@go-to-k/cdkd 0.300.0 → 0.300.2

package/dist/{provider-classes-CVC9_-km.js → provider-classes-DzoIZFZK.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-BxP3yqlr.js";
+import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DFk7zr0Q.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as findSilentDropProperties, Ao as lambdaFunctionNameForMask, Ar as unchangedBehindSecretReference, At as withNestedStackContext, Br as ec2InstanceProtectionSite, Bt as awaitInFlightSibling, C as withApiLimit, Cl as derivePartitionAndUrlSuffix, Co as requireConfigObject, Cr as getCurrentResourceSecrets, Cs as physicalNameCopiesOf, Ds as carriesSecretMask, Fl as renderAssemblyPathEscape, Fr as deleteSkipReason, G as deleteBudgetKey, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as observeThenDisableInstanceApiTermination, Ht as getStackRecords, Il as resolveAssemblyPath, Ir as withIndeterminateGuard, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Li as passedParameterClassesOf, Lr as isWaitAbandonedError, Nl as describeFileReadFailure, Oo as withRetry, Pi as parseWebACLArn, Pl as displayAssemblyPath, Q as ECR_AUTO_DELETE_IMAGES_TAG, Rr as markWaitAbandoned, S as lookupEachName, Sl as canonicalizeRegion, So as requireConfigArray, Ss as recoverMaskedOutput, St as getNestedRevertRun, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Uo as passedNoEchoParametersOf, Ur as reDisableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as isTerminationProtectionPropagationError, W as compensateRemovedDeletionProtection, Wi as accountArgs, Wr as reEnableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Xo as hasMaskableValues, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, Za as withheldAccountClause, _c as rewriteTemplateAssetReferences, _o as configBooleanRefusal, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as readConfigString, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as planTagDiff, cs as markSameGenerationBag, do as coerceWarmThroughput$1, dr as tagMapAsList, ds as redactSecretsForState, et as hasCdkAutoDeleteTag, fc as stringifyValue, fi as s3BucketArn, fo as isWarmThroughputDecrease, fr as tagPlanWarning, gi as s3BucketWebsiteUrl, go as coerceCfnInteger, gs as dynamicReferenceTokens, hi as s3BucketRegionalDomainName, ho as coerceCfnBoolean, jo as sameLambdaFunctionAddress, ko as canonicalLambdaFunctionName, kr as slowCcOperationTimeoutMs, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as outputReferenceProvenanceOf, ln as redactedDeleteAddressFields, lr as readTagList, ls as recordReferenceProvenanceEntry, mi as s3BucketDualStackDomainName, mo as toFiniteNumber, mr as stringifyIfAssigned, ms as withoutPhysicalNameCopies, nt as getPriorAttempts, or as DBPROXY_TAGS_WHAT, pi as s3BucketDomainName, po as toCfnInteger, pr as definedAttributes, q as resolveDynamoDbDeleteBudgetMs, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, si as isSettledInstanceState, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as DBPROXY_TAG_OPTIONS, t as DeployEngine, to as withoutSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, uo as WARM_THROUGHPUT_MEMBERS, ur as refuseMalformedDesiredTags, us as snapshotPassProvenance, vo as configIntegerRefusal, wi as getAccountInfo, wo as requireConfigString, ws as recordAttributeIdCopy, x as isAccessDeniedError, xo as replayWarn, ya as refuseMalformedNestedChildOutputs, yl as decodeListingKey, yo as configStringRefusal, za as refuseMalformedResourcesForDestroy } from "./deploy-engine-C-4ho8TJ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-a-8z7Dpm.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BHjdsRtD.js";
-import { RDSProvider } from "./rds-provider-QKN-WHF3.js";
-import { NeptuneProvider } from "./neptune-provider-Bnr2VC6V.js";
-import { ASGProvider } from "./asg-provider-COcKVcvZ.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-DOBzE5TD.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8gNXG1G.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BDm58Wc8.js";
+import { RDSProvider } from "./rds-provider-C-lGTdAb.js";
+import { NeptuneProvider } from "./neptune-provider-UDy6HC5O.js";
+import { ASGProvider } from "./asg-provider-DJdNNqDe.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -417,7 +417,9 @@ var IAMPolicyProvider = class {
 		}
 		let secretPrincipalLacksGrant = false;
 		const detached = context?.resolveSecretDerivedPrincipals?.retryMemo?.detached;
+		let removedAny = false;
 		const onDetached = (kind, name) => {
+			removedAny = true;
 			if (fromSecret(kind, name)) detached?.add(injectiveKey(kind, name));
 		};
 		const claimed = (kind, name) => {
@@ -505,7 +507,8 @@ var IAMPolicyProvider = class {
 			this.logger.debug(`Successfully deleted IAM policy ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw maskError(new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
+			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -772,6 +775,7 @@ var IAMManagedPolicyProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(mask(`Deleting IAM managed policy ${logicalId}: ${physicalId}`));
+		const progress = { stripped: false };
 		try {
 			try {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
@@ -782,7 +786,7 @@ var IAMManagedPolicyProvider = class {
 				}
 				throw error;
 			}
-			await this.detachAllPrincipals(physicalId);
+			await this.detachAllPrincipals(physicalId, progress);
 			await this.deleteAllNonDefaultVersions(physicalId);
 			await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: physicalId }));
 			this.logger.debug(`Successfully deleted IAM managed policy ${logicalId}`);
@@ -792,7 +796,8 @@ var IAMManagedPolicyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const failure = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async goneOnDelete(logicalId, physicalId, resourceType, context, mask) {
@@ -1035,7 +1040,7 @@ var IAMManagedPolicyProvider = class {
 		} while (marker);
 		return live;
 	}
-	async detachAllPrincipals(policyArn) {
+	async detachAllPrincipals(policyArn, progress) {
 		try {
 			let marker;
 			while (true) {
@@ -1050,6 +1055,7 @@ var IAMManagedPolicyProvider = class {
