@go-to-k/cdkd 0.299.6 → 0.299.8

package/dist/{provider-classes-Dnof5qun.js → provider-classes-DmohfhIq.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-dAY3-gXJ.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-DZhdwU1d.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DIo2_z0s.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CvyqGZ2h.js";
-import { RDSProvider } from "./rds-provider--_cLSeij.js";
-import { NeptuneProvider } from "./neptune-provider-eZd5MtAD.js";
-import { ASGProvider } from "./asg-provider-SsXASjNc.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-BU3iY59A.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8O3q2ua.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-C87Q8YFK.js";
+import { RDSProvider } from "./rds-provider-Br3hPyHP.js";
+import { NeptuneProvider } from "./neptune-provider-CuJF3t-Q.js";
+import { ASGProvider } from "./asg-provider-ebjf5E8o.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -9470,7 +9470,8 @@ var LambdaLayerVersionProvider = class {
 			throw wrapMaskedAwsError(log.mask, error, (text) => new ProvisioningError(`Failed to create Lambda layer version ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	async update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, _properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.lambdaClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS Lambda LayerVersion is immutable on AWS — there is no UpdateLayerVersion API; every change requires PublishLayerVersion (a new version with a new LayerVersionArn). cdkd normally classifies any LayerVersion property change as a replacement (DELETE + CREATE), so reaching this path is unexpected; re-run the deploy or change the resource definition to publish a new version."));
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -12203,6 +12204,10 @@ function isTransientStreamReadFailure(err) {
 
 //#endregion
 //#region src/provisioning/providers/logs-loggroup-provider.ts
+const LOG_GROUP_TYPE = "AWS::Logs::LogGroup";
+function isLogGroupName(id) {
+	return /^[A-Za-z0-9._/#-]{1,512}$/.test(id);
+}
 function isAbsentRetention(raw, desiredFromAwsReadback) {
 	if (raw === void 0) return true;
 	if (typeof raw === "string" && raw.trim() === "") return true;
@@ -12557,13 +12562,56 @@ var LogsLogGroupProvider = class {
 			if (error instanceof ResourceNotFoundException$5) {
 				const clientRegion = await this.logsClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Log group ${physicalId} does not exist, skipping deletion`);
+				this.logGoneOnDelete(logicalId, physicalId, context);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete log group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	logGoneOnDelete(logicalId, physicalId, context) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Log group ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(`Log group ${physicalId} does not exist, skipping deletion`);
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== LOG_GROUP_TYPE) return "unknown";
+		if (!isLogGroupName(journaledPhysicalId) || !isLogGroupName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.logsClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordGroup = await this.readIdentityIfExists(record.physicalId);
+		if (recordGroup === void 0) return "unknown";
+		const journaledGroup = await this.readIdentityIfExists(journaledPhysicalId);
+		if (journaledGroup === void 0) return "different";
+		return journaledGroup.arn === recordGroup.arn ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== LOG_GROUP_TYPE || !isLogGroupName(physicalId)) return void 0;
+		if (await this.logsClient.config.region() !== context.expectedRegion) return void 0;
+		const group = await this.readIdentityIfExists(physicalId);
+		if (group === void 0) return RESOURCE_NOT_FOUND;
+		if (group.creationTime === void 0) return void 0;
+		return `${group.arn}@${group.creationTime}`;
+	}
+	async readIdentityIfExists(name) {
+		let found;
+		try {
+			const response = await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: name }));
+			found = response.logGroups?.find((g) => g.logGroupName === name);
+			if (found === void 0 && response.nextToken) throw new Error("CloudWatch Logs did not list the log group on a first page that has more pages");
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$5) return void 0;
+			throw error;
+		}
+		if (found === void 0) return void 0;
+		const arn = found.logGroupArn;
+		if (typeof arn !== "string" || arn === "") throw new Error("CloudWatch Logs returned no logGroupArn");
+		const created = found.creationTime;
+		return {
+			arn,
+			creationTime: typeof created === "number" && Number.isSafeInteger(created) && created > 0 ? created : void 0
+		};
+	}
 	async buildArn(logGroupName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -21739,8 +21787,9 @@ var AgentCoreRuntimeProvider = class {
 			throw new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating BedrockAgentCore Runtime ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for ${logicalId}`, resourceType, logicalId, physicalId);
 		try {
@@ -21891,7 +21940,7 @@ var AgentCoreBrowserProvider = class {
 			throw new ProvisioningError(`Failed to adopt the AWS-managed default browser for ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties, _context) {
