@go-to-k/cdkd 0.300.0 → 0.300.1

package/dist/{provider-classes-CVC9_-km.js → provider-classes-CDzT2xg0.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-BxP3yqlr.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, dr as wrapMaskedAwsError, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as markNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, o as readPrincipalLists, or as THROTTLING_ERROR_NAMES, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isRetryableTransientError, sr as isMarkedNonRetryable, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, u as clearOnUpdateRemoval, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DAs3w7QW.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as findSilentDropProperties, Ao as lambdaFunctionNameForMask, Ar as unchangedBehindSecretReference, At as withNestedStackContext, Br as ec2InstanceProtectionSite, Bt as awaitInFlightSibling, C as withApiLimit, Cl as derivePartitionAndUrlSuffix, Co as requireConfigObject, Cr as getCurrentResourceSecrets, Cs as physicalNameCopiesOf, Ds as carriesSecretMask, Fl as renderAssemblyPathEscape, Fr as deleteSkipReason, G as deleteBudgetKey, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as observeThenDisableInstanceApiTermination, Ht as getStackRecords, Il as resolveAssemblyPath, Ir as withIndeterminateGuard, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Li as passedParameterClassesOf, Lr as isWaitAbandonedError, Nl as describeFileReadFailure, Oo as withRetry, Pi as parseWebACLArn, Pl as displayAssemblyPath, Q as ECR_AUTO_DELETE_IMAGES_TAG, Rr as markWaitAbandoned, S as lookupEachName, Sl as canonicalizeRegion, So as requireConfigArray, Ss as recoverMaskedOutput, St as getNestedRevertRun, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Uo as passedNoEchoParametersOf, Ur as reDisableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as isTerminationProtectionPropagationError, W as compensateRemovedDeletionProtection, Wi as accountArgs, Wr as reEnableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Xo as hasMaskableValues, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, Za as withheldAccountClause, _c as rewriteTemplateAssetReferences, _o as configBooleanRefusal, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as readConfigString, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as planTagDiff, cs as markSameGenerationBag, do as coerceWarmThroughput$1, dr as tagMapAsList, ds as redactSecretsForState, et as hasCdkAutoDeleteTag, fc as stringifyValue, fi as s3BucketArn, fo as isWarmThroughputDecrease, fr as tagPlanWarning, gi as s3BucketWebsiteUrl, go as coerceCfnInteger, gs as dynamicReferenceTokens, hi as s3BucketRegionalDomainName, ho as coerceCfnBoolean, jo as sameLambdaFunctionAddress, ko as canonicalLambdaFunctionName, kr as slowCcOperationTimeoutMs, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as outputReferenceProvenanceOf, ln as redactedDeleteAddressFields, lr as readTagList, ls as recordReferenceProvenanceEntry, mi as s3BucketDualStackDomainName, mo as toFiniteNumber, mr as stringifyIfAssigned, ms as withoutPhysicalNameCopies, nt as getPriorAttempts, or as DBPROXY_TAGS_WHAT, pi as s3BucketDomainName, po as toCfnInteger, pr as definedAttributes, q as resolveDynamoDbDeleteBudgetMs, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, si as isSettledInstanceState, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as DBPROXY_TAG_OPTIONS, t as DeployEngine, to as withoutSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, uo as WARM_THROUGHPUT_MEMBERS, ur as refuseMalformedDesiredTags, us as snapshotPassProvenance, vo as configIntegerRefusal, wi as getAccountInfo, wo as requireConfigString, ws as recordAttributeIdCopy, x as isAccessDeniedError, xo as replayWarn, ya as refuseMalformedNestedChildOutputs, yl as decodeListingKey, yo as configStringRefusal, za as refuseMalformedResourcesForDestroy } from "./deploy-engine-C-4ho8TJ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-a-8z7Dpm.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BHjdsRtD.js";
-import { RDSProvider } from "./rds-provider-QKN-WHF3.js";
-import { NeptuneProvider } from "./neptune-provider-Bnr2VC6V.js";
-import { ASGProvider } from "./asg-provider-COcKVcvZ.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-BK4gG_5A.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-SmvPHPLC.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DVPHKsxv.js";
+import { RDSProvider } from "./rds-provider-DraxDuQq.js";
+import { NeptuneProvider } from "./neptune-provider-CqZ1FaqT.js";
+import { ASGProvider } from "./asg-provider-BS5i71bK.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -417,7 +417,9 @@ var IAMPolicyProvider = class {
 		}
 		let secretPrincipalLacksGrant = false;
 		const detached = context?.resolveSecretDerivedPrincipals?.retryMemo?.detached;
+		let removedAny = false;
