@go-to-k/cdkd 0.301.13 → 0.301.15

package/dist/{provider-classes-BUvql6rX.js → provider-classes-CBbWGsK0.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { B as plainIdentOr, F as displayIdent, I as displaySafe, L as displayStackName, R as isPasteableIdent, V as safeMsg, b as generateResourceName, i as safeStringify, k as SECRET_REF_MAX_CODE_POINTS, n as describeAwsFailure, o as getLogger, r as isAwsAuthoredFailure, x as generateResourceNameWithFallback } from "./aws-failure-text-YMKku1DS.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Df2XcLrn.js";
+import { A as SECRET_REF_MAX_CODE_POINTS, H as safeMsg, I as displayIdent, L as displaySafe, R as displayStackName, S as generateResourceNameWithFallback, V as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, r as describeAwsStatusReason, s as getLogger, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dap4bLyq.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-DnImYUXS.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-kw3QPlJV.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DJGAVTCe.js";
-import { RDSProvider } from "./rds-provider-CybUrptt.js";
-import { NeptuneProvider } from "./neptune-provider-I_6jHlEU.js";
-import { ASGProvider } from "./asg-provider-CTocGE6p.js";
+import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-Dy7N7-Il.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8Icvrf7.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CXvao3wc.js";
+import { RDSProvider } from "./rds-provider-BMQvQTTS.js";
+import { NeptuneProvider } from "./neptune-provider-CtnwSAGM.js";
+import { ASGProvider } from "./asg-provider-ClDYCUia.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, DisabledException, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
@@ -8789,8 +8789,12 @@ var LambdaUrlProvider = class {
 	operationSinks(maskSecrets, pairs) {
 		return withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, maskSecrets), pairs);
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(log.mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		return markRedactedCause(build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const targetFunctionArn = properties["TargetFunctionArn"];
@@ -8821,7 +8825,7 @@ var LambdaUrlProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, targetFunctionArn, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, targetFunctionArn, cause));
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -8887,23 +8891,24 @@ var LambdaUrlProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting Lambda URL ${logicalId}: ${physicalId}`);
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const log = this.operationSinks(context?.maskSecrets, [[properties?.["TargetFunctionArn"], physicalId], [properties?.["TargetFunctionArn"], lambdaFunctionNameForMask(physicalId)]]);
+		log.debug(`Deleting Lambda URL ${logicalId}: ${physicalId}`);
 		try {
 			await this.lambdaClient.send(new DeleteFunctionUrlConfigCommand({ FunctionName: physicalId }));
-			this.logger.debug(`Successfully deleted Lambda URL ${logicalId}`);
+			log.debug(`Successfully deleted Lambda URL ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
 				const clientRegion = await this.lambdaClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Lambda URL ${physicalId} does not exist, skipping deletion`);
+				log.debug(`Lambda URL ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda URL ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -9129,6 +9134,14 @@ const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = /* @__PURE__ */ new Set([
 	"dynamodb"
 ]);
 const KINDS_WITH_STREAM_NUMERICS = /* @__PURE__ */ new Set(["kinesis", "dynamodb"]);
+const DEFAULT_BATCH_SIZE_BY_KIND = /* @__PURE__ */ new Map([
+	["sqs", 10],
+	["kinesis", 100],
+	["dynamodb", 100],
+	["kafka", 100],
+	["mq", 100],
+	["documentdb", 100]
+]);
 var LambdaEventSourceMappingProvider = class {
 	lambdaClient;
 	createClient;
@@ -9185,8 +9198,12 @@ var LambdaEventSourceMappingProvider = class {
 		}
 		return withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, maskSecrets), pairs);
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(log.mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		return markRedactedCause(build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = this.operationSinks(context?.maskSecrets, properties);
@@ -9257,7 +9274,7 @@ var LambdaEventSourceMappingProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create event source mapping ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create event source mapping ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async reportPossibleMappingOrphans(logicalId, window, log, functionName, sourceArn) {
@@ -9297,7 +9314,7 @@ var LambdaEventSourceMappingProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, context) {
@@ -9344,6 +9361,14 @@ var LambdaEventSourceMappingProvider = class {
 			if (wasSet("TumblingWindowInSeconds")) updateParams.TumblingWindowInSeconds = 0;
 		}
