@go-to-k/cdkd 0.296.6 → 0.296.8

package/dist/{provider-classes-oRTqcSCp.js → provider-classes-CxXTKgEM.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
+import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger } from "./logger-DAaB7GFO.js";
 import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as deleteSkipReason, $s as derivePartitionAndUrlSuffix, A as resolveDynamoDbDeleteBudgetClock, Aa as requireConfigObject, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ca as coerceCfnInteger, Ct as getStackRecords, D as beginDeleteWait, Da as readConfigString, Di as refuseMalformedNestedChildOutputs, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configStringRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fa as withRetry, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as canonicalLambdaFunctionName, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Jn as slowCcOperationTimeoutMs, Ka as hasMaskableValues, L as S3_AUTO_DELETE_OBJECTS_TAG, La as lambdaFunctionNameForMask, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as replayWarn, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, Qs as canonicalizeRegion, R as hasCdkAutoDeleteTag, Ra as sameLambdaFunctionAddress, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as coerceCfnBoolean, T as DynamoDBGlobalTableProvider, Ta as configIntegerRefusal, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wo as stringifyValue, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Yo as rewriteTemplateAssetReferences, Ys as decodeListingKey, _a as WARM_THROUGHPUT_MEMBERS, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ar as isTerminationProtectionPropagationError, ba as toCfnInteger, c as renderNestedTemplateTreeDefect, ca as withoutSilentDropProperties, co as dynamicReferenceTokens, cr as reEnableInstanceApiTermination, dc as renderAssemblyPathEscape, dt as getNestedRevertRun, er as withIndeterminateGuard, fc as resolveAssemblyPath, fo as carriesSecretMask, io as redactSecretsForState, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigString, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as requireConfigArray, kr as s3BucketRegionalDomainName, lc as describeFileReadFailure, mt as revertNestedChildFromJournal, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as findSilentDropProperties, oo as recoverMaskedOutput, or as observeThenDisableInstanceApiTermination, qi as refuseMalformedResourcesForDestroy, qr as passedParameterClassesOf, ro as markSameGenerationBag, s as listNestedTemplateRows, sr as reDisableInstanceApiTermination, t as DeployEngine, tr as isWaitAbandonedError, uc as displayAssemblyPath, va as coerceWarmThroughput$1, vt as withNestedStackContext, wa as configBooleanRefusal, xa as toFiniteNumber, xt as awaitInFlightSibling, ya as isWarmThroughputDecrease, z as isTruthyCfnBoolean, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-BPcBCyUE.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CVIClaZV.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CAlg2KEF.js";
-import { RDSProvider } from "./rds-provider-DeGFzOUc.js";
-import { NeptuneProvider } from "./neptune-provider-CvY6ekmg.js";
-import { ASGProvider } from "./asg-provider-C1TlpooI.js";
+import { $n as deleteSkipReason, $s as derivePartitionAndUrlSuffix, A as resolveDynamoDbDeleteBudgetClock, Aa as requireConfigObject, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ca as coerceCfnInteger, Ct as getStackRecords, D as beginDeleteWait, Da as readConfigString, Di as refuseMalformedNestedChildOutputs, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configStringRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fa as withRetry, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as canonicalLambdaFunctionName, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Jn as slowCcOperationTimeoutMs, L as S3_AUTO_DELETE_OBJECTS_TAG, La as lambdaFunctionNameForMask, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as replayWarn, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, Qs as canonicalizeRegion, R as hasCdkAutoDeleteTag, Ra as sameLambdaFunctionAddress, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as coerceCfnBoolean, T as DynamoDBGlobalTableProvider, Ta as