 		const onDetached = (kind, name) => {
+			removedAny = true;
 			if (fromSecret(kind, name)) detached?.add(injectiveKey(kind, name));
 		};
 		const claimed = (kind, name) => {
@@ -505,7 +507,8 @@ var IAMPolicyProvider = class {
 			this.logger.debug(`Successfully deleted IAM policy ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw maskError(new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
+			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -772,6 +775,7 @@ var IAMManagedPolicyProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(mask(`Deleting IAM managed policy ${logicalId}: ${physicalId}`));
+		const progress = { stripped: false };
 		try {
 			try {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
@@ -782,7 +786,7 @@ var IAMManagedPolicyProvider = class {
 				}
 				throw error;
 			}
-			await this.detachAllPrincipals(physicalId);
+			await this.detachAllPrincipals(physicalId, progress);
 			await this.deleteAllNonDefaultVersions(physicalId);
 			await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: physicalId }));
 			this.logger.debug(`Successfully deleted IAM managed policy ${logicalId}`);
@@ -792,7 +796,8 @@ var IAMManagedPolicyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const failure = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async goneOnDelete(logicalId, physicalId, resourceType, context, mask) {
@@ -1035,7 +1040,7 @@ var IAMManagedPolicyProvider = class {
 		} while (marker);
 		return live;
 	}
-	async detachAllPrincipals(policyArn) {
+	async detachAllPrincipals(policyArn, progress) {
 		try {
 			let marker;
 			while (true) {
@@ -1050,6 +1055,7 @@ var IAMManagedPolicyProvider = class {
 							GroupName: g.GroupName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1061,6 +1067,7 @@ var IAMManagedPolicyProvider = class {
 							RoleName: r.RoleName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1072,6 +1079,7 @@ var IAMManagedPolicyProvider = class {
 							UserName: u.UserName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1317,6 +1325,7 @@ var IAMInstanceProfileProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
 			let roles = [];
 			try {
@@ -1335,6 +1344,7 @@ var IAMInstanceProfileProvider = class {
 					InstanceProfileName: physicalId,
 					RoleName: roleName
 				}));
+				stripped = true;
 				this.logger.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -1349,7 +1359,8 @@ var IAMInstanceProfileProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	logGoneOnDelete(logicalId, physicalId, context) {
@@ -1513,7 +1524,10 @@ var IAMAccessKeyProvider = class {
 			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
-			if (leftBehindKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+			if (leftBehindKeyId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -1999,9 +2013,11 @@ var IAMUserGroupProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting IAM user ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
+		let hadBoundary = false;
 		try {
 			try {
-				await this.iamClient.send(new GetUserCommand({ UserName: physicalId }));
+				hadBoundary = (await this.iamClient.send(new GetUserCommand({ UserName: physicalId }))).User?.PermissionsBoundary !== void 0;
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
@@ -2012,18 +2028,20 @@ var IAMUserGroupProvider = class {
 				}
 				throw error;
 			}
-			await this.removeUserFromAllGroups(physicalId, log);
-			await this.detachAllUserPolicies(physicalId, log);
-			await this.deleteAllUserInlinePolicies(physicalId, log);
+			await this.removeUserFromAllGroups(physicalId, log, progress);
+			await this.detachAllUserPolicies(physicalId, log, progress);
+			await this.deleteAllUserInlinePolicies(physicalId, log, progress);
 			try {
 				await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: physicalId }));
+				progress.stripped = true;
 				log.debug(`Deleted login profile for user ${v(physicalId)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
-			await this.deleteAllAccessKeys(physicalId, log);
+			await this.deleteAllAccessKeys(physicalId, log, progress);
 			try {
 				await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: physicalId }));
+				if (hadBoundary) progress.stripped = true;
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
@@ -2031,7 +2049,8 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async readLiveGroups(userName) {
@@ -2047,7 +2066,7 @@ var IAMUserGroupProvider = class {
 		} while (marker);
 		return groups;
 	}
-	async removeUserFromAllGroups(userName, log) {
+	async removeUserFromAllGroups(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const groups = (await this.iamClient.send(new ListGroupsForUserCommand({ UserName: userName }))).Groups || [];
