAwsFailure(error).detail}); retrying`);
 				}
 				if (response) {
 					const status = response.Distribution?.Status;
@@ -35567,7 +35570,7 @@ var AgentCoreRuntimeProvider = class {
 				attributes: this.buildAttributes(resp, resp.agentRuntimeName)
 			};
 		} catch (err) {
-			this.logger.debug(`Could not enrich imported BedrockAgentCore Runtime ${physicalId} attributes (${err instanceof Error ? err.message : String(err)}); recording AgentRuntimeId only (Fn::GetAtt resolves live via getAttribute)`);
+			this.logger.debug(`Could not enrich imported BedrockAgentCore Runtime ${physicalId} attributes (${describeAwsFailure(err).detail}); recording AgentRuntimeId only (Fn::GetAtt resolves live via getAttribute)`);
 			return {
 				physicalId,
 				attributes: { AgentRuntimeId: physicalId }
@@ -36041,7 +36044,7 @@ var AgentCoreEvaluatorProvider = class {
 		try {
 			result["Tags"] = tagMapToCfnList((await this.client.send(new ListTagsForResourceCommand$6({ resourceArn: physicalId }))).tags ?? {});
 		} catch (err) {
-			this.logger.debug(`Failed to read tags for evaluator ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Failed to read tags for evaluator ${physicalId}: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -36983,7 +36986,7 @@ var ECSProvider = class {
 					}));
 					this.logger.warn(`Deleted partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed, so the next deploy's CreateService does not collide on the name. Its stopped tasks remain inspectable for about an hour: aws ecs list-tasks${clusterArg} --desired-status STOPPED`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created ECS service ${logicalId} (${service.serviceArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ecs delete-service${clusterArg} --service ${service.serviceArn} --force`);
+					this.logger.warn(`Failed to clean up partially-created ECS service ${logicalId} (${service.serviceArn}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: aws ecs delete-service${clusterArg} --service ${service.serviceArn} --force`);
 				}
 				throw new Error(`ECS service ${logicalId} did not reach steady state under --full-wait: ${waitError instanceof Error ? waitError.message : String(waitError)}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): aws ecs list-tasks${clusterArg} --desired-status STOPPED, then aws ecs describe-tasks${clusterArg} --tasks <task-arn> --query 'tasks[].[stoppedReason,containers[].reason]'`, { cause: waitError });
 			}
@@ -38863,7 +38866,7 @@ var ELBv2Provider = class {
 			try {
 				zones = (await this.getClient().send(new DescribeCapacityReservationCommand({ LoadBalancerArn: lbArn }))).CapacityReservationState ?? [];
 			} catch (probeError) {
-				this.logger.debug(`DescribeCapacityReservation for ${logicalId} failed transiently (attempt ${attempt + 1}/${maxAttempts}): ${probeError instanceof Error ? probeError.message : String(probeError)}`);
+				this.logger.debug(`DescribeCapacityReservation for ${logicalId} failed transiently (attempt ${attempt + 1}/${maxAttempts}): ${describeAwsFailure(probeError).detail}`);
 				await capacityReservationDelays.sleep(intervalMs);
 				continue;
 			}
@@ -38889,7 +38892,7 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Disabled deletion_protection.enabled on LoadBalancer ${logicalId} before delete`);
 		} catch (flipError) {
-			if (!this.isNotFoundError(flipError)) this.logger.debug(`Could not disable deletion_protection.enabled on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+			if (!this.isNotFoundError(flipError)) this.logger.debug(`Could not disable deletion_protection.enabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
 		}
 		try {
 			await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: physicalId }));
@@ -39593,7 +39596,7 @@ var ELBv2Provider = class {
 			}
 			result["Targets"] = targets;
 		} catch (err) {
-			this.logger.debug(`ELBv2 DescribeTargetHealth(${targetGroupArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`ELBv2 DescribeTargetHealth(${targetGroupArn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	/**
@@ -39681,7 +39684,7 @@ var ELBv2Provider = class {
 			const tagDesc = (await this.getClient().send(new DescribeTagsCommand({ ResourceArns: [arn] }))).TagDescriptions?.[0];
 			result["Tags"] = normalizeAwsTagsToCfn(tagDesc?.Tags);
 		} catch (err) {
-			this.logger.debug(`ELBv2 DescribeTags(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`ELBv2 DescribeTags(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	/**
@@ -39983,7 +39986,7 @@ var RDSProvider = class {
 							ApplyImmediately: true
 						}));
 					} catch (disableError) {
-						this.logger.debug(`Could not disable DeletionProtection on partially-created DBCluster ${dbClusterIdentifier}: ${disableError instanceof Error ? disableError.message : String(disableError)} (proceeding with DeleteDBCluster anyway)`);
+						this.logger.debug(`Could not disable DeletionProtection on partially-created DBCluster ${dbClusterIdentifier}: ${describeAwsFailure(disableError).detail} (proceeding with DeleteDBCluster anyway)`);
 					}
 					await this.getClient().send(new DeleteDBClusterCommand({
 						DBClusterIdentifier: dbClusterIdentifier,
@@ -39991,7 +39994,7 @@ var RDSProvider = class {
 					}));