 							GroupName: g.GroupName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1061,6 +1067,7 @@ var IAMManagedPolicyProvider = class {
 							RoleName: r.RoleName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1072,6 +1079,7 @@ var IAMManagedPolicyProvider = class {
 							UserName: u.UserName,
 							PolicyArn: policyArn
 						}));
+						if (progress) progress.stripped = true;
 					} catch (err) {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
@@ -1317,6 +1325,7 @@ var IAMInstanceProfileProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
 			let roles = [];
 			try {
@@ -1335,6 +1344,7 @@ var IAMInstanceProfileProvider = class {
 					InstanceProfileName: physicalId,
 					RoleName: roleName
 				}));
+				stripped = true;
 				this.logger.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -1349,7 +1359,8 @@ var IAMInstanceProfileProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	logGoneOnDelete(logicalId, physicalId, context) {
@@ -1513,7 +1524,10 @@ var IAMAccessKeyProvider = class {
 			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
-			if (leftBehindKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+			if (leftBehindKeyId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -1999,9 +2013,11 @@ var IAMUserGroupProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting IAM user ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
+		let hadBoundary = false;
 		try {
 			try {
-				await this.iamClient.send(new GetUserCommand({ UserName: physicalId }));
+				hadBoundary = (await this.iamClient.send(new GetUserCommand({ UserName: physicalId }))).User?.PermissionsBoundary !== void 0;
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
@@ -2012,18 +2028,20 @@ var IAMUserGroupProvider = class {
 				}
 				throw error;
 			}
-			await this.removeUserFromAllGroups(physicalId, log);
-			await this.detachAllUserPolicies(physicalId, log);
-			await this.deleteAllUserInlinePolicies(physicalId, log);
+			await this.removeUserFromAllGroups(physicalId, log, progress);
+			await this.detachAllUserPolicies(physicalId, log, progress);
+			await this.deleteAllUserInlinePolicies(physicalId, log, progress);
 			try {
 				await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: physicalId }));
+				progress.stripped = true;
 				log.debug(`Deleted login profile for user ${v(physicalId)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
-			await this.deleteAllAccessKeys(physicalId, log);
+			await this.deleteAllAccessKeys(physicalId, log, progress);
 			try {
 				await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: physicalId }));
+				if (hadBoundary) progress.stripped = true;
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
@@ -2031,7 +2049,8 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async readLiveGroups(userName) {
@@ -2047,7 +2066,7 @@ var IAMUserGroupProvider = class {
 		} while (marker);
 		return groups;
 	}
-	async removeUserFromAllGroups(userName, log) {
+	async removeUserFromAllGroups(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const groups = (await this.iamClient.send(new ListGroupsForUserCommand({ UserName: userName }))).Groups || [];
@@ -2056,6 +2075,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					GroupName: group.GroupName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Removed user ${v(userName)} from group ${v(group.GroupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2065,7 +2085,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllAccessKeys(userName, log) {
+	async deleteAllAccessKeys(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const keys = (await this.iamClient.send(new ListAccessKeysCommand({ UserName: userName }))).AccessKeyMetadata || [];
@@ -2074,6 +2094,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					AccessKeyId: key.AccessKeyId
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted access key ${key.AccessKeyId} for user ${v(userName)}`);
 			}
 		} catch (error) {
@@ -2081,7 +2102,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async detachAllUserPolicies(userName, log) {
+	async detachAllUserPolicies(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policies = (await this.iamClient.send(new ListAttachedUserPoliciesCommand({ UserName: userName }))).AttachedPolicies || [];
@@ -2090,6 +2111,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					PolicyArn: policy.PolicyArn
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from user ${v(userName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2099,7 +2121,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllUserInlinePolicies(userName, log) {
+	async deleteAllUserInlinePolicies(userName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policyNames = (await this.iamClient.send(new ListUserPoliciesCommand({ UserName: userName }))).PolicyNames || [];
@@ -2108,6 +2130,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					PolicyName: policyName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted inline policy ${v(policyName)} from user ${v(userName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2291,10 +2314,11 @@ var IAMUserGroupProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Deleting IAM group ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
 		try {
-			await this.detachAllGroupPolicies(physicalId, log);
-			await this.deleteAllGroupInlinePolicies(physicalId, log);
-			await this.removeAllUsersFromGroup(physicalId, log);
+			await this.detachAllGroupPolicies(physicalId, log, progress);
+			await this.deleteAllGroupInlinePolicies(physicalId, log, progress);
+			await this.removeAllUsersFromGroup(physicalId, log, progress);
 			await this.iamClient.send(new DeleteGroupCommand({ GroupName: physicalId }));
 			log.debug(`Successfully deleted IAM group ${logicalId}`);
 		} catch (error) {
@@ -2306,10 +2330,11 @@ var IAMUserGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	async detachAllGroupPolicies(groupName, log) {
+	async detachAllGroupPolicies(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policies = (await this.iamClient.send(new ListAttachedGroupPoliciesCommand({ GroupName: groupName }))).AttachedPolicies || [];
@@ -2318,6 +2343,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					PolicyArn: policy.PolicyArn