configIntegerRefusal, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wa as hasMaskableValues, Wo as stringifyValue, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Yo as rewriteTemplateAssetReferences, Ys as decodeListingKey, _a as WARM_THROUGHPUT_MEMBERS, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ao as dynamicReferenceTokens, ar as isTerminationProtectionPropagationError, ba as toCfnInteger, c as renderNestedTemplateTreeDefect, ca as withoutSilentDropProperties, cr as reEnableInstanceApiTermination, dc as renderAssemblyPathEscape, dt as getNestedRevertRun, er as withIndeterminateGuard, fc as resolveAssemblyPath, fo as carriesSecretMask, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigString, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as requireConfigArray, kr as s3BucketRegionalDomainName, lc as describeFileReadFailure, mt as revertNestedChildFromJournal, no as redactSecretsForState, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as findSilentDropProperties, or as observeThenDisableInstanceApiTermination, qi as refuseMalformedResourcesForDestroy, qr as passedParameterClassesOf, s as listNestedTemplateRows, sr as reDisableInstanceApiTermination, t as DeployEngine, to as markSameGenerationBag, tr as isWaitAbandonedError, uc as displayAssemblyPath, uo as recoverMaskedOutput, va as coerceWarmThroughput$1, vt as withNestedStackContext, wa as configBooleanRefusal, xa as toFiniteNumber, xt as awaitInFlightSibling, ya as isWarmThroughputDecrease, z as isTruthyCfnBoolean, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-iXgQFHYR.js";
+import { a as AmbiguousCreateLatch, c as isInsideWindow, i as AMBIGUOUS_LATCH_TTL_MS, l as setBounded, n as collectInlinePolicyNamesManagedBySiblings, o as RecentIdSet, r as IamCreateClientCache, s as createAttemptKey, t as IAMRoleProvider, u as withoutServerErrorRetries } from "./iam-role-provider-B1Ma2zVK.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CPziYRDp.js";
+import { RDSProvider } from "./rds-provider-C193wAF8.js";
+import { NeptuneProvider } from "./neptune-provider-C-WMp2hQ.js";
+import { ASGProvider } from "./asg-provider-BDJ1qN0J.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -573,6 +573,7 @@ const PRINCIPAL_NAMES = "group / role / user names";
 const AWS_MANAGED_POLICY_ARN_RE = /^arn:aws[a-z0-9-]*:iam::aws:/;
 var IAMManagedPolicyProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMManagedPolicyProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -611,7 +612,7 @@ var IAMManagedPolicyProvider = class {
 			if (properties["Description"]) createParams.Description = properties["Description"];
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (tags.length > 0) createParams.Tags = tags;
-			const policyArn = (await this.iamClient.send(new CreatePolicyCommand(createParams))).Policy?.Arn;
+			const policyArn = (await (await this.createClient.get()).send(new CreatePolicyCommand(createParams))).Policy?.Arn;
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
@@ -1113,6 +1114,7 @@ function recordedNonRootPath(arn) {
 //#region src/provisioning/providers/iam-instance-profile-provider.ts
 var IAMInstanceProfileProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMInstanceProfileProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -1137,7 +1139,7 @@ var IAMInstanceProfileProvider = class {
 		const roles = principals.lists.Roles;
 		let leftBehind = false;
 		try {
-			const response = await this.iamClient.send(new CreateInstanceProfileCommand({
+			const response = await (await this.createClient.get()).send(new CreateInstanceProfileCommand({
 				InstanceProfileName: instanceProfileName,
 				Path: path
 			}));
@@ -1318,6 +1320,7 @@ var IAMInstanceProfileProvider = class {
 const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
 var IAMAccessKeyProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMAccessKeyProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -1349,7 +1352,7 @@ var IAMAccessKeyProvider = class {
 		const baseline = await this.tryListAccessKeyIds(userName, logicalId, log);
 		let leftBehindKeyId;
 		try {
-			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
+			const response = await (await this.createClient.get()).send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
