@go-to-k/cdkd 0.299.8 → 0.300.1

package/dist/{provider-classes-DmohfhIq.js → provider-classes-CDzT2xg0.js}

@@ -1,13 +1,13 @@
-import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
+import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-dAY3-gXJ.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, dr as wrapMaskedAwsError, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as markNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, o as readPrincipalLists, or as THROTTLING_ERROR_NAMES, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isRetryableTransientError, sr as isMarkedNonRetryable, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, u as clearOnUpdateRemoval, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DAs3w7QW.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-BU3iY59A.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8O3q2ua.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-C87Q8YFK.js";
-import { RDSProvider } from "./rds-provider-Br3hPyHP.js";
-import { NeptuneProvider } from "./neptune-provider-CuJF3t-Q.js";
-import { ASGProvider } from "./asg-provider-ebjf5E8o.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-BK4gG_5A.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-SmvPHPLC.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DVPHKsxv.js";
+import { RDSProvider } from "./rds-provider-DraxDuQq.js";
+import { NeptuneProvider } from "./neptune-provider-CqZ1FaqT.js";
+import { ASGProvider } from "./asg-provider-BS5i71bK.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -28,6 +28,8 @@ import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluat
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$7, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-elasticache";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
+import { CreateWebFunctionEndpointCommand, CreateWebFunctionRevisionCommand, DeleteWebFunctionEndpointCommand, DeleteWebFunctionRevisionCommand, GetWebFunctionEndpointCommand, GetWebFunctionRevisionCommand, LambdaWebClient, ListWebFunctionRevisionsCommand, ResourceNotFoundException as ResourceNotFoundException$9, UpdateWebFunctionEndpointCommand } from "@aws-sdk/client-lambda-web";
+import { CreateNetworkConnectorCommand, DeleteNetworkConnectorCommand, GetNetworkConnectorCommand, LambdaCoreClient, ResourceNotFoundException as ResourceNotFoundException$10, UpdateNetworkConnectorCommand } from "@aws-sdk/client-lambda-core";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
@@ -42,22 +44,22 @@ import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMach
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$13, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
@@ -415,7 +417,9 @@ var IAMPolicyProvider = class {
 		}
 		let secretPrincipalLacksGrant = false;
 		const detached = context?.resolveSecretDerivedPrincipals?.retryMemo?.detached;
+		let removedAny = false;
 		const onDetached = (kind, name) => {
+			removedAny = true;
 			if (fromSecret(kind, name)) detached?.add(injectiveKey(kind, name));
 		};
 		const claimed = (kind, name) => {
@@ -503,7 +507,8 @@ var IAMPolicyProvider = class {
 			this.logger.debug(`Successfully deleted IAM policy ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw maskError(new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
+			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -770,6 +775,7 @@ var IAMManagedPolicyProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(mask(`Deleting IAM managed policy ${logicalId}: ${physicalId}`));
+		const progress = { stripped: false };
 		try {
 			try {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
@@ -780,7 +786,7 @@ var IAMManagedPolicyProvider = class {
 				}
 				throw error;
 			}
-			await this.detachAllPrincipals(physicalId);
+			await this.detachAllPrincipals(physicalId, progress);
 			await this.deleteAllNonDefaultVersions(physicalId);
 			await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: physicalId }));
 			this.logger.debug(`Successfully deleted IAM managed policy ${logicalId}`);
@@ -790,7 +796,8 @@ var IAMManagedPolicyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const failure = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async goneOnDelete(logicalId, physicalId, resourceType, context, mask) {
@@ -1033,7 +1040,7 @@ var IAMManagedPolicyProvider = class {
 		} while (marker);
 		return live;
 	}
-	async detachAllPrincipals(policyArn) {
+	async detachAllPrincipals(policyArn, progress) {
 		try {
 			let marker;
 			while (true) {
@@ -1048,6 +1055,7 @@ var IAMManagedPolicyProvider = class {
 							GroupName: g.GroupName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1059,6 +1067,7 @@ var IAMManagedPolicyProvider = class {
 							RoleName: r.RoleName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1070,6 +1079,7 @@ var IAMManagedPolicyProvider = class {
 							UserName: u.UserName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1315,6 +1325,7 @@ var IAMInstanceProfileProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
 			let roles = [];
 			try {
@@ -1333,6 +1344,7 @@ var IAMInstanceProfileProvider = class {
 					InstanceProfileName: physicalId,
 					RoleName: roleName
 				}));
+				stripped = true;
 				this.logger.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -1347,7 +1359,8 @@ var IAMInstanceProfileProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	logGoneOnDelete(logicalId, physicalId, context) {
@@ -1421,6 +1434,7 @@ var IAMInstanceProfileProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/iam-access-key-provider.ts
+const ACCESS_KEY_ID_PATTERN = /^AKIA[A-Z0-9]{16}$/;
 const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
 var IAMAccessKeyProvider = class {
 	iamClient;
@@ -1510,7 +1524,10 @@ var IAMAccessKeyProvider = class {
 			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
-			if (leftBehindKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+			if (leftBehindKeyId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -1640,9 +1657,16 @@ var IAMAccessKeyProvider = class {
 		throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType} (only 'Id' and 'SecretAccessKey' are defined)`, resourceType, logicalId, physicalId);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const found = await this.findAccessKey(physicalId);
+		if (found === void 0 || found === RESOURCE_NOT_FOUND) return found;
+		const result = { UserName: found.userName };
+		if (found.status !== void 0) result["Status"] = found.status;
+		return result;
+	}
+	async findAccessKey(accessKeyId) {
 		let userName;
 		try {
-			userName = (await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: physicalId }))).UserName;
+			userName = (await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: accessKeyId }))).UserName;
 		} catch (err) {
 			if (err instanceof NoSuchEntityException) return RESOURCE_NOT_FOUND;
 			throw err;
@@ -1660,15 +1684,23 @@ var IAMAccessKeyProvider = class {
 				if (err instanceof NoSuchEntityException) return RESOURCE_NOT_FOUND;
 				throw err;
 			}
-			for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId === physicalId) {
-				const result = { UserName: userName };
-				if (key.Status !== void 0) result["Status"] = key.Status;
-				return result;
-			}
+			for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId === accessKeyId) return {
+				userName,
+				status: key.Status
+			};
 			marker = page.IsTruncated ? page.Marker : void 0;
 		} while (marker);
 		return RESOURCE_NOT_FOUND;
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::IAM::AccessKey") return "unknown";
+		if (!ACCESS_KEY_ID_PATTERN.test(journaledPhysicalId) || !ACCESS_KEY_ID_PATTERN.test(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordKey = await this.findAccessKey(record.physicalId);
+		if (recordKey === void 0 || recordKey === RESOURCE_NOT_FOUND) return "unknown";
+		return await this.findAccessKey(journaledPhysicalId) === void 0 ? "unknown" : "different";
+	}
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::IAM::AccessKey") return ["Serial"];
 		return [];
@@ -1981,9 +2013,11 @@ var IAMUserGroupProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting IAM user ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
+		let hadBoundary = false;
 		try {
 			try {
-				await this.iamClient.send(new GetUserCommand({ UserName: physicalId }));
+				hadBoundary = (await this.iamClient.send(new GetUserCommand({ UserName: physicalId }))).User?.PermissionsBoundary !== void 0;
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
@@ -1994,18 +2028,20 @@ var IAMUserGroupProvider = class {
 				}
 				throw error;
 			}
-			await this.removeUserFromAllGroups(physicalId, log);
-			await this.detachAllUserPolicies(physicalId, log);
-			await this.deleteAllUserInlinePolicies(physicalId, log);
+			await this.removeUserFromAllGroups(physicalId, log, progress);
+			await this.detachAllUserPolicies(physicalId, log, progress);
+			await this.deleteAllUserInlinePolicies(physicalId, log, progress);
 			try {
 				await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: physicalId }));
+				progress.stripped = true;
 				log.debug(`Deleted login profile for user ${v(physicalId)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
-			await this.deleteAllAccessKeys(physicalId, log);
+			await this.deleteAllAccessKeys(physicalId, log, progress);
 			try {
 				await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: physicalId }));
+				if (hadBoundary) progress.stripped = true;
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
@@ -2013,7 +2049,8 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async readLiveGroups(userName) {
@@ -2029,7 +2066,7 @@ var IAMUserGroupProvider = class {
 		} while (marker);
 		return groups;
 	}
-	async removeUserFromAllGroups(userName, log) {
+	async removeUserFromAllGroups(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const groups = (await this.iamClient.send(new ListGroupsForUserCommand({ UserName: userName }))).Groups || [];
@@ -2038,6 +2075,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					GroupName: group.GroupName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Removed user ${v(userName)} from group ${v(group.GroupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2047,7 +2085,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllAccessKeys(userName, log) {
+	async deleteAllAccessKeys(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const keys = (await this.iamClient.send(new ListAccessKeysCommand({ UserName: userName }))).AccessKeyMetadata || [];
@@ -2056,6 +2094,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					AccessKeyId: key.AccessKeyId
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted access key ${key.AccessKeyId} for user ${v(userName)}`);
 			}
 		} catch (error) {
@@ -2063,7 +2102,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async detachAllUserPolicies(userName, log) {
+	async detachAllUserPolicies(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policies = (await this.iamClient.send(new ListAttachedUserPoliciesCommand({ UserName: userName }))).AttachedPolicies || [];
@@ -2072,6 +2111,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					PolicyArn: policy.PolicyArn
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from user ${v(userName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2081,7 +2121,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllUserInlinePolicies(userName, log) {
+	async deleteAllUserInlinePolicies(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policyNames = (await this.iamClient.send(new ListUserPoliciesCommand({ UserName: userName }))).PolicyNames || [];
@@ -2090,6 +2130,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					PolicyName: policyName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted inline policy ${v(policyName)} from user ${v(userName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2273,10 +2314,11 @@ var IAMUserGroupProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting IAM group ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
 		try {
-			await this.detachAllGroupPolicies(physicalId, log);
-			await this.deleteAllGroupInlinePolicies(physicalId, log);
-			await this.removeAllUsersFromGroup(physicalId, log);
+			await this.detachAllGroupPolicies(physicalId, log, progress);
+			await this.deleteAllGroupInlinePolicies(physicalId, log, progress);
+			await this.removeAllUsersFromGroup(physicalId, log, progress);
 			await this.iamClient.send(new DeleteGroupCommand({ GroupName: physicalId }));
 			log.debug(`Successfully deleted IAM group ${logicalId}`);
 		} catch (error) {
@@ -2288,10 +2330,11 @@ var IAMUserGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	async detachAllGroupPolicies(groupName, log) {
+	async detachAllGroupPolicies(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policies = (await this.iamClient.send(new ListAttachedGroupPoliciesCommand({ GroupName: groupName }))).AttachedPolicies || [];
@@ -2300,6 +2343,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					PolicyArn: policy.PolicyArn
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2309,7 +2353,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async removeAllUsersFromGroup(groupName, log) {
+	async removeAllUsersFromGroup(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const users = (await this.iamClient.send(new GetGroupCommand({ GroupName: groupName }))).Users || [];
@@ -2318,6 +2362,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					UserName: user.UserName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Removed user ${v(user.UserName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2346,7 +2391,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Detached managed policy ${v(policyArn)} from group ${v(groupName)}`);