@@ -2056,6 +2075,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					GroupName: group.GroupName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Removed user ${v(userName)} from group ${v(group.GroupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2065,7 +2085,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllAccessKeys(userName, log) {
+	async deleteAllAccessKeys(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const keys = (await this.iamClient.send(new ListAccessKeysCommand({ UserName: userName }))).AccessKeyMetadata || [];
@@ -2074,6 +2094,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					AccessKeyId: key.AccessKeyId
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted access key ${key.AccessKeyId} for user ${v(userName)}`);
 			}
 		} catch (error) {
@@ -2081,7 +2102,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async detachAllUserPolicies(userName, log) {
+	async detachAllUserPolicies(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policies = (await this.iamClient.send(new ListAttachedUserPoliciesCommand({ UserName: userName }))).AttachedPolicies || [];
@@ -2090,6 +2111,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					PolicyArn: policy.PolicyArn
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from user ${v(userName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2099,7 +2121,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllUserInlinePolicies(userName, log) {
+	async deleteAllUserInlinePolicies(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policyNames = (await this.iamClient.send(new ListUserPoliciesCommand({ UserName: userName }))).PolicyNames || [];
@@ -2108,6 +2130,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					PolicyName: policyName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted inline policy ${v(policyName)} from user ${v(userName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2291,10 +2314,11 @@ var IAMUserGroupProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting IAM group ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
 		try {
-			await this.detachAllGroupPolicies(physicalId, log);
-			await this.deleteAllGroupInlinePolicies(physicalId, log);
-			await this.removeAllUsersFromGroup(physicalId, log);
+			await this.detachAllGroupPolicies(physicalId, log, progress);
+			await this.deleteAllGroupInlinePolicies(physicalId, log, progress);
+			await this.removeAllUsersFromGroup(physicalId, log, progress);
 			await this.iamClient.send(new DeleteGroupCommand({ GroupName: physicalId }));
 			log.debug(`Successfully deleted IAM group ${logicalId}`);
 		} catch (error) {
@@ -2306,10 +2330,11 @@ var IAMUserGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	async detachAllGroupPolicies(groupName, log) {
+	async detachAllGroupPolicies(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policies = (await this.iamClient.send(new ListAttachedGroupPoliciesCommand({ GroupName: groupName }))).AttachedPolicies || [];
@@ -2318,6 +2343,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					PolicyArn: policy.PolicyArn
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2327,7 +2353,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async removeAllUsersFromGroup(groupName, log) {
+	async removeAllUsersFromGroup(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const users = (await this.iamClient.send(new GetGroupCommand({ GroupName: groupName }))).Users || [];
@@ -2336,6 +2362,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					UserName: user.UserName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Removed user ${v(user.UserName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2364,7 +2391,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Detached managed policy ${v(policyArn)} from group ${v(groupName)}`);
 		}
 	}
-	async deleteAllGroupInlinePolicies(groupName, log) {
+	async deleteAllGroupInlinePolicies(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policyNames = (await this.iamClient.send(new ListGroupPoliciesCommand({ GroupName: groupName }))).PolicyNames || [];
@@ -2373,6 +2400,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					PolicyName: policyName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted inline policy ${v(policyName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2546,6 +2574,7 @@ var IAMUserGroupProvider = class {
 			};
 		}
 		let secretUserNotMember = false;
+		let removedAny = false;
 		try {
 			for (const userName of users ?? []) {
 				if (resolvedNames.has(userName) && memo?.detached.has(injectiveKey("Users", userName)) !== true) {
@@ -2567,6 +2596,7 @@ var IAMUserGroupProvider = class {
 						GroupName: groupName,
 						UserName: userName
 					}));
+					removedAny = true;
 					if (resolvedNames.has(userName)) memo?.detached.add(injectiveKey("Users", userName));
 					this.logger.debug(`Removed user ${mask(userName)} from group ${groupName}`);
 				} catch (error) {
@@ -2584,7 +2614,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM UserToGroupAddition ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw maskError(new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