 					this.logger.debug(`Delete requested for partially-created DBCluster ${logicalId} (${dbClusterIdentifier}) after wiring failure (not waiting for deleted state)`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to delete partially-created DBCluster ${logicalId} (${dbClusterIdentifier}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. THE CLUSTER IS STILL RUNNING AND BILLING. Manual cleanup required: ${wantsDeletionProtection ? `aws rds modify-db-cluster --db-cluster-identifier ${dbClusterIdentifier} --no-deletion-protection --apply-immediately; ` : ""}aws rds delete-db-cluster --db-cluster-identifier ${dbClusterIdentifier} --skip-final-snapshot`);
+					this.logger.warn(`Failed to delete partially-created DBCluster ${logicalId} (${dbClusterIdentifier}): ${describeAwsFailure(cleanupError).detail}. THE CLUSTER IS STILL RUNNING AND BILLING. Manual cleanup required: ${wantsDeletionProtection ? `aws rds modify-db-cluster --db-cluster-identifier ${dbClusterIdentifier} --no-deletion-protection --apply-immediately; ` : ""}aws rds delete-db-cluster --db-cluster-identifier ${dbClusterIdentifier} --skip-final-snapshot`);
 				}
 				throw innerError;
 			}
@@ -40058,7 +40061,7 @@ var RDSProvider = class {
 				}));
 				this.logger.debug(`Disabled DeletionProtection on DBCluster ${logicalId} before delete`);
 			} catch (disableError) {
-				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
+				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${describeAwsFailure(disableError).detail}`);
 			}
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand({
@@ -40186,7 +40189,7 @@ var RDSProvider = class {
 				}));
 				this.logger.debug(`Disabled DeletionProtection on DBInstance ${logicalId} before delete`);
 			} catch (disableError) {
-				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
+				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${describeAwsFailure(disableError).detail}`);
 			}
 			const finalSnapshotId = properties?.["DBClusterIdentifier"] === void 0 ? context?.finalSnapshotIdentifier : void 0;
 			await this.getClient().send(new DeleteDBInstanceCommand({
@@ -40476,7 +40479,7 @@ var RDSProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
-			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	async importDBInstance(input) {
@@ -40776,7 +40779,7 @@ var RDSDBProxyProvider = class {
 			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagResp.TagList ?? []);
 		} catch (error) {
-			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${describeAwsFailure(error).detail}`);
 			result["Tags"] = [];
 		}
 		else result["Tags"] = [];
@@ -40793,7 +40796,7 @@ var RDSDBProxyProvider = class {
 			arn = (await client.send(new DescribeDBProxiesCommand({ DBProxyName: physicalId }))).DBProxies?.[0]?.DBProxyArn;
 			if (arn) this.attributeCache.set(arnCacheKey, arn);
 		} catch (error) {
-			this.logger.debug(`Skipping tag diff for ${physicalId} (no ARN): ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Skipping tag diff for ${physicalId} (no ARN): ${describeAwsFailure(error).detail}`);
 			return;
 		}
 		if (!arn) return;
@@ -41087,7 +41090,7 @@ var RDSDBProxyEndpointProvider = class {
 			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagResp.TagList ?? []);
 		} catch (error) {
-			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${describeAwsFailure(error).detail}`);
 			result["Tags"] = [];
 		}
 		else result["Tags"] = [];
@@ -41104,7 +41107,7 @@ var RDSDBProxyEndpointProvider = class {
 			arn = (await client.send(new DescribeDBProxyEndpointsCommand({ DBProxyEndpointName: physicalId }))).DBProxyEndpoints?.[0]?.DBProxyEndpointArn;
 			if (arn) this.attributeCache.set(arnCacheKey, arn);
 		} catch (error) {
-			this.logger.debug(`Skipping tag diff for ${physicalId} (no ARN): ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Skipping tag diff for ${physicalId} (no ARN): ${describeAwsFailure(error).detail}`);
 			return;
 		}
 		if (!arn) return;
@@ -41730,7 +41733,7 @@ var DocDBProvider = class {
 				}));
 				this.logger.debug(`Disabled DeletionProtection on DocDB DBCluster ${logicalId} before delete`);
 			} catch (disableError) {
-				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
+				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${describeAwsFailure(disableError).detail}`);
 			}
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand$1({
@@ -42069,7 +42072,7 @@ var DocDBProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
-			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	async importDBInstance(input) {
@@ -42367,7 +42370,7 @@ var NeptuneProvider = class {
 				}));
 				this.logger.debug(`Disabled DeletionProtection on Neptune DBCluster ${logicalId} before delete`);
 			} catch (disableError) {
-				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
+				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${describeAwsFailure(disableError).detail}`);
 			}
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			await this.getClient().send(new DeleteDBClusterCommand$2({
@@ -42467,7 +42470,7 @@ var NeptuneProvider = class {
 				}));
 				this.logger.debug(`Disabled DeletionProtection on Neptune DBInstance ${logicalId} before delete`);
 			} catch (disableError) {
-				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${disableError instanceof Error ? disableError.message : String(disableError)}`);