 		}
 	}
-	async deleteAllGroupInlinePolicies(groupName, log) {
+	async deleteAllGroupInlinePolicies(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policyNames = (await this.iamClient.send(new ListGroupPoliciesCommand({ GroupName: groupName }))).PolicyNames || [];
@@ -2355,6 +2400,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					PolicyName: policyName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted inline policy ${v(policyName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2528,6 +2574,7 @@ var IAMUserGroupProvider = class {
 			};
 		}
 		let secretUserNotMember = false;
+		let removedAny = false;
 		try {
 			for (const userName of users ?? []) {
 				if (resolvedNames.has(userName) && memo?.detached.has(injectiveKey("Users", userName)) !== true) {
@@ -2549,6 +2596,7 @@ var IAMUserGroupProvider = class {
 						GroupName: groupName,
 						UserName: userName
 					}));
+					removedAny = true;
 					if (resolvedNames.has(userName)) memo?.detached.add(injectiveKey("Users", userName));
 					this.logger.debug(`Removed user ${mask(userName)} from group ${groupName}`);
 				} catch (error) {
@@ -2566,7 +2614,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM UserToGroupAddition ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw maskError(new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
+			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -5419,7 +5468,7 @@ var S3BucketPolicyProvider = class {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 bucket policy ${logicalId}`);
 		const bucketName = properties["Bucket"];
 		const policyDocument = properties["PolicyDocument"];
@@ -5437,8 +5486,7 @@ var S3BucketPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
+			throw this.wrapOperationError("create", logicalId, resourceType, bucketName, error, context?.maskSecrets);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
@@ -5461,8 +5509,7 @@ var S3BucketPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -5487,10 +5534,17 @@ var S3BucketPolicyProvider = class {
 				throw error;
 			}
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error, maskSecrets) {
+		const mask = maskSecrets ?? ((t) => t);
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(`Failed to ${operation} S3 bucket policy ${logicalId}: ${failure.detail}`));
+		const cause = error instanceof Error ? error : void 0;
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket policy ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, cause);
+		return failure.redacted && cause !== void 0 ? markRedactedCause(wrapped) : wrapped;
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		let policyJson;
 		try {
@@ -6049,7 +6103,7 @@ var SQSQueuePolicyProvider = class {
 		const awsClients = getAwsClients();
 		this.sqsClient = awsClients.sqs;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SQS queue policy ${logicalId}`);
 		const queues = properties["Queues"];
 		const policyDocument = properties["PolicyDocument"];
@@ -6072,8 +6126,7 @@ var SQSQueuePolicyProvider = class {
 				attributes: { [WRITTEN_QUEUES_KEY]: queues.join(",") }
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queues[0], cause);
+			const thrown = this.wrapOperationError("create", logicalId, resourceType, queues[0], error, context?.maskSecrets);
 			if (applied.length > 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, applied.join(","));
 			throw thrown;
 		}
@@ -6105,8 +6158,7 @@ var SQSQueuePolicyProvider = class {
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -6115,12 +6167,13 @@ var SQSQueuePolicyProvider = class {
 		const named = physicalId.includes(",") ? splitQueueUrls(physicalId) : recordedQueues(physicalId, context?.recordedAttributes);
 		const queueUrls = [...physicalId.includes(",") ? [] : await this.queuesCarryingDocument(listedQueues(properties ?? {}).filter((url) => !named.includes(url)), properties?.["PolicyDocument"], logicalId), ...named];
 		if (queueUrls.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
+		let clearedAny = false;
 		for (const queueUrl of queueUrls) try {
 			await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion);
+			clearedAny = true;
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			throw clearedAny ? markDeleteStarted(failure) : failure;
 		}
 		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
@@ -6165,7 +6218,7 @@ var SQSQueuePolicyProvider = class {
 				await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context.expectedRegion);
 			} catch (error) {
 				if (error instanceof ProvisioningError) throw error;
-				throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+				throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context.maskSecrets);
 			}
 			else {
 				mismatched = true;
@@ -6181,6 +6234,14 @@ var SQSQueuePolicyProvider = class {
 			leftInPlace: QUEUE_POLICY_MISMATCH_LEFT_REASON
 		};
 	}
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error, maskSecrets) {
+		const mask = maskSecrets ?? ((t) => t);
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(`Failed to ${operation} SQS queue policy ${logicalId}: ${failure.detail}`));
+		const cause = error instanceof Error ? error : void 0;
+		const wrapped = new ProvisioningError(`Failed to ${operation} SQS queue policy ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, cause);
+		return failure.redacted && cause !== void 0 ? markRedactedCause(wrapped) : wrapped;
+	}
 	async clearQueuePolicy(queueUrl, resourceType, logicalId, expectedRegion, phase = "not-found") {
 		try {
 			await this.sqsClient.send(new SetQueueAttributesCommand({
@@ -7160,7 +7221,7 @@ const TOPIC_POLICY_NOT_COMPARED_LEFT_REASON = "the document it attempted is miss
 var SNSTopicPolicyProvider = class {
 	logger = getLogger().child("SNSTopicPolicyProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::SNS::TopicPolicy", /* @__PURE__ */ new Set(["Topics", "PolicyDocument"])]]);
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS topic policy ${logicalId}`);
 		const topics = properties["Topics"];
 		const policyDocument = properties["PolicyDocument"];
@@ -7179,7 +7240,7 @@ var SNSTopicPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			const thrown = new ProvisioningError(`Failed to create SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = this.wrapOperationError("create", logicalId, resourceType, void 0, error, context?.maskSecrets);
 			if (applied.length > 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, applied.join(","));
 			throw thrown;
 		}
@@ -7213,8 +7274,7 @@ var SNSTopicPolicyProvider = class {
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapOperationError("update", logicalId, resourceType, physicalId, error, mask);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -7224,12 +7284,13 @@ var SNSTopicPolicyProvider = class {
 		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id is empty, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
 		const topicArns = named.every((arn) => isSnsTopicArn(arn)) ? named : [.../* @__PURE__ */ new Set([...named.filter((arn) => isSnsTopicArn(arn)), ...listedTopics(properties ?? {})])];
 		if (topicArns.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id names no SNS topic ARN and its Topics lists none either, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
+		let clearedAny = false;
 		for (const topicArn of topicArns) try {
 			await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion);
+			clearedAny = true;
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			throw clearedAny ? markDeleteStarted(failure) : failure;
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
@@ -7281,7 +7342,7 @@ var SNSTopicPolicyProvider = class {
 					await this.resetTopicPolicy(topicArn, resourceType, logicalId, context.expectedRegion);
 				} catch (error) {
 					if (error instanceof ProvisioningError) throw error;
-					throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+					throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context.maskSecrets);
 				}
 				continue;
 			}
@@ -7302,6 +7363,14 @@ var SNSTopicPolicyProvider = class {
 			leftInPlace: TOPIC_POLICY_MISMATCH_LEFT_REASON
 		};
 	}
+	wrapOperationError(operation, logicalId, resourceType, physicalId, error, maskSecrets) {
+		const mask = maskSecrets ?? ((t) => t);
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(`Failed to ${operation} SNS topic policy ${logicalId}: ${failure.detail}`));
+		const cause = error instanceof Error ? error : void 0;
+		const wrapped = new ProvisioningError(`Failed to ${operation} SNS topic policy ${logicalId}: ${failure.summary}`, resourceType, logicalId, physicalId, cause);
+		return failure.redacted && cause !== void 0 ? markRedactedCause(wrapped) : wrapped;
+	}
 	async resetTopicPolicy(topicArn, resourceType, logicalId, expectedRegion, phase = "not-found", mask = (t) => t) {
 		const defaultPolicy = defaultTopicPolicy(topicArn);
 		if (defaultPolicy === void 0) throw new ProvisioningError(`Cannot remove SNS topic policy ${logicalId} from ${topicArn}: not an SNS topic ARN`, resourceType, logicalId, topicArn);
@@ -8004,8 +8073,10 @@ var LambdaFunctionProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Lambda function ${logicalId}: ${physicalId}`);
 		const hasVpcConfig = this.hasVpcConfig(properties?.["VpcConfig"]);
+		let stripped = false;
 		if (hasVpcConfig) {
 			try {
+				stripped = true;
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand({
 					FunctionName: physicalId,
 					VpcConfig: {
@@ -8021,6 +8092,7 @@ var LambdaFunctionProvider = class {
 					this.logFunctionGone(logicalId, physicalId, context);
 					return;
 				}
+				if (isRefusedByName(error)) stripped = false;
 				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${describeAwsFailure(error).detail} — continuing with delete`);
 			}
 			await this.waitForLambdaUpdateCompleted(physicalId);
@@ -8036,7 +8108,8 @@ var LambdaFunctionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 		if (hasVpcConfig) await this.cleanupLambdaEnis(physicalId);
 	}
@@ -10016,7 +10089,7 @@ var LambdaMicrovmImageProvider = class {
 			}
 			if (state === "CREATE_FAILED" || state === "UPDATE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered ${state} during ${operation}. Check the build logs in CloudWatch under /aws/lambda/microvms/ to diagnose.`);
 			this.logger.debug(`MicroVM image ${imageArn} state: ${state} (attempt ${attempt}/${this.maxPollAttempts})`);
-			await sleep$1(this.pollIntervalMs);
+			await sleep$2(this.pollIntervalMs);
 		}
 		throw new Error(`MicroVM image ${logicalIdShown(logicalId)} ${isPlainImportValue(imageArn) ? `(${imageArn})` : VALUE_NOT_SHOWN} did not finish ${operation} within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. Increase --resource-timeout AWS::Lambda::MicrovmImage=${commandHole("duration")} or set CDKD_NO_WAIT=true.`);
 	}
@@ -10031,7 +10104,7 @@ var LambdaMicrovmImageProvider = class {
 			}
 			if (resp.state === "DELETE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered DELETE_FAILED. Check the CloudWatch build logs under /aws/lambda/microvms/ to diagnose.`);
 			this.logger.debug(`MicroVM image ${imageArn} state: ${resp.state} (delete attempt ${attempt}/${this.maxPollAttempts})`);
-			await sleep$1(this.pollIntervalMs);
+			await sleep$2(this.pollIntervalMs);
 		}
 		throw new Error(`MicroVM image ${logicalId} (${imageArn}) was not fully deleted within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s.`);
 	}
@@ -10075,7 +10148,7 @@ function positiveIntFromEnv(value, dflt) {
 	const n = Number(value);
 	return Number.isFinite(n) && n > 0 ? n : dflt;
 }
-function sleep$1(ms) {
+function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function buildCommonImageInput(properties) {
@@ -10143,6 +10216,957 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/providers/lambda-web-function-arns.ts
+const CHILD_ARN = /^(arn:[^:]+:lambda:[^:]+:\d{12}:web-function\/[^/]+)\/(revision|endpoint)\/([^/]+)$/;
+function parseWebFunctionChildArn(arn, kind) {
+	const match = CHILD_ARN.exec(arn);
+	if (!match || match[2] !== kind) return void 0;
+	return {
+		functionArn: match[1],
+		childId: match[3]
+	};
+}
+function webFunctionNameOfArn(functionArn) {
+	return functionArn.slice(functionArn.lastIndexOf("/") + 1);
+}
+function recordedFunctionNameSpelling(recorded, liveFunctionArn) {
+	if (typeof recorded === "string" && (recorded === liveFunctionArn || recorded === webFunctionNameOfArn(liveFunctionArn))) return recorded;
+	return liveFunctionArn;
+}
+function projectOntoRecorded(recorded, live) {
+	if (!isPlainRecord$2(recorded) || !isPlainRecord$2(live)) return live;
+	const out = {};
+	for (const key of Object.keys(recorded)) {
+		if (!Object.prototype.hasOwnProperty.call(live, key)) continue;
+		out[key] = projectOntoRecorded(recorded[key], live[key]);
+	}
+	return out;
+}
+function isPlainRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const LAMBDA_WEB_MAX_POLL_ATTEMPTS = 1200;
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+//#endregion
+//#region src/provisioning/providers/lambda-web-function-revision-provider.ts
+const createRevisionLatch = new AmbiguousCreateLatch("lambda-web:CreateWebFunctionRevision");
+const revisionsCreatedByThisProcess = new RecentIdSet();
+var LambdaWebFunctionRevisionProvider = class {
+	client;
+	createClient;
+	logger = getLogger().child("LambdaWebFunctionRevisionProvider");
+	constructor() {
+		this.client = getAwsClients().lambdaWeb;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionRevision", /* @__PURE__ */ new Set([
+		"FunctionName",
+		"Description",
+		"KmsKeyArn",
+		"BuildConfig",
+		"ServiceConfig"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionRevision", /* @__PURE__ */ new Map([
+		["FunctionArn", "AWS-managed read-only attribute"],