+			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -6136,11 +6167,13 @@ var SQSQueuePolicyProvider = class {
 		const named = physicalId.includes(",") ? splitQueueUrls(physicalId) : recordedQueues(physicalId, context?.recordedAttributes);
 		const queueUrls = [...physicalId.includes(",") ? [] : await this.queuesCarryingDocument(listedQueues(properties ?? {}).filter((url) => !named.includes(url)), properties?.["PolicyDocument"], logicalId), ...named];
 		if (queueUrls.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
+		let clearedAny = false;
 		for (const queueUrl of queueUrls) try {
 			await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion);
+			clearedAny = true;
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			const failure = error instanceof ProvisioningError ? error : this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			throw clearedAny ? markDeleteStarted(failure) : failure;
 		}
 		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
@@ -7251,11 +7284,13 @@ var SNSTopicPolicyProvider = class {
 		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id is empty, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
 		const topicArns = named.every((arn) => isSnsTopicArn(arn)) ? named : [.../* @__PURE__ */ new Set([...named.filter((arn) => isSnsTopicArn(arn)), ...listedTopics(properties ?? {})])];
 		if (topicArns.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id names no SNS topic ARN and its Topics lists none either, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
+		let clearedAny = false;
 		for (const topicArn of topicArns) try {
 			await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion);
+			clearedAny = true;
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			const failure = error instanceof ProvisioningError ? error : this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			throw clearedAny ? markDeleteStarted(failure) : failure;
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
@@ -8038,8 +8073,10 @@ var LambdaFunctionProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Lambda function ${logicalId}: ${physicalId}`);
 		const hasVpcConfig = this.hasVpcConfig(properties?.["VpcConfig"]);
+		let stripped = false;
 		if (hasVpcConfig) {
 			try {
+				stripped = true;
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand({
 					FunctionName: physicalId,
 					VpcConfig: {
@@ -8055,6 +8092,7 @@ var LambdaFunctionProvider = class {
 					this.logFunctionGone(logicalId, physicalId, context);
 					return;
 				}
+				if (isRefusedByName(error)) stripped = false;
 				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${describeAwsFailure(error).detail} — continuing with delete`);
 			}
 			await this.waitForLambdaUpdateCompleted(physicalId);
@@ -8070,7 +8108,8 @@ var LambdaFunctionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 		if (hasVpcConfig) await this.cleanupLambdaEnis(physicalId);
 	}
@@ -10270,7 +10309,17 @@ var LambdaWebFunctionRevisionProvider = class {
 			};
 		} catch (error) {
 			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
-			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			let leftBehindArn = createdArn;
+			if (leftBehindArn) try {
+				await this.delete(logicalId, leftBehindArn, resourceType);
+				leftBehindArn = void 0;
+			} catch (cleanupError) {
+				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
+			}
+			if (leftBehindArn) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -15080,6 +15129,7 @@ var EventBridgeRuleProvider = class {
 		this.logger.debug(`Deleting EventBridge rule ${logicalId}: ${physicalId}`);
 		const ruleName = this.extractRuleNameFromArn(physicalId);
 		const busParam = this.busParamFromArn(physicalId);
+		let stripped = false;
 		try {
 			let targetIds = [];
 			try {
@@ -15102,6 +15152,7 @@ var EventBridgeRuleProvider = class {
 					Ids: targetIds,
 					...busParam
 				}));
+				stripped = true;
 				this.logger.debug(`Removed ${targetIds.length} targets from rule ${ruleName}`);
 			}
 			await this.eventBridgeClient.send(new DeleteRuleCommand({
@@ -15117,7 +15168,8 @@ var EventBridgeRuleProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -15383,8 +15435,9 @@ var EventBridgeBusProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting EventBus ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
-			await this.cleanupRulesOnBus(physicalId);
+			stripped = await this.cleanupRulesOnBus(physicalId);
 			await this.eventBridgeClient.send(new DeleteEventBusCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted EventBus ${logicalId}`);
 		} catch (error) {
@@ -15402,7 +15455,8 @@ var EventBridgeBusProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EventBus ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBus ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	getAttribute(physicalId, _resourceType, attributeName) {
