@go-to-k/cdkd 0.296.1 → 0.296.3

package/dist/{provider-classes-DNkoEEo4.js → provider-classes-Ca6o5by0.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-Dvc7ddKe.js";
 import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as dynamicReferenceTokens, $i as withoutSilentDropProperties, $n as reEnableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, An as definedAttributes, B as getPriorAttempts, Bo as rewriteTemplateAssetReferences, Bs as decodeListingKey, Cn as DBPROXY_TAGS_WHAT, Ct as getStackRecords, D as beginDeleteWait, Da as canonicalLambdaFunctionName, Dn as refuseMalformedDesiredTags, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as withRetry, En as readTagList, F as waitForIndexesSettled, Fo as stringifyValue, Fr as parseWebACLArn, Gn as withIndeterminateGuard, Gt as redactedDeleteAddressFields, I as ECR_AUTO_DELETE_IMAGES_TAG, Ja as markSameGenerationBag, Kn as isWaitAbandonedError, Kt as redactedDeleteAddressSkip, L as S3_AUTO_DELETE_OBJECTS_TAG, La as hasMaskableValues, Ln as getCurrentResourceSecrets, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mt as getCurrentProducerRegions, N as INDEX_SETTLE_POLL_INTERVAL_MS, O as compensateRemovedDeletionProtection, Oa as lambdaFunctionNameForMask, On as tagMapAsList, P as deleteTableWithIndexBusyRetry, Qn as reDisableInstanceApiTermination, R as hasCdkAutoDeleteTag, Ri as refuseMalformedResourcesForDestroy, Rr as passedParameterClassesOf, Sa as requireConfigString, Sn as acquireIdempotencyToken, T as DynamoDBGlobalTableProvider, Tn as planTagDiff, Tr as getAccountInfo, Us as canonicalizeRegion, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as markRefusedBeforeApplying, Vn as unchangedBehindSecretReference, Wn as deleteSkipReason, Ws as derivePartitionAndUrlSuffix, Wt as isRedactedRecordedValue, Xn as isTerminationProtectionPropagationError, Ya as redactSecretsForState, Yn as ec2InstanceProtectionSite, Za as recoverMaskedOutput, Zi as findSilentDropProperties, Zn as observeThenDisableInstanceApiTermination, _a as configStringRefusal, _r as s3BucketArn, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ba as requireConfigArray, bn as reserveStackCreateToken, br as s3BucketRegionalDomainName, c as renderNestedTemplateTreeDefect, ca as WARM_THROUGHPUT_MEMBERS, da as toCfnInteger, dt as getNestedRevertRun, ec as describeFileReadFailure, fa as toFiniteNumber, ga as configIntegerRefusal, gr as isSettledInstanceState, ha as configBooleanRefusal, j as resolveDynamoDbDeleteBudgetMs, jn as stringifyIfAssigned, k as deleteBudgetKey, ka as sameLambdaFunctionAddress, kn as tagPlanWarning, la as coerceWarmThroughput$1, ma as coerceCfnInteger, mt as revertNestedChildFromJournal, nc as renderAssemblyPathEscape, o as isAbsoluteAssetPath, pa as coerceCfnBoolean, qn as markWaitAbandoned, rc as resolveAssemblyPath, ro as carriesSecretMask, s as listNestedTemplateRows, t as DeployEngine, tc as displayAssemblyPath, ua as isWarmThroughputDecrease, va as readConfigString, vi as refuseMalformedNestedChildOutputs, vn as earliestDefined, vr as s3BucketDomainName, vt as withNestedStackContext, wn as DBPROXY_TAG_OPTIONS, xa as requireConfigObject, xr as s3BucketWebsiteUrl, xt as awaitInFlightSibling, ya as replayWarn, yr as s3BucketDualStackDomainName, z as isTruthyCfnBoolean, zn as slowCcOperationTimeoutMs } from "./deploy-engine-xlct0Hcm.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-BRVCTUZu.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DXRavuSm.js";
-import { RDSProvider } from "./rds-provider-McCDKyXN.js";
-import { NeptuneProvider } from "./neptune-provider-Cdp4jX8S.js";
-import { ASGProvider } from "./asg-provider-BwWy0pBH.js";
