@go-to-k/cdkd 0.299.8 → 0.300.0

package/dist/{provider-classes-DmohfhIq.js → provider-classes-CVC9_-km.js}

@@ -1,13 +1,13 @@
-import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
+import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-dAY3-gXJ.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-BxP3yqlr.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-BU3iY59A.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8O3q2ua.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-C87Q8YFK.js";
-import { RDSProvider } from "./rds-provider-Br3hPyHP.js";
-import { NeptuneProvider } from "./neptune-provider-CuJF3t-Q.js";
-import { ASGProvider } from "./asg-provider-ebjf5E8o.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as findSilentDropProperties, Ao as lambdaFunctionNameForMask, Ar as unchangedBehindSecretReference, At as withNestedStackContext, Br as ec2InstanceProtectionSite, Bt as awaitInFlightSibling, C as withApiLimit, Cl as derivePartitionAndUrlSuffix, Co as requireConfigObject, Cr as getCurrentResourceSecrets, Cs as physicalNameCopiesOf, Ds as carriesSecretMask, Fl as renderAssemblyPathEscape, Fr as deleteSkipReason, G as deleteBudgetKey, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as observeThenDisableInstanceApiTermination, Ht as getStackRecords, Il as resolveAssemblyPath, Ir as withIndeterminateGuard, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Li as passedParameterClassesOf, Lr as isWaitAbandonedError, Nl as describeFileReadFailure, Oo as withRetry, Pi as parseWebACLArn, Pl as displayAssemblyPath, Q as ECR_AUTO_DELETE_IMAGES_TAG, Rr as markWaitAbandoned, S as lookupEachName, Sl as canonicalizeRegion, So as requireConfigArray, Ss as recoverMaskedOutput, St as getNestedRevertRun, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Uo as passedNoEchoParametersOf, Ur as reDisableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as isTerminationProtectionPropagationError, W as compensateRemovedDeletionProtection, Wi as accountArgs, Wr as reEnableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Xo as hasMaskableValues, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, Za as withheldAccountClause, _c as rewriteTemplateAssetReferences, _o as configBooleanRefusal, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as readConfigString, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as planTagDiff, cs as markSameGenerationBag, do as coerceWarmThroughput$1, dr as tagMapAsList, ds as redactSecretsForState, et as hasCdkAutoDeleteTag, fc as stringifyValue, fi as s3BucketArn, fo as isWarmThroughputDecrease, fr as tagPlanWarning, gi as s3BucketWebsiteUrl, go as coerceCfnInteger, gs as dynamicReferenceTokens, hi as s3BucketRegionalDomainName, ho as coerceCfnBoolean, jo as sameLambdaFunctionAddress, ko as canonicalLambdaFunctionName, kr as slowCcOperationTimeoutMs, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as outputReferenceProvenanceOf, ln as redactedDeleteAddressFields, lr as readTagList, ls as recordReferenceProvenanceEntry, mi as s3BucketDualStackDomainName, mo as toFiniteNumber, mr as stringifyIfAssigned, ms as withoutPhysicalNameCopies, nt as getPriorAttempts, or as DBPROXY_TAGS_WHAT, pi as s3BucketDomainName, po as toCfnInteger, pr as definedAttributes, q as resolveDynamoDbDeleteBudgetMs, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, si as isSettledInstanceState, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as DBPROXY_TAG_OPTIONS, t as DeployEngine, to as withoutSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, uo as WARM_THROUGHPUT_MEMBERS, ur as refuseMalformedDesiredTags, us as snapshotPassProvenance, vo as configIntegerRefusal, wi as getAccountInfo, wo as requireConfigString, ws as recordAttributeIdCopy, x as isAccessDeniedError, xo as replayWarn, ya as refuseMalformedNestedChildOutputs, yl as decodeListingKey, yo as configStringRefusal, za as refuseMalformedResourcesForDestroy } from "./deploy-engine-C-4ho8TJ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-a-8z7Dpm.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BHjdsRtD.js";
+import { RDSProvider } from "./rds-provider-QKN-WHF3.js";
+import { NeptuneProvider } from "./neptune-provider-Bnr2VC6V.js";
+import { ASGProvider } from "./asg-provider-COcKVcvZ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -28,6 +28,8 @@ import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluat
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$7, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-elasticache";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
+import { CreateWebFunctionEndpointCommand, CreateWebFunctionRevisionCommand, DeleteWebFunctionEndpointCommand, DeleteWebFunctionRevisionCommand, GetWebFunctionEndpointCommand, GetWebFunctionRevisionCommand, LambdaWebClient, ListWebFunctionRevisionsCommand, ResourceNotFoundException as ResourceNotFoundException$9, UpdateWebFunctionEndpointCommand } from "@aws-sdk/client-lambda-web";
+import { CreateNetworkConnectorCommand, DeleteNetworkConnectorCommand, GetNetworkConnectorCommand, LambdaCoreClient, ResourceNotFoundException as ResourceNotFoundException$10, UpdateNetworkConnectorCommand } from "@aws-sdk/client-lambda-core";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
@@ -42,22 +44,22 @@ import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMach
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$13, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
@@ -1421,6 +1423,7 @@ var IAMInstanceProfileProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/iam-access-key-provider.ts
+const ACCESS_KEY_ID_PATTERN = /^AKIA[A-Z0-9]{16}$/;
 const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
 var IAMAccessKeyProvider = class {
 	iamClient;
@@ -1640,9 +1643,16 @@ var IAMAccessKeyProvider = class {
 		throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType} (only 'Id' and 'SecretAccessKey' are defined)`, resourceType, logicalId, physicalId);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const found = await this.findAccessKey(physicalId);
+		if (found === void 0 || found === RESOURCE_NOT_FOUND) return found;
+		const result = { UserName: found.userName };
+		if (found.status !== void 0) result["Status"] = found.status;
+		return result;
+	}
+	async findAccessKey(accessKeyId) {
 		let userName;
 		try {
-			userName = (await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: physicalId }))).UserName;
+			userName = (await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: accessKeyId }))).UserName;
 		} catch (err) {
 			if (err instanceof NoSuchEntityException) return RESOURCE_NOT_FOUND;
 			throw err;
@@ -1660,15 +1670,23 @@ var IAMAccessKeyProvider = class {
 				if (err instanceof NoSuchEntityException) return RESOURCE_NOT_FOUND;
 				throw err;
 			}
-			for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId === physicalId) {
-				const result = { UserName: userName };
-				if (key.Status !== void 0) result["Status"] = key.Status;
-				return result;
-			}
+			for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId === accessKeyId) return {
+				userName,
+				status: key.Status
+			};
 			marker = page.IsTruncated ? page.Marker : void 0;
 		} while (marker);
 		return RESOURCE_NOT_FOUND;
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::IAM::AccessKey") return "unknown";
+		if (!ACCESS_KEY_ID_PATTERN.test(journaledPhysicalId) || !ACCESS_KEY_ID_PATTERN.test(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordKey = await this.findAccessKey(record.physicalId);
+		if (recordKey === void 0 || recordKey === RESOURCE_NOT_FOUND) return "unknown";
+		return await this.findAccessKey(journaledPhysicalId) === void 0 ? "unknown" : "different";
+	}
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::IAM::AccessKey") return ["Serial"];
 		return [];
@@ -5419,7 +5437,7 @@ var S3BucketPolicyProvider = class {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 bucket policy ${logicalId}`);
 		const bucketName = properties["Bucket"];
 		const policyDocument = properties["PolicyDocument"];
@@ -5437,8 +5455,7 @@ var S3BucketPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
+			throw this.wrapOperationError("create", logicalId, resourceType, bucketName, error, context?.maskSecrets);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
@@ -5461,8 +5478,7 @@ var S3BucketPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -5487,10 +5503,17 @@ var S3BucketPolicyProvider = class {
 				throw error;
 			}
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error, maskSecrets) {
+		const mask = maskSecrets ?? ((t) => t);
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(`Failed to ${operation} S3 bucket policy ${logicalId}: ${failure.detail}`));
+		const cause = error instanceof Error ? error : void 0;
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket policy ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, cause);
+		return failure.redacted && cause !== void 0 ? markRedactedCause(wrapped) : wrapped;
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		let policyJson;
 		try {
@@ -6049,7 +6072,7 @@ var SQSQueuePolicyProvider = class {
 		const awsClients = getAwsClients();
 		this.sqsClient = awsClients.sqs;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SQS queue policy ${logicalId}`);
 		const queues = properties["Queues"];
 		const policyDocument = properties["PolicyDocument"];
@@ -6072,8 +6095,7 @@ var SQSQueuePolicyProvider = class {
 				attributes: { [WRITTEN_QUEUES_KEY]: queues.join(",") }
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queues[0], cause);
+			const thrown = this.wrapOperationError("create", logicalId, resourceType, queues[0], error, context?.maskSecrets);
 			if (applied.length > 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, applied.join(","));
 			throw thrown;
 		}
@@ -6105,8 +6127,7 @@ var SQSQueuePolicyProvider = class {
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -6119,8 +6140,7 @@ var SQSQueuePolicyProvider = class {
 			await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion);
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
@@ -6165,7 +6185,7 @@ var SQSQueuePolicyProvider = class {
 				await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context.expectedRegion);
 			} catch (error) {
 				if (error instanceof ProvisioningError) throw error;
-				throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+				throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context.maskSecrets);
 			}
 			else {
 				mismatched = true;