 			const secretAccessKey = response.AccessKey?.SecretAccessKey;
 			leftBehindKeyId = accessKeyId;
@@ -1632,6 +1635,7 @@ function derivedNamePairs(resourceType, logicalId, properties) {
 }
 var IAMUserGroupProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMUserGroupProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -1700,7 +1704,7 @@ var IAMUserGroupProvider = class {
 			const createParams = { UserName: userName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (properties["Tags"] !== void 0 && properties["Tags"] !== null) createParams.Tags = desiredTags;
-			const response = await this.iamClient.send(new CreateUserCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateUserCommand(createParams));
 			leftBehind = true;
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
@@ -2078,7 +2082,7 @@ var IAMUserGroupProvider = class {
 		try {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
-			const response = await this.iamClient.send(new CreateGroupCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateGroupCommand(createParams));
 			leftBehind = true;
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
@@ -6943,6 +6947,28 @@ function canonicalPolicy(text) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/providers/lambda-create-client.ts
+var LambdaCreateClientCache = class {
+	client;
+	shared;
+	constructor(shared) {
+		this.shared = shared;
+	}
+	get() {
+		const shared = this.shared();
+		if (!(shared instanceof LambdaClient)) return Promise.resolve(shared);
+		this.client ??= shared.config.region().then((region) => withoutServerErrorRetries(new LambdaClient({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.client = void 0;
+			throw error;
+		});
+		return this.client;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/lambda-function-provider.ts
 const SELF_NEEDLE_MIN_LENGTH$1 = 3;
@@ -7090,6 +7116,7 @@ function inlineCodeFileNameForRuntime(runtime) {
 }
 var LambdaFunctionProvider = class {
 	lambdaClient;
+	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
 	ec2Client;
 	logger = getLogger().child("LambdaFunctionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Set([
@@ -7209,7 +7236,7 @@ var LambdaFunctionProvider = class {
 				CodeSigningConfigArn: properties["CodeSigningConfigArn"],
 				Tags: tags
 			};
-			const response = await this.lambdaClient.send(new CreateFunctionCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateFunctionCommand(createParams));
 			functionCreated = true;
 			createdFunctionName = response.FunctionName || functionName;
 			const recursiveLoop = properties["RecursiveLoop"];
@@ -7847,6 +7874,7 @@ function functionNamePairs(value) {
 }
 var LambdaPermissionProvider = class {
 	lambdaClient;
+	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
 	logger = getLogger().child("LambdaPermissionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Permission", /* @__PURE__ */ new Set([
 		"FunctionName",
@@ -7899,7 +7927,7 @@ var LambdaPermissionProvider = class {
 			if (properties["EventSourceToken"]) addParams.EventSourceToken = properties["EventSourceToken"];
 			if (properties["FunctionUrlAuthType"]) addParams.FunctionUrlAuthType = properties["FunctionUrlAuthType"];
 			if (properties["InvokedViaFunctionUrl"] !== void 0) addParams.InvokedViaFunctionUrl = properties["InvokedViaFunctionUrl"];
-			await this.lambdaClient.send(new AddPermissionCommand(addParams));
+			await (await this.createClient.get()).send(new AddPermissionCommand(addParams));
 			log.debug(`Successfully created Lambda permission ${logicalId}: ${statementId}`);
 			return {
 				physicalId: statementId,
@@ -8056,6 +8084,7 @@ var LambdaPermissionProvider = class {
 //#region src/provisioning/providers/lambda-url-provider.ts
 var LambdaUrlProvider = class {
 	lambdaClient;
+	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
 	logger = getLogger().child("LambdaUrlProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Url", /* @__PURE__ */ new Set([
 		"TargetFunctionArn",
@@ -8090,7 +8119,7 @@ var LambdaUrlProvider = class {
 			if (properties["Qualifier"]) createParams.Qualifier = properties["Qualifier"];
 			if (properties["InvokeMode"]) createParams.InvokeMode = properties["InvokeMode"];