@@ -15411,9 +15465,11 @@ var EventBridgeBusProvider = class {
 		return Promise.resolve(void 0);
 	}
 	async cleanupRulesOnBus(busName) {
+		let found = false;
 		try {
 			const rules = (await this.eventBridgeClient.send(new ListRulesCommand({ EventBusName: busName }))).Rules ?? [];
-			if (rules.length === 0) return;
+			if (rules.length === 0) return false;
+			found = true;
 			this.logger.debug(`Cleaning up ${rules.length} rule(s) on bus ${busName}`);
 			for (const rule of rules) {
 				if (!rule.Name) continue;
@@ -15436,9 +15492,10 @@ var EventBridgeBusProvider = class {
 				} catch {}
 			}
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$2) return;
+			if (error instanceof ResourceNotFoundException$2) return found;
 			this.logger.debug(`Failed to list rules on bus ${busName}: ${describeAwsFailure(error).detail}`);
 		}
+		return found;
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		try {
@@ -16143,7 +16200,10 @@ var EC2Provider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			if (leftBehindId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -16489,6 +16549,7 @@ var EC2Provider = class {
 		let publicIp;
 		let created = false;
 		let createdId;
+		let allocatedId;
 		try {
 			const input = {
 				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
@@ -16508,6 +16569,7 @@ var EC2Provider = class {
 			}
 			created = true;
 			allocationId = response.AllocationId;
+			allocatedId = allocationId;
 			publicIp = response.PublicIp;
 			try {
 				createdId = this.eipPhysicalId(logicalId, publicIp, allocationId);
@@ -16532,9 +16594,31 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
 		} catch (error) {
 			if (created) markAuxiliaryFailure(error, logicalId);
+			if (createdId !== void 0 && allocatedId !== void 0) try {
+				const releaseId = allocatedId;
+				const watch = startInterruptWatch(`EIP ${logicalId} release`);
+				try {
+					await withRetry(() => this.ec2Client.send(new ReleaseAddressCommand({ AllocationId: releaseId })), logicalId, {
+						maxRetries: 4,
+						initialDelayMs: 500,
+						isRetryable: (_text, releaseError) => isThrottlingError(releaseError),
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
+				createdId = void 0;
+				this.logger.debug(safeMsg`Released partially-created EIP ${logicalId} (${allocatedId})`);
+			} catch (cleanupError) {
+				this.logger.warn(safeMsg`Failed to release partially-created EIP ${logicalId} (${allocatedId}): ${describeAwsFailure(cleanupError).detail}. Manual release may be required: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 release-address --allocation-id ${allocatedId}`.render()}`);
+			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+			if (createdId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 		return {
@@ -22205,6 +22289,7 @@ var CloudFrontDistributionProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting CloudFront Distribution ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
 			let etag;
 			let config;
@@ -22224,11 +22309,13 @@ var CloudFrontDistributionProvider = class {
 			if (config.Enabled) {
 				this.logger.debug(`Disabling CloudFront Distribution ${physicalId} before deletion`);
 				config.Enabled = false;
-				etag = (await this.cloudFrontClient.send(new UpdateDistributionCommand({
+				const updateResponse = await this.cloudFrontClient.send(new UpdateDistributionCommand({
 					Id: physicalId,
 					IfMatch: etag,
 					DistributionConfig: config
-				}))).ETag;
+				}));
+				stripped = true;
+				etag = updateResponse.ETag;
 				if (!await this.waitForDistributionStable(physicalId, false)) this.logger.warn(`Distribution ${shownId(physicalId)} disable did not settle (Deployed + disabled) within the wait budget; attempting delete anyway. If it fails with DistributionNotDisabled, retry the destroy or raise the budget with --resource-timeout AWS::CloudFront::Distribution=${commandHole("duration")}.`);
 				etag = (await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }))).ETag;
 			} else {
@@ -22248,7 +22335,8 @@ var CloudFrontDistributionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
@@ -24183,6 +24271,7 @@ var ECSProvider = class {
 				if (skip) return skip;
 			}
 		} else cluster = recordedCluster;
+		let stripped = false;
 		try {
 			try {
 				await client.send(new UpdateServiceCommand({
@@ -24190,6 +24279,8 @@ var ECSProvider = class {
 					service: physicalId,
 					desiredCount: 0
 				}));
+				const recordedCount = properties?.["DesiredCount"];
+				stripped = !(recordedCount === 0 || recordedCount === "0");
 				this.logger.debug(`Scaled down ECS service ${physicalId} to 0`);
 			} catch (error) {
 				if (this.isServiceNotFoundException(error)) {
@@ -24214,7 +24305,8 @@ var ECSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getServiceAttribute(physicalId, attributeName) {