+				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(`Could not disable deletion protection for ${physicalId}: ${describeAwsFailure(disableError).detail}`);
 			}
 			await this.getClient().send(new DeleteDBInstanceCommand$2({
 				DBInstanceIdentifier: physicalId,
@@ -42712,7 +42715,7 @@ var NeptuneProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
-			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	async importDBInstance(input) {
@@ -43038,7 +43041,7 @@ var Route53Provider = class {
 					await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
 					callerReferenceToken.release();
 				} catch (deleteError) {
-					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)} — operator may need to clean up the orphan zone`);
+					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${describeAwsFailure(deleteError).detail} — operator may need to clean up the orphan zone`);
 				}
 				const cause = uhfError instanceof Error ? uhfError : void 0;
 				throw new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${uhfError instanceof Error ? uhfError.message : String(uhfError)}`, resourceType, logicalId, zoneId, cause);
@@ -43568,7 +43571,7 @@ var Route53Provider = class {
 			}));
 			this.logger.debug(`Applied ${tags.length} tag(s) and removed ${removeTagKeys.length} tag(s) on hosted zone ${logicalId}`);
 		} catch (error) {
-			const detail = error instanceof Error ? error.message : String(error);
+			const detail = describeAwsFailure(error).detail;
 			if (removeTagKeys.length > 0) throw new ProvisioningError(`Failed to remove tag(s) ${removeTagKeys.join(", ")} from hosted zone ${logicalId}: ${detail}. The removal will NOT be retried on the next deploy (state no longer records the tag), so it is reported instead of ignored.`, "AWS::Route53::HostedZone", logicalId, zoneId, error instanceof Error ? error : void 0);
 			this.logger.warn(`Failed to apply tags to hosted zone ${logicalId}: ${detail}`);
 		}
@@ -43631,7 +43634,7 @@ var Route53Provider = class {
 				this.logger.debug(`Query logging config already exists for hosted zone ${logicalId}`);
 				return;
 			}
-			this.logger.warn(`Failed to apply query logging config to hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to apply query logging config to hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`);
 		}
 	}
 	/**
@@ -43676,7 +43679,7 @@ var Route53Provider = class {
 			}
 		} catch (error) {
 			if (error instanceof Error && (error.name === "NoSuchHostedZone" || error.name === "NoSuchQueryLoggingConfig")) return;
-			this.logger.warn(`Failed to delete query logging config for hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to delete query logging config for hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`);
 		}
 	}
 	/**
@@ -43718,7 +43721,7 @@ var Route53Provider = class {
 				}));
 			}
 		} catch (error) {
-			this.logger.warn(`Failed to sync VPC associations for hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.warn(`Failed to sync VPC associations for hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`);
 		}
 	}
 	/**
@@ -43768,7 +43771,7 @@ var Route53Provider = class {
 				const sawLaterName = zones.some((z) => normalizeRecordName(z.Name ?? "") !== normalizedName);
 				absenceIsSound = !hostedZoneName.includes("\\") && (narrowing ? sawLaterName || response.IsTruncated !== true : zones.length > 0 || response.IsTruncated !== true);
 			} catch (error) {
-				lookupErrorMessage = error instanceof Error ? error.message : String(error);
+				lookupErrorMessage = describeAwsFailure(error).detail;
 				lookupErrorCause = error instanceof Error ? error : void 0;
 				this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${lookupErrorMessage}`);
 			}
@@ -43811,7 +43814,7 @@ var Route53Provider = class {
 				type
 			};
 		} catch (err) {
-			this.logger.debug(`Cannot resolve record-set identity for '${physicalId}': ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Cannot resolve record-set identity for '${physicalId}': ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
@@ -43878,14 +43881,14 @@ var Route53Provider = class {
 			}));
 			result["HostedZoneTags"] = normalizeAwsTagsToCfn(tagsResp.ResourceTagSet?.Tags);
 		} catch (err) {
-			this.logger.debug(`Route53 ListTagsForResource(${idTail}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Route53 ListTagsForResource(${idTail}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		try {
 			const qlc = (await this.getClient().send(new ListQueryLoggingConfigsCommand({ HostedZoneId: idTail }))).QueryLoggingConfigs?.[0];
 			if (qlc?.CloudWatchLogsLogGroupArn) result["QueryLoggingConfig"] = { CloudWatchLogsLogGroupArn: qlc.CloudWatchLogsLogGroupArn };
 			else result["QueryLoggingConfig"] = {};
 		} catch (err) {
-			this.logger.debug(`Route53 ListQueryLoggingConfigs(${idTail}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Route53 ListQueryLoggingConfigs(${idTail}) failed: ${describeAwsFailure(err).detail}`);
 			result["QueryLoggingConfig"] = {};
 		}
 		return result;
@@ -44101,7 +44104,7 @@ var Route53Provider = class {
 		try {
 			observed = await this.readRecordSet(compositeId);
 		} catch (err) {
-			return adoptVerbatim(`verification failed: ${err instanceof Error ? err.message : String(err)}`);