+import { $a as recoverMaskedOutput, $i as findSilentDropProperties, $n as observeThenDisableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, Aa as lambdaFunctionNameForMask, An as tagMapAsList, B as getPriorAttempts, Bi as refuseMalformedResourcesForDestroy, Br as passedParameterClassesOf, Ca as requireConfigObject, Cr as s3BucketWebsiteUrl, Ct as getStackRecords, D as beginDeleteWait, Dn as planTagDiff, Dr as getAccountInfo, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, En as DBPROXY_TAG_OPTIONS, F as waitForIndexesSettled, Gs as canonicalizeRegion, Gt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ho as rewriteTemplateAssetReferences, Hs as decodeListingKey, I as ECR_AUTO_DELETE_IMAGES_TAG, Jn as isWaitAbandonedError, Jt as redactedDeleteAddressSkip, Kn as deleteSkipReason, Ks as derivePartitionAndUrlSuffix, Kt as isRedactedRecordedValue, L as S3_AUTO_DELETE_OBJECTS_TAG, Lo as stringifyValue, Lr as parseWebACLArn, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as definedAttributes, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as stringifyIfAssigned, O as compensateRemovedDeletionProtection, Oa as withRetry, On as readTagList, P as deleteTableWithIndexBusyRetry, Pt as getCurrentProducerRegions, Qn as isTerminationProtectionPropagationError, R as hasCdkAutoDeleteTag, Sa as requireConfigArray, Sn as reserveStackCreateToken, Sr as s3BucketRegionalDomainName, T as DynamoDBGlobalTableProvider, Tn as DBPROXY_TAGS_WHAT, Un as unchangedBehindSecretReference, V as markRefusedBeforeApplying, Vn as slowCcOperationTimeoutMs, Xa as markSameGenerationBag, Yn as markWaitAbandoned, Za as redactSecretsForState, Zn as ec2InstanceProtectionSite, _a as configBooleanRefusal, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ac as resolveAssemblyPath, ao as carriesSecretMask, ba as readConfigString, bi as refuseMalformedNestedChildOutputs, bn as earliestDefined, br as s3BucketDomainName, c as renderNestedTemplateTreeDefect, da as coerceWarmThroughput$1, dt as getNestedRevertRun, er as reDisableInstanceApiTermination, fa as isWarmThroughputDecrease, ga as coerceCfnInteger, ha as coerceCfnBoolean, ic as renderAssemblyPathEscape, j as resolveDynamoDbDeleteBudgetMs, ja as sameLambdaFunctionAddress, jn as tagPlanWarning, k as deleteBudgetKey, ka as canonicalLambdaFunctionName, kn as refuseMalformedDesiredTags, ma as toFiniteNumber, mt as revertNestedChildFromJournal, nc as describeFileReadFailure, o as isAbsoluteAssetPath, pa as toCfnInteger, qn as withIndeterminateGuard, qt as redactedDeleteAddressFields, rc as displayAssemblyPath, s as listNestedTemplateRows, t as DeployEngine, ta as withoutSilentDropProperties, to as dynamicReferenceTokens, tr as reEnableInstanceApiTermination, ua as WARM_THROUGHPUT_MEMBERS, va as configIntegerRefusal, vr as isSettledInstanceState, vt as withNestedStackContext, wa as requireConfigString, wn as acquireIdempotencyToken, xa as replayWarn, xr as s3BucketDualStackDomainName, xt as awaitInFlightSibling, ya as configStringRefusal, yr as s3BucketArn, z as isTruthyCfnBoolean, za as hasMaskableValues, zn as getCurrentResourceSecrets } from "./deploy-engine-Dre6eDNJ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-D9wk9Bnh.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DFehMfoh.js";
+import { RDSProvider } from "./rds-provider-Dl--9uQU.js";
+import { NeptuneProvider } from "./neptune-provider-B1GRQ6UO.js";
+import { ASGProvider } from "./asg-provider-CksS_6jO.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -2606,7 +2606,7 @@ function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
 		identifier: bucketName,
 		maskSecrets
 	});
-	const lead = journaled ? "On a first-time create the failed deploy's rollback journal records the bucket for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy" : "Manual deletion may be required before the next deploy";
+	const lead = journaled ? "Outside a rollback's re-create, the failed deploy's rollback journal records the bucket for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy" : "Manual deletion may be required before the next deploy";
 	return command ? `${lead}: ${command}` : `${lead}, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.`;
 }
 function configItemId(item) {
@@ -5518,7 +5518,7 @@ var SQSQueuePolicyProvider = class {