 		this.logger.debug(`No-op update for default browser ${logicalId}`);
 		return {
 			physicalId,
@@ -21958,7 +22007,7 @@ var AgentCoreCodeInterpreterProvider = class {
 			throw new ProvisioningError(`Failed to adopt the AWS-managed default code interpreter for ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties, _context) {
 		this.logger.debug(`No-op update for default code interpreter ${logicalId}`);
 		return {
 			physicalId,
@@ -22054,8 +22103,9 @@ var AgentCoreEvaluatorProvider = class {
 			throw new ProvisioningError(`Failed to create BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating BedrockAgentCore Evaluator ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const input = { evaluatorId: evaluatorIdFromArn(physicalId) };
@@ -24120,6 +24170,21 @@ function elbv2ArnScope(resourceType, physicalId) {
 	const match = ELBV2_ARN_PATTERNS.get(resourceType)?.exec(physicalId);
 	return match ? `${match[1]}:${match[2]}:${match[3]}` : void 0;
 }
+const LISTENER_LEFT_IN_PLACE_ON_REMOVAL = [
+	"AlpnPolicy",
+	"Certificates",
+	"MutualAuthentication",
+	"Port",
+	"Protocol",
+	"SslPolicy"
+];
+const LISTENER_TLS_DOWNGRADE = /* @__PURE__ */ new Map([["HTTPS", "HTTP"], ["TLS", "TCP"]]);
+const CLEARED_BY_TLS_DOWNGRADE = /* @__PURE__ */ new Set(["SslPolicy", "Certificates"]);
+const listenerLeftInPlaceWarning = (logicalId, names, caller) => {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyListener keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+};
 var ELBv2Provider = class {
 	elbv2Client;
 	providerRegion = ambientRegion();
@@ -24177,6 +24242,13 @@ var ELBv2Provider = class {
 			"Tags"
 		])]
 	]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
+		"LoadBalancerArn",
+		"DefaultActions",
+		"ListenerAttributes",
+		"Tags",
+		...LISTENER_LEFT_IN_PLACE_ON_REMOVAL
+	])]]);
 	getClient() {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
 			...ambientClientDefaults(),
@@ -24222,7 +24294,7 @@ var ELBv2Provider = class {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.desiredFromAwsReadback === true);
 			case "AWS::ElasticLoadBalancingV2::TargetGroup": return this.updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.desiredFromAwsReadback === true);
-			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.desiredFromAwsReadback === true);
+			case "AWS::ElasticLoadBalancingV2::Listener": return this.updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -24806,9 +24878,16 @@ var ELBv2Provider = class {
 			throw thrown;
 		}
 	}
-	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets, fromReadback = false) {
+	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const maskSecrets = context?.maskSecrets;
+		const fromReadback = context?.desiredFromAwsReadback === true;
 		this.logger.debug(`Updating Listener ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const removed = context?.removedProperties;
+		const desiredProtocol = properties["Protocol"];
+		const previousProtocol = previousProperties["Protocol"];
+		const tlsDowngrade = typeof desiredProtocol === "string" && typeof previousProtocol === "string" && LISTENER_TLS_DOWNGRADE.get(previousProtocol) === desiredProtocol;
+		const leftInPlaceNames = LISTENER_LEFT_IN_PLACE_ON_REMOVAL.filter((key) => (removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0) && !(tlsDowngrade && CLEARED_BY_TLS_DOWNGRADE.has(key)));
 		try {
 			const defaultActions = this.convertActions(properties["DefaultActions"]);
 			const certificates = this.convertCertificates(properties["Certificates"]);
@@ -24843,6 +24922,7 @@ var ELBv2Provider = class {
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskSecrets);
 			this.logger.debug(`Successfully updated Listener ${logicalId}`);
+			if (leftInPlaceNames.length > 0 && !fromReadback) this.logger.warn(listenerLeftInPlaceWarning(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -27045,9 +27125,10 @@ var DocDBSubnetGroupProvider = class {
 			throw new ProvisioningError(`Failed to create DocDB DBSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbSubnetGroupName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.assertType(resourceType, logicalId, physicalId);
 		this.logger.debug(safeMsg`Updating DocDB DBSubnetGroup ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const subnetIds = properties["SubnetIds"];
@@ -40779,7 +40860,8 @@ var FirehoseProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
 		} catch (error) {
@@ -42916,7 +42998,8 @@ var DLMLifecyclePolicyProvider = class {
 			throw new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "DefaultPolicy cannot be changed in place; re-run with `cdkd deploy --replace` to recreate the policy (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)");
 		this.logger.debug(`Updating DLM Lifecycle Policy ${logicalId} (${physicalId})`);
@@ -44869,7 +44952,7 @@ var WaitConditionHandleProvider = class {
 			attributes: {}
 		};
 	}
-	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties, _context) {
 		this.logger.debug(`No-op update for WaitConditionHandle ${logicalId}`);
 		return {
 			physicalId,
@@ -45234,4 +45317,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dnof5qun.js.map
+//# sourceMappingURL=provider-classes-DmohfhIq.js.map