@@ -28487,9 +28579,10 @@ var Route53Provider = class {
 	}
 	async deleteHostedZone(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route 53 hosted zone ${logicalId}: ${physicalId}`);
+		const progress = { stripped: false };
 		try {
-			await this.deleteQueryLoggingConfigForZone(physicalId, logicalId);
-			await this.ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId);
+			await this.deleteQueryLoggingConfigForZone(physicalId, logicalId, progress);
+			await this.ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId, progress);
 			await this.getClient().send(new DeleteHostedZoneCommand({ Id: physicalId }));
 			this.logger.debug(`Successfully deleted hosted zone ${logicalId}`);
 		} catch (error) {
@@ -28499,12 +28592,12 @@ var Route53Provider = class {
 				this.logger.debug(`Hosted zone ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	async ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId) {
+	async ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId, progress) {
 		const client = this.getClient();
 		const pollIntervalMs = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_INTERVAL_MS"] ?? "15000", 10);
 		const timeoutMs = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_TIMEOUT_MS"] ?? "600000", 10);
@@ -28547,6 +28640,7 @@ var Route53Provider = class {
 				HostedZoneId: physicalId,
 				EnableAcceleratedRecovery: false
 			}));
+			progress.stripped = true;
 		} else if (current === "DISABLING" || current === "DISABLING_HOSTED_ZONE_LOCKED") this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecovery is already ${current} (a disabling phase); waiting for settle`);
 		const settled = await waitFor(/* @__PURE__ */ new Set(["DISABLED"]), "DISABLED");
 		this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecoveryStatus settled to ${settled ?? "undefined (zone gone)"}`);
@@ -28899,11 +28993,18 @@ var Route53Provider = class {
 			throw error;
 		}
 	}
-	async deleteQueryLoggingConfigForZone(zoneId, logicalId) {
+	async deleteQueryLoggingConfigForZone(zoneId, logicalId, progress) {
 		try {
 			const configs = (await this.getClient().send(new ListQueryLoggingConfigsCommand({ HostedZoneId: zoneId }))).QueryLoggingConfigs ?? [];
 			for (const config of configs) if (config.Id) {
-				await this.getClient().send(new DeleteQueryLoggingConfigCommand({ Id: config.Id }));
+				const before = progress?.stripped;
+				if (progress) progress.stripped = true;
+				try {
+					await this.getClient().send(new DeleteQueryLoggingConfigCommand({ Id: config.Id }));
+				} catch (deleteError) {
+					if (progress && before !== void 0 && isRefusedByName(deleteError)) progress.stripped = before;
+					throw deleteError;
+				}
 				this.logger.debug(`Deleted query logging config ${config.Id} for hosted zone ${logicalId}`);
 			}
 		} catch (error) {
@@ -30085,7 +30186,10 @@ var CognitoUserPoolProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
-			if (poolLeftBehind && createdUserPoolId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+			if (poolLeftBehind && createdUserPoolId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -32940,7 +33044,10 @@ var AppSyncProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (apiLeftBehind && createdApiId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+			if (apiLeftBehind && createdApiId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -35693,10 +35800,17 @@ var GlueTriggerProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Trigger ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
+		let stripped = false;
 		try {
 			try {
 				if ((await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State === "ACTIVATED") {
-					await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					stripped = true;
+					try {
+						await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					} catch (stopError) {
+						if (isRefusedByName(stopError)) stripped = false;
+						throw stopError;
+					}
 					await this.waitForTriggerDeactivated(physicalId);
 				}
 			} catch (err) {
@@ -35711,7 +35825,8 @@ var GlueTriggerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35766,6 +35881,7 @@ var GlueTriggerProvider = class {
 const createKeyLatch = new AmbiguousCreateLatch("CreateKey");
 const keysCreatedByThisProcess = new RecentIdSet();
 const pendingKeys = /* @__PURE__ */ new Map();
+const supersededAttempts = /* @__PURE__ */ new Map();
 const RESUMABLE_KEY_STATES = /* @__PURE__ */ new Set([
 	"Enabled",
 	"Disabled",
@@ -35860,11 +35976,12 @@ var KMSProvider = class {
 			enabled: properties["Enabled"] !== false
 		})).digest("hex");
 		let createdKeyId;
+		let supersededPending = false;
 		try {
 			const resumed = await this.resumeKeyFromFailedAttempt(logicalId, attemptKey, inputDigest);
 			let keyId;
 			let keyArn;
-			if (resumed) ({keyId, keyArn} = resumed);
+			if (resumed && resumed !== "superseded") ({keyId, keyArn} = resumed);