 			this.logger.debug(`Successfully created SQS queue policy ${logicalId}`);
 			return {
 				physicalId: queues[0],
-				attributes: {}
+				attributes: { [WRITTEN_QUEUES_KEY]: queues.join(",") }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -5527,12 +5527,15 @@ var SQSQueuePolicyProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating SQS queue policy ${logicalId}: ${physicalId}`);
 		const queues = properties["Queues"];
 		const policyDocument = properties["PolicyDocument"];
 		if (!queues || queues.length === 0) throw new ProvisioningError(`Queues is required for SQS queue policy ${logicalId}`, resourceType, logicalId, physicalId);
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for SQS queue policy ${logicalId}`, resourceType, logicalId, physicalId);
+		const written = recordedQueues(physicalId, context?.recordedAttributes);
+		const listedOnly = await this.queuesCarryingDocument(listedQueues(previousProperties).filter((url) => !written.includes(url) && !queues.includes(url)), previousProperties["PolicyDocument"], logicalId);
+		const removed = [...written.filter((url) => !queues.includes(url)), ...listedOnly];
 		try {
 			const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
 			for (const queueUrl of queues) {
@@ -5542,21 +5545,35 @@ var SQSQueuePolicyProvider = class {
 					Attributes: { Policy: policyDoc }
 				}));
 			}
+			for (const queueUrl of removed) await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion, "pre-update");
 			this.logger.debug(`Successfully updated SQS queue policy ${logicalId}`);
 			return {
 				physicalId: queues[0],
 				wasReplaced: false,
-				attributes: {}
+				attributes: { [WRITTEN_QUEUES_KEY]: queues.join(",") }
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SQS queue policy ${logicalId}: ${physicalId}`);
-		const queueUrls = physicalId.split(",");
+		const named = physicalId.includes(",") ? splitQueueUrls(physicalId) : recordedQueues(physicalId, context?.recordedAttributes);
+		const queueUrls = [...physicalId.includes(",") ? [] : await this.queuesCarryingDocument(listedQueues(properties ?? {}).filter((url) => !named.includes(url)), properties?.["PolicyDocument"], logicalId), ...named];
+		if (queueUrls.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
 		for (const queueUrl of queueUrls) try {
+			await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion);
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
+	}
+	async clearQueuePolicy(queueUrl, resourceType, logicalId, expectedRegion, phase = "not-found") {
+		try {
 			await this.sqsClient.send(new SetQueueAttributesCommand({
 				QueueUrl: queueUrl,
 				Attributes: { Policy: "" }
@@ -5564,33 +5581,77 @@ var SQSQueuePolicyProvider = class {
 		} catch (error) {
 			if (error instanceof Error && (error.name === "QueueDoesNotExist" || error.message.includes("does not exist"))) {
 				const clientRegion = await this.sqsClient.config.region();
-				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, queueUrl);
+				assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, queueUrl, phase);
 				this.logger.debug(`Queue ${queueUrl} does not exist, skipping policy deletion`);
-				continue;
+				return;
 			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw error;
 		}
-		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		let policyAttr;
+	async queuesCarryingDocument(candidates, document, logicalId) {
+		if (candidates.length === 0) return [];
+		let reference;
+		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy$1(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$2(document);
+		if (reference === void 0) {
+			this.logger.warn(safeMsg`The queues ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`);
+			return [];
+		}
+		const carrying = [];
+		for (const queueUrl of candidates) {
+			const current = await this.readPolicyForWidening(queueUrl);
+			if (current.kind === "policy" && canonicalPolicy$1(current.policy) === reference) carrying.push(queueUrl);