@@ -6181,6 +6201,14 @@ var SQSQueuePolicyProvider = class {
 			leftInPlace: QUEUE_POLICY_MISMATCH_LEFT_REASON
 		};
 	}
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error, maskSecrets) {
+		const mask = maskSecrets ?? ((t) => t);
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(`Failed to ${operation} SQS queue policy ${logicalId}: ${failure.detail}`));
+		const cause = error instanceof Error ? error : void 0;
+		const wrapped = new ProvisioningError(`Failed to ${operation} SQS queue policy ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, cause);
+		return failure.redacted && cause !== void 0 ? markRedactedCause(wrapped) : wrapped;
+	}
 	async clearQueuePolicy(queueUrl, resourceType, logicalId, expectedRegion, phase = "not-found") {
 		try {
 			await this.sqsClient.send(new SetQueueAttributesCommand({
@@ -7160,7 +7188,7 @@ const TOPIC_POLICY_NOT_COMPARED_LEFT_REASON = "the document it attempted is miss
 var SNSTopicPolicyProvider = class {
 	logger = getLogger().child("SNSTopicPolicyProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::SNS::TopicPolicy", /* @__PURE__ */ new Set(["Topics", "PolicyDocument"])]]);
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS topic policy ${logicalId}`);
 		const topics = properties["Topics"];
 		const policyDocument = properties["PolicyDocument"];
@@ -7179,7 +7207,7 @@ var SNSTopicPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			const thrown = new ProvisioningError(`Failed to create SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = this.wrapOperationError("create", logicalId, resourceType, void 0, error, context?.maskSecrets);
 			if (applied.length > 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, applied.join(","));
 			throw thrown;
 		}
@@ -7213,8 +7241,7 @@ var SNSTopicPolicyProvider = class {
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error, mask);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -7228,8 +7255,7 @@ var SNSTopicPolicyProvider = class {
 			await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion);
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
@@ -7281,7 +7307,7 @@ var SNSTopicPolicyProvider = class {
 					await this.resetTopicPolicy(topicArn, resourceType, logicalId, context.expectedRegion);
 				} catch (error) {
 					if (error instanceof ProvisioningError) throw error;
-					throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+					throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context.maskSecrets);
 				}
 				continue;
 			}
@@ -7302,6 +7328,14 @@ var SNSTopicPolicyProvider = class {
 			leftInPlace: TOPIC_POLICY_MISMATCH_LEFT_REASON
 		};
 	}
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error, maskSecrets) {
+		const mask = maskSecrets ?? ((t) => t);
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(`Failed to ${operation} SNS topic policy ${logicalId}: ${failure.detail}`));
+		const cause = error instanceof Error ? error : void 0;
+		const wrapped = new ProvisioningError(`Failed to ${operation} SNS topic policy ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, cause);
+		return failure.redacted && cause !== void 0 ? markRedactedCause(wrapped) : wrapped;
+	}
 	async resetTopicPolicy(topicArn, resourceType, logicalId, expectedRegion, phase = "not-found", mask = (t) => t) {
 		const defaultPolicy = defaultTopicPolicy(topicArn);
 		if (defaultPolicy === void 0) throw new ProvisioningError(`Cannot remove SNS topic policy ${logicalId} from ${topicArn}: not an SNS topic ARN`, resourceType, logicalId, topicArn);
@@ -10016,7 +10050,7 @@ var LambdaMicrovmImageProvider = class {
 			}
 			if (state === "CREATE_FAILED" || state === "UPDATE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered ${state} during ${operation}. Check the build logs in CloudWatch under /aws/lambda/microvms/ to diagnose.`);
 			this.logger.debug(`MicroVM image ${imageArn} state: ${state} (attempt ${attempt}/${this.maxPollAttempts})`);
-			await sleep$1(this.pollIntervalMs);
+			await sleep$2(this.pollIntervalMs);
 		}
 		throw new Error(`MicroVM image ${logicalIdShown(logicalId)} ${isPlainImportValue(imageArn) ? `(${imageArn})` : VALUE_NOT_SHOWN} did not finish ${operation} within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. Increase --resource-timeout AWS::Lambda::MicrovmImage=${commandHole("duration")} or set CDKD_NO_WAIT=true.`);
 	}
@@ -10031,7 +10065,7 @@ var LambdaMicrovmImageProvider = class {
 			}
 			if (resp.state === "DELETE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered DELETE_FAILED. Check the CloudWatch build logs under /aws/lambda/microvms/ to diagnose.`);
 			this.logger.debug(`MicroVM image ${imageArn} state: ${resp.state} (delete attempt ${attempt}/${this.maxPollAttempts})`);
-			await sleep$1(this.pollIntervalMs);
+			await sleep$2(this.pollIntervalMs);
 		}
 		throw new Error(`MicroVM image ${logicalId} (${imageArn}) was not fully deleted within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s.`);
 	}
@@ -10075,7 +10109,7 @@ function positiveIntFromEnv(value, dflt) {
 	const n = Number(value);
 	return Number.isFinite(n) && n > 0 ? n : dflt;
 }
-function sleep$1(ms) {
+function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function buildCommonImageInput(properties) {
@@ -10143,6 +10177,947 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/providers/lambda-web-function-arns.ts
+const CHILD_ARN = /^(arn:[^:]+:lambda:[^:]+:\d{12}:web-function\/[^/]+)\/(revision|endpoint)\/([^/]+)$/;
+function parseWebFunctionChildArn(arn, kind) {
+	const match = CHILD_ARN.exec(arn);
+	if (!match || match[2] !== kind) return void 0;
+	return {
+		functionArn: match[1],
+		childId: match[3]
+	};
+}
+function webFunctionNameOfArn(functionArn) {
+	return functionArn.slice(functionArn.lastIndexOf("/") + 1);
+}
+function recordedFunctionNameSpelling(recorded, liveFunctionArn) {
+	if (typeof recorded === "string" && (recorded === liveFunctionArn || recorded === webFunctionNameOfArn(liveFunctionArn))) return recorded;
+	return liveFunctionArn;
+}
+function projectOntoRecorded(recorded, live) {
+	if (!isPlainRecord$2(recorded) || !isPlainRecord$2(live)) return live;
+	const out = {};
+	for (const key of Object.keys(recorded)) {
+		if (!Object.prototype.hasOwnProperty.call(live, key)) continue;
+		out[key] = projectOntoRecorded(recorded[key], live[key]);
+	}
+	return out;
+}
+function isPlainRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const LAMBDA_WEB_MAX_POLL_ATTEMPTS = 1200;
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+//#endregion
+//#region src/provisioning/providers/lambda-web-function-revision-provider.ts
+const createRevisionLatch = new AmbiguousCreateLatch("lambda-web:CreateWebFunctionRevision");
+const revisionsCreatedByThisProcess = new RecentIdSet();
+var LambdaWebFunctionRevisionProvider = class {
+	client;
+	createClient;
+	logger = getLogger().child("LambdaWebFunctionRevisionProvider");
+	constructor() {
+		this.client = getAwsClients().lambdaWeb;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionRevision", /* @__PURE__ */ new Set([
+		"FunctionName",
+		"Description",
+		"KmsKeyArn",
+		"BuildConfig",
+		"ServiceConfig"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionRevision", /* @__PURE__ */ new Map([
+		["FunctionArn", "AWS-managed read-only attribute"],
+		["RevisionId", "AWS-managed read-only attribute"],
+		["RevisionArn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["State", "AWS-managed read-only attribute"],
+		["StateReason", "AWS-managed read-only attribute"],
+		["CreatedAt", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(safeMsg`Creating Lambda web function revision ${logicalId}`);
+		const input = this.buildCreateInput(logicalId, resourceType, properties, context);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		let createdArn;
+		try {
+			const orphanWindow = createRevisionLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, orphanWindow, log, input.functionName);
+			const createClient = await this.getCreateClient();
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateWebFunctionRevisionCommand(input));
+			} catch (error) {
+				createRevisionLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			createdArn = response.revisionArn;
+			if (createdArn) revisionsCreatedByThisProcess.add(createdArn);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, replayWindow, log, input.functionName);
+			if (!createdArn || !response.revisionId) throw new ProvisioningError(`CreateWebFunctionRevision succeeded but returned no revision ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			const active = await this.waitForActive(input.functionName, createdArn, logicalId);
+			return {
+				physicalId: createdArn,
+				attributes: buildAttributes$2(active)
+			};
+		} catch (error) {
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	getCreateClient() {
+		this.createClient ??= this.client.config.region().then((region) => withoutServerErrorRetries(new LambdaWebClient({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
+	}
+	async reportPossibleRevisionOrphans(logicalId, window, log, functionName) {
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.client, aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "CreateWebFunctionRevision",
+			service: "Lambda",
+			listAction: "ListWebFunctionRevisions",
+			subject: `a revision of web function ${log.value(functionName)}`,
+			noun: "revision(s)",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.client.send(new ListWebFunctionRevisionsCommand({
+					functionName,
+					...token && { nextToken: token }
+				}));
+				return {
+					items: page.revisions ?? [],
+					next: page.nextToken
+				};
+			}, (item) => item.revisionArn && isInsideWindow(item.createdAt, window) && !revisionsCreatedByThisProcess.has(item.revisionArn) ? item.revisionArn : void 0),
+			inspect: (id) => aws`aws cloudcontrol get-resource --type-name AWS::Lambda::WebFunctionRevision --identifier ${id}${regionArg}`.render(),
+			remove: (id) => aws`aws cloudcontrol delete-resource --type-name AWS::Lambda::WebFunctionRevision --identifier ${id}${regionArg}`.render()
+		});
+	}
+	async update(logicalId, physicalId, resourceType, _properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "A Lambda web function revision is immutable — every property is create-only and there is no update API, so any change creates a new revision. cdkd normally classifies such a change as a replacement, so reaching this path is unexpected; re-run the deploy."));