+		["RevisionId", "AWS-managed read-only attribute"],
+		["RevisionArn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["State", "AWS-managed read-only attribute"],
+		["StateReason", "AWS-managed read-only attribute"],
+		["CreatedAt", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(safeMsg`Creating Lambda web function revision ${logicalId}`);
+		const input = this.buildCreateInput(logicalId, resourceType, properties, context);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		let createdArn;
+		try {
+			const orphanWindow = createRevisionLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, orphanWindow, log, input.functionName);
+			const createClient = await this.getCreateClient();
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateWebFunctionRevisionCommand(input));
+			} catch (error) {
+				createRevisionLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			createdArn = response.revisionArn;
+			if (createdArn) revisionsCreatedByThisProcess.add(createdArn);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, replayWindow, log, input.functionName);
+			if (!createdArn || !response.revisionId) throw new ProvisioningError(`CreateWebFunctionRevision succeeded but returned no revision ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			const active = await this.waitForActive(input.functionName, createdArn, logicalId);
+			return {
+				physicalId: createdArn,
+				attributes: buildAttributes$2(active)
+			};
+		} catch (error) {
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			let leftBehindArn = createdArn;
+			if (leftBehindArn) try {
+				await this.delete(logicalId, leftBehindArn, resourceType);
+				leftBehindArn = void 0;
+			} catch (cleanupError) {
+				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
+			}
+			if (leftBehindArn) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+				markNonRetryable(thrown);
+			}
+			throw thrown;
+		}
+	}
+	getCreateClient() {
+		this.createClient ??= this.client.config.region().then((region) => withoutServerErrorRetries(new LambdaWebClient({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
+	}
+	async reportPossibleRevisionOrphans(logicalId, window, log, functionName) {
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.client, aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "CreateWebFunctionRevision",
+			service: "Lambda",
+			listAction: "ListWebFunctionRevisions",
+			subject: `a revision of web function ${log.value(functionName)}`,
+			noun: "revision(s)",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.client.send(new ListWebFunctionRevisionsCommand({
+					functionName,
+					...token && { nextToken: token }
+				}));
+				return {
+					items: page.revisions ?? [],
+					next: page.nextToken
+				};
+			}, (item) => item.revisionArn && isInsideWindow(item.createdAt, window) && !revisionsCreatedByThisProcess.has(item.revisionArn) ? item.revisionArn : void 0),
+			inspect: (id) => aws`aws cloudcontrol get-resource --type-name AWS::Lambda::WebFunctionRevision --identifier ${id}${regionArg}`.render(),
+			remove: (id) => aws`aws cloudcontrol delete-resource --type-name AWS::Lambda::WebFunctionRevision --identifier ${id}${regionArg}`.render()
+		});
+	}
+	async update(logicalId, physicalId, resourceType, _properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "A Lambda web function revision is immutable — every property is create-only and there is no update API, so any change creates a new revision. cdkd normally classifies such a change as a replacement, so reaching this path is unexpected; re-run the deploy."));
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(safeMsg`Deleting Lambda web function revision ${logicalId}`);
+		const parts = parseWebFunctionChildArn(physicalId, "revision");
+		if (!parts) throw new ProvisioningError(`Cannot delete Lambda web function revision ${logicalIdShown(logicalId)}: its recorded id is not a revision ARN`, resourceType, logicalId, physicalId);
+		try {
+			try {
+				await this.client.send(new DeleteWebFunctionRevisionCommand({
+					functionName: parts.functionArn,
+					revisionId: physicalId
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(safeMsg`Lambda web function revision ${logicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForGone(parts.functionArn, physicalId, logicalId);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		const parts = parseWebFunctionChildArn(physicalId, "revision");
+		if (attributeName === "RevisionArn") return physicalId;
+		if (attributeName === "RevisionId" && parts) return parts.childId;
+		if (attributeName === "FunctionArn" && parts) return parts.functionArn;
+		if (!parts) return void 0;
+		return buildAttributes$2(await this.client.send(new GetWebFunctionRevisionCommand({
+			functionName: parts.functionArn,
+			revisionId: physicalId
+		})))[attributeName];
+	}
+	async import(input) {
+		const arn = input.knownPhysicalId;
+		if (!arn) return null;
+		const parts = parseWebFunctionChildArn(arn, "revision");
+		if (!parts) throw new Error(`--resource override for ${logicalIdShown(input.logicalId)} must be a Lambda web function revision ARN (got ${isPlainImportValue(arn) ? `'${arn}'` : VALUE_NOT_SHOWN}); use the arn:...:web-function/<name>/revision/<id> ARN.`);
+		try {
+			return {
+				physicalId: arn,
+				attributes: buildAttributes$2(await this.client.send(new GetWebFunctionRevisionCommand({
+					functionName: parts.functionArn,
+					revisionId: arn
+				})))
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return null;
+			throw error;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
+		const parts = parseWebFunctionChildArn(physicalId, "revision");
+		if (!parts) return void 0;
+		let resp;
+		try {
+			resp = await this.client.send(new GetWebFunctionRevisionCommand({
+				functionName: parts.functionArn,
+				revisionId: physicalId
+			}));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const live = { FunctionName: recordedFunctionNameSpelling(properties?.["FunctionName"], resp.functionArn ?? parts.functionArn) };
+		if (resp.description !== void 0) live["Description"] = resp.description;
+		if (resp.kmsKeyArn !== void 0) live["KmsKeyArn"] = resp.kmsKeyArn;
+		if (resp.buildConfig) live["BuildConfig"] = buildConfigToCfn(resp.buildConfig);
+		if (resp.serviceConfig) live["ServiceConfig"] = serviceConfigToCfn(resp.serviceConfig);
+		if (!properties) return live;
+		const out = { FunctionName: live["FunctionName"] };
+		for (const key of [
+			"Description",
+			"KmsKeyArn",
+			"BuildConfig",
+			"ServiceConfig"
+		]) if (key in live) out[key] = projectOntoRecorded(properties[key], live[key]);
+		return out;
+	}
+	buildCreateInput(logicalId, resourceType, properties, context) {
+		const fail = (message) => {
+			throw new ProvisioningError(`${message} for Lambda web function revision ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+		};
+		const functionName = properties["FunctionName"];
+		if (typeof functionName !== "string" || functionName === "") fail("FunctionName must be a non-empty string");
+		const build = properties["BuildConfig"];
+		if (!isPlainRecord$2(build)) fail("BuildConfig must be an object");
+		const code = build["CodeConfig"];
+		const s3 = isPlainRecord$2(code) ? code["S3Object"] : void 0;
+		if (!isPlainRecord$2(s3) || typeof s3["Bucket"] !== "string" || typeof s3["Key"] !== "string") fail("BuildConfig.CodeConfig.S3Object.Bucket and .Key are required strings");
+		const runtimeConfig = build["RuntimeConfig"];
+		const runtime = isPlainRecord$2(runtimeConfig) ? runtimeConfig["Runtime"] : void 0;
+		if (typeof runtime !== "string") fail("BuildConfig.RuntimeConfig.Runtime is a required string");
+		const service = properties["ServiceConfig"];
+		if (!isPlainRecord$2(service) || typeof service["ExecutionRoleArn"] !== "string") fail("ServiceConfig.ExecutionRoleArn is a required string");
+		const s3Object = s3;
+		const input = {
+			functionName,
+			buildConfig: {
+				codeConfig: { s3Object: {
+					bucket: s3Object["Bucket"],
+					key: s3Object["Key"],
+					...typeof s3Object["VersionId"] === "string" ? { versionId: s3Object["VersionId"] } : {}
+				} },
+				runtimeConfig: { runtime }
+			},
+			serviceConfig: this.buildServiceConfig(service, fail, context)
+		};
+		if (typeof properties["Description"] === "string") input.description = properties["Description"];
+		if (typeof properties["KmsKeyArn"] === "string") input.kmsKeyArn = properties["KmsKeyArn"];
+		return input;
+	}
+	buildServiceConfig(service, fail, context) {
+		const out = { executionRoleArn: service["ExecutionRoleArn"] };
+		const integer = (key) => {
+			const raw = service[key];
+			if (raw === void 0) return void 0;
+			const n = coerceCfnInteger(raw);
+			if (n !== void 0) return n;
+			const message = `ServiceConfig.${key} must be an integer`;
+			if (context?.replayingState) {
+				this.logger.warn(safeMsg`${message}; omitting it while replaying a state record`);
+				return;
+			}
+			return fail(message);
+		};
+		const timeoutSeconds = integer("TimeoutSeconds");
+		if (timeoutSeconds !== void 0) out.timeoutSeconds = timeoutSeconds;
+		const maxConcurrencyPerEnvironment = integer("MaxConcurrencyPerEnvironment");
+		if (maxConcurrencyPerEnvironment !== void 0) out.maxConcurrencyPerEnvironment = maxConcurrencyPerEnvironment;
+		if (typeof service["EgressNetworkConnectorArn"] === "string") out.egressNetworkConnectorArn = service["EgressNetworkConnectorArn"];
+		const env = service["EnvironmentVariables"];
+		if (env !== void 0) {
+			if (isPlainRecord$2(env) && Object.values(env).every((v) => typeof v === "string")) out.environmentVariables = { ...env };
+			else if (context?.replayingState) this.logger.warn(safeMsg`ServiceConfig.EnvironmentVariables must be an object of string values; omitting it while replaying a state record`);
+			else fail("ServiceConfig.EnvironmentVariables must be an object of string values");
+		}
+		const telemetry = service["TelemetryConfig"];
+		if (isPlainRecord$2(telemetry)) {
+			const telemetryConfig = {};
+			const logging = telemetry["LoggingConfig"];
+			if (isPlainRecord$2(logging)) {
+				const loggingConfig = {};
+				if (typeof logging["LogGroup"] === "string") loggingConfig.logGroup = logging["LogGroup"];
+				if (typeof logging["ApplicationLogLevel"] === "string") loggingConfig.applicationLogLevel = logging["ApplicationLogLevel"];
+				if (typeof logging["SystemLogLevel"] === "string") loggingConfig.systemLogLevel = logging["SystemLogLevel"];
+				telemetryConfig.loggingConfig = loggingConfig;
+			}
+			out.telemetryConfig = telemetryConfig;
+		}
+		return out;
+	}
+	async waitForActive(functionName, revisionArn, logicalId) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			const resp = await this.client.send(new GetWebFunctionRevisionCommand({
+				functionName,
+				revisionId: revisionArn
+			}));
+			if (resp.state === "Active") return resp;
+			if (resp.state === "Failed") {
+				const errors = (resp.errors ?? []).map((e) => `${e.errorCode ?? ""} ${e.errorMessage ?? ""}`.trim());
+				throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}` + (errors.length > 0 ? ` (${errors.join("; ")})` : ""));
+			}
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} did not become Active within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	async waitForGone(functionName, revisionArn, logicalId) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			try {
+				await this.client.send(new GetWebFunctionRevisionCommand({
+					functionName,
+					revisionId: revisionArn
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) return;
+				throw error;
+			}
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} Lambda web function revision ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+function buildAttributes$2(resp) {
+	return definedAttributes({
+		RevisionArn: resp.revisionArn,
+		RevisionId: resp.revisionId,
+		FunctionArn: resp.functionArn,
+		State: resp.state,
+		StateReason: resp.stateReason,
+		CreatedAt: resp.createdAt?.toISOString()
+	});
+}
+function buildConfigToCfn(config) {
+	const out = {};
+	const s3 = config.codeConfig && "s3Object" in config.codeConfig ? config.codeConfig.s3Object : void 0;
+	if (s3) {
+		const S3Object = {
+			Bucket: s3.bucket,
+			Key: s3.key
+		};
+		if (s3.versionId !== void 0) S3Object["VersionId"] = s3.versionId;
+		out["CodeConfig"] = { S3Object };
+	}
+	if (config.runtimeConfig) out["RuntimeConfig"] = { Runtime: config.runtimeConfig.runtime };
+	return out;
+}
+function serviceConfigToCfn(config) {
+	const out = { ExecutionRoleArn: config.executionRoleArn };
+	if (config.timeoutSeconds !== void 0) out["TimeoutSeconds"] = config.timeoutSeconds;
+	if (config.maxConcurrencyPerEnvironment !== void 0) out["MaxConcurrencyPerEnvironment"] = config.maxConcurrencyPerEnvironment;
+	if (config.egressNetworkConnectorArn !== void 0) out["EgressNetworkConnectorArn"] = config.egressNetworkConnectorArn;
+	if (config.environmentVariables !== void 0) out["EnvironmentVariables"] = { ...config.environmentVariables };
+	const logging = config.telemetryConfig?.loggingConfig;
+	if (logging) {
+		const LoggingConfig = {};
+		if (logging.logGroup !== void 0) LoggingConfig["LogGroup"] = logging.logGroup;
+		if (logging.applicationLogLevel !== void 0) LoggingConfig["ApplicationLogLevel"] = logging.applicationLogLevel;
+		if (logging.systemLogLevel !== void 0) LoggingConfig["SystemLogLevel"] = logging.systemLogLevel;
+		out["TelemetryConfig"] = { LoggingConfig };
+	}
+	return out;
+}
+
+//#endregion
+//#region src/provisioning/providers/lambda-web-function-endpoint-provider.ts
+var LambdaWebFunctionEndpointProvider = class {
+	client;
+	logger = getLogger().child("LambdaWebFunctionEndpointProvider");
+	constructor() {