+			else if (current.kind === "unreadable") this.logger.warn(safeMsg`Could not read the policy of queue ${queueUrl} (${current.reason}), so it is not cleared: it may still carry the policy of ${logicalId}.`);
+			else this.logger.debug(safeMsg`Queue ${queueUrl} does not carry the policy of ${logicalId}; left as is`);
+		}
+		return carrying;
+	}
+	async readPolicyForWidening(queueUrl) {
 		try {
-			policyAttr = (await this.sqsClient.send(new GetQueueAttributesCommand({
-				QueueUrl: physicalId,
+			const policy = (await this.sqsClient.send(new GetQueueAttributesCommand({
+				QueueUrl: queueUrl,
 				AttributeNames: ["Policy"]
 			}))).Attributes?.["Policy"];
+			return policy ? {
+				kind: "policy",
+				policy
+			} : { kind: "none" };
 		} catch (err) {
-			const e = err;
-			if (e.name === "QueueDoesNotExist" || e.name === "AWS.SimpleQueueService.NonExistentQueue") return RESOURCE_NOT_FOUND;
-			throw err;
+			const name = err.name;
+			if (name === "QueueDoesNotExist" || name === "AWS.SimpleQueueService.NonExistentQueue") return { kind: "none" };
+			return {
+				kind: "unreadable",
+				reason: name ?? "error"
+			};
 		}
-		if (!policyAttr) return RESOURCE_NOT_FOUND;
-		const result = { Queues: [physicalId] };
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const queueUrls = splitQueueUrls(physicalId);
+		if (queueUrls.length === 0) return void 0;
+		const held = [];
+		let firstPolicy;
+		for (const queueUrl of queueUrls) {
+			let policyAttr;
+			try {
+				policyAttr = (await this.sqsClient.send(new GetQueueAttributesCommand({
+					QueueUrl: queueUrl,
+					AttributeNames: ["Policy"]
+				}))).Attributes?.["Policy"];
+			} catch (err) {
+				const e = err;
+				if (e.name === "QueueDoesNotExist" || e.name === "AWS.SimpleQueueService.NonExistentQueue") continue;
+				throw err;
+			}
+			if (!policyAttr) continue;
+			held.push(queueUrl);
+			firstPolicy ??= policyAttr;
+		}
+		if (firstPolicy === void 0) return RESOURCE_NOT_FOUND;
+		const result = { Queues: held };
 		try {
-			result["PolicyDocument"] = JSON.parse(policyAttr);
+			result["PolicyDocument"] = JSON.parse(firstPolicy);
 		} catch {
-			result["PolicyDocument"] = policyAttr;
+			result["PolicyDocument"] = firstPolicy;
 		}
 		return result;
 	}
@@ -5615,6 +5676,49 @@ var SQSQueuePolicyProvider = class {
 function isSqsQueueUrl(value) {
 	return value.startsWith("https://sqs.") && value.includes("/");
 }
+const WRITTEN_QUEUES_KEY = "cdkd:WrittenQueues";
+function recordedQueues(physicalId, attributes) {
+	const named = splitQueueUrls(physicalId);
+	const value = attributes?.[WRITTEN_QUEUES_KEY];
+	if (typeof value !== "string") return named;
+	const recorded = splitQueueUrls(value);
+	if (recorded.length === 0 || !recorded.every(isListedQueueUrl)) return named;
+	for (const url of recorded) if (!named.includes(url)) named.push(url);
+	return named;
+}
+function listedQueues(bag) {
+	const listed = bag["Queues"];
+	if (!Array.isArray(listed)) return [];
+	const out = [];
+	for (const entry of listed) if (typeof entry === "string" && isListedQueueUrl(entry) && !out.includes(entry)) out.push(entry);
+	return out;
+}
+function isListedQueueUrl(value) {
+	return isSqsQueueUrl(value) && !value.includes(",") && !value.includes("*");
+}
+function canonicalJson$2(value) {
+	const sortKeys = (v) => {
+		if (Array.isArray(v)) return v.map(sortKeys);
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			for (const key of Object.keys(v).sort()) out[key] = sortKeys(v[key]);
+			return out;
+		}
+		return v;
+	};
+	const sorted = sortKeys(value);
+	return JSON.stringify(sorted);
+}
+function canonicalPolicy$1(text) {
+	try {
+		return canonicalJson$2(JSON.parse(text));
+	} catch {
+		return `raw:${text}`;
+	}
+}
+function splitQueueUrls(physicalId) {
+	return physicalId.split(",").filter((url) => url.length > 0);
+}
 
 //#endregion
 //#region src/provisioning/providers/create-ownership.ts
@@ -5748,7 +5852,7 @@ var SNSTopicProvider = class {
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = topicArn;