 			if (cors) createParams.Cors = this.buildCorsConfig(cors);
-			const response = await this.lambdaClient.send(new CreateFunctionUrlConfigCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateFunctionUrlConfigCommand(createParams));
 			const functionUrl = response.FunctionUrl;
 			const functionArn = response.FunctionArn;
 			log.debug(`Successfully created Lambda URL ${logicalId}: ${functionUrl}`);
@@ -8256,93 +8285,6 @@ var LambdaUrlProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ambiguous-create.ts
-const CREATION_DATE_SKEW_MARGIN_MS = 5e3;
-const AMBIGUOUS_LATCH_TTL_MS = 18e5;
-const MAX_TRACKED = 1e4;
-const createAttemptKey = (scope, logicalId) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId);
-const setBounded = (map, key, value) => {
-	if (!map.has(key) && map.size >= MAX_TRACKED) {
-		const oldest = map.keys().next();
-		if (!oldest.done) map.delete(oldest.value);
-	}
-	map.set(key, value);
-};
-const mergeWindow = (existing, next, armedAtMs) => existing === void 0 ? {
-	floorMs: next.floorMs,
-	ceilingMs: next.ceilingMs,
-	armedAtMs
-} : {
-	floorMs: Math.min(existing.floorMs, next.floorMs),
-	ceilingMs: Math.max(existing.ceilingMs, next.ceilingMs),
-	armedAtMs: Math.max(existing.armedAtMs, armedAtMs)
-};
-var AmbiguousCreateLatch = class {
-	entries = /* @__PURE__ */ new Map();
-	scope;
-	constructor(scope) {
-		this.scope = scope;
-	}
-	noteFailure(logicalId, error, attemptStartMs, carried) {
-		if (!isAmbiguousOutcomeError(error)) return;
-		const key = createAttemptKey(this.scope, logicalId);
-		const now = Date.now();
-		let entry = mergeWindow(this.entries.get(key), {
-			floorMs: attemptStartMs - CREATION_DATE_SKEW_MARGIN_MS,
-			ceilingMs: now + CREATION_DATE_SKEW_MARGIN_MS
-		}, now);
-		if (carried !== void 0) entry = mergeWindow(entry, carried, now);
-		setBounded(this.entries, key, entry);
-	}
-	take(logicalId) {
-		const key = createAttemptKey(this.scope, logicalId);
-		const entry = this.entries.get(key);
-		this.entries.delete(key);
-		if (entry === void 0 || Date.now() - entry.armedAtMs > 18e5) return;
-		return {
-			floorMs: entry.floorMs,
-			ceilingMs: entry.ceilingMs
-		};
-	}
-	resetForTests() {
-		this.entries.clear();
-	}
-};
-const isInsideWindow = (date, window) => date !== void 0 && date.getTime() >= window.floorMs && date.getTime() <= window.ceilingMs;
-var RecentIdSet = class {
-	ids = /* @__PURE__ */ new Map();
-	add(id) {
-		setBounded(this.ids, id, true);
-	}
-	has(id) {
-		return this.ids.has(id);
-	}
-	resetForTests() {
-		this.ids.clear();
-	}
-};
-const isRetryStrategyV2 = (value) => typeof value === "object" && value !== null && typeof value.acquireInitialRetryToken === "function" && typeof value.refreshRetryTokenForRetry === "function" && typeof value.recordSuccess === "function";
-function withoutServerErrorRetries(client) {
-	const config = client.config;
-	const base = config?.retryStrategy;
-	if (config === void 0 || typeof base !== "function") return client;
-	const resolveBase = base;
-	config.retryStrategy = async () => {
-		const strategy = await resolveBase();
-		if (!isRetryStrategyV2(strategy)) return strategy;
-		return {
-			acquireInitialRetryToken: (scope) => strategy.acquireInitialRetryToken(scope),
-			refreshRetryTokenForRetry: (token, errorInfo) => {
-				if (isTransientServerError(errorInfo.error) && isAmbiguousOutcomeError(errorInfo.error)) return Promise.reject(/* @__PURE__ */ new Error("cdkd: no SDK retry of a 5xx on a tokenless create"));
-				return strategy.refreshRetryTokenForRetry(token, errorInfo);
-			},
-			recordSuccess: (token) => strategy.recordSuccess(token)
-		};
-	};
-	return client;
-}
-
 //#endregion
 //#region src/provisioning/providers/orphan-report.ts
 async function orphanCommandRegionArg(client, aws) {
@@ -13460,6 +13402,19 @@ var EventBridgeBusProvider = class {
 	constructor() {
 		this.eventBridgeClient = getAwsClients().eventBridge;
 	}
+	createClient;
+	getCreateClient() {
+		const shared = this.eventBridgeClient;
+		if (!(shared instanceof EventBridgeClient)) return Promise.resolve(shared);
+		this.createClient ??= shared.config.region().then((region) => withoutServerErrorRetries(new EventBridgeClient({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const name = properties["Name"];