+		this.client = getAwsClients().lambdaWeb;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionEndpoint", /* @__PURE__ */ new Set([
+		"FunctionName",
+		"EndpointName",
+		"Description",
+		"EndpointType",
+		"AuthType",
+		"RevisionWeights",
+		"Regions",
+		"ScalingConfig",
+		"ThrottleConfig"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::WebFunctionEndpoint", /* @__PURE__ */ new Map([
+		["FunctionArn", "AWS-managed read-only attribute"],
+		["EndpointArn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["DomainName", "AWS-managed read-only attribute"],
+		["State", "AWS-managed read-only attribute"],
+		["StateReason", "AWS-managed read-only attribute"],
+		["UpdateStatus", "AWS-managed read-only attribute"],
+		["UpdateStatusReason", "AWS-managed read-only attribute"],
+		["RegionalEndpoints", "AWS-managed read-only attribute"],
+		["CreatedAt", "AWS-managed read-only attribute"],
+		["UpdatedAt", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(safeMsg`Creating Lambda web function endpoint ${logicalId}`);
+		const fail = this.refusal(logicalId, resourceType);
+		const lenient = context?.replayingState === true;
+		const functionName = properties["FunctionName"];
+		const endpointName = properties["EndpointName"];
+		const endpointType = properties["EndpointType"];
+		const authType = properties["AuthType"];
+		for (const [key, value] of [
+			["FunctionName", functionName],
+			["EndpointName", endpointName],
+			["EndpointType", endpointType],
+			["AuthType", authType]
+		]) if (typeof value !== "string" || value === "") fail(`${key} must be a non-empty string`);
+		const input = {
+			functionName,
+			endpointName,
+			endpointType,
+			authType
+		};
+		if (typeof properties["Description"] === "string") input.description = properties["Description"];
+		const weights = readRevisionWeights(properties["RevisionWeights"], fail);
+		if (weights !== void 0) input.revisionWeights = weights.map((w) => ({
+			revisionId: w.RevisionId,
+			weight: w.Weight
+		}));
+		if (properties["Regions"] !== void 0) {
+			const regions = properties["Regions"];
+			if (!Array.isArray(regions) || regions.some((r) => typeof r !== "string")) fail("Regions must be a list of strings");
+			input.regions = [...regions];
+		}
+		const scaling = this.readIntegerBlock(properties["ScalingConfig"], "ScalingConfig", "MaxEnvironments", fail, lenient);
+		if (scaling !== void 0) input.scalingConfig = scaling.present ? { maxEnvironments: scaling.n } : {};
+		const throttle = this.readIntegerBlock(properties["ThrottleConfig"], "ThrottleConfig", "RateLimit", fail, lenient);
+		if (throttle !== void 0) input.throttleConfig = throttle.present ? { rateLimit: throttle.n } : {};
+		let createdArn;
+		try {
+			createdArn = (await this.client.send(new CreateWebFunctionEndpointCommand(input))).endpointArn;
+			if (!createdArn) throw new ProvisioningError(`CreateWebFunctionEndpoint succeeded but returned no endpoint ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, "create");
+			return {
+				physicalId: createdArn,
+				attributes: buildAttributes$1(settled)
+			};
+		} catch (error) {
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) throw new ProvisioningError(`Cannot update Lambda web function endpoint ${logicalIdShown(logicalId)}: its recorded id is not an endpoint ARN`, resourceType, logicalId, physicalId);
+		const fail = this.refusal(logicalId, resourceType, physicalId);
+		const lenient = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		const input = {
+			functionName: parts.functionArn,
+			endpointName: parts.childId,
+			description: typeof properties["Description"] === "string" ? properties["Description"] : ""
+		};
+		if (typeof properties["AuthType"] === "string") input.authType = properties["AuthType"];
+		const weights = readRevisionWeights(properties["RevisionWeights"], fail);
+		if (weights !== void 0) input.revisionWeights = weights.map((w) => ({
+			revisionId: w.RevisionId,
+			weight: w.Weight
+		}));
+		else if (!lenient) fail("RevisionWeights is required; AWS keeps routing to the current revisions when it is removed");
+		const scaling = this.readIntegerBlock(properties["ScalingConfig"], "ScalingConfig", "MaxEnvironments", fail, lenient);
+		if (properties["ScalingConfig"] === void 0) input.scalingConfig = {};
+		else if (scaling !== void 0) input.scalingConfig = scaling.present ? { maxEnvironments: scaling.n } : {};
+		const throttle = this.readIntegerBlock(properties["ThrottleConfig"], "ThrottleConfig", "RateLimit", fail, lenient);
+		if (properties["ThrottleConfig"] === void 0) input.throttleConfig = {};
+		else if (throttle !== void 0) input.throttleConfig = throttle.present ? { rateLimit: throttle.n } : {};
+		try {
+			await this.client.send(new UpdateWebFunctionEndpointCommand(input));
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: buildAttributes$1(await this.waitForSettled(parts.functionArn, parts.childId, logicalId, "update", input.revisionWeights))
+			};
+		} catch (error) {
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(safeMsg`Deleting Lambda web function endpoint ${logicalId}`);
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) throw new ProvisioningError(`Cannot delete Lambda web function endpoint ${logicalIdShown(logicalId)}: its recorded id is not an endpoint ARN`, resourceType, logicalId, physicalId);
+		try {
+			try {
+				await this.client.send(new DeleteWebFunctionEndpointCommand({
+					functionName: parts.functionArn,
+					endpointName: parts.childId
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(safeMsg`Lambda web function endpoint ${logicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForGone(parts.functionArn, parts.childId, logicalId);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "EndpointArn") return physicalId;
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) return void 0;
+		if (attributeName === "FunctionArn") return parts.functionArn;
+		return buildAttributes$1(await this.client.send(new GetWebFunctionEndpointCommand({
+			functionName: parts.functionArn,
+			endpointName: parts.childId
+		})))[attributeName];
+	}
+	async import(input) {
+		let functionName;
+		let endpointName;
+		if (input.knownPhysicalId) {
+			const parts = parseWebFunctionChildArn(input.knownPhysicalId, "endpoint");
+			if (!parts) throw new Error(`--resource override for ${logicalIdShown(input.logicalId)} must be a Lambda web function endpoint ARN (got ${isPlainImportValue(input.knownPhysicalId) ? `'${input.knownPhysicalId}'` : VALUE_NOT_SHOWN}); use the arn:...:web-function/<name>/endpoint/<endpoint> ARN.`);
+			functionName = parts.functionArn;
+			endpointName = parts.childId;
+		} else {
+			const props = input.properties ?? {};
+			if (typeof props["FunctionName"] !== "string" || typeof props["EndpointName"] !== "string") return null;
+			functionName = props["FunctionName"];
+			endpointName = props["EndpointName"];
+		}
+		try {
+			const resp = await this.client.send(new GetWebFunctionEndpointCommand({
+				functionName,
+				endpointName
+			}));
+			if (!resp.endpointArn) return null;
+			return {
+				physicalId: resp.endpointArn,
+				attributes: buildAttributes$1(resp)
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return null;
+			throw error;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
+		const parts = parseWebFunctionChildArn(physicalId, "endpoint");
+		if (!parts) return void 0;
+		let resp;
+		try {
+			resp = await this.client.send(new GetWebFunctionEndpointCommand({
+				functionName: parts.functionArn,
+				endpointName: parts.childId
+			}));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$9) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const live = {
+			FunctionName: recordedFunctionNameSpelling(properties?.["FunctionName"], resp.functionArn ?? parts.functionArn),
+			EndpointName: resp.endpointName ?? parts.childId
+		};
+		if (resp.description !== void 0) live["Description"] = resp.description;
+		if (resp.endpointType !== void 0) live["EndpointType"] = resp.endpointType;
+		if (resp.authType !== void 0) live["AuthType"] = resp.authType;
+		if (resp.revisionWeights !== void 0) live["RevisionWeights"] = resp.revisionWeights.map((w) => ({
+			RevisionId: w.revisionId,
+			Weight: w.weight
+		}));
+		if (resp.regions !== void 0) live["Regions"] = [...resp.regions];
+		if (resp.scalingConfig !== void 0) live["ScalingConfig"] = resp.scalingConfig.maxEnvironments !== void 0 ? { MaxEnvironments: resp.scalingConfig.maxEnvironments } : {};
+		if (resp.throttleConfig !== void 0) live["ThrottleConfig"] = resp.throttleConfig.rateLimit !== void 0 ? { RateLimit: resp.throttleConfig.rateLimit } : {};
+		if (!properties) return live;
+		const out = {};
+		for (const [key, value] of Object.entries(live)) out[key] = key === "ScalingConfig" || key === "ThrottleConfig" ? value : projectOntoRecorded(properties[key], value);
+		return out;
+	}
+	refusal(logicalId, resourceType, physicalId) {
+		return (message) => {
+			throw new ProvisioningError(`${message} for Lambda web function endpoint ${logicalIdShown(logicalId)}`, resourceType, logicalId, physicalId);
+		};
+	}
+	readIntegerBlock(value, blockKey, memberKey, fail, lenient) {
+		if (value === void 0) return void 0;
+		const bad = (message) => {
+			if (lenient) {
+				this.logger.warn(safeMsg`${message}; leaving the live ${blockKey} unchanged`);
+				return;
+			}
+			return fail(message);
+		};
+		if (!isPlainRecord$2(value)) return bad(`${blockKey} must be an object`);
+		if (value[memberKey] === void 0) return { present: false };
+		const n = coerceCfnInteger(value[memberKey]);
+		if (n === void 0) return bad(`${blockKey}.${memberKey} must be an integer`);
+		return {
+			present: true,
+			n
+		};
+	}
+	async waitForSettled(functionName, endpointName, logicalId, operation, sentWeights) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			let resp;
+			try {
+				resp = await this.client.send(new GetWebFunctionEndpointCommand({
+					functionName,
+					endpointName
+				}));
+			} catch (error) {
+				if (operation === "create" && attempt <= 10 && error instanceof ResourceNotFoundException$9) {
+					await sleep$1(500);
+					continue;
+				}
+				throw error;
+			}
+			if (resp.state === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}`);
+			if (resp.updateStatus === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} ${operation} failed: ${resp.updateStatusReason ?? "no reason given"}`);
+			if (resp.state === "Active" && resp.updateStatus !== "InProgress" && (sentWeights === void 0 || sameWeights(sentWeights, resp.revisionWeights))) return resp;
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} did not finish ${operation} within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	async waitForGone(functionName, endpointName, logicalId) {
+		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
+			try {
+				await this.client.send(new GetWebFunctionEndpointCommand({
+					functionName,
+					endpointName
+				}));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$9) return;
+				throw error;
+			}
+			await sleep$1(500);
+		}
+		throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} Lambda web function endpoint ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+function readRevisionWeights(value, fail) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) return fail("RevisionWeights must be a list");
+	return value.map((entry, i) => {
+		if (!isPlainRecord$2(entry) || typeof entry["RevisionId"] !== "string") return fail(`RevisionWeights[${i}].RevisionId must be a string`);
+		const weight = coerceCfnInteger(entry["Weight"]);
+		if (weight === void 0) return fail(`RevisionWeights[${i}].Weight must be an integer`);
+		return {
+			RevisionId: entry["RevisionId"],
+			Weight: weight
+		};
+	});
+}
+function sameWeights(a, b) {
+	if (b === void 0 || a.length !== b.length) return false;
+	const key = (w) => `${w.revisionId ?? ""}=${w.weight ?? ""}`;
+	const left = a.map(key).sort();
+	const right = b.map(key).sort();
+	return left.every((k, i) => k === right[i]);
+}
+function buildAttributes$1(resp) {
+	return definedAttributes({
+		EndpointArn: resp.endpointArn,
+		FunctionArn: resp.functionArn,
+		DomainName: resp.domainName,
+		State: resp.state,
+		StateReason: resp.stateReason,
+		UpdateStatus: resp.updateStatus,
+		UpdateStatusReason: resp.updateStatusReason,
+		CreatedAt: resp.createdAt?.toISOString(),
+		UpdatedAt: resp.updatedAt?.toISOString()
+	});
+}
+
+//#endregion
+//#region src/provisioning/providers/lambda-network-connector-provider.ts
+const POLL_INTERVAL_MS$2 = 1e3;
+const MAX_POLL_ATTEMPTS = 1200;
+var LambdaNetworkConnectorProvider = class {
+	client;
+	lambda;
+	logger = getLogger().child("LambdaNetworkConnectorProvider");
+	constructor() {
+		const clients = getAwsClients();
+		this.client = clients.lambdaCore;
+		this.lambda = clients.lambda;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::NetworkConnector", /* @__PURE__ */ new Set([
+		"Name",
+		"Configuration",
+		"OperatorRole",
+		"Tags"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::NetworkConnector", /* @__PURE__ */ new Map([
+		["Arn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["State", "AWS-managed read-only attribute"],
+		["LatestVersionArn", "AWS-managed read-only attribute"],
+		["LatestVersion", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(safeMsg`Creating Lambda network connector ${logicalId}`);
+		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generateResourceName(logicalId, { maxLength: 64 });
+		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
+		const createToken = acquireIdempotencyToken({
+			scope: "CreateNetworkConnector",
+			logicalId
+		});
+		const input = {
+			Name: name,
+			Configuration: { VpcEgressConfiguration: {
+				SubnetIds: vpc.SubnetIds,