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(safeMsg`Deleting Lambda web function revision ${logicalId}`);
+		const parts = parseWebFunctionChildArn(physicalId, "revision");
+		if (!parts) throw new ProvisioningError(`Cannot delete Lambda web function revision ${logicalIdShown(logicalId)}: its recorded id is not a revision ARN`, resourceType, logicalId, physicalId);
+		try {
+			try {
+				await this.client.send(new DeleteWebFunctionRevisionCommand({
+					functionName: parts.functionArn,
+					revisionId: physicalId
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(safeMsg`Lambda web function revision ${logicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForGone(parts.functionArn, physicalId, logicalId);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		const parts = parseWebFunctionChildArn(physicalId, "revision");
+		if (attributeName === "RevisionArn") return physicalId;
+		if (attributeName === "RevisionId" && parts) return parts.childId;
+		if (attributeName === "FunctionArn" && parts) return parts.functionArn;
+		if (!parts) return void 0;
+		return buildAttributes$2(await this.client.send(new GetWebFunctionRevisionCommand({
+			functionName: parts.functionArn,
+			revisionId: physicalId
+		})))[attributeName];
+	}
+	async import(input) {
+		const arn = input.knownPhysicalId;
+		if (!arn) return null;
+		const parts = parseWebFunctionChildArn(arn, "revision");
+		if (!parts) throw new Error(`--resource override for ${logicalIdShown(input.logicalId)} must be a Lambda web function revision ARN (got ${isPlainImportValue(arn) ? `'${arn}'` : VALUE_NOT_SHOWN}); use the arn:...:web-function/<name>/revision/<id> ARN.`);
+		try {
+			return {
+				physicalId: arn,
+				attributes: buildAttributes$2(await this.client.send(new GetWebFunctionRevisionCommand({
+					functionName: parts.functionArn,
+					revisionId: arn
+				})))
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return null;
+			throw error;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
+		const parts = parseWebFunctionChildArn(physicalId, "revision");
+		if (!parts) return void 0;
+		let resp;
+		try {
+			resp = await this.client.send(new GetWebFunctionRevisionCommand({
+				functionName: parts.functionArn,
+				revisionId: physicalId
+			}));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const live = { FunctionName: recordedFunctionNameSpelling(properties?.["FunctionName"], resp.functionArn ?? parts.functionArn) };
+		if (resp.description !== void 0) live["Description"] = resp.description;
+		if (resp.kmsKeyArn !== void 0) live["KmsKeyArn"] = resp.kmsKeyArn;
+		if (resp.buildConfig) live["BuildConfig"] = buildConfigToCfn(resp.buildConfig);
+		if (resp.serviceConfig) live["ServiceConfig"] = serviceConfigToCfn(resp.serviceConfig);
+		if (!properties) return live;
+		const out = { FunctionName: live["FunctionName"] };
+		for (const key of [
+			"Description",
+			"KmsKeyArn",
+			"BuildConfig",
+			"ServiceConfig"
+		]) if (key in live) out[key] = projectOntoRecorded(properties[key], live[key]);
+		return out;
+	}
+	buildCreateInput(logicalId, resourceType, properties, context) {
+		const fail = (message) => {
+			throw new ProvisioningError(`${message} for Lambda web function revision ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+		};
+		const functionName = properties["FunctionName"];
+		if (typeof functionName !== "string" || functionName === "") fail("FunctionName must be a non-empty string");
+		const build = properties["BuildConfig"];
+		if (!isPlainRecord$2(build)) fail("BuildConfig must be an object");
+		const code = build["CodeConfig"];
+		const s3 = isPlainRecord$2(code) ? code["S3Object"] : void 0;
+		if (!isPlainRecord$2(s3) || typeof s3["Bucket"] !== "string" || typeof s3["Key"] !== "string") fail("BuildConfig.CodeConfig.S3Object.Bucket and .Key are required strings");
+		const runtimeConfig = build["RuntimeConfig"];
+		const runtime = isPlainRecord$2(runtimeConfig) ? runtimeConfig["Runtime"] : void 0;
+		if (typeof runtime !== "string") fail("BuildConfig.RuntimeConfig.Runtime is a required string");
+		const service = properties["ServiceConfig"];
+		if (!isPlainRecord$2(service) || typeof service["ExecutionRoleArn"] !== "string") fail("ServiceConfig.ExecutionRoleArn is a required string");
+		const s3Object = s3;
+		const input = {
+			functionName,
+			buildConfig: {
+				codeConfig: { s3Object: {
+					bucket: s3Object["Bucket"],
+					key: s3Object["Key"],
+					...typeof s3Object["VersionId"] === "string" ? { versionId: s3Object["VersionId"] } : {}
+				} },
+				runtimeConfig: { runtime }
+			},
+			serviceConfig: this.buildServiceConfig(service, fail, context)
+		};
+		if (typeof properties["Description"] === "string") input.description = properties["Description"];
+		if (typeof properties["KmsKeyArn"] === "string") input.kmsKeyArn = properties["KmsKeyArn"];
+		return input;
+	}
+	buildServiceConfig(service, fail, context) {
+		const out = { executionRoleArn: service["ExecutionRoleArn"] };
+		const integer = (key) => {
+			const raw = service[key];
+			if (raw === void 0) return void 0;
+			const n = coerceCfnInteger(raw);
+			if (n !== void 0) return n;
+			const message = `ServiceConfig.${key} must be an integer`;
+			if (context?.replayingState) {
+				this.logger.warn(safeMsg`${message}; omitting it while replaying a state record`);
+				return;
+			}
+			return fail(message);
+		};
+		const timeoutSeconds = integer("TimeoutSeconds");
+		if (timeoutSeconds !== void 0) out.timeoutSeconds = timeoutSeconds;
+		const maxConcurrencyPerEnvironment = integer("MaxConcurrencyPerEnvironment");
+		if (maxConcurrencyPerEnvironment !== void 0) out.maxConcurrencyPerEnvironment = maxConcurrencyPerEnvironment;
+		if (typeof service["EgressNetworkConnectorArn"] === "string") out.egressNetworkConnectorArn = service["EgressNetworkConnectorArn"];
+		const env = service["EnvironmentVariables"];
+		if (env !== void 0) {
+			if (isPlainRecord$2(env) && Object.values(env).every((v) => typeof v === "string")) out.environmentVariables = { ...env };
+			else if (context?.replayingState) this.logger.warn(safeMsg`ServiceConfig.EnvironmentVariables must be an object of string values; omitting it while replaying a state record`);
+			else fail("ServiceConfig.EnvironmentVariables must be an object of string values");
+		}
+		const telemetry = service["TelemetryConfig"];
+		if (isPlainRecord$2(telemetry)) {
+			const telemetryConfig = {};
+			const logging = telemetry["LoggingConfig"];
+			if (isPlainRecord$2(logging)) {
+				const loggingConfig = {};
+				if (typeof logging["LogGroup"] === "string") loggingConfig.logGroup = logging["LogGroup"];
+				if (typeof logging["ApplicationLogLevel"] === "string") loggingConfig.applicationLogLevel = logging["ApplicationLogLevel"];
+				if (typeof logging["SystemLogLevel"] === "string") loggingConfig.systemLogLevel = logging["SystemLogLevel"];
+				telemetryConfig.loggingConfig = loggingConfig;
+			}
+			out.telemetryConfig = telemetryConfig;
+		}
+		return out;
+	}
+	async waitForActive(functionName, revisionArn, logicalId) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			const resp = await this.client.send(new GetWebFunctionRevisionCommand({
+				functionName,
+				revisionId: revisionArn
+			}));
+			if (resp.state === "Active") return resp;
+			if (resp.state === "Failed") {
+				const errors = (resp.errors ?? []).map((e) => `${e.errorCode ?? ""} ${e.errorMessage ?? ""}`.trim());
+				throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}` + (errors.length > 0 ? ` (${errors.join("; ")})` : ""));
+			}
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} did not become Active within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	async waitForGone(functionName, revisionArn, logicalId) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			try {
+				await this.client.send(new GetWebFunctionRevisionCommand({
+					functionName,
+					revisionId: revisionArn
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) return;
+				throw error;
+			}
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} Lambda web function revision ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+function buildAttributes$2(resp) {
+	return definedAttributes({
+		RevisionArn: resp.revisionArn,
+		RevisionId: resp.revisionId,
+		FunctionArn: resp.functionArn,
+		State: resp.state,
+		StateReason: resp.stateReason,
+		CreatedAt: resp.createdAt?.toISOString()
+	});
+}
+function buildConfigToCfn(config) {
+	const out = {};
+	const s3 = config.codeConfig && "s3Object" in config.codeConfig ? config.codeConfig.s3Object : void 0;
+	if (s3) {
+		const S3Object = {
+			Bucket: s3.bucket,
+			Key: s3.key
+		};
+		if (s3.versionId !== void 0) S3Object["VersionId"] = s3.versionId;
+		out["CodeConfig"] = { S3Object };
+	}
+	if (config.runtimeConfig) out["RuntimeConfig"] = { Runtime: config.runtimeConfig.runtime };
+	return out;
+}
+function serviceConfigToCfn(config) {
+	const out = { ExecutionRoleArn: config.executionRoleArn };
+	if (config.timeoutSeconds !== void 0) out["TimeoutSeconds"] = config.timeoutSeconds;
+	if (config.maxConcurrencyPerEnvironment !== void 0) out["MaxConcurrencyPerEnvironment"] = config.maxConcurrencyPerEnvironment;
+	if (config.egressNetworkConnectorArn !== void 0) out["EgressNetworkConnectorArn"] = config.egressNetworkConnectorArn;
+	if (config.environmentVariables !== void 0) out["EnvironmentVariables"] = { ...config.environmentVariables };
+	const logging = config.telemetryConfig?.loggingConfig;
+	if (logging) {
+		const LoggingConfig = {};
+		if (logging.logGroup !== void 0) LoggingConfig["LogGroup"] = logging.logGroup;
+		if (logging.applicationLogLevel !== void 0) LoggingConfig["ApplicationLogLevel"] = logging.applicationLogLevel;
+		if (logging.systemLogLevel !== void 0) LoggingConfig["SystemLogLevel"] = logging.systemLogLevel;
+		out["TelemetryConfig"] = { LoggingConfig };
+	}
+	return out;
+}
+
+//#endregion
+//#region src/provisioning/providers/lambda-web-function-endpoint-provider.ts
+var LambdaWebFunctionEndpointProvider = class {
+	client;
+	logger = getLogger().child("LambdaWebFunctionEndpointProvider");
+	constructor() {
+		this.client = getAwsClients().lambdaWeb;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionEndpoint", /* @__PURE__ */ new Set([
+		"FunctionName",
+		"EndpointName",
+		"Description",
+		"EndpointType",
+		"AuthType",
+		"RevisionWeights",
+		"Regions",
+		"ScalingConfig",
+		"ThrottleConfig"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionEndpoint", /* @__PURE__ */ new Map([