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2327,7 +2353,7 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async removeAllUsersFromGroup(groupName, log) {
+	async removeAllUsersFromGroup(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const users = (await this.iamClient.send(new GetGroupCommand({ GroupName: groupName }))).Users || [];
@@ -2336,6 +2362,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					UserName: user.UserName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Removed user ${v(user.UserName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2364,7 +2391,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Detached managed policy ${v(policyArn)} from group ${v(groupName)}`);
 		}
 	}
-	async deleteAllGroupInlinePolicies(groupName, log) {
+	async deleteAllGroupInlinePolicies(groupName, log, progress) {
 		const { value: v } = log;
 		try {
 			const policyNames = (await this.iamClient.send(new ListGroupPoliciesCommand({ GroupName: groupName }))).PolicyNames || [];
@@ -2373,6 +2400,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					PolicyName: policyName
 				}));
+				if (progress) progress.stripped = true;
 				log.debug(`Deleted inline policy ${v(policyName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
@@ -2546,6 +2574,7 @@ var IAMUserGroupProvider = class {
 			};
 		}
 		let secretUserNotMember = false;
+		let removedAny = false;
 		try {
 			for (const userName of users ?? []) {
 				if (resolvedNames.has(userName) && memo?.detached.has(injectiveKey("Users", userName)) !== true) {
@@ -2567,6 +2596,7 @@ var IAMUserGroupProvider = class {
 						GroupName: groupName,
 						UserName: userName
 					}));
+					removedAny = true;
 					if (resolvedNames.has(userName)) memo?.detached.add(injectiveKey("Users", userName));
 					this.logger.debug(`Removed user ${mask(userName)} from group ${groupName}`);
 				} catch (error) {
@@ -2584,7 +2614,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM UserToGroupAddition ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw maskError(new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
+			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -3228,6 +3259,8 @@ function isPlainBucketName(value) {
 const BUCKET_LIST_IDENTITY_ATTEMPTS = 3;
 const BUCKET_LIST_IDENTITY_DELAY_MS = 1500;
 const BUCKET_LIST_IDENTITY_BUDGET_MS = 6e3;
+const OWN_WRITE_HEAD_ATTEMPTS = 5;
+const OWN_WRITE_HEAD_DELAY_MS = 500;
 function isNoSuchBucketError(error) {
 	return error?.name === "NoSuchBucket";
 }
@@ -3293,6 +3326,15 @@ function takeOwnLeftoverBucket(logicalId) {
 	ownLeftoverBuckets.delete(key);
 	return held !== void 0 && Date.now() - held.heldAtMs <= 18e5 ? held.identity : void 0;
 }
+function isCreateTagResourceDenial(error) {
+	return error instanceof Error && error.name === "AccessDenied" && describeAwsFailure(error).detail.includes("s3:TagResource");
+}
+function isCreateTagsShapeRefusal(error) {
+	if (!(error instanceof Error)) return false;
+	if (error.name === "MalformedXML" || error.name === "NotImplemented") return true;
+	return (error.name === "InvalidArgument" || error.name === "InvalidRequest") && /\btags?\b/i.test(describeAwsFailure(error).detail);
+}
+const untaggedExplicitDeny = /* @__PURE__ */ new WeakMap();
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	createClientHolder = {};
@@ -4572,6 +4614,11 @@ var S3BucketProvider = class S3BucketProvider {
 			const canonicalRegion = canonicalizeRegion(region);
 			if (canonicalRegion !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: canonicalRegion };
 			if (declaresBucketObjectLock(properties)) createParams.ObjectLockEnabledForBucket = true;
+			if (desiredTags.length > 0) createParams.CreateBucketConfiguration = {
+				...createParams.CreateBucketConfiguration,
+				Tags: desiredTags
+			};
+			let tagsAppliedOnCreate = false;
 			const preflight = canonicalizeRegion(region) === "us-east-1" ? await this.probeBucketRegion(bucketName) : { kind: "absent" };
 			let createdNewBucket = false;
 			const createClient = await this.getCreateClient();
@@ -4597,11 +4644,40 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			try {
 				const attemptStartMs = Date.now();
-				if (!adoptedOwnLeftover) try {
-					await createClient.send(new CreateBucketCommand(createParams));
-				} catch (sendError) {
-					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
-					throw sendError;
+				if (!adoptedOwnLeftover) {
+					let tagsSent = createParams.CreateBucketConfiguration?.Tags !== void 0;
+					try {
+						try {
+							await createClient.send(new CreateBucketCommand(createParams));
+						} catch (taggedError) {
+							const tagResourceDenied = isCreateTagResourceDenial(taggedError);
+							if (!tagsSent || !(tagResourceDenied || isCreateTagsShapeRefusal(taggedError))) throw taggedError;
+							this.logger.debug(safeMsg`CreateBucket with tags was ${tagResourceDenied ? "denied s3:TagResource" : "refused for its Tags member"} for ${displaySafe(logicalId)}; ` + `retrying without tags and applying them with PutBucketTagging`);
+							const { Tags: _omitted, ...rest } = createParams.CreateBucketConfiguration ?? {};
+							const untagged = { ...createParams };
+							if (Object.keys(rest).length > 0) untagged.CreateBucketConfiguration = rest;
+							else delete untagged.CreateBucketConfiguration;
+							tagsSent = false;
+							try {
+								await createClient.send(new CreateBucketCommand(untagged));
+							} catch (untaggedError) {
+								if (tagResourceDenied && untaggedError instanceof Error && untaggedError.name === "AccessDenied") {
+									this.logger.debug(safeMsg`CreateBucket without tags was denied too for ${displaySafe(logicalId)}; ` + `reporting the s3:TagResource denial`);
+									const untaggedText = describeAwsFailure(untaggedError).detail;
+									if (isExplicitDenyError(untaggedText) && taggedError instanceof Error) {
+										untaggedExplicitDeny.set(taggedError, explicitDenyPolicyKind(untaggedText) ?? null);
+										markNonRetryable(taggedError);
+									}
+									throw taggedError;
+								}
+								throw untaggedError;
+							}
+						}