-					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()}`);
+					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -6363,15 +6467,27 @@ var SNSTopicPolicyProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating SNS topic policy ${logicalId}: ${physicalId}`);
 		const topics = properties["Topics"];
 		const policyDocument = properties["PolicyDocument"];
 		if (!topics || topics.length === 0) throw new ProvisioningError(`Topics is required for SNS topic policy ${logicalId}`, resourceType, logicalId, physicalId);
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for SNS topic policy ${logicalId}`, resourceType, logicalId, physicalId);
 		const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
+		const mask = context?.maskSecrets ?? ((t) => t);
+		const written = splitTopicArns(physicalId);
+		const listedOnly = await this.topicsCarryingDocument(listedTopics(previousProperties).filter((arn) => !written.includes(arn) && !topics.includes(arn)), previousProperties["PolicyDocument"], logicalId, mask);
+		const dropped = written.filter((arn) => !topics.includes(arn));
+		const unaddressable = dropped.filter((arn) => !isSnsTopicArn(arn));
+		if (unaddressable.length > 0) {
+			const message = mask(safeMsg`The recorded id segment(s) ${unaddressable.join(", ")} of ${logicalId} are not topic ARNs; ` + (listedTopics(previousProperties).length > 0 ? "the topics its previous Topics listed were checked instead." : "its previous Topics lists no topic ARN either, so a topic it was attached to may still carry its policy."));
+			if (listedTopics(previousProperties).length > 0) this.logger.debug(message);
+			else this.logger.warn(message);
+		}
+		const removed = [...dropped.filter((arn) => isSnsTopicArn(arn)), ...listedOnly];
 		try {
 			for (const topicArn of topics) await this.setTopicPolicy(topicArn, policyDoc);
+			for (const topicArn of removed) await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion, "not-found", mask);
 			this.logger.debug(`Successfully updated SNS topic policy ${logicalId}`);
 			return {
 				physicalId: topics.join(","),
@@ -6379,28 +6495,77 @@ var SNSTopicPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SNS topic policy ${logicalId}: ${physicalId}`);
-		const topicArns = physicalId.split(",");
+		const named = splitTopicArns(physicalId);
+		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id is empty, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
+		const topicArns = named.every((arn) => isSnsTopicArn(arn)) ? named : [.../* @__PURE__ */ new Set([...named.filter((arn) => isSnsTopicArn(arn)), ...listedTopics(properties ?? {})])];
+		if (topicArns.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id names no SNS topic ARN and its Topics lists none either, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
 		for (const topicArn of topicArns) try {
-			await this.setTopicPolicy(topicArn, "");
-			this.logger.debug(`Removed policy from topic ${topicArn}`);
+			await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion);
 		} catch (error) {
-			if (error instanceof Error && (error.name === "NotFoundException" || error.name === "NotFound" || error.message.includes("not found") || error.message.includes("does not exist") || error.message.includes("Invalid parameter"))) {
-				const clientRegion = await getAwsClients().sns.config.region();
-				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, topicArn);
-				this.logger.debug(`Topic ${topicArn} not found or policy already removed, skipping`);
-				continue;
-			}
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
+	async resetTopicPolicy(topicArn, resourceType, logicalId, expectedRegion, phase = "not-found", mask = (t) => t) {
+		const defaultPolicy = defaultTopicPolicy(topicArn);
+		if (defaultPolicy === void 0) throw new ProvisioningError(`Cannot remove SNS topic policy ${logicalId} from ${topicArn}: not an SNS topic ARN`, resourceType, logicalId, topicArn);
+		try {
+			await this.setTopicPolicy(topicArn, defaultPolicy);