+		["FunctionArn", "AWS-managed read-only attribute"],
+		["EndpointArn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["DomainName", "AWS-managed read-only attribute"],
+		["State", "AWS-managed read-only attribute"],
+		["StateReason", "AWS-managed read-only attribute"],
+		["UpdateStatus", "AWS-managed read-only attribute"],
+		["UpdateStatusReason", "AWS-managed read-only attribute"],
+		["RegionalEndpoints", "AWS-managed read-only attribute"],
+		["CreatedAt", "AWS-managed read-only attribute"],
+		["UpdatedAt", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(safeMsg`Creating Lambda web function endpoint ${logicalId}`);
+		const fail = this.refusal(logicalId, resourceType);
+		const lenient = context?.replayingState === true;
+		const functionName = properties["FunctionName"];
+		const endpointName = properties["EndpointName"];
+		const endpointType = properties["EndpointType"];
+		const authType = properties["AuthType"];
+		for (const [key, value] of [
+			["FunctionName", functionName],
+			["EndpointName", endpointName],
+			["EndpointType", endpointType],
+			["AuthType", authType]
+		]) if (typeof value !== "string" || value === "") fail(`${key} must be a non-empty string`);
+		const input = {
+			functionName,
+			endpointName,
+			endpointType,
+			authType
+		};
+		if (typeof properties["Description"] === "string") input.description = properties["Description"];
+		const weights = readRevisionWeights(properties["RevisionWeights"], fail);
+		if (weights !== void 0) input.revisionWeights = weights.map((w) => ({
+			revisionId: w.RevisionId,
+			weight: w.Weight
+		}));
+		if (properties["Regions"] !== void 0) {
+			const regions = properties["Regions"];
+			if (!Array.isArray(regions) || regions.some((r) => typeof r !== "string")) fail("Regions must be a list of strings");
+			input.regions = [...regions];
+		}
+		const scaling = this.readIntegerBlock(properties["ScalingConfig"], "ScalingConfig", "MaxEnvironments", fail, lenient);
+		if (scaling !== void 0) input.scalingConfig = scaling.present ? { maxEnvironments: scaling.n } : {};
+		const throttle = this.readIntegerBlock(properties["ThrottleConfig"], "ThrottleConfig", "RateLimit", fail, lenient);
+		if (throttle !== void 0) input.throttleConfig = throttle.present ? { rateLimit: throttle.n } : {};
+		let createdArn;
+		try {
+			createdArn = (await this.client.send(new CreateWebFunctionEndpointCommand(input))).endpointArn;
+			if (!createdArn) throw new ProvisioningError(`CreateWebFunctionEndpoint succeeded but returned no endpoint ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, "create");
+			return {
+				physicalId: createdArn,
+				attributes: buildAttributes$1(settled)
+			};
+		} catch (error) {
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) throw new ProvisioningError(`Cannot update Lambda web function endpoint ${logicalIdShown(logicalId)}: its recorded id is not an endpoint ARN`, resourceType, logicalId, physicalId);
+		const fail = this.refusal(logicalId, resourceType, physicalId);
+		const lenient = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		const input = {
+			functionName: parts.functionArn,
+			endpointName: parts.childId,
+			description: typeof properties["Description"] === "string" ? properties["Description"] : ""
+		};
+		if (typeof properties["AuthType"] === "string") input.authType = properties["AuthType"];
+		const weights = readRevisionWeights(properties["RevisionWeights"], fail);
+		if (weights !== void 0) input.revisionWeights = weights.map((w) => ({
+			revisionId: w.RevisionId,
+			weight: w.Weight
+		}));
+		else if (!lenient) fail("RevisionWeights is required; AWS keeps routing to the current revisions when it is removed");
+		const scaling = this.readIntegerBlock(properties["ScalingConfig"], "ScalingConfig", "MaxEnvironments", fail, lenient);
+		if (properties["ScalingConfig"] === void 0) input.scalingConfig = {};
+		else if (scaling !== void 0) input.scalingConfig = scaling.present ? { maxEnvironments: scaling.n } : {};
+		const throttle = this.readIntegerBlock(properties["ThrottleConfig"], "ThrottleConfig", "RateLimit", fail, lenient);
+		if (properties["ThrottleConfig"] === void 0) input.throttleConfig = {};
+		else if (throttle !== void 0) input.throttleConfig = throttle.present ? { rateLimit: throttle.n } : {};
+		try {
+			await this.client.send(new UpdateWebFunctionEndpointCommand(input));
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: buildAttributes$1(await this.waitForSettled(parts.functionArn, parts.childId, logicalId, "update", input.revisionWeights))
+			};
+		} catch (error) {
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(safeMsg`Deleting Lambda web function endpoint ${logicalId}`);
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) throw new ProvisioningError(`Cannot delete Lambda web function endpoint ${logicalIdShown(logicalId)}: its recorded id is not an endpoint ARN`, resourceType, logicalId, physicalId);
+		try {
+			try {
+				await this.client.send(new DeleteWebFunctionEndpointCommand({
+					functionName: parts.functionArn,
+					endpointName: parts.childId
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(safeMsg`Lambda web function endpoint ${logicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForGone(parts.functionArn, parts.childId, logicalId);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "EndpointArn") return physicalId;
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) return void 0;
+		if (attributeName === "FunctionArn") return parts.functionArn;
+		return buildAttributes$1(await this.client.send(new GetWebFunctionEndpointCommand({
+			functionName: parts.functionArn,
+			endpointName: parts.childId
+		})))[attributeName];
+	}
+	async import(input) {
+		let functionName;
+		let endpointName;
+		if (input.knownPhysicalId) {
+			const parts = parseWebFunctionChildArn(input.knownPhysicalId, "endpoint");
+			if (!parts) throw new Error(`--resource override for ${logicalIdShown(input.logicalId)} must be a Lambda web function endpoint ARN (got ${isPlainImportValue(input.knownPhysicalId) ? `'${input.knownPhysicalId}'` : VALUE_NOT_SHOWN}); use the arn:...:web-function/<name>/endpoint/<endpoint> ARN.`);
+			functionName = parts.functionArn;
+			endpointName = parts.childId;
+		} else {
+			const props = input.properties ?? {};
+			if (typeof props["FunctionName"] !== "string" || typeof props["EndpointName"] !== "string") return null;
+			functionName = props["FunctionName"];
+			endpointName = props["EndpointName"];
+		}
+		try {
+			const resp = await this.client.send(new GetWebFunctionEndpointCommand({
+				functionName,
+				endpointName
+			}));
+			if (!resp.endpointArn) return null;
+			return {
+				physicalId: resp.endpointArn,
+				attributes: buildAttributes$1(resp)
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return null;
+			throw error;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) return void 0;
+		let resp;
+		try {
+			resp = await this.client.send(new GetWebFunctionEndpointCommand({
+				functionName: parts.functionArn,
+				endpointName: parts.childId
+			}));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const live = {
+			FunctionName: recordedFunctionNameSpelling(properties?.["FunctionName"], resp.functionArn ?? parts.functionArn),
+			EndpointName: resp.endpointName ?? parts.childId
+		};
+		if (resp.description !== void 0) live["Description"] = resp.description;
+		if (resp.endpointType !== void 0) live["EndpointType"] = resp.endpointType;
+		if (resp.authType !== void 0) live["AuthType"] = resp.authType;
+		if (resp.revisionWeights !== void 0) live["RevisionWeights"] = resp.revisionWeights.map((w) => ({
+			RevisionId: w.revisionId,
+			Weight: w.weight
+		}));
+		if (resp.regions !== void 0) live["Regions"] = [...resp.regions];
+		if (resp.scalingConfig !== void 0) live["ScalingConfig"] = resp.scalingConfig.maxEnvironments !== void 0 ? { MaxEnvironments: resp.scalingConfig.maxEnvironments } : {};
+		if (resp.throttleConfig !== void 0) live["ThrottleConfig"] = resp.throttleConfig.rateLimit !== void 0 ? { RateLimit: resp.throttleConfig.rateLimit } : {};
+		if (!properties) return live;
+		const out = {};
+		for (const [key, value] of Object.entries(live)) out[key] = key === "ScalingConfig" || key === "ThrottleConfig" ? value : projectOntoRecorded(properties[key], value);
+		return out;
+	}
+	refusal(logicalId, resourceType, physicalId) {
+		return (message) => {
+			throw new ProvisioningError(`${message} for Lambda web function endpoint ${logicalIdShown(logicalId)}`, resourceType, logicalId, physicalId);
+		};
+	}
+	readIntegerBlock(value, blockKey, memberKey, fail, lenient) {
+		if (value === void 0) return void 0;
+		const bad = (message) => {
+			if (lenient) {
+				this.logger.warn(safeMsg`${message}; leaving the live ${blockKey} unchanged`);
+				return;
+			}
+			return fail(message);
+		};
+		if (!isPlainRecord$2(value)) return bad(`${blockKey} must be an object`);
+		if (value[memberKey] === void 0) return { present: false };
+		const n = coerceCfnInteger(value[memberKey]);
+		if (n === void 0) return bad(`${blockKey}.${memberKey} must be an integer`);
+		return {
+			present: true,
+			n
+		};
+	}
+	async waitForSettled(functionName, endpointName, logicalId, operation, sentWeights) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			let resp;
+			try {
+				resp = await this.client.send(new GetWebFunctionEndpointCommand({
+					functionName,
+					endpointName
+				}));
+			} catch (error) {
+				if (operation === "create" && attempt <= 10 && error instanceof ResourceNotFoundException$9) {
+					await sleep$1(500);
+					continue;
+				}
+				throw error;
+			}
+			if (resp.state === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}`);
+			if (resp.updateStatus === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} ${operation} failed: ${resp.updateStatusReason ?? "no reason given"}`);
+			if (resp.state === "Active" && resp.updateStatus !== "InProgress" && (sentWeights === void 0 || sameWeights(sentWeights, resp.revisionWeights))) return resp;
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} did not finish ${operation} within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	async waitForGone(functionName, endpointName, logicalId) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			try {
+				await this.client.send(new GetWebFunctionEndpointCommand({
+					functionName,
+					endpointName
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) return;
+				throw error;
+			}