+					} catch (sendError) {
+						createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
+						throw sendError;
+					}
+					tagsAppliedOnCreate = tagsSent && preflight.kind === "absent";
 				}
 				createdNewBucket = adoptedOwnLeftover || preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
@@ -4627,7 +4703,7 @@ var S3BucketProvider = class S3BucketProvider {
 			try {
 				effectiveOverrides = await this.applyConfiguration(bucketName, properties, {
 					...context ? { context } : {},
-					desiredTags
+					...tagsAppliedOnCreate ? { skipTags: true } : { desiredTags }
 				});
 				for (const [key, value] of await this.applyAllSubConfigsForCreate(bucketName, properties, context)) effectiveOverrides.set(key, value);
 			} catch (innerError) {
@@ -4734,7 +4810,12 @@ var S3BucketProvider = class S3BucketProvider {
 	wrapOperationError(operation, logicalId, resourceType, physicalId, error) {
 		const failure = describeAwsFailure(error);
 		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)} (${this.shown(physicalId)}): ${this.maskRaw(failure.detail)}`);
-		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${this.maskRaw(failure.summary)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		const denyKind = failure.redacted ? explicitDenyPolicyKind(failure.detail) : void 0;
+		const denyNote = failure.redacted && isExplicitDenyError(failure.detail) ? ` Refused by an explicit deny${denyKind !== void 0 ? ` (${denyKind})` : ""}, which retrying cannot clear.` : "";
+		const tagResourceNote = failure.redacted && isCreateTagResourceDenial(error) ? " Creating a bucket with tags needs s3:TagResource." : "";
+		const untaggedDenyKind = error instanceof Error ? untaggedExplicitDeny.get(error) : void 0;
+		const untaggedDenyNote = untaggedDenyKind !== void 0 ? ` The untagged retry was refused by an explicit deny${untaggedDenyKind !== null ? ` (${untaggedDenyKind})` : ""}, which retrying cannot clear.` : "";
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${this.maskRaw(failure.summary)}${denyNote}${tagResourceNote}${untaggedDenyNote}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		return failure.redacted ? markRedactedCause(wrapped) : wrapped;
 	}
 	canonicalizeDesiredProperties(resourceType, properties) {
@@ -4746,12 +4827,20 @@ var S3BucketProvider = class S3BucketProvider {
 		out = canonicalizeBlock(out, "LifecycleConfiguration", effectiveLifecycleConfiguration);
 		return out;
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		try {
+	async readCurrentState(physicalId, _logicalId, _resourceType, _properties, context) {
+		const headAttempts = context?.afterOwnWrite === true ? OWN_WRITE_HEAD_ATTEMPTS : 1;
+		for (let attempt = 1;; attempt++) try {
 			await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
+			break;
 		} catch (err) {
 			const e = err;
-			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) return RESOURCE_NOT_FOUND;
+			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) {
+				if (attempt < headAttempts) {
+					await new Promise((r) => setTimeout(r, OWN_WRITE_HEAD_DELAY_MS));
+					continue;
+				}
+				return RESOURCE_NOT_FOUND;
+			}
 			throw err;
 		}
 		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
@@ -6136,11 +6225,13 @@ var SQSQueuePolicyProvider = class {
 		const named = physicalId.includes(",") ? splitQueueUrls(physicalId) : recordedQueues(physicalId, context?.recordedAttributes);
 		const queueUrls = [...physicalId.includes(",") ? [] : await this.queuesCarryingDocument(listedQueues(properties ?? {}).filter((url) => !named.includes(url)), properties?.["PolicyDocument"], logicalId), ...named];
 		if (queueUrls.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
+		let clearedAny = false;
 		for (const queueUrl of queueUrls) try {
 			await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion);
+			clearedAny = true;
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			const failure = error instanceof ProvisioningError ? error : this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			throw clearedAny ? markDeleteStarted(failure) : failure;
 		}
 		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
@@ -7251,11 +7342,13 @@ var SNSTopicPolicyProvider = class {
 		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id is empty, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
 		const topicArns = named.every((arn) => isSnsTopicArn(arn)) ? named : [.../* @__PURE__ */ new Set([...named.filter((arn) => isSnsTopicArn(arn)), ...listedTopics(properties ?? {})])];
 		if (topicArns.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id names no SNS topic ARN and its Topics lists none either, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
+		let clearedAny = false;
 		for (const topicArn of topicArns) try {
 			await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion);
+			clearedAny = true;
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			throw this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			const failure = error instanceof ProvisioningError ? error : this.wrapOperationError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
+			throw clearedAny ? markDeleteStarted(failure) : failure;
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
@@ -8038,8 +8131,10 @@ var LambdaFunctionProvider = class {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Lambda function ${logicalId}: ${physicalId}`);
 		const hasVpcConfig = this.hasVpcConfig(properties?.["VpcConfig"]);
+		let stripped = false;
 		if (hasVpcConfig) {
 			try {
+				stripped = true;
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand({
 					FunctionName: physicalId,
 					VpcConfig: {
@@ -8055,6 +8150,7 @@ var LambdaFunctionProvider = class {
 					this.logFunctionGone(logicalId, physicalId, context);
 					return;
 				}
+				if (isRefusedByName(error)) stripped = false;
 				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${describeAwsFailure(error).detail} — continuing with delete`);
 			}
 			await this.waitForLambdaUpdateCompleted(physicalId);
@@ -8070,7 +8166,8 @@ var LambdaFunctionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 		if (hasVpcConfig) await this.cleanupLambdaEnis(physicalId);