+				SecurityGroupIds: vpc.SecurityGroupIds,
+				NetworkProtocol: vpc.NetworkProtocol,
+				AssociatedComputeResourceTypes: vpc.AssociatedComputeResourceTypes
+			} },
+			ClientToken: createToken.value
+		};
+		const operatorRole = this.readOperatorRole(properties, logicalId, resourceType, void 0, context);
+		if (operatorRole !== void 0) input.OperatorRole = operatorRole;
+		if (tagList.length > 0) input.Tags = Object.fromEntries(tagList.map((t) => [t.Key, t.Value]));
+		let createdArn;
+		try {
+			createdArn = (await this.client.send(new CreateNetworkConnectorCommand(input))).Arn;
+			if (!createdArn) throw new ProvisioningError(`CreateNetworkConnector succeeded but returned no ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			const settled = await this.waitForSettled(createdArn, logicalId, "create");
+			createToken.release();
+			return {
+				physicalId: createdArn,
+				attributes: buildAttributes(settled)
+			};
+		} catch (error) {
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			if (error instanceof TerminalConnectorStateError) markNonRetryable(thrown);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const vpc = this.readVpcEgress(properties, logicalId, resourceType, physicalId);
+		const updateRole = this.readOperatorRole(properties, logicalId, resourceType, physicalId, context);
+		if (typeof previousProperties["OperatorRole"] === "string" && properties["OperatorRole"] === void 0 && context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`OperatorRole cannot be removed in place for Lambda network connector ${logicalIdShown(logicalId)}: cdkd sends no role when the template declares none, so the current one would stay attached. Set it to another role, or replace the connector (change its Name).`, resourceType, logicalId, physicalId);
+		try {
+			const configChanged = JSON.stringify(properties["Configuration"]) !== JSON.stringify(previousProperties["Configuration"]) || properties["OperatorRole"] !== previousProperties["OperatorRole"];
+			await this.reconcileTags(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"]);
+			if (configChanged) await this.client.send(new UpdateNetworkConnectorCommand({
+				Identifier: physicalId,
+				Configuration: { VpcEgressConfiguration: {
+					SubnetIds: vpc.SubnetIds,
+					SecurityGroupIds: vpc.SecurityGroupIds,
+					NetworkProtocol: vpc.NetworkProtocol,
+					AssociatedComputeResourceTypes: vpc.AssociatedComputeResourceTypes
+				} },
+				...updateRole !== void 0 ? { OperatorRole: updateRole } : {},
+				ClientToken: randomUUID()
+			}));
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: buildAttributes(configChanged ? await this.waitForSettled(physicalId, logicalId, "update") : await this.client.send(new GetNetworkConnectorCommand({ Identifier: physicalId })))
+			};
+		} catch (error) {
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(safeMsg`Deleting Lambda network connector ${logicalId}`);
+		try {
+			try {
+				await this.client.send(new DeleteNetworkConnectorCommand({ Identifier: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$10) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(safeMsg`Lambda network connector ${logicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForGone(physicalId, logicalId);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Arn") return physicalId;
+		return buildAttributes(await this.client.send(new GetNetworkConnectorCommand({ Identifier: physicalId })))[attributeName];
+	}
+	async import(input) {
+		const props = input.properties ?? {};
+		const identifier = input.knownPhysicalId ?? (typeof props["Name"] === "string" ? props["Name"] : void 0);
+		if (!identifier) return null;
+		try {
+			const resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: identifier }));
+			if (!resp.Arn) return null;
+			return {
+				physicalId: resp.Arn,
+				attributes: buildAttributes(resp)
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return null;
+			throw error;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let resp;
+		try {
+			resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: physicalId }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const result = {};
+		if (resp.Name !== void 0) result["Name"] = resp.Name;
+		if (resp.OperatorRole !== void 0) result["OperatorRole"] = resp.OperatorRole;
+		const vpc = resp.Configuration && "VpcEgressConfiguration" in resp.Configuration ? resp.Configuration.VpcEgressConfiguration : void 0;
+		if (vpc) {
+			const VpcEgressConfiguration = {};
+			if (vpc.SubnetIds !== void 0) VpcEgressConfiguration["SubnetIds"] = [...vpc.SubnetIds];
+			if (vpc.SecurityGroupIds !== void 0) VpcEgressConfiguration["SecurityGroupIds"] = [...vpc.SecurityGroupIds];
+			if (vpc.NetworkProtocol !== void 0) VpcEgressConfiguration["NetworkProtocol"] = vpc.NetworkProtocol;
+			if (vpc.AssociatedComputeResourceTypes !== void 0) VpcEgressConfiguration["AssociatedComputeResourceTypes"] = [...vpc.AssociatedComputeResourceTypes];
+			result["Configuration"] = { VpcEgressConfiguration };
+		}
+		let tags;
+		try {
+			tags = await this.lambda.send(new ListTagsCommand({ Resource: physicalId }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		result["Tags"] = normalizeAwsTagsToCfn(tags.Tags);
+		return result;
+	}
+	getDriftUnorderedPaths() {
+		return [
+			"Configuration.VpcEgressConfiguration.SubnetIds",
+			"Configuration.VpcEgressConfiguration.SecurityGroupIds",
+			"Configuration.VpcEgressConfiguration.AssociatedComputeResourceTypes"
+		];
+	}
+	readVpcEgress(properties, logicalId, resourceType, physicalId) {
+		const fail = (message) => {
+			throw new ProvisioningError(`${message} for Lambda network connector ${logicalIdShown(logicalId)}`, resourceType, logicalId, physicalId);
+		};
+		const config = properties["Configuration"];
+		const vpc = isPlainRecord$2(config) ? config["VpcEgressConfiguration"] : void 0;
+		if (!isPlainRecord$2(vpc)) return fail("Configuration.VpcEgressConfiguration must be an object");
+		const strings = (key) => {
+			const value = vpc[key];
+			if (value === void 0) return void 0;
+			if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) return fail(`Configuration.VpcEgressConfiguration.${key} must be a list of strings`);
+			return [...value];
+		};
+		const subnetIds = strings("SubnetIds");
+		const securityGroupIds = strings("SecurityGroupIds");
+		const types = strings("AssociatedComputeResourceTypes");
+		const protocol = vpc["NetworkProtocol"];
+		if (protocol !== void 0 && typeof protocol !== "string") fail("Configuration.VpcEgressConfiguration.NetworkProtocol must be a string");
+		return {
+			SubnetIds: subnetIds,
+			SecurityGroupIds: securityGroupIds,
+			NetworkProtocol: typeof protocol === "string" ? protocol : void 0,
+			AssociatedComputeResourceTypes: types
+		};
+	}
+	readOperatorRole(properties, logicalId, resourceType, physicalId, context) {
+		const role = properties["OperatorRole"];
+		if (role === void 0 || typeof role === "string") return role;
+		const message = `OperatorRole must be a string for Lambda network connector ${logicalIdShown(logicalId)}`;
+		if (context?.replayingState === true || context !== void 0 && "desiredFromAwsReadback" in context && context.desiredFromAwsReadback === true) {
+			this.logger.warn(safeMsg`${message}; omitting it while applying a state-borne bag`);
+			return;
+		}
+		throw new ProvisioningError(message, resourceType, logicalId, physicalId);
+	}
+	async reconcileTags(physicalId, resourceType, logicalId, newTags, oldTags) {
+		const plan = planTagDiff(oldTags, newTags);
+		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
+		if (tagWarning !== void 0) this.logger.warn(tagWarning);
+		if (plan.remove.length > 0) await this.lambda.send(new UntagResourceCommand$1({
+			Resource: physicalId,
+			TagKeys: plan.remove
+		}));
+		const toAdd = Object.fromEntries(plan.set);
+		if (Object.keys(toAdd).length > 0) await this.lambda.send(new TagResourceCommand$1({
+			Resource: physicalId,
+			Tags: toAdd
+		}));
+	}
+	async waitForSettled(arn, logicalId, operation) {
+		for (let attempt = 1; attempt <= MAX_POLL_ATTEMPTS; attempt++) {
+			const resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: arn }));
+			if (resp.State === "FAILED" || resp.State === "DELETING" || resp.State === "DELETE_FAILED" || resp.State === "INACTIVE") throw new TerminalConnectorStateError(`Lambda network connector ${logicalIdShown(logicalId)} entered ${resp.State}: ${resp.StateReason ?? resp.StateReasonCode ?? "no reason given"}`);
+			if (operation === "update" && resp.LastUpdateStatus === "Failed") throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} update failed: ${resp.LastUpdateStatusReason ?? resp.LastUpdateStatusReasonCode ?? "no reason given"}`);
+			if (resp.State === "ACTIVE" && resp.LastUpdateStatus !== "InProgress") return resp;
+			await sleep$1(POLL_INTERVAL_MS$2);
+		}
+		throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} did not finish ${operation} within ${MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2 / 1e3}s.`);
+	}
+	async waitForGone(arn, logicalId) {
+		for (let attempt = 1; attempt <= MAX_POLL_ATTEMPTS; attempt++) {
+			let resp;
+			try {
+				resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: arn }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$10) return;
+				throw error;
+			}
+			if (resp.State === "DELETE_FAILED") throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} entered DELETE_FAILED: ${resp.StateReason ?? resp.StateReasonCode ?? "no reason given"}`);
+			await sleep$1(POLL_INTERVAL_MS$2);
+		}
+		throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} was not fully deleted within ${MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2 / 1e3}s.`);
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} Lambda network connector ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+var TerminalConnectorStateError = class extends Error {};
+function buildAttributes(resp) {
+	return definedAttributes({
+		Arn: resp.Arn,
+		State: resp.State,
+		LatestVersionArn: resp.LatestVersionArn,
+		LatestVersion: resp.LatestVersion ?? versionOfArn(resp.LatestVersionArn)
+	});
+}
+function versionOfArn(arn) {
+	const match = arn === void 0 ? null : /:network-connector:[^:]+:(\d+)$/.exec(arn);
+	return match ? Number(match[1]) : void 0;
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-contributor-insights.ts
 const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
@@ -14105,6 +15129,7 @@ var EventBridgeRuleProvider = class {
 		this.logger.debug(`Deleting EventBridge rule ${logicalId}: ${physicalId}`);
 		const ruleName = this.extractRuleNameFromArn(physicalId);
 		const busParam = this.busParamFromArn(physicalId);
+		let stripped = false;
 		try {
 			let targetIds = [];
 			try {
@@ -14127,6 +15152,7 @@ var EventBridgeRuleProvider = class {
 					Ids: targetIds,
 					...busParam
 				}));
+				stripped = true;
 				this.logger.debug(`Removed ${targetIds.length} targets from rule ${ruleName}`);
 			}
 			await this.eventBridgeClient.send(new DeleteRuleCommand({
@@ -14142,7 +15168,8 @@ var EventBridgeRuleProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -14408,8 +15435,9 @@ var EventBridgeBusProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting EventBus ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
-			await this.cleanupRulesOnBus(physicalId);
+			stripped = await this.cleanupRulesOnBus(physicalId);
 			await this.eventBridgeClient.send(new DeleteEventBusCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted EventBus ${logicalId}`);
 		} catch (error) {
@@ -14427,7 +15455,8 @@ var EventBridgeBusProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EventBus ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBus ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	getAttribute(physicalId, _resourceType, attributeName) {
@@ -14436,9 +15465,11 @@ var EventBridgeBusProvider = class {
 		return Promise.resolve(void 0);
 	}
 	async cleanupRulesOnBus(busName) {
+		let found = false;
 		try {
 			const rules = (await this.eventBridgeClient.send(new ListRulesCommand({ EventBusName: busName }))).Rules ?? [];
-			if (rules.length === 0) return;
+			if (rules.length === 0) return false;
+			found = true;
 			this.logger.debug(`Cleaning up ${rules.length} rule(s) on bus ${busName}`);
 			for (const rule of rules) {
 				if (!rule.Name) continue;
@@ -14461,9 +15492,10 @@ var EventBridgeBusProvider = class {
 				} catch {}
 			}
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$2) return;
+			if (error instanceof ResourceNotFoundException$2) return found;
 			this.logger.debug(`Failed to list rules on bus ${busName}: ${describeAwsFailure(error).detail}`);
 		}
+		return found;
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		try {
@@ -15168,7 +16200,10 @@ var EC2Provider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			if (leftBehindId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -15514,6 +16549,7 @@ var EC2Provider = class {
 		let publicIp;
 		let created = false;
 		let createdId;
+		let allocatedId;
 		try {
 			const input = {
 				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
@@ -15533,6 +16569,7 @@ var EC2Provider = class {
 			}
 			created = true;
 			allocationId = response.AllocationId;
+			allocatedId = allocationId;
 			publicIp = response.PublicIp;
 			try {
 				createdId = this.eipPhysicalId(logicalId, publicIp, allocationId);
@@ -15557,9 +16594,31 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
 		} catch (error) {
 			if (created) markAuxiliaryFailure(error, logicalId);
+			if (createdId !== void 0 && allocatedId !== void 0) try {
+				const releaseId = allocatedId;
+				const watch = startInterruptWatch(`EIP ${logicalId} release`);
+				try {