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} Lambda web function endpoint ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+function readRevisionWeights(value, fail) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) return fail("RevisionWeights must be a list");
+	return value.map((entry, i) => {
+		if (!isPlainRecord$2(entry) || typeof entry["RevisionId"] !== "string") return fail(`RevisionWeights[${i}].RevisionId must be a string`);
+		const weight = coerceCfnInteger(entry["Weight"]);
+		if (weight === void 0) return fail(`RevisionWeights[${i}].Weight must be an integer`);
+		return {
+			RevisionId: entry["RevisionId"],
+			Weight: weight
+		};
+	});
+}
+function sameWeights(a, b) {
+	if (b === void 0 || a.length !== b.length) return false;
+	const key = (w) => `${w.revisionId ?? ""}=${w.weight ?? ""}`;
+	const left = a.map(key).sort();
+	const right = b.map(key).sort();
+	return left.every((k, i) => k === right[i]);
+}
+function buildAttributes$1(resp) {
+	return definedAttributes({
+		EndpointArn: resp.endpointArn,
+		FunctionArn: resp.functionArn,
+		DomainName: resp.domainName,
+		State: resp.state,
+		StateReason: resp.stateReason,
+		UpdateStatus: resp.updateStatus,
+		UpdateStatusReason: resp.updateStatusReason,
+		CreatedAt: resp.createdAt?.toISOString(),
+		UpdatedAt: resp.updatedAt?.toISOString()
+	});
+}
+
+//#endregion
+//#region src/provisioning/providers/lambda-network-connector-provider.ts
+const POLL_INTERVAL_MS$2 = 1e3;
+const MAX_POLL_ATTEMPTS = 1200;
+var LambdaNetworkConnectorProvider = class {
+	client;
+	lambda;
+	logger = getLogger().child("LambdaNetworkConnectorProvider");
+	constructor() {
+		const clients = getAwsClients();
+		this.client = clients.lambdaCore;
+		this.lambda = clients.lambda;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::NetworkConnector", /* @__PURE__ */ new Set([
+		"Name",
+		"Configuration",
+		"OperatorRole",
+		"Tags"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::NetworkConnector", /* @__PURE__ */ new Map([
+		["Arn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["State", "AWS-managed read-only attribute"],
+		["LatestVersionArn", "AWS-managed read-only attribute"],
+		["LatestVersion", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(safeMsg`Creating Lambda network connector ${logicalId}`);
+		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generateResourceName(logicalId, { maxLength: 64 });
+		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
+		const createToken = acquireIdempotencyToken({
+			scope: "CreateNetworkConnector",
+			logicalId
+		});
+		const input = {
+			Name: name,
+			Configuration: { VpcEgressConfiguration: {
+				SubnetIds: vpc.SubnetIds,
+				SecurityGroupIds: vpc.SecurityGroupIds,
+				NetworkProtocol: vpc.NetworkProtocol,
+				AssociatedComputeResourceTypes: vpc.AssociatedComputeResourceTypes
+			} },
+			ClientToken: createToken.value
+		};
+		const operatorRole = this.readOperatorRole(properties, logicalId, resourceType, void 0, context);
+		if (operatorRole !== void 0) input.OperatorRole = operatorRole;
+		if (tagList.length > 0) input.Tags = Object.fromEntries(tagList.map((t) => [t.Key, t.Value]));
+		let createdArn;
+		try {
+			createdArn = (await this.client.send(new CreateNetworkConnectorCommand(input))).Arn;
+			if (!createdArn) throw new ProvisioningError(`CreateNetworkConnector succeeded but returned no ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			const settled = await this.waitForSettled(createdArn, logicalId, "create");
+			createToken.release();
+			return {
+				physicalId: createdArn,
+				attributes: buildAttributes(settled)
+			};
+		} catch (error) {
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			if (error instanceof TerminalConnectorStateError) markNonRetryable(thrown);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const vpc = this.readVpcEgress(properties, logicalId, resourceType, physicalId);
+		const updateRole = this.readOperatorRole(properties, logicalId, resourceType, physicalId, context);
+		if (typeof previousProperties["OperatorRole"] === "string" && properties["OperatorRole"] === void 0 && context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`OperatorRole cannot be removed in place for Lambda network connector ${logicalIdShown(logicalId)}: cdkd sends no role when the template declares none, so the current one would stay attached. Set it to another role, or replace the connector (change its Name).`, resourceType, logicalId, physicalId);
+		try {
+			const configChanged = JSON.stringify(properties["Configuration"]) !== JSON.stringify(previousProperties["Configuration"]) || properties["OperatorRole"] !== previousProperties["OperatorRole"];
+			await this.reconcileTags(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"]);
+			if (configChanged) await this.client.send(new UpdateNetworkConnectorCommand({
+				Identifier: physicalId,
+				Configuration: { VpcEgressConfiguration: {
+					SubnetIds: vpc.SubnetIds,
+					SecurityGroupIds: vpc.SecurityGroupIds,
+					NetworkProtocol: vpc.NetworkProtocol,
+					AssociatedComputeResourceTypes: vpc.AssociatedComputeResourceTypes
+				} },
+				...updateRole !== void 0 ? { OperatorRole: updateRole } : {},
+				ClientToken: randomUUID()
+			}));
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: buildAttributes(configChanged ? await this.waitForSettled(physicalId, logicalId, "update") : await this.client.send(new GetNetworkConnectorCommand({ Identifier: physicalId })))
+			};
+		} catch (error) {
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(safeMsg`Deleting Lambda network connector ${logicalId}`);
+		try {
+			try {
+				await this.client.send(new DeleteNetworkConnectorCommand({ Identifier: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$10) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(safeMsg`Lambda network connector ${logicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForGone(physicalId, logicalId);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Arn") return physicalId;
+		return buildAttributes(await this.client.send(new GetNetworkConnectorCommand({ Identifier: physicalId })))[attributeName];
+	}
+	async import(input) {
+		const props = input.properties ?? {};
+		const identifier = input.knownPhysicalId ?? (typeof props["Name"] === "string" ? props["Name"] : void 0);
+		if (!identifier) return null;
+		try {
+			const resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: identifier }));
+			if (!resp.Arn) return null;
+			return {
+				physicalId: resp.Arn,
+				attributes: buildAttributes(resp)
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return null;
+			throw error;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let resp;
+		try {
+			resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: physicalId }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const result = {};
+		if (resp.Name !== void 0) result["Name"] = resp.Name;
+		if (resp.OperatorRole !== void 0) result["OperatorRole"] = resp.OperatorRole;
+		const vpc = resp.Configuration && "VpcEgressConfiguration" in resp.Configuration ? resp.Configuration.VpcEgressConfiguration : void 0;
+		if (vpc) {
+			const VpcEgressConfiguration = {};
+			if (vpc.SubnetIds !== void 0) VpcEgressConfiguration["SubnetIds"] = [...vpc.SubnetIds];
+			if (vpc.SecurityGroupIds !== void 0) VpcEgressConfiguration["SecurityGroupIds"] = [...vpc.SecurityGroupIds];
+			if (vpc.NetworkProtocol !== void 0) VpcEgressConfiguration["NetworkProtocol"] = vpc.NetworkProtocol;
+			if (vpc.AssociatedComputeResourceTypes !== void 0) VpcEgressConfiguration["AssociatedComputeResourceTypes"] = [...vpc.AssociatedComputeResourceTypes];
+			result["Configuration"] = { VpcEgressConfiguration };
+		}
+		let tags;
+		try {
+			tags = await this.lambda.send(new ListTagsCommand({ Resource: physicalId }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		result["Tags"] = normalizeAwsTagsToCfn(tags.Tags);
+		return result;
+	}
+	getDriftUnorderedPaths() {
+		return [
+			"Configuration.VpcEgressConfiguration.SubnetIds",
+			"Configuration.VpcEgressConfiguration.SecurityGroupIds",
+			"Configuration.VpcEgressConfiguration.AssociatedComputeResourceTypes"
+		];
+	}
+	readVpcEgress(properties, logicalId, resourceType, physicalId) {
+		const fail = (message) => {
+			throw new ProvisioningError(`${message} for Lambda network connector ${logicalIdShown(logicalId)}`, resourceType, logicalId, physicalId);
+		};
+		const config = properties["Configuration"];
+		const vpc = isPlainRecord$2(config) ? config["VpcEgressConfiguration"] : void 0;
+		if (!isPlainRecord$2(vpc)) return fail("Configuration.VpcEgressConfiguration must be an object");
+		const strings = (key) => {
+			const value = vpc[key];
+			if (value === void 0) return void 0;
+			if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) return fail(`Configuration.VpcEgressConfiguration.${key} must be a list of strings`);
+			return [...value];
+		};
+		const subnetIds = strings("SubnetIds");
+		const securityGroupIds = strings("SecurityGroupIds");
+		const types = strings("AssociatedComputeResourceTypes");
+		const protocol = vpc["NetworkProtocol"];
+		if (protocol !== void 0 && typeof protocol !== "string") fail("Configuration.VpcEgressConfiguration.NetworkProtocol must be a string");
+		return {
+			SubnetIds: subnetIds,
+			SecurityGroupIds: securityGroupIds,
+			NetworkProtocol: typeof protocol === "string" ? protocol : void 0,
+			AssociatedComputeResourceTypes: types
+		};
+	}
+	readOperatorRole(properties, logicalId, resourceType, physicalId, context) {
+		const role = properties["OperatorRole"];
+		if (role === void 0 || typeof role === "string") return role;
+		const message = `OperatorRole must be a string for Lambda network connector ${logicalIdShown(logicalId)}`;
+		if (context?.replayingState === true || context !== void 0 && "desiredFromAwsReadback" in context && context.desiredFromAwsReadback === true) {
+			this.logger.warn(safeMsg`${message}; omitting it while applying a state-borne bag`);
+			return;
+		}
+		throw new ProvisioningError(message, resourceType, logicalId, physicalId);
+	}
+	async reconcileTags(physicalId, resourceType, logicalId, newTags, oldTags) {
+		const plan = planTagDiff(oldTags, newTags);
+		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
+		if (tagWarning !== void 0) this.logger.warn(tagWarning);
+		if (plan.remove.length > 0) await this.lambda.send(new UntagResourceCommand$1({
+			Resource: physicalId,
+			TagKeys: plan.remove
+		}));