 	}
@@ -10270,7 +10367,17 @@ var LambdaWebFunctionRevisionProvider = class {
 			};
 		} catch (error) {
 			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
-			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			let leftBehindArn = createdArn;
+			if (leftBehindArn) try {
+				await this.delete(logicalId, leftBehindArn, resourceType);
+				leftBehindArn = void 0;
+			} catch (cleanupError) {
+				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
+			}
+			if (leftBehindArn) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -15080,6 +15187,7 @@ var EventBridgeRuleProvider = class {
 		this.logger.debug(`Deleting EventBridge rule ${logicalId}: ${physicalId}`);
 		const ruleName = this.extractRuleNameFromArn(physicalId);
 		const busParam = this.busParamFromArn(physicalId);
+		let stripped = false;
 		try {
 			let targetIds = [];
 			try {
@@ -15102,6 +15210,7 @@ var EventBridgeRuleProvider = class {
 					Ids: targetIds,
 					...busParam
 				}));
+				stripped = true;
 				this.logger.debug(`Removed ${targetIds.length} targets from rule ${ruleName}`);
 			}
 			await this.eventBridgeClient.send(new DeleteRuleCommand({
@@ -15117,7 +15226,8 @@ var EventBridgeRuleProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -15383,8 +15493,9 @@ var EventBridgeBusProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting EventBus ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
-			await this.cleanupRulesOnBus(physicalId);
+			stripped = await this.cleanupRulesOnBus(physicalId);
 			await this.eventBridgeClient.send(new DeleteEventBusCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted EventBus ${logicalId}`);
 		} catch (error) {
@@ -15402,7 +15513,8 @@ var EventBridgeBusProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EventBus ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBus ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	getAttribute(physicalId, _resourceType, attributeName) {
@@ -15411,9 +15523,11 @@ var EventBridgeBusProvider = class {
 		return Promise.resolve(void 0);
 	}
 	async cleanupRulesOnBus(busName) {
+		let found = false;
 		try {
 			const rules = (await this.eventBridgeClient.send(new ListRulesCommand({ EventBusName: busName }))).Rules ?? [];
-			if (rules.length === 0) return;
+			if (rules.length === 0) return false;
+			found = true;
 			this.logger.debug(`Cleaning up ${rules.length} rule(s) on bus ${busName}`);
 			for (const rule of rules) {
 				if (!rule.Name) continue;
@@ -15436,9 +15550,10 @@ var EventBridgeBusProvider = class {
 				} catch {}
 			}
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$2) return;
+			if (error instanceof ResourceNotFoundException$2) return found;
 			this.logger.debug(`Failed to list rules on bus ${busName}: ${describeAwsFailure(error).detail}`);
 		}
+		return found;
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		try {
@@ -16143,7 +16258,10 @@ var EC2Provider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			if (leftBehindId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -16489,6 +16607,7 @@ var EC2Provider = class {
 		let publicIp;
 		let created = false;
 		let createdId;
+		let allocatedId;
 		try {
 			const input = {
 				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
@@ -16508,6 +16627,7 @@ var EC2Provider = class {
 			}
 			created = true;
 			allocationId = response.AllocationId;
+			allocatedId = allocationId;
 			publicIp = response.PublicIp;
 			try {
 				createdId = this.eipPhysicalId(logicalId, publicIp, allocationId);
@@ -16532,9 +16652,31 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
 		} catch (error) {
 			if (created) markAuxiliaryFailure(error, logicalId);
+			if (createdId !== void 0 && allocatedId !== void 0) try {
+				const releaseId = allocatedId;
+				const watch = startInterruptWatch(`EIP ${logicalId} release`);
+				try {
+					await withRetry(() => this.ec2Client.send(new ReleaseAddressCommand({ AllocationId: releaseId })), logicalId, {
+						maxRetries: 4,
+						initialDelayMs: 500,
+						isRetryable: (_text, releaseError) => isThrottlingError(releaseError),
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
+				createdId = void 0;
+				this.logger.debug(safeMsg`Released partially-created EIP ${logicalId} (${allocatedId})`);
+			} catch (cleanupError) {
+				this.logger.warn(safeMsg`Failed to release partially-created EIP ${logicalId} (${allocatedId}): ${describeAwsFailure(cleanupError).detail}. Manual release may be required: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 release-address --allocation-id ${allocatedId}`.render()}`);
+			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+			if (createdId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 		return {
@@ -22205,6 +22347,7 @@ var CloudFrontDistributionProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting CloudFront Distribution ${logicalId}: ${physicalId}`);
+		let stripped = false;
 		try {
 			let etag;
 			let config;
@@ -22224,11 +22367,13 @@ var CloudFrontDistributionProvider = class {
 			if (config.Enabled) {
 				this.logger.debug(`Disabling CloudFront Distribution ${physicalId} before deletion`);
 				config.Enabled = false;
-				etag = (await this.cloudFrontClient.send(new UpdateDistributionCommand({
+				const updateResponse = await this.cloudFrontClient.send(new UpdateDistributionCommand({
 					Id: physicalId,
 					IfMatch: etag,
 					DistributionConfig: config
-				}))).ETag;
+				}));
+				stripped = true;
+				etag = updateResponse.ETag;
 				if (!await this.waitForDistributionStable(physicalId, false)) this.logger.warn(`Distribution ${shownId(physicalId)} disable did not settle (Deployed + disabled) within the wait budget; attempting delete anyway. If it fails with DistributionNotDisabled, retry the destroy or raise the budget with --resource-timeout AWS::CloudFront::Distribution=${commandHole("duration")}.`);
 				etag = (await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }))).ETag;
 			} else {
@@ -22248,7 +22393,8 @@ var CloudFrontDistributionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
@@ -24183,6 +24329,7 @@ var ECSProvider = class {
 				if (skip) return skip;
 			}