+			return adoptVerbatim(`verification failed: ${describeAwsFailure(err).detail}`);
 		}
 		if (!observed) return adoptVerbatim("the record was not found under the resolved hosted zone");
 		return {
@@ -44157,7 +44160,7 @@ var Route53Provider = class {
 			};
 		} catch (error) {
 			if (error instanceof Error && error.name === "NoSuchHostedZone") return null;
-			this.logger.warn(`Imported hosted zone ${zoneId} but could not read its NameServers: ${error instanceof Error ? error.message : String(error)}. The zone is adopted without them (any attributes already in state for this zone are kept). Re-run \`cdkd import --resource ${logicalId}=${zoneId} --force\` once the permission is granted, or make a template change that forces an UPDATE — a plain \`cdkd deploy\` does NOT heal the record, because an unchanged zone is NO_CHANGE and never calls update().`);
+			this.logger.warn(`Imported hosted zone ${zoneId} but could not read its NameServers: ${describeAwsFailure(error).detail}. The zone is adopted without them (any attributes already in state for this zone are kept). Re-run \`cdkd import --resource ${logicalId}=${zoneId} --force\` once the permission is granted, or make a template change that forces an UPDATE — a plain \`cdkd deploy\` does NOT heal the record, because an unchanged zone is NO_CHANGE and never calls update().`);
 			return {};
 		}
 	}
@@ -45132,7 +45135,7 @@ var CognitoUserPoolProvider = class {
 				await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: createdUserPoolId }));
 				this.logger.debug(`Rolled back partially-created Cognito User Pool ${createdUserPoolId}`);
 			} catch (rollbackError) {
-				this.logger.warn(`Failed to roll back partially-created Cognito User Pool ${createdUserPoolId}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+				this.logger.warn(`Failed to roll back partially-created Cognito User Pool ${createdUserPoolId}: ${describeAwsFailure(rollbackError).detail}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
@@ -45283,7 +45286,7 @@ var CognitoUserPoolProvider = class {
 				failed: false
 			} : { failed: false };
 		} catch (error) {
-			this.logger.debug(`GetUserPoolMfaConfig failed for UserPool ${physicalId} (${error instanceof Error ? error.name : typeof error}): ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`GetUserPoolMfaConfig failed for UserPool ${physicalId} (${error instanceof Error ? error.name : typeof error}): ${describeAwsFailure(error).detail}`);
 			return { failed: true };
 		}
 	}
@@ -45301,7 +45304,7 @@ var CognitoUserPoolProvider = class {
 		for (let attempt = 1;; attempt++) try {
 			return await fn();
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (!((error instanceof Error ? error.name : "") === "ConcurrentModificationException" || /concurrent modification|please retry|try again|in progress/i.test(msg)) || attempt >= maxAttempts) throw error;
 			const delayMs = Math.min(1e3 * 2 ** (attempt - 1), 4e3);
 			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
@@ -45559,7 +45562,7 @@ var CognitoUserPoolProvider = class {
 							DeletionProtection: "INACTIVE"
 						}));
 					} catch (flipError) {
-						this.logger.debug(`Could not disable DeletionProtection for ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+						this.logger.debug(`Could not disable DeletionProtection for ${physicalId}: ${describeAwsFailure(flipError).detail}`);
 					}
 				}
 			}
@@ -45646,7 +45649,7 @@ var CognitoUserPoolProvider = class {
 			result["WebAuthnRelyingPartyID"] = mfa.WebAuthnConfiguration?.RelyingPartyId ?? "";
 			result["WebAuthnUserVerification"] = mfa.WebAuthnConfiguration?.UserVerification ?? "";
 		} catch (mfaErr) {
-			this.logger.debug(`GetUserPoolMfaConfig failed for ${physicalId}, skipping MFA-derived drift keys: ${mfaErr instanceof Error ? mfaErr.message : String(mfaErr)}`);
+			this.logger.debug(`GetUserPoolMfaConfig failed for ${physicalId}, skipping MFA-derived drift keys: ${describeAwsFailure(mfaErr).detail}`);
 		}
 		return result;
 	}
@@ -46159,7 +46162,7 @@ var ElastiCacheProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$7({ ResourceName: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
-			this.logger.debug(`ElastiCache ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`ElastiCache ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	/**
@@ -46598,7 +46601,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				arn = nsResp.Namespace?.Arn;
 				hostedZoneId = nsResp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
 			} catch (err) {
-				this.logger.debug(`GetNamespace(${namespaceId}) after create failed: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.debug(`GetNamespace(${namespaceId}) after create failed: ${describeAwsFailure(err).detail}`);
 			}
 			if (!arn) arn = await this.buildNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created public DNS namespace ${logicalId}: ${namespaceId}`);
@@ -46874,7 +46877,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: namespaceId }));
 			if (resp.Namespace?.Arn) return resp.Namespace.Arn;
 		} catch (err) {
-			this.logger.debug(`GetNamespace(${namespaceId}) failed while resolving ARN: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`GetNamespace(${namespaceId}) failed while resolving ARN: ${describeAwsFailure(err).detail}`);
 		}
 		return this.buildNamespaceArn(namespaceId);