+		const toAdd = Object.fromEntries(plan.set);
+		if (Object.keys(toAdd).length > 0) await this.lambda.send(new TagResourceCommand$1({
+			Resource: physicalId,
+			Tags: toAdd
+		}));
+	}
+	async waitForSettled(arn, logicalId, operation) {
+		for (let attempt = 1; attempt <= MAX_POLL_ATTEMPTS; attempt++) {
+			const resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: arn }));
+			if (resp.State === "FAILED" || resp.State === "DELETING" || resp.State === "DELETE_FAILED" || resp.State === "INACTIVE") throw new TerminalConnectorStateError(`Lambda network connector ${logicalIdShown(logicalId)} entered ${resp.State}: ${resp.StateReason ?? resp.StateReasonCode ?? "no reason given"}`);
+			if (operation === "update" && resp.LastUpdateStatus === "Failed") throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} update failed: ${resp.LastUpdateStatusReason ?? resp.LastUpdateStatusReasonCode ?? "no reason given"}`);
+			if (resp.State === "ACTIVE" && resp.LastUpdateStatus !== "InProgress") return resp;
+			await sleep$1(POLL_INTERVAL_MS$2);
+		}
+		throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} did not finish ${operation} within ${MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2 / 1e3}s.`);
+	}
+	async waitForGone(arn, logicalId) {
+		for (let attempt = 1; attempt <= MAX_POLL_ATTEMPTS; attempt++) {
+			let resp;
+			try {
+				resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: arn }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$10) return;
+				throw error;
+			}
+			if (resp.State === "DELETE_FAILED") throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} entered DELETE_FAILED: ${resp.StateReason ?? resp.StateReasonCode ?? "no reason given"}`);
+			await sleep$1(POLL_INTERVAL_MS$2);
+		}
+		throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} was not fully deleted within ${MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2 / 1e3}s.`);
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} Lambda network connector ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+var TerminalConnectorStateError = class extends Error {};
+function buildAttributes(resp) {
+	return definedAttributes({
+		Arn: resp.Arn,
+		State: resp.State,
+		LatestVersionArn: resp.LatestVersionArn,
+		LatestVersion: resp.LatestVersion ?? versionOfArn(resp.LatestVersionArn)
+	});
+}
+function versionOfArn(arn) {
+	const match = arn === void 0 ? null : /:network-connector:[^:]+:(\d+)$/.exec(arn);
+	return match ? Number(match[1]) : void 0;
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-contributor-insights.ts
 const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
@@ -18475,12 +19450,15 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			log.debug(`PathPart changed from "${log.value(oldPathPart)}" to "${log.value(newPathPart)}", replacing resource`);
 			const createResult = await this.createResource(logicalId, resourceType, properties, log);
 			let orphanReason;
+			let oldResourceSurvivor = "unconfirmed";
 			try {
 				if (redactedDeleteAddressFields({ RestApiId: previousProperties["RestApiId"] }).length > 0) {
 					orphanReason = `old API Gateway Resource ${physicalId} was not deleted: its recorded RestApiId is redacted`;
+					oldResourceSurvivor = "kept";
 					log.warn(safeMsg`Old API Gateway Resource ${physicalId} was not deleted during replacement: its ` + "recorded RestApiId is redacted in state, which names no API. The old resource may be orphaned and require manual cleanup.");
 				} else await this.deleteResource(logicalId, physicalId, resourceType, previousProperties);
 			} catch (error) {
+				oldResourceSurvivor = replacedDeleteFailureVerdict(error);
 				orphanReason = log.mask(`old API Gateway Resource ${physicalId} could not be deleted: ${safeStringify(error)}`);
 				log.warn(`Failed to delete old API Gateway Resource ${physicalId} during replacement: ${safeStringify(error)}. The old resource may be orphaned and require manual cleanup.`);
 			}
@@ -18492,7 +19470,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			return orphanReason !== void 0 ? {
 				...base,
 				outcome: "partial",
-				reason: orphanReason
+				reason: orphanReason,
+				...oldResourceSurvivor === "kept" && { oldResourceSurvivor }
 			} : base;
 		}
 		return {
@@ -20802,8 +21781,9 @@ var CloudFrontOAIProvider = class {
 			throw new ProvisioningError(`Failed to create CloudFront OAI ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating CloudFront OAI ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudFrontClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update", "global");
 		const config = properties["CloudFrontOriginAccessIdentityConfig"];
 		try {
 			const comment = readConfigString(config, "Comment", "", "AWS::CloudFront::CloudFrontOriginAccessIdentity CloudFrontOriginAccessIdentityConfig");
@@ -20946,8 +21926,9 @@ var CloudFrontOACProvider = class {
 			throw new ProvisioningError(`Failed to create CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating CloudFront Origin Access Control ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudFrontClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update", "global");
 		try {
 			const etag = (await this.cloudFrontClient.send(new GetOriginAccessControlCommand({ Id: physicalId }))).ETag;
 			if (!etag) throw new Error("GetOriginAccessControl did not return ETag");
@@ -21185,8 +22166,9 @@ var CloudFrontDistributionProvider = class {
 		if (comment !== "") parts.push(`comment ${JSON.stringify(comment)}`);
 		return parts.length > 0 ? parts.join(" and ") : "its creation time (the orphan is the newest distribution in this account)";
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating CloudFront Distribution ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudFrontClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update", "global");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const getConfigResponse = await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }));
@@ -28528,8 +29510,9 @@ var WAFv2WebACLProvider = class {
 			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
@@ -28575,6 +29558,7 @@ var WAFv2WebACLProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			const { id, name, scope } = parseWebACLArn(physicalId);
 			const lockToken = (await this.getClient().send(new GetWebACLCommand({
@@ -29414,7 +30398,7 @@ var CognitoUserPoolProvider = class {
 						} catch (bareError) {
 							failure = bareError;
 						}
-						if (readOn && !(failure instanceof ResourceNotFoundException$9)) {
+						if (readOn && !(failure instanceof ResourceNotFoundException$11)) {
 							this.logger.debug(safeMsg`Writing DeletionProtection back on ${physicalId} failed: ${describeAwsFailure(failure).detail}`);
 							return "read-on-write-failed";
 						}
@@ -29471,7 +30455,7 @@ var CognitoUserPoolProvider = class {
 								return;
 							}
 							if (!observedPool) {
-								if (observeError instanceof ResourceNotFoundException$9) return;
+								if (observeError instanceof ResourceNotFoundException$11) return;
 								if (observeError !== void 0 && isTransientCognitoFailure(observeError)) {
 									transientReadError = observeError;
 									return;
@@ -29494,7 +30478,7 @@ var CognitoUserPoolProvider = class {
 			flip.deleteAccepted = true;
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$11) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
@@ -29528,7 +30512,7 @@ var CognitoUserPoolProvider = class {
 			if (earlier) earlier.echoedSince = true;
 			return;
 		} catch (echoError) {
-			if (echoError instanceof ResourceNotFoundException$9) throw echoError;
+			if (echoError instanceof ResourceNotFoundException$11) throw echoError;
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
@@ -29541,7 +30525,7 @@ var CognitoUserPoolProvider = class {
 					DeletionProtection: "INACTIVE"
 				}));
 			} catch (bareError) {
-				if (bareError instanceof ResourceNotFoundException$9) throw bareError;
+				if (bareError instanceof ResourceNotFoundException$11) throw bareError;
 				if (isAmbiguousWriteFailure(bareError)) {
 					if (observedOn) flip.flippedOffByThisRun = true;
 					if (!this.preFlipPools.has(flip)) this.preFlipPools.set(flip, {
@@ -29583,7 +30567,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$11) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		const pool = resp.UserPool;
@@ -29652,7 +30636,7 @@ var CognitoUserPoolProvider = class {
 				attributes: await this.userPoolAttributes(input.knownPhysicalId, resp.UserPool?.Arn)
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return null;
+			if (err instanceof ResourceNotFoundException$11) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
@@ -29668,7 +30652,7 @@ var CognitoUserPoolProvider = class {
 				try {
 					resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$9) return null;
+					if (err instanceof ResourceNotFoundException$11) return null;
 					throw err;
 				}
 				return {
@@ -30178,6 +31162,13 @@ const NAMESPACE_TYPES = [
 	"AWS::ServiceDiscovery::HttpNamespace",
 	"AWS::ServiceDiscovery::PublicDnsNamespace"
 ];
+const NAMESPACE_KIND_BY_TYPE = /* @__PURE__ */ new Map([
+	["AWS::ServiceDiscovery::PrivateDnsNamespace", "DNS_PRIVATE"],
+	["AWS::ServiceDiscovery::PublicDnsNamespace", "DNS_PUBLIC"],
+	["AWS::ServiceDiscovery::HttpNamespace", "HTTP"]
+]);
+const NAMESPACE_ID_PATTERN = /^ns-[a-z0-9]{16}$/;
+const SERVICE_ID_PATTERN = /^srv-[a-z0-9]{16}$/;
 var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	client;
 	stsClient;
@@ -30783,6 +31774,47 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			default: return;
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		let pattern;
+		let read;
+		const namespaceKind = NAMESPACE_KIND_BY_TYPE.get(resourceType);
+		if (namespaceKind !== void 0) {
+			pattern = NAMESPACE_ID_PATTERN;
+			read = (id) => this.readNamespaceIdForIdentity(id, namespaceKind);
+		} else if (resourceType === "AWS::ServiceDiscovery::Service") {
+			pattern = SERVICE_ID_PATTERN;
+			read = (id) => this.readServiceIdForIdentity(id);
+		} else return "unknown";
+		if (!pattern.test(journaledPhysicalId) || !pattern.test(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		if (await read(record.physicalId) !== record.physicalId) return "unknown";
+		const journaledRead = await read(journaledPhysicalId);
+		return journaledRead === void 0 || journaledRead === journaledPhysicalId ? "different" : "unknown";
+	}
+	async readNamespaceIdForIdentity(namespaceId, kind) {
+		let response;
+		try {