+					await withRetry(() => this.ec2Client.send(new ReleaseAddressCommand({ AllocationId: releaseId })), logicalId, {
+						maxRetries: 4,
+						initialDelayMs: 500,
+						isRetryable: (_text, releaseError) => isThrottlingError(releaseError),
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
+				createdId = void 0;
+				this.logger.debug(safeMsg`Released partially-created EIP ${logicalId} (${allocatedId})`);
+			} catch (cleanupError) {
+				this.logger.warn(safeMsg`Failed to release partially-created EIP ${logicalId} (${allocatedId}): ${describeAwsFailure(cleanupError).detail}. Manual release may be required: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 release-address --allocation-id ${allocatedId}`.render()}`);
+			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+			if (createdId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 		return {
@@ -18475,12 +19534,15 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			log.debug(`PathPart changed from "${log.value(oldPathPart)}" to "${log.value(newPathPart)}", replacing resource`);
 			const createResult = await this.createResource(logicalId, resourceType, properties, log);
 			let orphanReason;
+			let oldResourceSurvivor = "unconfirmed";
 			try {
 				if (redactedDeleteAddressFields({ RestApiId: previousProperties["RestApiId"] }).length > 0) {
 					orphanReason = `old API Gateway Resource ${physicalId} was not deleted: its recorded RestApiId is redacted`;
+					oldResourceSurvivor = "kept";
 					log.warn(safeMsg`Old API Gateway Resource ${physicalId} was not deleted during replacement: its ` + "recorded RestApiId is redacted in state, which names no API. The old resource may be orphaned and require manual cleanup.");
 				} else await this.deleteResource(logicalId, physicalId, resourceType, previousProperties);
 			} catch (error) {
+				oldResourceSurvivor = replacedDeleteFailureVerdict(error);
 				orphanReason = log.mask(`old API Gateway Resource ${physicalId} could not be deleted: ${safeStringify(error)}`);
 				log.warn(`Failed to delete old API Gateway Resource ${physicalId} during replacement: ${safeStringify(error)}. The old resource may be orphaned and require manual cleanup.`);
 			}
@@ -18492,7 +19554,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			return orphanReason !== void 0 ? {
 				...base,
 				outcome: "partial",
-				reason: orphanReason
+				reason: orphanReason,
+				...oldResourceSurvivor === "kept" && { oldResourceSurvivor }
 			} : base;
 		}
 		return {
@@ -20802,8 +21865,9 @@ var CloudFrontOAIProvider = class {
 			throw new ProvisioningError(`Failed to create CloudFront OAI ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating CloudFront OAI ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudFrontClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update", "global");
 		const config = properties["CloudFrontOriginAccessIdentityConfig"];
 		try {
 			const comment = readConfigString(config, "Comment", "", "AWS::CloudFront::CloudFrontOriginAccessIdentity CloudFrontOriginAccessIdentityConfig");
@@ -20946,8 +22010,9 @@ var CloudFrontOACProvider = class {
 			throw new ProvisioningError(`Failed to create CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating CloudFront Origin Access Control ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudFrontClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update", "global");
 		try {
 			const etag = (await this.cloudFrontClient.send(new GetOriginAccessControlCommand({ Id: physicalId }))).ETag;
 			if (!etag) throw new Error("GetOriginAccessControl did not return ETag");
@@ -21185,8 +22250,9 @@ var CloudFrontDistributionProvider = class {
 		if (comment !== "") parts.push(`comment ${JSON.stringify(comment)}`);
 		return parts.length > 0 ? parts.join(" and ") : "its creation time (the orphan is the newest distribution in this account)";
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating CloudFront Distribution ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudFrontClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update", "global");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const getConfigResponse = await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }));
@@ -21223,6 +22289,7 @@ var CloudFrontDistributionProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting CloudFront Distribution ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
 			let etag;
 			let config;
@@ -21242,11 +22309,13 @@ var CloudFrontDistributionProvider = class {
 			if (config.Enabled) {
 				this.logger.debug(`Disabling CloudFront Distribution ${physicalId} before deletion`);
 				config.Enabled = false;
-				etag = (await this.cloudFrontClient.send(new UpdateDistributionCommand({
+				const updateResponse = await this.cloudFrontClient.send(new UpdateDistributionCommand({
 					Id: physicalId,
 					IfMatch: etag,
 					DistributionConfig: config
-				}))).ETag;
+				}));
+				stripped = true;
+				etag = updateResponse.ETag;
 				if (!await this.waitForDistributionStable(physicalId, false)) this.logger.warn(`Distribution ${shownId(physicalId)} disable did not settle (Deployed + disabled) within the wait budget; attempting delete anyway. If it fails with DistributionNotDisabled, retry the destroy or raise the budget with --resource-timeout AWS::CloudFront::Distribution=${commandHole("duration")}.`);
 				etag = (await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }))).ETag;
 			} else {
@@ -21266,7 +22335,8 @@ var CloudFrontDistributionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
@@ -23201,6 +24271,7 @@ var ECSProvider = class {
 				if (skip) return skip;
 			}
 		} else cluster = recordedCluster;
+		let stripped = false;
 		try {
 			try {
 				await client.send(new UpdateServiceCommand({
@@ -23208,6 +24279,8 @@ var ECSProvider = class {
 					service: physicalId,
 					desiredCount: 0
 				}));
+				const recordedCount = properties?.["DesiredCount"];
+				stripped = !(recordedCount === 0 || recordedCount === "0");
 				this.logger.debug(`Scaled down ECS service ${physicalId} to 0`);
 			} catch (error) {
 				if (this.isServiceNotFoundException(error)) {
@@ -23232,7 +24305,8 @@ var ECSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getServiceAttribute(physicalId, attributeName) {
@@ -27505,9 +28579,10 @@ var Route53Provider = class {
 	}
 	async deleteHostedZone(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route 53 hosted zone ${logicalId}: ${physicalId}`);
+		const progress = { stripped: false };
 		try {
-			await this.deleteQueryLoggingConfigForZone(physicalId, logicalId);
-			await this.ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId);
+			await this.deleteQueryLoggingConfigForZone(physicalId, logicalId, progress);
+			await this.ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId, progress);
 			await this.getClient().send(new DeleteHostedZoneCommand({ Id: physicalId }));
 			this.logger.debug(`Successfully deleted hosted zone ${logicalId}`);
 		} catch (error) {
@@ -27517,12 +28592,12 @@ var Route53Provider = class {
 				this.logger.debug(`Hosted zone ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	async ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId) {
+	async ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId, progress) {
 		const client = this.getClient();
 		const pollIntervalMs = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_INTERVAL_MS"] ?? "15000", 10);
 		const timeoutMs = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_TIMEOUT_MS"] ?? "600000", 10);
@@ -27565,6 +28640,7 @@ var Route53Provider = class {
 				HostedZoneId: physicalId,
 				EnableAcceleratedRecovery: false
 			}));
+			progress.stripped = true;
 		} else if (current === "DISABLING" || current === "DISABLING_HOSTED_ZONE_LOCKED") this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecovery is already ${current} (a disabling phase); waiting for settle`);
 		const settled = await waitFor(/* @__PURE__ */ new Set(["DISABLED"]), "DISABLED");
 		this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecoveryStatus settled to ${settled ?? "undefined (zone gone)"}`);
@@ -27917,11 +28993,18 @@ var Route53Provider = class {
 			throw error;
 		}
 	}
-	async deleteQueryLoggingConfigForZone(zoneId, logicalId) {
+	async deleteQueryLoggingConfigForZone(zoneId, logicalId, progress) {
 		try {
 			const configs = (await this.getClient().send(new ListQueryLoggingConfigsCommand({ HostedZoneId: zoneId }))).QueryLoggingConfigs ?? [];
 			for (const config of configs) if (config.Id) {
-				await this.getClient().send(new DeleteQueryLoggingConfigCommand({ Id: config.Id }));
+				const before = progress?.stripped;
+				if (progress) progress.stripped = true;
+				try {
+					await this.getClient().send(new DeleteQueryLoggingConfigCommand({ Id: config.Id }));
+				} catch (deleteError) {
+					if (progress && before !== void 0 && isRefusedByName(deleteError)) progress.stripped = before;
+					throw deleteError;
+				}
 				this.logger.debug(`Deleted query logging config ${config.Id} for hosted zone ${logicalId}`);
 			}
 		} catch (error) {
@@ -28528,8 +29611,9 @@ var WAFv2WebACLProvider = class {
 			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
@@ -28575,6 +29659,7 @@ var WAFv2WebACLProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			const { id, name, scope } = parseWebACLArn(physicalId);
 			const lockToken = (await this.getClient().send(new GetWebACLCommand({
@@ -29101,7 +30186,10 @@ var CognitoUserPoolProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
-			if (poolLeftBehind && createdUserPoolId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+			if (poolLeftBehind && createdUserPoolId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -29414,7 +30502,7 @@ var CognitoUserPoolProvider = class {
 						} catch (bareError) {
 							failure = bareError;
 						}
-						if (readOn && !(failure instanceof ResourceNotFoundException$9)) {
+						if (readOn && !(failure instanceof ResourceNotFoundException$11)) {
 							this.logger.debug(safeMsg`Writing DeletionProtection back on ${physicalId} failed: ${describeAwsFailure(failure).detail}`);
 							return "read-on-write-failed";
 						}
@@ -29471,7 +30559,7 @@ var CognitoUserPoolProvider = class {
 								return;
 							}
 							if (!observedPool) {
-								if (observeError instanceof ResourceNotFoundException$9) return;
+								if (observeError instanceof ResourceNotFoundException$11) return;
 								if (observeError !== void 0 && isTransientCognitoFailure(observeError)) {
 									transientReadError = observeError;
 									return;
@@ -29494,7 +30582,7 @@ var CognitoUserPoolProvider = class {
 			flip.deleteAccepted = true;
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$11) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
@@ -29528,7 +30616,7 @@ var CognitoUserPoolProvider = class {
 			if (earlier) earlier.echoedSince = true;
 			return;
 		} catch (echoError) {
-			if (echoError instanceof ResourceNotFoundException$9) throw echoError;
+			if (echoError instanceof ResourceNotFoundException$11) throw echoError;
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
@@ -29541,7 +30629,7 @@ var CognitoUserPoolProvider = class {
 					DeletionProtection: "INACTIVE"
 				}));
 			} catch (bareError) {
-				if (bareError instanceof ResourceNotFoundException$9) throw bareError;
+				if (bareError instanceof ResourceNotFoundException$11) throw bareError;
 				if (isAmbiguousWriteFailure(bareError)) {
 					if (observedOn) flip.flippedOffByThisRun = true;
 					if (!this.preFlipPools.has(flip)) this.preFlipPools.set(flip, {
@@ -29583,7 +30671,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$11) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		const pool = resp.UserPool;
@@ -29652,7 +30740,7 @@ var CognitoUserPoolProvider = class {
 				attributes: await this.userPoolAttributes(input.knownPhysicalId, resp.UserPool?.Arn)
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return null;
+			if (err instanceof ResourceNotFoundException$11) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
@@ -29668,7 +30756,7 @@ var CognitoUserPoolProvider = class {
 				try {
 					resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$9) return null;
+					if (err instanceof ResourceNotFoundException$11) return null;
 					throw err;
 				}
 				return {
@@ -30178,6 +31266,13 @@ const NAMESPACE_TYPES = [
 	"AWS::ServiceDiscovery::HttpNamespace",
 	"AWS::ServiceDiscovery::PublicDnsNamespace"
 ];
+const NAMESPACE_KIND_BY_TYPE = /* @__PURE__ */ new Map([
+	["AWS::ServiceDiscovery::PrivateDnsNamespace", "DNS_PRIVATE"],
+	["AWS::ServiceDiscovery::PublicDnsNamespace", "DNS_PUBLIC"],
+	["AWS::ServiceDiscovery::HttpNamespace", "HTTP"]
+]);
+const NAMESPACE_ID_PATTERN = /^ns-[a-z0-9]{16}$/;
+const SERVICE_ID_PATTERN = /^srv-[a-z0-9]{16}$/;
 var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	client;
 	stsClient;
@@ -30783,6 +31878,47 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			default: return;
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		let pattern;
+		let read;
+		const namespaceKind = NAMESPACE_KIND_BY_TYPE.get(resourceType);
+		if (namespaceKind !== void 0) {
+			pattern = NAMESPACE_ID_PATTERN;
+			read = (id) => this.readNamespaceIdForIdentity(id, namespaceKind);
+		} else if (resourceType === "AWS::ServiceDiscovery::Service") {
+			pattern = SERVICE_ID_PATTERN;
+			read = (id) => this.readServiceIdForIdentity(id);
+		} else return "unknown";
+		if (!pattern.test(journaledPhysicalId) || !pattern.test(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		if (await read(record.physicalId) !== record.physicalId) return "unknown";
+		const journaledRead = await read(journaledPhysicalId);
+		return journaledRead === void 0 || journaledRead === journaledPhysicalId ? "different" : "unknown";