 	}
@@ -47098,7 +47101,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		try {
 			result["ServiceAttributes"] = (await this.getClient().send(new GetServiceAttributesCommand({ ServiceId: physicalId }))).ServiceAttributes?.Attributes ?? {};
 		} catch (err) {
-			this.logger.debug(`ServiceDiscovery GetServiceAttributes(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`ServiceDiscovery GetServiceAttributes(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		if (svc.Arn) await this.attachTags(result, svc.Arn);
 		return result;
@@ -47126,7 +47129,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	async import(input) {
@@ -47396,7 +47399,7 @@ var AppSyncProvider = class {
 		try {
 			return await this.buildAppSyncArn(suffix);
 		} catch (error) {
-			this.logger.warn(`Created ${logicalId} (${physicalId}) but could not build its ARN attribute: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id until the next update.`);
+			this.logger.warn(`Created ${logicalId} (${physicalId}) but could not build its ARN attribute: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id until the next update.`);
 			return;
 		}
 	}
@@ -47437,7 +47440,7 @@ var AppSyncProvider = class {
 				return await this.buildAppSyncArn(suffix, regionOverride);
 			} catch (error) {
 				if (!omitArnOnFailure) throw error;
-				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
 				return;
 			}
 		};
@@ -47480,7 +47483,7 @@ var AppSyncProvider = class {
 		try {
 			attributes = await this.childRefAttributes(resourceType, physicalId);
 		} catch (error) {
-			this.logger.warn(`Updated ${resourceType} (${physicalId}) but could not rebuild its ARN attribute: ${error instanceof Error ? error.message : String(error)}. The previously recorded attributes are kept.`);
+			this.logger.warn(`Updated ${resourceType} (${physicalId}) but could not rebuild its ARN attribute: ${describeAwsFailure(error).detail}. The previously recorded attributes are kept.`);
 		}
 		return {
 			physicalId,
@@ -47525,7 +47528,7 @@ var AppSyncProvider = class {
 		try {
 			return await this.childRefAttributes(resourceType, physicalId, region, true) ?? {};
 		} catch (error) {
-			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
 			return {};
 		}
 	}
@@ -47992,7 +47995,7 @@ var AppSyncProvider = class {
 		try {
 			entries = requireConfigArray(value, "AWS::AppSync::GraphQLApi AdditionalAuthenticationProviders");
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			if (options?.onUnusable) {
 				options.onUnusable(message);
 				return;
@@ -48087,7 +48090,7 @@ var AppSyncProvider = class {
 			desired = this.asObject(properties["EnvironmentVariables"], "EnvironmentVariables", { logicalId });
 		} catch (error) {
 			if (!isUpdate && !replayingState) throw error;
-			this.logger.warn(`AppSync GraphqlApi ${logicalId}: ${error instanceof Error ? error.message : String(error)} — leaving the live environment variables untouched`);
+			this.logger.warn(`AppSync GraphqlApi ${logicalId}: ${describeAwsFailure(error).detail} — leaving the live environment variables untouched`);
 			return;
 		}
 		let previous;
@@ -48396,7 +48399,7 @@ var AppSyncProvider = class {
 				await this.getClient().send(new DeleteGraphqlApiCommand({ apiId: createdApiId }));
 				this.logger.debug(`Rolled back partially-created GraphQL API ${createdApiId}`);
 			} catch (rollbackError) {
-				this.logger.warn(`Failed to roll back partially-created GraphQL API ${createdApiId}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+				this.logger.warn(`Failed to roll back partially-created GraphQL API ${createdApiId}: ${describeAwsFailure(rollbackError).detail}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
@@ -48703,7 +48706,7 @@ var AppSyncProvider = class {
 		try {
 			return print(parse$1(sdl));
 		} catch (err) {
-			this.logger.debug(`Failed to parse ${source} SDL via graphql-js (falling back to raw): ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Failed to parse ${source} SDL via graphql-js (falling back to raw): ${describeAwsFailure(err).detail}`);
 			return sdl;
 		}
 	}
@@ -48782,7 +48785,7 @@ var AppSyncProvider = class {
 			const envResp = await this.getClient().send(new GetGraphqlApiEnvironmentVariablesCommand({ apiId: physicalId }));
 			if (envResp.environmentVariables !== void 0) result["EnvironmentVariables"] = envResp.environmentVariables;
 		} catch (err) {
-			this.logger.warn(`Could not read AppSync GraphqlApi ${physicalId} environment variables (drift on that property will not be reported): ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.warn(`Could not read AppSync GraphqlApi ${physicalId} environment variables (drift on that property will not be reported): ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -50158,7 +50161,7 @@ var GlueWorkflowProvider = class {
 			const tagResp = await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }));
 			tags = normalizeAwsTagsToCfn(tagResp.Tags);
 		} catch (err) {
-			this.logger.debug(`GetTags failed for Glue Workflow ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`GetTags failed for Glue Workflow ${physicalId}: ${describeAwsFailure(err).detail}`);
 		}
 		result["Tags"] = tags;
 		return result;
@@ -50525,7 +50528,7 @@ async function fetchGlueTags(client, stsClient, resource, name, accountId, logge