+			response = await this.getClient().send(new GetNamespaceCommand({ Id: namespaceId }));
+		} catch (error) {
+			if (error instanceof NamespaceNotFound) return void 0;
+			throw error;
+		}
+		const namespace = response.Namespace;
+		if (typeof namespace?.Id !== "string" || namespace.Type !== kind) throw new Error("GetNamespace did not return a namespace of the kind asked for");
+		return namespace.Id;
+	}
+	async readServiceIdForIdentity(serviceId) {
+		let response;
+		try {
+			response = await this.getClient().send(new GetServiceCommand({ Id: serviceId }));
+		} catch (error) {
+			if (error instanceof ServiceNotFound) return void 0;
+			throw error;
+		}
+		if (typeof response.Service?.Id !== "string") throw new Error("GetService did not return the service asked for");
+		return response.Service.Id;
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
@@ -32817,6 +33849,7 @@ var GlueProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.deleteDatabase(logicalId, physicalId, resourceType, properties, context);
 			case "AWS::Glue::Table": return this.deleteTable(logicalId, physicalId, resourceType, properties, context);
@@ -33522,6 +34555,7 @@ var GlueWorkflowProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Workflow ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteWorkflowCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted Glue Workflow ${logicalId}`);
@@ -33643,11 +34677,13 @@ var GlueSecurityConfigurationProvider = class {
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create Glue SecurityConfiguration ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	async update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, _properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS Glue SecurityConfiguration is immutable on AWS — there is no UpdateSecurityConfiguration API; every change requires DeleteSecurityConfiguration + CreateSecurityConfiguration. Use cdkd deploy --replace, or destroy + redeploy with the new EncryptionConfiguration.");
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue SecurityConfiguration ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteSecurityConfigurationCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted Glue SecurityConfiguration ${logicalId}`);
@@ -33899,6 +34935,7 @@ var GlueJobProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Job ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteJobCommand({ JobName: physicalId }));
 		} catch (error) {
@@ -34190,6 +35227,7 @@ var GlueCrawlerProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting Glue Crawler ${logicalId}: ${v(physicalId)}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
 		} catch (error) {
@@ -34437,6 +35475,7 @@ var GlueConnectionProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		log.debug(`Deleting Glue Connection ${logicalId}: ${log.value(physicalId)}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		const redactedSkip = redactedDeleteAddressSkip(this.logger, logicalId, resourceType, redactedDeleteAddressFields({ CatalogId: properties?.["CatalogId"] }));
 		if (redactedSkip) return redactedSkip;
 		const target = deleteCatalogId(properties);
@@ -34653,6 +35692,7 @@ var GlueTriggerProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Trigger ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			try {
 				if ((await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State === "ACTIVATED") {
@@ -36118,7 +37158,7 @@ var KinesisStreamProvider = class {
 				EnforceConsumerDeletion: true
 			}));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$12) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Kinesis stream ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
@@ -36155,7 +37195,7 @@ var KinesisStreamProvider = class {
 		try {
 			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (error instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw error;
 		}
 		const arn = response.StreamDescriptionSummary?.StreamARN;
@@ -36169,7 +37209,7 @@ var KinesisStreamProvider = class {
 		try {
 			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return void 0;
+			if (error instanceof ResourceNotFoundException$12) return void 0;
 			throw error;
 		}
 		const arn = response.StreamDescriptionSummary?.StreamARN;
@@ -36180,7 +37220,7 @@ var KinesisStreamProvider = class {
 		try {
 			return (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }))).StreamDescriptionSummary?.StreamStatus ?? "UNKNOWN";
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return void 0;
+			if (error instanceof ResourceNotFoundException$12) return void 0;
 			throw error;
 		}
 	}
@@ -36233,7 +37273,7 @@ var KinesisStreamProvider = class {
 		try {
 			stream = (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!stream) return void 0;
@@ -36253,14 +37293,14 @@ var KinesisStreamProvider = class {
 			const maxRecordSize = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.MaxRecordSizeInKiB;
 			if (maxRecordSize !== void 0) result["MaxRecordSizeInKiB"] = maxRecordSize;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		try {
 			const tagsResp = await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
@@ -36274,7 +37314,7 @@ var KinesisStreamProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return null;
+			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
 		return null;
@@ -36434,7 +37474,7 @@ var KinesisStreamConsumerProvider = class {
 			await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$12) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
@@ -36462,7 +37502,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeStreamConsumerCommand({ ConsumerARN: physicalId }))).ConsumerDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -36473,7 +37513,7 @@ var KinesisStreamConsumerProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
@@ -36692,7 +37732,7 @@ var SchedulerScheduleProvider = class {
 		for (let attempt = 0;; attempt++) try {
 			return (await this.readIdentity(name, groupName)).creation;
 		} catch (error) {
-			const transient = error instanceof ResourceNotFoundException$11 || isThrottlingError(error);
+			const transient = error instanceof ResourceNotFoundException$13 || isThrottlingError(error);
 			const delay = this.readBackDelaysMs[attempt];
 			if (transient && delay !== void 0) {
 				await this.sleep(delay);
@@ -36716,7 +37756,7 @@ var SchedulerScheduleProvider = class {
 		try {
 			live = await this.readIdentity(physicalId, groupName);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return "absent";
+			if (error instanceof ResourceNotFoundException$13) return "absent";
 			throw this.wrapUnconfirmedGroupError(logicalId, physicalId, resourceType, error, mask);
 		}
 		if (sameRecordedDate(live, recorded) && !sameRecordedIdentity(live, recorded)) this.refuseUnconfirmed(logicalId, physicalId, resourceType, "holds a schedule of this name that carries the recorded creation date but not the recorded target or role (edited outside cdkd?)", false, "restore them, or drop the record with `cdkd orphan <construct path>` and deploy again");
@@ -36807,7 +37847,7 @@ var SchedulerScheduleProvider = class {
 				try {
 					live = await this.readIdentity(physicalId, group);
 				} catch (error) {
-					if (error instanceof ResourceNotFoundException$11) continue;
+					if (error instanceof ResourceNotFoundException$13) continue;
 					throw wrapDeleteError("reading a schedule of its name", error);
 				}
 				if (sameRecordedIdentity(live, recorded)) matches.push(group);
@@ -36843,7 +37883,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(safeMsg`Deleted Schedule ${logicalId} (found by its recorded creation date)`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return;
+			if (error instanceof ResourceNotFoundException$13) return;
 			throw wrapDeleteError("the delete", error);
 		}
 	}
@@ -36873,7 +37913,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) {
+			if (error instanceof ResourceNotFoundException$13) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
@@ -36889,7 +37929,7 @@ var SchedulerScheduleProvider = class {
 			return (await this.getClient().send(new GetScheduleCommand({ Name: physicalId }))).Arn;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const customGroupHint = error instanceof ResourceNotFoundException$11 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
+			const customGroupHint = error instanceof ResourceNotFoundException$13 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
 			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
@@ -36915,7 +37955,7 @@ var SchedulerScheduleProvider = class {
 				...response.Target !== void 0 && { Target: this.toCfnTarget(response.Target) }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return RESOURCE_NOT_FOUND;
+			if (error instanceof ResourceNotFoundException$13) return RESOURCE_NOT_FOUND;
 			throw error;
 		}
 	}
@@ -36936,7 +37976,7 @@ var SchedulerScheduleProvider = class {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return null;
+			if (error instanceof ResourceNotFoundException$13) return null;
 			throw error;
 		}
 	}
@@ -36945,6 +37985,32 @@ var SchedulerScheduleProvider = class {
 //#endregion
 //#region src/provisioning/providers/pipes-provider.ts
 const PIPE_TYPE = "AWS::Pipes::Pipe";
+function isPipeName(id) {
+	return /^[.\-_A-Za-z0-9]{1,64}$/.test(id);
+}
+const IDENTITY_STATES = /* @__PURE__ */ new Set([
+	"CREATING",
+	"CREATE_FAILED",
+	"CREATE_ROLLBACK_FAILED",
+	"RUNNING",
+	"STARTING",
+	"START_FAILED",
+	"STOPPED",
+	"STOPPING",
+	"STOP_FAILED",
+	"UPDATING",
+	"UPDATE_FAILED",
+	"UPDATE_ROLLBACK_FAILED",
+	"DELETE_FAILED",
+	"DELETE_ROLLBACK_FAILED"
+]);
+function pipeIdentityToken(name, arn, creationTime) {
+	if (typeof arn !== "string" || !arn.startsWith("arn:") || !arn.endsWith(`:pipe/${name}`)) return;
+	if (!(creationTime instanceof Date)) return void 0;
+	const ms = creationTime.getTime();
+	if (!Number.isFinite(ms) || ms <= 0) return void 0;
+	return `${arn}@${Math.floor(ms / 1e3)}`;
+}
 const SETTLED_STATES = /* @__PURE__ */ new Set(["RUNNING", "STOPPED"]);
 const PIPE_POLL_INTERVAL_MS = 5e3;
 const PIPE_SETTLE_MAX_WAIT_MS = 9e5;
@@ -37163,8 +38229,9 @@ var PipesPipeProvider = class {
 		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
 		const tags = desiredTagMap(properties["Tags"], logicalId);
 		this.logger.debug(mask(`Creating Pipe ${logicalId}: ${name}`));
+		let createdIdentity;
 		try {
-			await this.getCreateClient().send(new CreatePipeCommand({
+			const created = await this.getCreateClient().send(new CreatePipeCommand({