@@ -13474,7 +13429,7 @@ var EventBridgeBusProvider = class {
 			const dlcCreate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
 			if (dlcCreate) createParams.DeadLetterConfig = dlcCreate;
 			if (properties["LogConfig"] !== void 0) createParams.LogConfig = properties["LogConfig"];
-			const response = await this.eventBridgeClient.send(new CreateEventBusCommand(createParams));
+			const response = await (await this.getCreateClient()).send(new CreateEventBusCommand(createParams));
 			if (properties["Policy"]) {}
 			return {
 				physicalId: name,
@@ -13766,6 +13721,22 @@ function isEc2NotFoundCode(error) {
 	const name = error?.name;
 	return typeof name === "string" && name.endsWith(".NotFound");
 }
+function isNamedError(error, names) {
+	const name = error?.name;
+	return typeof name === "string" && names.has(name);
+}
+const NAT_GATEWAY_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["NatGatewayNotFound"]);
+const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
+const NAT_GATEWAY_ID_PATTERN = /^nat-[0-9a-f]+$/;
+const EIP_ALLOCATION_ID_PATTERN = /^eipalloc-[0-9a-f]+$/;
+function natGatewayIdentity(physicalId) {
+	return NAT_GATEWAY_ID_PATTERN.test(physicalId) ? physicalId : void 0;
+}
+function eipAllocationIdentity(physicalId) {
+	const segments = physicalId.split("|");
+	const allocationId = segments.length === 1 ? segments[0] : segments.length === 2 ? segments[1] : void 0;
+	return allocationId !== void 0 && EIP_ALLOCATION_ID_PATTERN.test(allocationId) ? allocationId : void 0;
+}
 const createVpcLatch = new AmbiguousCreateLatch("ec2:CreateVpc");
 const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
 const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
@@ -14097,6 +14068,51 @@ var EC2Provider = class {
 			default: return;
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		let read;
+		let journaledId;
+		let recordId;
+		if (resourceType === "AWS::EC2::NatGateway") {
+			journaledId = natGatewayIdentity(journaledPhysicalId);
+			recordId = natGatewayIdentity(record.physicalId);
+			read = (id) => this.readNatGatewayIdIfLive(id);
+		} else if (resourceType === "AWS::EC2::EIP") {
+			journaledId = eipAllocationIdentity(journaledPhysicalId);
+			recordId = eipAllocationIdentity(record.physicalId);
+			read = (id) => this.readEipAllocationIdIfExists(id);
+		} else return "unknown";
+		if (journaledId === void 0 || recordId === void 0) return "unknown";
+		if (journaledId === recordId) return "same";
+		if (resourceType === "AWS::EC2::EIP" && journaledPhysicalId === journaledId) return "unknown";
+		if (await this.ec2Client.config.region() !== context.expectedRegion) return "unknown";
+		if (await read(recordId) !== recordId) return "unknown";
+		return await read(journaledId) === recordId ? "same" : "different";
+	}
+	async readNatGatewayIdIfLive(natGatewayId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [natGatewayId] }));
+		} catch (error) {
+			if (isNamedError(error, NAT_GATEWAY_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const gateways = response.NatGateways ?? [];
+		if (gateways.length !== 1 || typeof gateways[0]?.NatGatewayId !== "string") throw new Error("DescribeNatGateways did not return exactly the gateway asked for");
+		const gateway = gateways[0];
+		return gateway.State === "pending" || gateway.State === "available" ? gateway.NatGatewayId : void 0;
+	}
+	async readEipAllocationIdIfExists(allocationId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }));
+		} catch (error) {
+			if (isNamedError(error, EIP_ALLOCATION_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const addresses = response.Addresses ?? [];
+		if (addresses.length !== 1 || typeof addresses[0]?.AllocationId !== "string") throw new Error("DescribeAddresses did not return exactly the address asked for");
+		return addresses[0].AllocationId;
+	}
 	async createVpc(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating VPC ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -14610,7 +14626,8 @@ var EC2Provider = class {