 		const resp = await client.send(new GetTagsCommand({ ResourceArn: arn }));
 		return normalizeAwsTagsToCfn(resp.Tags);
 	} catch (err) {
-		logger.debug(`GetTags failed for ${resource}/${name}: ${err instanceof Error ? err.message : String(err)}`);
+		logger.debug(`GetTags failed for ${resource}/${name}: ${describeAwsFailure(err).detail}`);
 		return [];
 	}
 }
@@ -51058,7 +51061,7 @@ var GlueCrawlerProvider = class {
 		try {
 			await this.getClient().send(new StopCrawlerCommand({ Name: physicalId }));
 		} catch (err) {
-			this.logger.debug(`StopCrawler for ${physicalId} returned ${err instanceof Error ? err.name : String(err)}; continuing to wait`);
+			this.logger.debug(`StopCrawler for ${physicalId} returned ${err instanceof Error ? err.name : safeStringify(err)}; continuing to wait`);
 		}
 		for (let attempt = 0; attempt < CRAWLER_STOP_MAX_ATTEMPTS; attempt++) {
 			try {
@@ -51493,7 +51496,7 @@ var GlueTriggerProvider = class {
 					await this.waitForTriggerDeactivated(physicalId);
 				}
 			} catch (err) {
-				if (!(err instanceof EntityNotFoundException)) this.logger.debug(`GetTrigger pre-check failed for ${physicalId}; continuing anyway: ${err instanceof Error ? err.message : String(err)}`);
+				if (!(err instanceof EntityNotFoundException)) this.logger.debug(`GetTrigger pre-check failed for ${physicalId}; continuing anyway: ${describeAwsFailure(err).detail}`);
 			}
 			const update = {
 				...properties["Description"] !== void 0 && { Description: properties["Description"] },
@@ -51556,7 +51559,7 @@ var GlueTriggerProvider = class {
 					await this.waitForTriggerDeactivated(physicalId);
 				}
 			} catch (err) {
-				if (!(err instanceof EntityNotFoundException)) this.logger.debug(`GetTrigger pre-delete check failed for ${physicalId}; continuing: ${err instanceof Error ? err.message : String(err)}`);
+				if (!(err instanceof EntityNotFoundException)) this.logger.debug(`GetTrigger pre-delete check failed for ${physicalId}; continuing: ${describeAwsFailure(err).detail}`);
 			}
 			await this.getClient().send(new DeleteTriggerCommand({ Name: physicalId }));
 		} catch (error) {
@@ -53115,7 +53118,7 @@ var KinesisStreamProvider = class {
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$10) return void 0;
-			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -53296,7 +53299,7 @@ var KinesisStreamConsumerProvider = class {
 				StreamARN: desc.StreamARN
 			};
 		} catch (err) {
-			this.logger.debug(`DescribeStreamConsumer(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`DescribeStreamConsumer(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return {
 			physicalId,
@@ -53378,7 +53381,7 @@ var KinesisStreamConsumerProvider = class {
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$10) return void 0;
-			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
 		return result;
@@ -53969,7 +53972,7 @@ var EFSProvider = class {
 				await this.getClient().send(new DeleteFileSystemCommand({ FileSystemId: fileSystemId }));
 				this.logger.debug(`Rolled back partially-created EFS FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
-				this.logger.warn(`Failed to roll back partially-created EFS FileSystem ${fileSystemId}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+				this.logger.warn(`Failed to roll back partially-created EFS FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail}`);
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
@@ -54051,7 +54054,7 @@ var EFSProvider = class {
 		for (let attempt = 1;; attempt++) try {
 			return await op();
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			const name = error instanceof Error ? error.name : "";
 			if (!(/in progress|please retry|incorrect file system life ?cycle state|being (updated|modified)|try again/i.test(msg) || name === "IncorrectFileSystemLifeCycleState" || name === "ConflictException" || name === "ThrottlingException") || attempt >= maxAttempts) throw error;
 			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
@@ -54793,7 +54796,7 @@ var FSxFileSystemProvider = class {
 				await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: fileSystemId }));
 				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
-				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)} — delete it manually to stop billing`);
+				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — delete it manually to stop billing`);
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
@@ -55014,7 +55017,7 @@ var FSxFileSystemProvider = class {
 			if (!updatedFs) try {
 				updatedFs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0];
 			} catch (describeError) {
-				this.logger.debug(`Post-update attribute refresh for ${physicalId} failed (returning without attributes): ${describeError instanceof Error ? describeError.message : String(describeError)}`);
+				this.logger.debug(`Post-update attribute refresh for ${physicalId} failed (returning without attributes): ${describeAwsFailure(describeError).detail}`);
 			}
 			this.logger.debug(`Successfully updated FSx FileSystem ${logicalId}`);
 			return {
@@ -55260,7 +55263,7 @@ var FSxFileSystemProvider = class {
 			return response.FileSystems?.[0];
 		} catch (error) {
 			const name = error instanceof Error ? error.name : "";