 		} else cluster = recordedCluster;
+		let stripped = false;
 		try {
 			try {
 				await client.send(new UpdateServiceCommand({
@@ -24190,6 +24337,8 @@ var ECSProvider = class {
 					service: physicalId,
 					desiredCount: 0
 				}));
+				const recordedCount = properties?.["DesiredCount"];
+				stripped = !(recordedCount === 0 || recordedCount === "0");
 				this.logger.debug(`Scaled down ECS service ${physicalId} to 0`);
 			} catch (error) {
 				if (this.isServiceNotFoundException(error)) {
@@ -24214,7 +24363,8 @@ var ECSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getServiceAttribute(physicalId, attributeName) {
@@ -28487,9 +28637,10 @@ var Route53Provider = class {
 	}
 	async deleteHostedZone(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route 53 hosted zone ${logicalId}: ${physicalId}`);
+		const progress = { stripped: false };
 		try {
-			await this.deleteQueryLoggingConfigForZone(physicalId, logicalId);
-			await this.ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId);
+			await this.deleteQueryLoggingConfigForZone(physicalId, logicalId, progress);
+			await this.ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId, progress);
 			await this.getClient().send(new DeleteHostedZoneCommand({ Id: physicalId }));
 			this.logger.debug(`Successfully deleted hosted zone ${logicalId}`);
 		} catch (error) {
@@ -28499,12 +28650,12 @@ var Route53Provider = class {
 				this.logger.debug(`Hosted zone ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	async ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId) {
+	async ensureAcceleratedRecoveryDisabledForDelete(physicalId, logicalId, progress) {
 		const client = this.getClient();
 		const pollIntervalMs = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_INTERVAL_MS"] ?? "15000", 10);
 		const timeoutMs = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_TIMEOUT_MS"] ?? "600000", 10);
@@ -28547,6 +28698,7 @@ var Route53Provider = class {
 				HostedZoneId: physicalId,
 				EnableAcceleratedRecovery: false
 			}));
+			progress.stripped = true;
 		} else if (current === "DISABLING" || current === "DISABLING_HOSTED_ZONE_LOCKED") this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecovery is already ${current} (a disabling phase); waiting for settle`);
 		const settled = await waitFor(/* @__PURE__ */ new Set(["DISABLED"]), "DISABLED");
 		this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecoveryStatus settled to ${settled ?? "undefined (zone gone)"}`);
@@ -28899,11 +29051,18 @@ var Route53Provider = class {
 			throw error;
 		}
 	}
-	async deleteQueryLoggingConfigForZone(zoneId, logicalId) {
+	async deleteQueryLoggingConfigForZone(zoneId, logicalId, progress) {
 		try {
 			const configs = (await this.getClient().send(new ListQueryLoggingConfigsCommand({ HostedZoneId: zoneId }))).QueryLoggingConfigs ?? [];
 			for (const config of configs) if (config.Id) {
-				await this.getClient().send(new DeleteQueryLoggingConfigCommand({ Id: config.Id }));
+				const before = progress?.stripped;
+				if (progress) progress.stripped = true;
+				try {
+					await this.getClient().send(new DeleteQueryLoggingConfigCommand({ Id: config.Id }));
+				} catch (deleteError) {
+					if (progress && before !== void 0 && isRefusedByName(deleteError)) progress.stripped = before;
+					throw deleteError;
+				}
 				this.logger.debug(`Deleted query logging config ${config.Id} for hosted zone ${logicalId}`);
 			}
 		} catch (error) {
@@ -29720,6 +29879,8 @@ function customAcrLevels(acr) {
 	}));
 	return Object.keys(custom).length > 0 ? custom : void 0;
 }
+const EMAIL_RESET_CLAUSE = "reset to Cognito's default sender (EmailSendingAccount COGNITO_DEFAULT), dropping its SES SourceArn, and a redeploy will not restore it. Put the SES settings back with an UpdateUserPool that also carries the pool's other settings, since that call resets what it omits.";
+const EMAIL_RESET_BEFORE_DELETE_CLAUSE = "reset to Cognito's default sender (EmailSendingAccount COGNITO_DEFAULT), dropping its SES SourceArn, which stays that way if the delete fails.";
 const sentWithoutEmail = /* @__PURE__ */ new WeakSet();
 const createUserPoolLatch = new AmbiguousCreateLatch("CreateUserPool");
 const userPoolsCreatedByThisProcess = new RecentIdSet();
@@ -29930,6 +30091,7 @@ var CognitoUserPoolProvider = class {
 	logger = getLogger().child("CognitoUserPoolProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	preFlipPools = /* @__PURE__ */ new WeakMap();
+	emailOmittedFlips = /* @__PURE__ */ new WeakMap();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Set([
 		"UserPoolName",
 		"AutoVerifiedAttributes",
@@ -30085,7 +30247,10 @@ var CognitoUserPoolProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
-			if (poolLeftBehind && createdUserPoolId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+			if (poolLeftBehind && createdUserPoolId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -30383,10 +30548,12 @@ var CognitoUserPoolProvider = class {
 					if (bareFlip && pool.DeletionProtection !== "ACTIVE") bareFlip.ambiguous = false;
 					const resetConfirmed = bareFlip !== void 0 && !bareFlip.ambiguous;
 					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+					if (flipRecord && this.emailOmittedFlips.has(flipRecord) && !echoesDeveloperEmail(pool) && !(bareFlip && echoesDeveloperEmail(bareFlip.pool))) this.logger.error(safeMsg`Cognito User Pool ${physicalId} is LIVE with its SES email configuration reset: ` + safeMsg`--remove-protection turned DeletionProtection off with an UpdateUserPool that left ` + safeMsg`out its DEVELOPER EmailConfiguration (sending it was refused), and the delete then ` + safeMsg`failed. The pool's email configuration was ${EMAIL_RESET_CLAUSE}`);
 					const bareLicensed = resetConfirmed && bareFlip.echoedSince !== true;
 					const readOn = pool.DeletionProtection === "ACTIVE";
 					try {
-						await this.sendEchoedDeletionProtection(physicalId, pool, "ACTIVE");
+						const emailAlreadyReset = flipRecord !== void 0 && this.emailOmittedFlips.get(flipRecord) === "definite";
+						await this.sendEchoedDeletionProtection(physicalId, pool, "ACTIVE", { emailFallback: !readOn || emailAlreadyReset });