 			if (this.isNotFoundError(error)) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Elastic IP ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -14742,7 +14759,8 @@ var EC2Provider = class {
 			if (this.isNotFoundError(error)) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`NatGateway ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  NAT gateway ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`NatGateway ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -34469,8 +34487,12 @@ function comparableRecordSize(value, mask) {
 }
 const KINESIS_DELETE_POLL_INTERVAL_MS = 2e3;
 const KINESIS_DELETE_MAX_WAIT_MS = 3e5;
+function isStreamName(id) {
+	return /^[a-zA-Z0-9_.-]{1,128}$/.test(id);
+}
 var KinesisStreamProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("KinesisProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::Stream", /* @__PURE__ */ new Set([
@@ -34490,6 +34512,13 @@ var KinesisStreamProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new KinesisClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const warn = (message) => this.logger.warn(mask(message));
@@ -34519,7 +34548,7 @@ var KinesisStreamProvider = class {
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
 			const maxRecordSizeInKiB = maxRecordRead.kind === "usable" ? maxRecordRead.size : void 0;
-			await this.getClient().send(new CreateStreamCommand({
+			await this.getCreateClient().send(new CreateStreamCommand({
 				StreamName: streamName,
 				...shardCount !== void 0 && { ShardCount: shardCount },
 				StreamModeDetails: { StreamMode: streamMode },
@@ -34716,7 +34745,8 @@ var KinesisStreamProvider = class {
 			if (error instanceof ResourceNotFoundException$10) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Kinesis stream ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -34732,6 +34762,28 @@ var KinesisStreamProvider = class {
 		});
 		this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 	}
+	async isSameResource(journaledPhysicalId, record, _resourceType, context) {
+		if (!isStreamName(journaledPhysicalId) || !isStreamName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordArn = await this.readStreamArnIfExists(record.physicalId);
+		if (recordArn === void 0) return "unknown";
+		const journaledArn = await this.readStreamArnIfExists(journaledPhysicalId);
+		if (journaledArn === void 0) return "different";
+		return journaledArn === recordArn ? "same" : "different";
+	}
+	async readStreamArnIfExists(streamName) {
+		let response;
+		try {
+			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return void 0;
+			throw error;
+		}
+		const arn = response.StreamDescriptionSummary?.StreamARN;
+		if (typeof arn !== "string" || arn === "") throw new Error("DescribeStreamSummary returned no StreamARN");
+		return arn;
+	}
 	async readStreamStatusForDelete(streamName) {
 		try {
 			return (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }))).StreamDescriptionSummary?.StreamStatus ?? "UNKNOWN";
@@ -42656,6 +42708,7 @@ var S3TablesProvider = class {
 //#region src/provisioning/providers/ecr-provider.ts
 var ECRProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ECRProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ECR::Repository", /* @__PURE__ */ new Set([
@@ -42676,6 +42729,13 @@ var ECRProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new ECRClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
 	toSdkScanningConfig(cfn) {
 		if (!cfn) return void 0;
 		return { scanOnPush: Boolean(cfn["ScanOnPush"]) };
@@ -42715,7 +42775,7 @@ var ECRProvider = class {
 			const scanningConfig = this.toSdkScanningConfig(properties["ImageScanningConfiguration"]);
 			const encryptionConfig = this.toSdkEncryptionConfig(properties["EncryptionConfiguration"]);
 			const exclusionFilters = this.toSdkTagMutabilityExclusionFilters(properties["ImageTagMutabilityExclusionFilters"]);
-			const response = await this.getClient().send(new CreateRepositoryCommand({
+			const response = await this.getCreateClient().send(new CreateRepositoryCommand({
 				repositoryName,
 				...scanningConfig ? { imageScanningConfiguration: scanningConfig } : {},
 				...properties["ImageTagMutability"] ? { imageTagMutability: properties["ImageTagMutability"] } : {},