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if ((name === "ThrottlingException" || name === "ServiceLimitExceeded" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
 				transientState.count += 1;
 				this.logger.debug(`Transient DescribeFileSystems error while polling ${fileSystemId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
@@ -55919,7 +55922,7 @@ var EMRClusterProvider = class {
 				await this.getClient().send(new TerminateJobFlowsCommand({ JobFlowIds: [clusterId] }));
 				this.logger.warn(`Rolled back partially-created EMR Cluster ${clusterId}`);
 			} catch (cleanupError) {
-				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)} — terminate it manually to stop billing`);
+				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${describeAwsFailure(cleanupError).detail} — terminate it manually to stop billing`);
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
@@ -56097,7 +56100,7 @@ var EMRClusterProvider = class {
 			try {
 				cluster = (await this.getClient().send(new DescribeClusterCommand({ ClusterId: physicalId }))).Cluster;
 			} catch (describeError) {
-				this.logger.debug(`Post-update attribute refresh for ${physicalId} failed (returning without attributes): ${describeError instanceof Error ? describeError.message : String(describeError)}`);
+				this.logger.debug(`Post-update attribute refresh for ${physicalId} failed (returning without attributes): ${describeAwsFailure(describeError).detail}`);
 			}
 			this.logger.debug(`Successfully updated EMR Cluster ${logicalId}`);
 			return {
@@ -56190,7 +56193,7 @@ var EMRClusterProvider = class {
 			return response.Cluster;
 		} catch (error) {
 			const name = error instanceof Error ? error.name : "";
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
 				transientState.count += 1;
 				this.logger.debug(`Transient DescribeCluster error while polling ${clusterId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
@@ -56737,7 +56740,7 @@ var EMRInstanceGroupConfigProvider = class {
 					const clientRegion = await this.getClient().config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`EMR instance group ${physicalId} scale-to-0 skipped (cluster/group gone): ${error.message}`);
-				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance group ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
+				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance group ${physicalId} failed: ${describeAwsFailure(error).detail} — its instances are released when the parent cluster terminates`);
 			}
 			return;
 		}
@@ -56824,7 +56827,7 @@ var EMRInstanceGroupConfigProvider = class {
 			return;
 		} catch (error) {
 			const name = error instanceof Error ? error.name : "";
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
 				transientState.count += 1;
 				this.logger.debug(`Transient ListInstanceGroups error while polling ${groupId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
@@ -57051,7 +57054,7 @@ var EMRInstanceFleetConfigProvider = class {
 					const clientRegion = await this.getClient().config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`EMR instance fleet ${physicalId} scale-to-0 skipped (cluster/fleet gone): ${error.message}`);
-				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance fleet ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
+				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance fleet ${physicalId} failed: ${describeAwsFailure(error).detail} — its instances are released when the parent cluster terminates`);
 			}
 			return;
 		}
@@ -57178,7 +57181,7 @@ var EMRInstanceFleetConfigProvider = class {
 			return;
 		} catch (error) {
 			const name = error instanceof Error ? error.name : "";
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
 				transientState.count += 1;
 				this.logger.debug(`Transient ListInstanceFleets error while polling ${fleetId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
@@ -58232,7 +58235,7 @@ var FirehoseProvider = class {
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return void 0;
-			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
 		return result;
@@ -58696,7 +58699,7 @@ var CloudTrailProvider = class {
 				newEventSelectors = requireConfigArray(rawEventSelectors, "AWS::CloudTrail::Trail EventSelectors");
 			} catch (error) {
 				eventSelectorsUnusable = true;
-				this.logger.warn(`${error instanceof Error ? error.message : String(error)} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
+				this.logger.warn(`${describeAwsFailure(error).detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
 			}
 			const oldEventSelectors = previousProperties["EventSelectors"];
 			if (!eventSelectorsUnusable && JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
@@ -58709,7 +58712,7 @@ var CloudTrailProvider = class {
 						EventSelectors: [...eventSelectorsToSend]
 					}));
 				} catch (error) {
-					const message = error instanceof Error ? error.message : String(error);
+					const message = describeAwsFailure(error).detail;
 					if (!isRemoval || !/advanced[\s-]*event[\s-]*selector/i.test(message)) throw error;
 					this.logger.warn(`CloudTrail Trail ${logicalId}: skipping the EventSelectors reset — the trail is using AdvancedEventSelectors, which AWS manages through a separate API, so there are no basic event selectors to clear (${message})`);