 					} catch (echoError) {
 						let failure = echoError;
 						if (bareLicensed && isRefusedEcho(echoError)) try {
@@ -30422,8 +30589,10 @@ var CognitoUserPoolProvider = class {
 		}
 		const mode = before.UserPoolAddOns?.AdvancedSecurityMode;
 		if (mode) held.push(`AdvancedSecurityMode=${mode}`);
+		if (echoesDeveloperEmail(before)) held.push("EmailConfiguration.EmailSendingAccount=DEVELOPER (SES)");
 		const heldText = held.length > 0 ? held.join(", ") : "none of these settings";
-		const state = kind === "unclear" ? safeMsg`is LIVE and its self sign-up, Lambda triggers and advanced security MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its self sign-up, Lambda triggers and advanced security were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its self sign-up, Lambda triggers and advanced security reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
+		const what = echoesDeveloperEmail(before) ? "self sign-up, Lambda triggers, advanced security and SES email configuration" : "self sign-up, Lambda triggers and advanced security";
+		const state = kind === "unclear" ? safeMsg`is LIVE and its ${what} MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its ${what} were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its ${what} reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
 		this.logger.error(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`);
 	}
 	async deleteOnce(logicalId, physicalId, resourceType, context, flip) {
@@ -30488,31 +30657,38 @@ var CognitoUserPoolProvider = class {
 			throw new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async sendEchoedDeletionProtection(physicalId, pool, value) {
+	async sendEchoedDeletionProtection(physicalId, pool, value, opts = {}) {
 		try {
 			await this.getClient().send(new UpdateUserPoolCommand(userPoolDeletionProtectionUpdate(physicalId, pool, value)));
+			return "echoed";
 		} catch (echoError) {
 			if (!echoesDeveloperEmail(pool) || !isRefusedEcho(echoError)) throw echoError;
+			if (opts.emailFallback === false) throw echoError;
+			const resetClause = value === "ACTIVE" ? EMAIL_RESET_CLAUSE : EMAIL_RESET_BEFORE_DELETE_CLAUSE;
 			this.logger.debug(safeMsg`UpdateUserPool refused the SES EmailConfiguration of ${physicalId}: ${describeAwsFailure(echoError).summary}`);
 			try {
 				await this.getClient().send(new UpdateUserPoolCommand(userPoolDeletionProtectionUpdate(physicalId, pool, value, { withoutDeveloperEmail: true })));
 			} catch (resendError) {
 				if (typeof resendError === "object" && resendError !== null) sentWithoutEmail.add(resendError);
+				if (isAmbiguousWriteFailure(resendError) && (value === "ACTIVE" || isTransientCognitoFailure(resendError))) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write carrying the ` + safeMsg`pool's SES EmailConfiguration (${describeAwsFailure(echoError).summary}), and the ` + safeMsg`write re-sent without it answered ${describeAwsFailure(resendError).summary}. If ` + safeMsg`that write landed, the pool's email configuration was ${resetClause}`);
 				throw resendError;
 			}
-			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write (possibly the ` + safeMsg`pool's SES EmailConfiguration, ${describeAwsFailure(echoError).summary}), so ` + safeMsg`DeletionProtection was set to ${value} with the pool's other settings but without ` + safeMsg`that EmailConfiguration. Whether that resets the email configuration is not ` + safeMsg`measured; check it with aws cognito-idp describe-user-pool.`);
+			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write (possibly the ` + safeMsg`pool's SES EmailConfiguration, ${describeAwsFailure(echoError).summary}), so ` + safeMsg`DeletionProtection was set to ${value} with the pool's other settings but without ` + safeMsg`that EmailConfiguration. The pool's email configuration was ${resetClause}`);
+			return "without-email";
 		}
 	}
 	async disableUserPoolDeletionProtection(physicalId, pool, flip) {
 		if (this.preFlipPools.get(flip)?.ambiguous) this.preFlipPools.delete(flip);
 		const observedOn = pool.DeletionProtection === "ACTIVE";
 		try {
-			await this.sendEchoedDeletionProtection(physicalId, pool, "INACTIVE");
+			if (await this.sendEchoedDeletionProtection(physicalId, pool, "INACTIVE") === "without-email") this.emailOmittedFlips.set(flip, "definite");
+			else if (echoesDeveloperEmail(pool)) this.emailOmittedFlips.delete(flip);
 			const earlier = this.preFlipPools.get(flip);
 			if (earlier) earlier.echoedSince = true;
 			return;
 		} catch (echoError) {
 			if (echoError instanceof ResourceNotFoundException$11) throw echoError;
+			if (typeof echoError === "object" && echoError !== null && sentWithoutEmail.has(echoError) && isAmbiguousWriteFailure(echoError) && !this.emailOmittedFlips.has(flip)) this.emailOmittedFlips.set(flip, "ambiguous");
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
@@ -30559,7 +30735,7 @@ var CognitoUserPoolProvider = class {
 		const echoClause = echoError === void 0 ? "" : safeMsg`; the pool's own settings sent back were refused first (${describeAwsFailure(echoError).summary})`;
 		this.logger.debug(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${physicalId}: ${describeAwsFailure(error).detail}`);
 		const refused = error instanceof Error && isAwsAuthoredFailure(error);
-		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except possibly the SES EmailConfiguration, which that write omitted.` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
+		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::Cognito::UserPool") return void 0;
@@ -32940,7 +33116,10 @@ var AppSyncProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (apiLeftBehind && createdApiId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+			if (apiLeftBehind && createdApiId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -35693,10 +35872,17 @@ var GlueTriggerProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Trigger ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-delete");
+		let stripped = false;
 		try {
 			try {
 				if ((await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State === "ACTIVATED") {