+	}
+	async readNamespaceIdForIdentity(namespaceId, kind) {
+		let response;
+		try {
+			response = await this.getClient().send(new GetNamespaceCommand({ Id: namespaceId }));
+		} catch (error) {
+			if (error instanceof NamespaceNotFound) return void 0;
+			throw error;
+		}
+		const namespace = response.Namespace;
+		if (typeof namespace?.Id !== "string" || namespace.Type !== kind) throw new Error("GetNamespace did not return a namespace of the kind asked for");
+		return namespace.Id;
+	}
+	async readServiceIdForIdentity(serviceId) {
+		let response;
+		try {
+			response = await this.getClient().send(new GetServiceCommand({ Id: serviceId }));
+		} catch (error) {
+			if (error instanceof ServiceNotFound) return void 0;
+			throw error;
+		}
+		if (typeof response.Service?.Id !== "string") throw new Error("GetService did not return the service asked for");
+		return response.Service.Id;
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
@@ -31908,7 +33044,10 @@ var AppSyncProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (apiLeftBehind && createdApiId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+			if (apiLeftBehind && createdApiId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -32817,6 +33956,7 @@ var GlueProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.deleteDatabase(logicalId, physicalId, resourceType, properties, context);
 			case "AWS::Glue::Table": return this.deleteTable(logicalId, physicalId, resourceType, properties, context);
@@ -33522,6 +34662,7 @@ var GlueWorkflowProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Workflow ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteWorkflowCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted Glue Workflow ${logicalId}`);
@@ -33643,11 +34784,13 @@ var GlueSecurityConfigurationProvider = class {
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create Glue SecurityConfiguration ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	async update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, _properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS Glue SecurityConfiguration is immutable on AWS — there is no UpdateSecurityConfiguration API; every change requires DeleteSecurityConfiguration + CreateSecurityConfiguration. Use cdkd deploy --replace, or destroy + redeploy with the new EncryptionConfiguration.");
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue SecurityConfiguration ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteSecurityConfigurationCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted Glue SecurityConfiguration ${logicalId}`);
@@ -33899,6 +35042,7 @@ var GlueJobProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Job ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteJobCommand({ JobName: physicalId }));
 		} catch (error) {
@@ -34190,6 +35334,7 @@ var GlueCrawlerProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting Glue Crawler ${logicalId}: ${v(physicalId)}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		try {
 			await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
 		} catch (error) {
@@ -34437,6 +35582,7 @@ var GlueConnectionProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		log.debug(`Deleting Glue Connection ${logicalId}: ${log.value(physicalId)}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		const redactedSkip = redactedDeleteAddressSkip(this.logger, logicalId, resourceType, redactedDeleteAddressFields({ CatalogId: properties?.["CatalogId"] }));
 		if (redactedSkip) return redactedSkip;
 		const target = deleteCatalogId(properties);
@@ -34653,10 +35799,18 @@ var GlueTriggerProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Trigger ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
+		let stripped = false;
 		try {
 			try {
 				if ((await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State === "ACTIVATED") {
-					await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					stripped = true;
+					try {
+						await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					} catch (stopError) {
+						if (isRefusedByName(stopError)) stripped = false;
+						throw stopError;
+					}
 					await this.waitForTriggerDeactivated(physicalId);
 				}
 			} catch (err) {
@@ -34671,7 +35825,8 @@ var GlueTriggerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -34726,6 +35881,7 @@ var GlueTriggerProvider = class {
 const createKeyLatch = new AmbiguousCreateLatch("CreateKey");
 const keysCreatedByThisProcess = new RecentIdSet();
 const pendingKeys = /* @__PURE__ */ new Map();
+const supersededAttempts = /* @__PURE__ */ new Map();
 const RESUMABLE_KEY_STATES = /* @__PURE__ */ new Set([
 	"Enabled",
 	"Disabled",
@@ -34820,11 +35976,12 @@ var KMSProvider = class {
 			enabled: properties["Enabled"] !== false
 		})).digest("hex");
 		let createdKeyId;
+		let supersededPending = false;
 		try {
 			const resumed = await this.resumeKeyFromFailedAttempt(logicalId, attemptKey, inputDigest);
 			let keyId;
 			let keyArn;
-			if (resumed) ({keyId, keyArn} = resumed);
+			if (resumed && resumed !== "superseded") ({keyId, keyArn} = resumed);
 			else {
 				const orphanWindow = createKeyLatch.take(logicalId);
 				if (orphanWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, orphanWindow);
@@ -34845,6 +36002,9 @@ var KMSProvider = class {
 					heldAtMs: Date.now()
 				});
 				createdKeyId = keyId;
+				const declinedAtMs = supersededAttempts.get(attemptKey);
+				supersededAttempts.delete(attemptKey);
+				supersededPending = declinedAtMs !== void 0 && Date.now() - declinedAtMs <= 18e5;
 				const replayWindow = replayedSendWindow(result, attemptStartMs);
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
@@ -34880,7 +36040,10 @@ var KMSProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (createdKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+			if (createdKeyId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+				if (supersededPending) markSupersedesEarlierCreate(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -34903,6 +36066,8 @@ var KMSProvider = class {
 		const deletion = aws`aws kms schedule-key-deletion --key-id ${pending.keyId}${region} --pending-window-in-days 7`.render();
 		const notReused = (reason) => {
 			this.logger.warn(safeMsg`KMS key ${pending.keyId} was created for ${logicalId} by an earlier attempt of this deploy, but ${reason}, so this attempt creates a new key and that one is not recorded in cdkd state. If it is unused, schedule its deletion with: ${deletion}`);
+			setBounded(supersededAttempts, attemptKey, Date.now());
+			return "superseded";
 		};
 		if (pending.inputDigest !== inputDigest) return notReused("this attempt was asked for a key with different inputs");
 		let metadata;
@@ -36118,7 +37283,7 @@ var KinesisStreamProvider = class {
 				EnforceConsumerDeletion: true
 			}));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$12) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Kinesis stream ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
@@ -36155,7 +37320,7 @@ var KinesisStreamProvider = class {
 		try {
 			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (error instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw error;
 		}
 		const arn = response.StreamDescriptionSummary?.StreamARN;
@@ -36169,7 +37334,7 @@ var KinesisStreamProvider = class {
 		try {
 			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return void 0;
+			if (error instanceof ResourceNotFoundException$12) return void 0;
 			throw error;
 		}
 		const arn = response.StreamDescriptionSummary?.StreamARN;
@@ -36180,7 +37345,7 @@ var KinesisStreamProvider = class {
 		try {
 			return (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }))).StreamDescriptionSummary?.StreamStatus ?? "UNKNOWN";
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return void 0;
+			if (error instanceof ResourceNotFoundException$12) return void 0;
 			throw error;
 		}
 	}
@@ -36233,7 +37398,7 @@ var KinesisStreamProvider = class {
 		try {
 			stream = (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!stream) return void 0;
@@ -36253,14 +37418,14 @@ var KinesisStreamProvider = class {
 			const maxRecordSize = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.MaxRecordSizeInKiB;
 			if (maxRecordSize !== void 0) result["MaxRecordSizeInKiB"] = maxRecordSize;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		try {
 			const tagsResp = await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
@@ -36274,7 +37439,7 @@ var KinesisStreamProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return null;
+			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
 		return null;
@@ -36434,7 +37599,7 @@ var KinesisStreamConsumerProvider = class {
 			await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$12) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
@@ -36462,7 +37627,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeStreamConsumerCommand({ ConsumerARN: physicalId }))).ConsumerDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -36473,7 +37638,7 @@ var KinesisStreamConsumerProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
@@ -36692,7 +37857,7 @@ var SchedulerScheduleProvider = class {
 		for (let attempt = 0;; attempt++) try {
 			return (await this.readIdentity(name, groupName)).creation;
 		} catch (error) {
-			const transient = error instanceof ResourceNotFoundException$11 || isThrottlingError(error);
+			const transient = error instanceof ResourceNotFoundException$13 || isThrottlingError(error);
 			const delay = this.readBackDelaysMs[attempt];
 			if (transient && delay !== void 0) {
 				await this.sleep(delay);
@@ -36716,7 +37881,7 @@ var SchedulerScheduleProvider = class {
 		try {
 			live = await this.readIdentity(physicalId, groupName);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return "absent";
+			if (error instanceof ResourceNotFoundException$13) return "absent";
 			throw this.wrapUnconfirmedGroupError(logicalId, physicalId, resourceType, error, mask);
 		}
 		if (sameRecordedDate(live, recorded) && !sameRecordedIdentity(live, recorded)) this.refuseUnconfirmed(logicalId, physicalId, resourceType, "holds a schedule of this name that carries the recorded creation date but not the recorded target or role (edited outside cdkd?)", false, "restore them, or drop the record with `cdkd orphan <construct path>` and deploy again");
@@ -36807,7 +37972,7 @@ var SchedulerScheduleProvider = class {
 				try {
 					live = await this.readIdentity(physicalId, group);
 				} catch (error) {
-					if (error instanceof ResourceNotFoundException$11) continue;
+					if (error instanceof ResourceNotFoundException$13) continue;
 					throw wrapDeleteError("reading a schedule of its name", error);
 				}
 				if (sameRecordedIdentity(live, recorded)) matches.push(group);
@@ -36843,7 +38008,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(safeMsg`Deleted Schedule ${logicalId} (found by its recorded creation date)`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return;
+			if (error instanceof ResourceNotFoundException$13) return;
 			throw wrapDeleteError("the delete", error);
 		}
 	}
@@ -36873,7 +38038,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) {
+			if (error instanceof ResourceNotFoundException$13) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
@@ -36889,7 +38054,7 @@ var SchedulerScheduleProvider = class {
 			return (await this.getClient().send(new GetScheduleCommand({ Name: physicalId }))).Arn;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const customGroupHint = error instanceof ResourceNotFoundException$11 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
+			const customGroupHint = error instanceof ResourceNotFoundException$13 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
 			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
@@ -36915,7 +38080,7 @@ var SchedulerScheduleProvider = class {
 				...response.Target !== void 0 && { Target: this.toCfnTarget(response.Target) }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return RESOURCE_NOT_FOUND;
+			if (error instanceof ResourceNotFoundException$13) return RESOURCE_NOT_FOUND;
 			throw error;
 		}
 	}
@@ -36936,7 +38101,7 @@ var SchedulerScheduleProvider = class {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) return null;
+			if (error instanceof ResourceNotFoundException$13) return null;
 			throw error;
 		}
 	}
@@ -36945,6 +38110,32 @@ var SchedulerScheduleProvider = class {
 //#endregion
 //#region src/provisioning/providers/pipes-provider.ts
 const PIPE_TYPE = "AWS::Pipes::Pipe";
+function isPipeName(id) {
+	return /^[.\-_A-Za-z0-9]{1,64}$/.test(id);
+}
+const IDENTITY_STATES = /* @__PURE__ */ new Set([
+	"CREATING",
+	"CREATE_FAILED",
+	"CREATE_ROLLBACK_FAILED",
+	"RUNNING",
+	"STARTING",
+	"START_FAILED",
+	"STOPPED",
+	"STOPPING",
+	"STOP_FAILED",
+	"UPDATING",
+	"UPDATE_FAILED",
+	"UPDATE_ROLLBACK_FAILED",
+	"DELETE_FAILED",
+	"DELETE_ROLLBACK_FAILED"
+]);
+function pipeIdentityToken(name, arn, creationTime) {
+	if (typeof arn !== "string" || !arn.startsWith("arn:") || !arn.endsWith(`:pipe/${name}`)) return;
+	if (!(creationTime instanceof Date)) return void 0;
+	const ms = creationTime.getTime();
+	if (!Number.isFinite(ms) || ms <= 0) return void 0;
+	return `${arn}@${Math.floor(ms / 1e3)}`;
+}
 const SETTLED_STATES = /* @__PURE__ */ new Set(["RUNNING", "STOPPED"]);
 const PIPE_POLL_INTERVAL_MS = 5e3;
 const PIPE_SETTLE_MAX_WAIT_MS = 9e5;
@@ -37163,8 +38354,9 @@ var PipesPipeProvider = class {
 		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
 		const tags = desiredTagMap(properties["Tags"], logicalId);
 		this.logger.debug(mask(`Creating Pipe ${logicalId}: ${name}`));
+		let createdIdentity;
 		try {