 				}
@@ -58878,7 +58881,7 @@ var CloudTrailProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }));
 			tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagList?.[0]?.TagsList);
 		} catch (err) {
-			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		result["Tags"] = tags;
 		return result;
@@ -59886,7 +59889,7 @@ var CodeCommitRepositoryProvider = class {
 		try {
 			await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName }));
 		} catch (cleanupError) {
-			this.logger.warn(`Failed to clean up CodeCommit Repository ${repositoryName} after a post-create failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+			this.logger.warn(`Failed to clean up CodeCommit Repository ${repositoryName} after a post-create failure: ${describeAwsFailure(cleanupError).detail}`);
 		}
 	}
 	/**
@@ -60067,7 +60070,7 @@ var DLMLifecyclePolicyProvider = class {
 			try {
 				arn = await this.fetchPolicyArn(response.PolicyId);
 			} catch (err) {
-				this.logger.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${describeAwsFailure(err).detail}`);
 			}
 			this.logger.debug(`Successfully created DLM Lifecycle Policy ${logicalId}: ${response.PolicyId}`);
 			return {
@@ -60436,7 +60439,7 @@ var S3VectorsProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
-			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
 		else this.logger.debug(`S3Vectors GetVectorBucket(${physicalId}) returned no vectorBucketArn; skipping Tags readback`);
@@ -60531,7 +60534,7 @@ var S3DirectoryBucketProvider = class {
 				return azId;
 			}
 		} catch (error) {
-			this.logger.debug(`Failed to resolve AZ ID for ${azName}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to resolve AZ ID for ${azName}: ${describeAwsFailure(error).detail}`);
 		}
 		return azName;
 	}
@@ -60717,7 +60720,7 @@ var S3DirectoryBucketProvider = class {
 			this.logger.debug(`Successfully deleted S3 Express Directory Bucket ${logicalId}`);
 			return;
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
 				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. Delete all objects first (e.g. aws s3 rm s3://${bucketName} --recursive) and destroy again.`);
 				this.logger.info(`Directory bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
@@ -61257,7 +61260,7 @@ var S3TablesProvider = class {
 		try {
 			resolved = await this.resolveTableParts(physicalId);
 		} catch (err) {
-			this.logger.warn(`S3 Tables Table ${physicalId}: could not resolve its identity for drift (${err instanceof Error ? err.message : String(err)}); reporting drift as unknown.`);
+			this.logger.warn(`S3 Tables Table ${physicalId}: could not resolve its identity for drift (${describeAwsFailure(err).detail}); reporting drift as unknown.`);
 			return;
 		}
 		if (resolved === "not-found" || resolved === "unparseable") return void 0;
@@ -61596,7 +61599,7 @@ var S3TablesProvider = class {
 			});
 			return out;
 		} catch (err) {
-			this.logger.debug(`readTagsBestEffort: ListTagsForResource failed for ${resourceArn}: ${err instanceof Error ? err.message : String(err)} — emitting Tags: []`);
+			this.logger.debug(`readTagsBestEffort: ListTagsForResource failed for ${resourceArn}: ${describeAwsFailure(err).detail} — emitting Tags: []`);
 			return [];
 		}
 	}
@@ -63513,7 +63516,7 @@ var ACMCertificateProvider = class {
 				idempotencyToken.release();
 				return;
 			}
-			const detail = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			const detail = describeAwsFailure(cleanupError).detail;
 			this.logger.warn(`Could not delete the ACM certificate ${certificateArn} that the failed create of ${logicalId} requested: ${detail}`);
 			return `The certificate ${certificateArn} this attempt created could NOT be deleted, and cdkd is not tracking it -- retire it with \`aws acm delete-certificate --certificate-arn ${certificateArn} --region ${this.regionOfArn(certificateArn)}\` (the reason is in the warning above).`;
 		}
@@ -63540,8 +63543,8 @@ var ACMCertificateProvider = class {
 				}
 			} catch (error) {
 				const inUse = isCertificateInUseError(error);
-				orphanReason = inUse ? `old certificate ${physicalId} is still in use by another resource and was not deleted` : `old certificate ${physicalId} could not be deleted: ${String(error)}`;
-				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${String(error)}. ` + (inUse ? "This usually means a consumer (e.g. a CloudFront distribution) still references it; it can be deleted once DescribeCertificate.InUseBy is empty. " : "") + `The old certificate may be orphaned and require manual cleanup.`);
+				orphanReason = inUse ? `old certificate ${physicalId} is still in use by another resource and was not deleted` : `old certificate ${physicalId} could not be deleted: ${safeStringify(error)}`;
+				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${safeStringify(error)}. ` + (inUse ? "This usually means a consumer (e.g. a CloudFront distribution) still references it; it can be deleted once DescribeCertificate.InUseBy is empty. " : "") + `The old certificate may be orphaned and require manual cleanup.`);
 			}
 			const base = {
 				physicalId: createResult.physicalId,
@@ -94392,4 +94395,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BKuJRiz3.js.map
+//# sourceMappingURL=program-DaoJ7P4H.js.map