 			else {
 				const orphanWindow = createKeyLatch.take(logicalId);
 				if (orphanWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, orphanWindow);
@@ -35885,6 +36002,9 @@ var KMSProvider = class {
 					heldAtMs: Date.now()
 				});
 				createdKeyId = keyId;
+				const declinedAtMs = supersededAttempts.get(attemptKey);
+				supersededAttempts.delete(attemptKey);
+				supersededPending = declinedAtMs !== void 0 && Date.now() - declinedAtMs <= 18e5;
 				const replayWindow = replayedSendWindow(result, attemptStartMs);
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
@@ -35920,7 +36040,10 @@ var KMSProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (createdKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+			if (createdKeyId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+				if (supersededPending) markSupersedesEarlierCreate(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -35943,6 +36066,8 @@ var KMSProvider = class {
 		const deletion = aws`aws kms schedule-key-deletion --key-id ${pending.keyId}${region} --pending-window-in-days 7`.render();
 		const notReused = (reason) => {
 			this.logger.warn(safeMsg`KMS key ${pending.keyId} was created for ${logicalId} by an earlier attempt of this deploy, but ${reason}, so this attempt creates a new key and that one is not recorded in cdkd state. If it is unused, schedule its deletion with: ${deletion}`);
+			setBounded(supersededAttempts, attemptKey, Date.now());
+			return "superseded";
 		};
 		if (pending.inputDigest !== inputDigest) return notReused("this attempt was asked for a key with different inputs");
 		let metadata;
@@ -40598,7 +40723,10 @@ var EMRClusterProvider = class {
 				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${describeAwsFailure(cleanupError).detail} — terminate it manually to stop billing`);
 			}
 			if (error instanceof ProvisioningError) {
-				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+				if (survivorId !== void 0) {
+					markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+					markNonRetryable(error);
+				}
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -40606,6 +40734,7 @@ var EMRClusterProvider = class {
 			if (survivorId !== void 0) {
 				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+				markNonRetryable(thrown);
 				throw thrown;
 			}
 			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
@@ -41274,7 +41403,27 @@ var EMRInstanceGroupConfigProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
-			if (createdGroupId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdGroupId);
+			let leftBehindGroupId = createdGroupId;
+			if (leftBehindGroupId && properties["InstanceRole"] === "TASK") {
+				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+				try {
+					await this.getClient().send(new ModifyInstanceGroupsCommand({
+						ClusterId: jobFlowId,
+						InstanceGroups: [{
+							InstanceGroupId: leftBehindGroupId,
+							InstanceCount: 0
+						}]
+					}));
+					log.warn(safeMsg`Scaled partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0; EMR has no delete API, so the empty group stays on cluster ${log.value(jobFlowId)} until it terminates`);
+					leftBehindGroupId = void 0;
+				} catch (cleanupError) {
+					log.warn(safeMsg`Failed to scale partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0: ${describeAwsFailure(cleanupError).detail} — its instances are released when the parent cluster terminates`);
+				}
+			}
+			if (leftBehindGroupId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindGroupId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -41580,7 +41729,10 @@ var EMRInstanceFleetConfigProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
-			if (createdFleetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+			if (createdFleetId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -42857,12 +43009,18 @@ var CloudTrailProvider = class {
 			throw new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting CloudTrail Trail ${logicalId}: ${physicalId}`);
+		const recordedIsLogging = properties?.["IsLogging"];
+		const recordedStopped = recordedIsLogging === false || recordedIsLogging === "false";
+		let stripped = false;
 		try {
 			try {
+				stripped = !recordedStopped;
 				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
-			} catch {}
+			} catch (stopError) {
+				if (isRefusedByName(stopError)) stripped = false;
+			}
 			await this.getClient().send(new DeleteTrailCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted CloudTrail Trail ${logicalId}`);
 		} catch (error) {
@@ -42873,7 +43031,8 @@ var CloudTrailProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	getAttribute(_physicalId, _resourceType, attributeName) {
@@ -46433,4 +46592,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CVC9_-km.js.map
+//# sourceMappingURL=provider-classes-CDzT2xg0.js.map