-					await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					stripped = true;
+					try {
+						await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					} catch (stopError) {
+						if (isRefusedByName(stopError)) stripped = false;
+						throw stopError;
+					}
 					await this.waitForTriggerDeactivated(physicalId);
 				}
 			} catch (err) {
@@ -35711,7 +35897,8 @@ var GlueTriggerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35766,6 +35953,7 @@ var GlueTriggerProvider = class {
 const createKeyLatch = new AmbiguousCreateLatch("CreateKey");
 const keysCreatedByThisProcess = new RecentIdSet();
 const pendingKeys = /* @__PURE__ */ new Map();
+const supersededAttempts = /* @__PURE__ */ new Map();
 const RESUMABLE_KEY_STATES = /* @__PURE__ */ new Set([
 	"Enabled",
 	"Disabled",
@@ -35860,11 +36048,12 @@ var KMSProvider = class {
 			enabled: properties["Enabled"] !== false
 		})).digest("hex");
 		let createdKeyId;
+		let supersededPending = false;
 		try {
 			const resumed = await this.resumeKeyFromFailedAttempt(logicalId, attemptKey, inputDigest);
 			let keyId;
 			let keyArn;
-			if (resumed) ({keyId, keyArn} = resumed);
+			if (resumed && resumed !== "superseded") ({keyId, keyArn} = resumed);
 			else {
 				const orphanWindow = createKeyLatch.take(logicalId);
 				if (orphanWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, orphanWindow);
@@ -35885,6 +36074,9 @@ var KMSProvider = class {
 					heldAtMs: Date.now()
 				});
 				createdKeyId = keyId;
+				const declinedAtMs = supersededAttempts.get(attemptKey);
+				supersededAttempts.delete(attemptKey);
+				supersededPending = declinedAtMs !== void 0 && Date.now() - declinedAtMs <= 18e5;
 				const replayWindow = replayedSendWindow(result, attemptStartMs);
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
@@ -35920,7 +36112,10 @@ var KMSProvider = class {
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-			if (createdKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+			if (createdKeyId !== void 0) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+				if (supersededPending) markSupersedesEarlierCreate(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -35943,6 +36138,8 @@ var KMSProvider = class {
 		const deletion = aws`aws kms schedule-key-deletion --key-id ${pending.keyId}${region} --pending-window-in-days 7`.render();
 		const notReused = (reason) => {
 			this.logger.warn(safeMsg`KMS key ${pending.keyId} was created for ${logicalId} by an earlier attempt of this deploy, but ${reason}, so this attempt creates a new key and that one is not recorded in cdkd state. If it is unused, schedule its deletion with: ${deletion}`);
+			setBounded(supersededAttempts, attemptKey, Date.now());
+			return "superseded";
 		};
 		if (pending.inputDigest !== inputDigest) return notReused("this attempt was asked for a key with different inputs");
 		let metadata;
@@ -40598,7 +40795,10 @@ var EMRClusterProvider = class {
 				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${describeAwsFailure(cleanupError).detail} — terminate it manually to stop billing`);
 			}
 			if (error instanceof ProvisioningError) {
-				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+				if (survivorId !== void 0) {
+					markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+					markNonRetryable(error);
+				}
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -40606,6 +40806,7 @@ var EMRClusterProvider = class {
 			if (survivorId !== void 0) {
 				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+				markNonRetryable(thrown);
 				throw thrown;
 			}
 			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
@@ -41274,7 +41475,27 @@ var EMRInstanceGroupConfigProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
-			if (createdGroupId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdGroupId);
+			let leftBehindGroupId = createdGroupId;
+			if (leftBehindGroupId && properties["InstanceRole"] === "TASK") {
+				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+				try {
+					await this.getClient().send(new ModifyInstanceGroupsCommand({
+						ClusterId: jobFlowId,
+						InstanceGroups: [{
+							InstanceGroupId: leftBehindGroupId,
+							InstanceCount: 0
+						}]
+					}));
+					log.warn(safeMsg`Scaled partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0; EMR has no delete API, so the empty group stays on cluster ${log.value(jobFlowId)} until it terminates`);
+					leftBehindGroupId = void 0;
+				} catch (cleanupError) {
+					log.warn(safeMsg`Failed to scale partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0: ${describeAwsFailure(cleanupError).detail} — its instances are released when the parent cluster terminates`);
+				}
+			}
+			if (leftBehindGroupId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindGroupId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -41580,7 +41801,10 @@ var EMRInstanceFleetConfigProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
-			if (createdFleetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+			if (createdFleetId) {
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+				markNonRetryable(thrown);
+			}
 			throw thrown;
 		}
 	}
@@ -42857,12 +43081,18 @@ var CloudTrailProvider = class {
 			throw new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting CloudTrail Trail ${logicalId}: ${physicalId}`);
+		const recordedIsLogging = properties?.["IsLogging"];
+		const recordedStopped = recordedIsLogging === false || recordedIsLogging === "false";
+		let stripped = false;
 		try {
 			try {
+				stripped = !recordedStopped;
 				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
-			} catch {}
+			} catch (stopError) {
+				if (isRefusedByName(stopError)) stripped = false;
+			}
 			await this.getClient().send(new DeleteTrailCommand({ Name: physicalId }));
 			this.logger.debug(`Successfully deleted CloudTrail Trail ${logicalId}`);
 		} catch (error) {
@@ -42873,7 +43103,8 @@ var CloudTrailProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
 	getAttribute(_physicalId, _resourceType, attributeName) {
@@ -46433,4 +46664,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CVC9_-km.js.map
+//# sourceMappingURL=provider-classes-DzoIZFZK.js.map