 				Name: name,
 				RoleArn: properties["RoleArn"],
 				Source: properties["Source"],
@@ -37179,6 +38246,7 @@ var PipesPipeProvider = class {
 				...properties["KmsKeyIdentifier"] !== void 0 && { KmsKeyIdentifier: properties["KmsKeyIdentifier"] },
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
+			createdIdentity = pipeIdentityToken(name, created?.Arn, created?.CreationTime);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${mask(cause?.message ?? String(error))}`, resourceType, logicalId, void 0, cause);
@@ -37187,7 +38255,7 @@ var PipesPipeProvider = class {
 		try {
 			settled = await this.waitForSettled(name, logicalId, resourceType, "create", mask);
 		} catch (error) {
-			throw await this.retireFailedCreate(name, logicalId, resourceType, error, mask);
+			throw await this.retireFailedCreate(name, logicalId, resourceType, error, mask, createdIdentity);
 		}
 		return {
 			physicalId: name,
@@ -37270,7 +38338,7 @@ var PipesPipeProvider = class {
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(safeMsg`Pipe ${logicalId} already deleted (not found), treating as success`);
+				this.logGoneOnDelete(logicalId, physicalId, context);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -37288,6 +38356,43 @@ var PipesPipeProvider = class {
 			now: this.now
 		});
 	}
+	logGoneOnDelete(logicalId, physicalId, context) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Pipe ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(safeMsg`Pipe ${logicalId} already deleted (not found), treating as success`);
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== PIPE_TYPE) return "unknown";
+		if (!isPipeName(journaledPhysicalId) || !isPipeName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordPipe = await this.describeIfExists(record.physicalId);
+		if (recordPipe === void 0) return "unknown";
+		const recordArn = recordPipe.Arn;
+		if (typeof recordArn !== "string" || recordArn === "") return "unknown";
+		const journaledPipe = await this.describeIfExists(journaledPhysicalId);
+		if (journaledPipe === void 0) return "different";
+		const journaledArn = journaledPipe.Arn;
+		if (typeof journaledArn !== "string" || journaledArn === "") return "unknown";
+		return journaledArn === recordArn ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== PIPE_TYPE || !isPipeName(physicalId)) return void 0;
+		if (await this.getClient().config.region() !== context.expectedRegion) return void 0;
+		const pipe = await this.describeIfExists(physicalId);
+		if (pipe === void 0) return RESOURCE_NOT_FOUND;
+		if (pipe.Name !== physicalId) return void 0;
+		if (pipe.CurrentState === void 0 || !IDENTITY_STATES.has(pipe.CurrentState)) return;
+		return pipeIdentityToken(physicalId, pipe.Arn, pipe.CreationTime);
+	}
+	async describeIfExists(name) {
+		try {
+			return await this.describe(name);
+		} catch (error) {
+			if (error instanceof NotFoundException$6) return void 0;
+			throw error;
+		}
+	}
 	async getAttribute(physicalId, _resourceType, attributeName, _logicalId) {
 		let response;
 		try {
@@ -37407,9 +38512,9 @@ var PipesPipeProvider = class {
 			watch.dispose();
 		}
 	}
-	async retireFailedCreate(name, logicalId, resourceType, error, mask) {
+	async retireFailedCreate(name, logicalId, resourceType, error, mask, createdIdentity) {
 		const original = error instanceof Error ? error : new Error(String(error));
-		const leftBehind = () => markCreatedBeforeFailure(original, logicalId, resourceType, name);
+		const leftBehind = () => markNonRetryable(markCreatedBeforeFailure(original, logicalId, resourceType, name, createdIdentity));
 		const orphaned = async (why) => {
 			const aws = pasteableAwsCommand(mask);
 			const command = aws`aws pipes delete-pipe --name ${name}${await orphanCommandRegionArg(this.getClient(), aws)}`;
@@ -40999,7 +42104,7 @@ var FirehoseProvider = class {
 		try {
 			await this.getClient().send(new DeleteDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) {
+			if (error instanceof ResourceNotFoundException$14) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
@@ -41023,7 +42128,7 @@ var FirehoseProvider = class {
 		try {
 			return (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: streamName }))).DeliveryStreamDescription?.DeliveryStreamStatus ?? "UNKNOWN";
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) return void 0;
+			if (error instanceof ResourceNotFoundException$14) return void 0;
 			throw error;
 		}
 	}
@@ -41355,7 +42460,7 @@ var FirehoseProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$14) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -41387,7 +42492,7 @@ var FirehoseProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$14) return RESOURCE_NOT_FOUND;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
@@ -41405,7 +42510,7 @@ var FirehoseProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return null;
+			if (err instanceof ResourceNotFoundException$14) return null;
 			throw err;
 		}
 		return null;
@@ -42122,7 +43227,7 @@ var CodeBuildProvider = class {
 			await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$13) {
+			if (error instanceof ResourceNotFoundException$15) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
@@ -42140,7 +43245,7 @@ var CodeBuildProvider = class {
 		try {
 			project = (await this.getClient().send(new BatchGetProjectsCommand({ names: [physicalId] }))).projects?.[0];
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$13) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$15) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!project) return RESOURCE_NOT_FOUND;
@@ -42316,7 +43421,7 @@ var CodeBuildProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$13) return null;
+			if (err instanceof ResourceNotFoundException$15) return null;
 			throw err;
 		}
 		return null;
@@ -42901,7 +44006,7 @@ var DLMLifecyclePolicyProvider = class {
 						created = detail.Policy?.DateCreated;
 						defaultType = detail.Policy?.PolicyDetails?.ResourceType;
 					} catch (error) {
-						if (error instanceof ResourceNotFoundException$14) continue;
+						if (error instanceof ResourceNotFoundException$16) continue;
 						throw error;
 					}
 					if (isDefault && defaultType !== void 0 && defaultType !== input.DefaultPolicy) continue;
@@ -43050,7 +44155,7 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$14) {
+			if (error instanceof ResourceNotFoundException$16) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
@@ -43081,7 +44186,7 @@ var DLMLifecyclePolicyProvider = class {
 				Tags: normalizeAwsTagsToCfn(policy.Tags)
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$14) return RESOURCE_NOT_FOUND;
+			if (error instanceof ResourceNotFoundException$16) return RESOURCE_NOT_FOUND;
 			throw error;
 		}
 	}
@@ -43105,7 +44210,7 @@ var DLMLifecyclePolicyProvider = class {
 				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$14) return null;
+			if (err instanceof ResourceNotFoundException$16) return null;
 			throw err;
 		}
 		return null;
@@ -43453,7 +44558,8 @@ var S3DirectoryBucketProvider = class {
 			throw new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (context?.expectedRegion) for (const clientRegion of [await this.s3Client.config.region(), await this.getS3ControlClient().config.region()]) assertRegionMatch(clientRegion, context.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
@@ -43491,6 +44597,7 @@ var S3DirectoryBucketProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(mask(`Deleting S3 Express Directory Bucket ${logicalId}: ${mask(physicalId)}`));
+		assertRegionMatch(context?.expectedRegion ? await this.s3Client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		try {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty, context?.maskSecrets);
@@ -43682,7 +44789,8 @@ var S3TablesProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		if (resourceType === "AWS::S3Tables::Table" || resourceType === "AWS::S3Tables::TableBucket") refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -43702,6 +44810,7 @@ var S3TablesProvider = class {
 		};
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		switch (resourceType) {
 			case "AWS::S3Tables::TableBucket": return this.deleteTableBucket(logicalId, physicalId, resourceType, context);
 			case "AWS::S3Tables::Namespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
@@ -44979,12 +46088,16 @@ var WaitConditionHandleProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/acm-certificate-provider.ts
-function isCertificateInUseError(error) {
+function certificateInUseByName(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
 		if (current.name === "ResourceInUseException") return true;
 		current = current.cause;
 	}
+	return false;
+}
+function isCertificateInUseError(error) {
+	if (certificateInUseByName(error)) return true;
 	const message = error instanceof Error ? error.message : String(error);
 	return /ResourceInUseException|in use/i.test(message);
 }
@@ -45131,6 +46244,7 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			let orphanReason;
+			let oldResourceSurvivor = "unconfirmed";
 			try {
 				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 				if (deleteResult?.outcome === "skipped") {
@@ -45139,6 +46253,7 @@ var ACMCertificateProvider = class {
 				}
 			} catch (error) {
 				const inUse = isCertificateInUseError(error);
+				oldResourceSurvivor = certificateInUseByName(error) ? "kept" : replacedDeleteFailureVerdict(error);
 				orphanReason = inUse ? `old certificate ${physicalId} is still in use by another resource and was not deleted` : `old certificate ${physicalId} could not be deleted: ${safeStringify(error)}`;
 				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${safeStringify(error)}. ` + (inUse ? "This usually means a consumer (e.g. a CloudFront distribution) still references it; it can be deleted once DescribeCertificate.InUseBy is empty. " : "") + `The old certificate may be orphaned and require manual cleanup.`);
 			}
@@ -45150,7 +46265,8 @@ var ACMCertificateProvider = class {
 			return orphanReason !== void 0 ? {
 				...base,
 				outcome: "partial",
-				reason: orphanReason
+				reason: orphanReason,
+				...oldResourceSurvivor === "kept" && { oldResourceSurvivor }
 			} : base;
 		}
 		try {
@@ -45316,5 +46432,5 @@ var ACMCertificateProvider = class {
 };
 
 //#endregion
-export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DmohfhIq.js.map
+export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
+//# sourceMappingURL=provider-classes-CVC9_-km.js.map