@@ -42974,7 +43034,7 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} under parent ${displayStackName(ctx.parentStackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
+		if (!childTemplatePath) throw markNonRetryable(/* @__PURE__ */ new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} under parent ${displayStackName(ctx.parentStackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`));
 		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
 		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
@@ -43009,7 +43069,7 @@ var NestedStackProvider = class {
 		if (context?.replayingState === true) return this.revertFromChildJournal(ctx, logicalId, physicalId);
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} on update.`);
+		if (!childTemplatePath) throw markNonRetryable(/* @__PURE__ */ new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} on update.`));
 		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
 		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
@@ -43103,7 +43163,7 @@ var NestedStackProvider = class {
 				opts: { plainIdent: true }
 			}]);
 			const failure = new Error(nestedStackChildFailureMessage(plainOrDescribed(childStackName, "stack name"), childResult.errorCount, childResult.skippedCount, childResult.interrupted, inspect.command, withheldTargetClause(inspect, "stack", "cdkd state show", "The child stack's name")));
-			throw childResult.interrupted ? markNonRetryable(failure) : failure;
+			throw markNonRetryable(failure);
 		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
 			const causes = [];
@@ -43116,7 +43176,7 @@ var NestedStackProvider = class {
 		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
-		throw new Error(`AWS::CloudFormation::Stack: attribute ${displayIdent(attributeName)} is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`AWS::CloudFormation::Stack: attribute ${displayIdent(attributeName)} is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`));
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
 		const inheritedSecrets = getCurrentResourceSecrets();
@@ -43150,7 +43210,7 @@ var NestedStackProvider = class {
 	}
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
-		if (!childStateData) throw new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`);
+		if (!childStateData) throw markNonRetryable(/* @__PURE__ */ new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`));
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
@@ -43174,7 +43234,7 @@ var NestedStackProvider = class {
 		return ctx;
 	}
 	requireDeployContext(ctx, op) {
-		if (!ctx.nestedTemplates || !ctx.dagBuilder || !ctx.diffCalculator) throw new Error(`NestedStackProvider.${op}: deploy-mode context fields (nestedTemplates / dagBuilder / diffCalculator) are missing. This usually means a destroy-mode entry point called into create/update by mistake.`);
+		if (!ctx.nestedTemplates || !ctx.dagBuilder || !ctx.diffCalculator) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider.${op}: deploy-mode context fields (nestedTemplates / dagBuilder / diffCalculator) are missing. This usually means a destroy-mode entry point called into create/update by mistake.`));
 	}
 	refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath) {
 		const defect = findNestedTemplateTreeDefect({ [logicalId]: childTemplatePath });
@@ -43201,7 +43261,7 @@ var NestedStackProvider = class {
 		return result;
 	}
 	refuseNonScalarParameter(k, offender, where) {
-		throw new Error(`NestedStackProvider: child Parameter ${displayIdent(k)}${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: child Parameter ${displayIdent(k)}${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`));
 	}
 	readChildTemplate(templatePath, assetRedirect) {
 		let raw;
@@ -43214,7 +43274,7 @@ var NestedStackProvider = class {
 		try {
 			template = JSON.parse(raw);
 		} catch (err) {
-			throw new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`);
+			throw markNonRetryable(/* @__PURE__ */ new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`));
 		}
 		const grandchildTemplates = this.indexGrandchildTemplates(template, templatePath);
 		if (assetRedirect) {
@@ -43625,4 +43685,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-oRTqcSCp.js.map
+//# sourceMappingURL=provider-classes-CxXTKgEM.js.map