+			this.logger.debug(mask(safeMsg`Reset the policy of topic ${topicArn} to the default`));
+		} catch (error) {
+			const name = error?.name;
+			if (name === "NotFoundException" || name === "NotFound") {
+				const clientRegion = await getAwsClients().sns.config.region();
+				assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, topicArn, phase);
+				this.logger.debug(mask(safeMsg`Topic ${topicArn} not found, skipping policy removal`));
+				return;
+			}
+			throw error;
+		}
+	}
+	async topicsCarryingDocument(candidates, document, logicalId, mask) {
+		if (candidates.length === 0) return [];
+		let reference;
+		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$1(document);
+		if (reference === void 0) {
+			this.logger.warn(mask(safeMsg`The topics ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`));
+			return [];
+		}
+		const carrying = [];
+		for (const topicArn of candidates) {
+			const current = await this.readPolicyForWidening(topicArn);
+			if (current.kind === "policy" && canonicalPolicy(current.policy) === reference) carrying.push(topicArn);
+			else if (current.kind === "unreadable") this.logger.warn(mask(safeMsg`Could not read the policy of topic ${topicArn} (${current.reason}), so it is not reset: it may still carry the policy of ${logicalId}.`));
+			else this.logger.debug(mask(safeMsg`Topic ${topicArn} does not carry the policy of ${logicalId}; left as is`));
+		}
+		return carrying;
+	}
+	async readPolicyForWidening(topicArn) {
+		try {
+			const policy = (await getAwsClients().sns.send(new GetTopicAttributesCommand({ TopicArn: topicArn }))).Attributes?.["Policy"];
+			return policy ? {
+				kind: "policy",
+				policy
+			} : { kind: "none" };
+		} catch (err) {
+			const name = err.name;
+			if (name === "NotFoundException" || name === "NotFound") return { kind: "none" };
+			return {
+				kind: "unreadable",
+				reason: name ?? "error"
+			};
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		const topics = physicalId.split(",").filter((t) => t.length > 0);
 		if (topics.length === 0) return void 0;
@@ -6453,6 +6618,60 @@ function isSnsTopicArnList(value) {
 	if (segments.length === 0) return false;
 	return segments.every((s) => isSnsTopicArn(s));
 }
+function splitTopicArns(physicalId) {
+	return physicalId.split(",").filter((arn) => arn.length > 0);
+}
+function listedTopics(bag) {
+	const listed = bag["Topics"];
+	if (!Array.isArray(listed)) return [];
+	const out = [];
+	for (const entry of listed) if (typeof entry === "string" && isSnsTopicArn(entry) && !out.includes(entry)) out.push(entry);
+	return out;
+}
+function defaultTopicPolicy(topicArn) {
+	if (!isSnsTopicArn(topicArn)) return void 0;
+	const account = topicArn.split(":")[4];
+	return JSON.stringify({
+		Version: "2008-10-17",
+		Id: "__default_policy_ID",
+		Statement: [{
+			Sid: "__default_statement_ID",
+			Effect: "Allow",
+			Principal: { AWS: "*" },
+			Action: [
+				"SNS:GetTopicAttributes",
+				"SNS:SetTopicAttributes",
+				"SNS:AddPermission",
+				"SNS:RemovePermission",
+				"SNS:DeleteTopic",
+				"SNS:Subscribe",
+				"SNS:ListSubscriptionsByTopic",
+				"SNS:Publish"
+			],
+			Resource: topicArn,
+			Condition: { StringEquals: { "AWS:SourceOwner": account } }
+		}]
+	});
+}
+function canonicalJson$1(value) {
+	const sortKeys = (v) => {
+		if (Array.isArray(v)) return v.map(sortKeys);
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			for (const key of Object.keys(v).sort()) out[key] = sortKeys(v[key]);
+			return out;
+		}
+		return v;
+	};
+	return JSON.stringify(sortKeys(value));
+}
+function canonicalPolicy(text) {
+	try {
+		return canonicalJson$1(JSON.parse(text));
+	} catch {
+		return `raw:${text}`;
+	}
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-function-provider.ts
@@ -11185,7 +11404,7 @@ var LogsLogGroupProvider = class {
 						identifier: logGroupName,
 						maskSecrets: mask
 					});
-					const manualStep = deleteCommand ? `On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "On a first-time create the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