-			await this.getCreateClient().send(new CreatePipeCommand({
+			const created = await this.getCreateClient().send(new CreatePipeCommand({
 				Name: name,
 				RoleArn: properties["RoleArn"],
 				Source: properties["Source"],
@@ -37179,6 +38371,7 @@ var PipesPipeProvider = class {
 				...properties["KmsKeyIdentifier"] !== void 0 && { KmsKeyIdentifier: properties["KmsKeyIdentifier"] },
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
+			createdIdentity = pipeIdentityToken(name, created?.Arn, created?.CreationTime);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${mask(cause?.message ?? String(error))}`, resourceType, logicalId, void 0, cause);
@@ -37187,7 +38380,7 @@ var PipesPipeProvider = class {
 		try {
 			settled = await this.waitForSettled(name, logicalId, resourceType, "create", mask);
 		} catch (error) {
-			throw await this.retireFailedCreate(name, logicalId, resourceType, error, mask);
+			throw await this.retireFailedCreate(name, logicalId, resourceType, error, mask, createdIdentity);
 		}
 		return {
 			physicalId: name,
@@ -37270,7 +38463,7 @@ var PipesPipeProvider = class {
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(safeMsg`Pipe ${logicalId} already deleted (not found), treating as success`);
+				this.logGoneOnDelete(logicalId, physicalId, context);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -37288,6 +38481,43 @@ var PipesPipeProvider = class {
 			now: this.now
 		});
 	}
+	logGoneOnDelete(logicalId, physicalId, context) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Pipe ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(safeMsg`Pipe ${logicalId} already deleted (not found), treating as success`);
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== PIPE_TYPE) return "unknown";
+		if (!isPipeName(journaledPhysicalId) || !isPipeName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordPipe = await this.describeIfExists(record.physicalId);
+		if (recordPipe === void 0) return "unknown";
+		const recordArn = recordPipe.Arn;
+		if (typeof recordArn !== "string" || recordArn === "") return "unknown";
+		const journaledPipe = await this.describeIfExists(journaledPhysicalId);
+		if (journaledPipe === void 0) return "different";
+		const journaledArn = journaledPipe.Arn;
+		if (typeof journaledArn !== "string" || journaledArn === "") return "unknown";
+		return journaledArn === recordArn ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== PIPE_TYPE || !isPipeName(physicalId)) return void 0;
+		if (await this.getClient().config.region() !== context.expectedRegion) return void 0;
+		const pipe = await this.describeIfExists(physicalId);
+		if (pipe === void 0) return RESOURCE_NOT_FOUND;
+		if (pipe.Name !== physicalId) return void 0;
+		if (pipe.CurrentState === void 0 || !IDENTITY_STATES.has(pipe.CurrentState)) return;
+		return pipeIdentityToken(physicalId, pipe.Arn, pipe.CreationTime);
+	}
+	async describeIfExists(name) {
+		try {
+			return await this.describe(name);
+		} catch (error) {
+			if (error instanceof NotFoundException$6) return void 0;
+			throw error;
+		}
+	}
 	async getAttribute(physicalId, _resourceType, attributeName, _logicalId) {
 		let response;
 		try {
@@ -37407,9 +38637,9 @@ var PipesPipeProvider = class {
 			watch.dispose();
 		}
 	}
-	async retireFailedCreate(name, logicalId, resourceType, error, mask) {
+	async retireFailedCreate(name, logicalId, resourceType, error, mask, createdIdentity) {
 		const original = error instanceof Error ? error : new Error(String(error));
-		const leftBehind = () => markCreatedBeforeFailure(original, logicalId, resourceType, name);
+		const leftBehind = () => markNonRetryable(markCreatedBeforeFailure(original, logicalId, resourceType, name, createdIdentity));
 		const orphaned = async (why) => {
 			const aws = pasteableAwsCommand(mask);
 			const command = aws`aws pipes delete-pipe --name ${name}${await orphanCommandRegionArg(this.getClient(), aws)}`;
@@ -39493,7 +40723,10 @@ var EMRClusterProvider = class {
 				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${describeAwsFailure(cleanupError).detail} — terminate it manually to stop billing`);
 			}
 			if (error instanceof ProvisioningError) {
-				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+				if (survivorId !== void 0) {
+					markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+					markNonRetryable(error);
+				}
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -39501,6 +40734,7 @@ var EMRClusterProvider = class {
 			if (survivorId !== void 0) {
 				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+				markNonRetryable(thrown);
 				throw thrown;
 			}
 			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
@@ -40169,7 +41403,27 @@ var EMRInstanceGroupConfigProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
-			if (createdGroupId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdGroupId);
+			let leftBehindGroupId = createdGroupId;
+			if (leftBehindGroupId && properties["InstanceRole"] === "TASK") {
+				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+				try {
+					await this.getClient().send(new ModifyInstanceGroupsCommand({
+						ClusterId: jobFlowId,
+						InstanceGroups: [{
+							InstanceGroupId: leftBehindGroupId,
+							InstanceCount: 0
+						}]
+					}));
+					log.warn(safeMsg`Scaled partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0; EMR has no delete API, so the empty group stays on cluster ${log.value(jobFlowId)} until it terminates`);
+					leftBehindGroupId = void 0;
+				} catch (cleanupError) {
+					log.warn(safeMsg`Failed to scale partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0: ${describeAwsFailure(cleanupError).detail} — its instances are released when the parent cluster terminates`);
+				}
+			}
+			if (leftBehindGroupId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindGroupId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -40475,7 +41729,10 @@ var EMRInstanceFleetConfigProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
-			if (createdFleetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+			if (createdFleetId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -40999,7 +42256,7 @@ var FirehoseProvider = class {
 		try {
 			await this.getClient().send(new DeleteDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) {
+			if (error instanceof ResourceNotFoundException$14) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
@@ -41023,7 +42280,7 @@ var FirehoseProvider = class {
 		try {
 			return (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: streamName }))).DeliveryStreamDescription?.DeliveryStreamStatus ?? "UNKNOWN";
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) return void 0;
+			if (error instanceof ResourceNotFoundException$14) return void 0;
 			throw error;
 		}
 	}
@@ -41355,7 +42612,7 @@ var FirehoseProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$14) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -41387,7 +42644,7 @@ var FirehoseProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$14) return RESOURCE_NOT_FOUND;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 			result["Tags"] = [];
 		}
@@ -41405,7 +42662,7 @@ var FirehoseProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return null;
+			if (err instanceof ResourceNotFoundException$14) return null;
 			throw err;
 		}
 		return null;
@@ -41752,12 +43009,18 @@ var CloudTrailProvider = class {
 			throw new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting CloudTrail Trail ${logicalId}: ${physicalId}`);
+		const recordedIsLogging = properties?.["IsLogging"];
+		const recordedStopped = recordedIsLogging === false || recordedIsLogging === "false";
+		let stripped = false;
 		try {
 			try {
+				stripped = !recordedStopped;
 				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
-			} catch {}
+			} catch (stopError) {
+				if (isRefusedByName(stopError)) stripped = false;
+			}
 			await this.getClient().send(new DeleteTrailCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted CloudTrail Trail ${logicalId}`);
 		} catch (error) {
@@ -41768,7 +43031,8 @@ var CloudTrailProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	getAttribute(_physicalId, _resourceType, attributeName) {
@@ -42122,7 +43386,7 @@ var CodeBuildProvider = class {
 			await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$13) {
+			if (error instanceof ResourceNotFoundException$15) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
@@ -42140,7 +43404,7 @@ var CodeBuildProvider = class {
 		try {
 			project = (await this.getClient().send(new BatchGetProjectsCommand({ names: [physicalId] }))).projects?.[0];
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$13) return RESOURCE_NOT_FOUND;
+			if (err instanceof ResourceNotFoundException$15) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		if (!project) return RESOURCE_NOT_FOUND;
@@ -42316,7 +43580,7 @@ var CodeBuildProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$13) return null;
+			if (err instanceof ResourceNotFoundException$15) return null;
 			throw err;
 		}
 		return null;
@@ -42901,7 +44165,7 @@ var DLMLifecyclePolicyProvider = class {
 						created = detail.Policy?.DateCreated;
 						defaultType = detail.Policy?.PolicyDetails?.ResourceType;
 					} catch (error) {
-						if (error instanceof ResourceNotFoundException$14) continue;
+						if (error instanceof ResourceNotFoundException$16) continue;
 						throw error;
 					}
 					if (isDefault && defaultType !== void 0 && defaultType !== input.DefaultPolicy) continue;
@@ -43050,7 +44314,7 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$14) {
+			if (error instanceof ResourceNotFoundException$16) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
@@ -43081,7 +44345,7 @@ var DLMLifecyclePolicyProvider = class {
 				Tags: normalizeAwsTagsToCfn(policy.Tags)
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$14) return RESOURCE_NOT_FOUND;
+			if (error instanceof ResourceNotFoundException$16) return RESOURCE_NOT_FOUND;
 			throw error;
 		}
 	}
@@ -43105,7 +44369,7 @@ var DLMLifecyclePolicyProvider = class {
 				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$14) return null;
+			if (err instanceof ResourceNotFoundException$16) return null;
 			throw err;
 		}
 		return null;
@@ -43453,7 +44717,8 @@ var S3DirectoryBucketProvider = class {
 			throw new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (context?.expectedRegion) for (const clientRegion of [await this.s3Client.config.region(), await this.getS3ControlClient().config.region()]) assertRegionMatch(clientRegion, context.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
@@ -43491,6 +44756,7 @@ var S3DirectoryBucketProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(mask(`Deleting S3 Express Directory Bucket ${logicalId}: ${mask(physicalId)}`));
+		assertRegionMatch(context?.expectedRegion ? await this.s3Client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		try {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty, context?.maskSecrets);
@@ -43682,7 +44948,8 @@ var S3TablesProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		if (resourceType === "AWS::S3Tables::Table" || resourceType === "AWS::S3Tables::TableBucket") refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -43702,6 +44969,7 @@ var S3TablesProvider = class {
 		};
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
 		switch (resourceType) {
 			case "AWS::S3Tables::TableBucket": return this.deleteTableBucket(logicalId, physicalId, resourceType, context);
 			case "AWS::S3Tables::Namespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
@@ -44979,12 +46247,16 @@ var WaitConditionHandleProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/acm-certificate-provider.ts
-function isCertificateInUseError(error) {
+function certificateInUseByName(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
 		if (current.name === "ResourceInUseException") return true;
 		current = current.cause;
 	}
+	return false;
+}
+function isCertificateInUseError(error) {
+	if (certificateInUseByName(error)) return true;
 	const message = error instanceof Error ? error.message : String(error);
 	return /ResourceInUseException|in use/i.test(message);
 }
@@ -45131,6 +46403,7 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			let orphanReason;
+			let oldResourceSurvivor = "unconfirmed";
 			try {
 				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 				if (deleteResult?.outcome === "skipped") {
@@ -45139,6 +46412,7 @@ var ACMCertificateProvider = class {
 				}
 			} catch (error) {
 				const inUse = isCertificateInUseError(error);
+				oldResourceSurvivor = certificateInUseByName(error) ? "kept" : replacedDeleteFailureVerdict(error);
 				orphanReason = inUse ? `old certificate ${physicalId} is still in use by another resource and was not deleted` : `old certificate ${physicalId} could not be deleted: ${safeStringify(error)}`;
 				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${safeStringify(error)}. ` + (inUse ? "This usually means a consumer (e.g. a CloudFront distribution) still references it; it can be deleted once DescribeCertificate.InUseBy is empty. " : "") + `The old certificate may be orphaned and require manual cleanup.`);
 			}
@@ -45150,7 +46424,8 @@ var ACMCertificateProvider = class {
 			return orphanReason !== void 0 ? {
 				...base,
 				outcome: "partial",
-				reason: orphanReason
+				reason: orphanReason,
+				...oldResourceSurvivor === "kept" && { oldResourceSurvivor }
 			} : base;
 		}
 		try {
@@ -45316,5 +46591,5 @@ var ACMCertificateProvider = class {
 };
 
 //#endregion
-export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DmohfhIq.js.map
+export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
+//# sourceMappingURL=provider-classes-CDzT2xg0.js.map