+					const manualStep = deleteCommand ? `Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "Outside a rollback's re-create, the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
 					this.logger.warn(mask(`Failed to clean up partially-created log group ${displaySafe(logicalId)} (${displaySafe(mask(logGroupName))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`));
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -12371,7 +12590,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 						identifier: name,
 						maskSecrets: mask
 					});
-					const manualStep = deleteCommand ? `On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "On a first-time create the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
+					const manualStep = deleteCommand ? `Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "Outside a rollback's re-create, the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
 					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -23210,13 +23429,13 @@ var ELBv2Provider = class {
 					this.logger.warn(maskerOrIdentity(maskSecrets)(skippedCleanupText(heldBefore, `Listener ${logicalId} (${listenerArn})`, pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render())));
 					throw markAuxiliaryFailure(innerError, logicalId);
 				}
-				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = listenerArn;
-					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`);
+					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -28738,13 +28957,13 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
-				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete fails, on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`));
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete fails, outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`));
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					leftBehindServiceId = void 0;
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`);
+					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -33007,7 +33226,7 @@ var KMSProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				const aws = pasteableAwsCommand();
 				const region = await this.regionArg(aws);
-				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS on a first-time create, its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
+				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS (outside a rollback's re-create), its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
@@ -35458,7 +35677,7 @@ var PipesPipeProvider = class {
 		const orphaned = async (why) => {
 			const aws = pasteableAwsCommand(mask);
 			const command = aws`aws pipes delete-pipe --name ${name}${await orphanCommandRegionArg(this.getClient(), aws)}`;
-			original.message += ` (cdkd could not delete the pipe it had created: ${why}; on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`. ` + (command.text !== void 0 ? `Otherwise delete it yourself with: ${command.text})` : `Otherwise delete it yourself from the EventBridge Pipes console.)`);
+			original.message += ` (cdkd could not delete the pipe it had created: ${why}; outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`. ` + (command.text !== void 0 ? `Otherwise delete it yourself with: ${command.text})` : `Otherwise delete it yourself from the EventBridge Pipes console.)`);
 			return leftBehind();
 		};
 		try {
@@ -36492,7 +36711,7 @@ var FSxFileSystemProvider = class {
 				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
 				survivorId = fileSystemId;
-				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself to stop billing`);
+				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself to stop billing`);
 			}
 			if (error instanceof ProvisioningError) {
 				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
@@ -43136,4 +43355,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DNkoEEo4.js.map
+//# sourceMappingURL=provider-classes-Ca6o5by0.js.map