 		if (wasSet("MaximumBatchingWindowInSeconds") && KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT.has(prevKind)) updateParams.MaximumBatchingWindowInSeconds = 0;
+		if (wasSet("BatchSize")) {
+			const defaultBatchSize = DEFAULT_BATCH_SIZE_BY_KIND.get(prevKind);
+			if (defaultBatchSize !== void 0) updateParams.BatchSize = defaultBatchSize;
+		}
+		if (prevKind === "kafka") {
+			if (wasSet("LoggingConfig")) updateParams.LoggingConfig = {};
+			if (wasSet("ProvisionedPollerConfig")) updateParams.ProvisionedPollerConfig = {};
+		}
 		const updateResp = await this.lambdaClient.send(new UpdateEventSourceMappingCommand(updateParams));
 		const eventSourceMappingArn = updateResp.EventSourceMappingArn;
 		if (eventSourceMappingArn) await this.applyTagDiff(eventSourceMappingArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
@@ -9378,7 +9403,7 @@ var LambdaEventSourceMappingProvider = class {
 			log.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on EventSourceMapping ${arn}`);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting event source mapping ${logicalId}: ${physicalId}`);
 		try {
 			try {
@@ -9402,7 +9427,7 @@ var LambdaEventSourceMappingProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete event source mapping ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(this.operationSinks(context?.maskSecrets, properties ?? {}), error, (text) => new ProvisioningError(`Failed to delete event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -9939,7 +9964,7 @@ var LambdaMicrovmImageProvider = class {
 	getMinResourceTimeoutMs() {
 		return this.maxPollAttempts * this.pollIntervalMs;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		this.logger.debug(`Creating MicroVM image ${logicalId}`);
 		const name = properties["Name"];
@@ -9988,7 +10013,7 @@ var LambdaMicrovmImageProvider = class {
 				})
 			};
 		} catch (error) {
-			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error, context?.maskSecrets);
 			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
 			throw thrown;
 		}
@@ -10046,7 +10071,7 @@ var LambdaMicrovmImageProvider = class {
 				})
 			};
 		} catch (error) {
-			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -10066,7 +10091,7 @@ var LambdaMicrovmImageProvider = class {
 			await this.waitForDeleted(physicalId, logicalId);
 			this.logger.debug(`Successfully deleted MicroVM image ${logicalId}`);
 		} catch (error) {
-			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -10173,10 +10198,15 @@ var LambdaMicrovmImageProvider = class {
 			Tags: tagsToAdd
 		}));
 	}
-	wrapError(operation, logicalId, resourceType, physicalId, error) {
+	wrapError(operation, logicalId, resourceType, physicalId, error, mask) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} MicroVM image ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} MicroVM image ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 };
 const BUILD_AFFECTING_CFN_KEYS = [
@@ -10352,16 +10382,16 @@ var LambdaWebFunctionRevisionProvider = class {
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, replayWindow, log, input.functionName);
 			if (!createdArn || !response.revisionId) throw new ProvisioningError(`CreateWebFunctionRevision succeeded but returned no revision ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
-			const active = await this.waitForActive(input.functionName, createdArn, logicalId);
+			const active = await this.waitForActive(input.functionName, createdArn, logicalId, resourceType, log.mask);
 			return {
 				physicalId: createdArn,
 				attributes: buildAttributes$2(active)
 			};
 		} catch (error) {
-			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error, log.mask);
 			let leftBehindArn = createdArn;
 			if (leftBehindArn) try {
-				await this.delete(logicalId, leftBehindArn, resourceType);
+				await this.delete(logicalId, leftBehindArn, resourceType, void 0, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 				leftBehindArn = void 0;
 			} catch (cleanupError) {
 				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
@@ -10430,7 +10460,7 @@ var LambdaWebFunctionRevisionProvider = class {
 			}
 			await this.waitForGone(parts.functionArn, physicalId, logicalId);
 		} catch (error) {
-			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -10563,7 +10593,7 @@ var LambdaWebFunctionRevisionProvider = class {
 		}
 		return out;
 	}
-	async waitForActive(functionName, revisionArn, logicalId) {
+	async waitForActive(functionName, revisionArn, logicalId, resourceType, mask) {
 		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
 			const resp = await this.client.send(new GetWebFunctionRevisionCommand({
 				functionName,
@@ -10571,8 +10601,12 @@ var LambdaWebFunctionRevisionProvider = class {
 			}));
 			if (resp.state === "Active") return resp;
 			if (resp.state === "Failed") {
-				const errors = (resp.errors ?? []).map((e) => `${e.errorCode ?? ""} ${e.errorMessage ?? ""}`.trim());
-				throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}` + (errors.length > 0 ? ` (${errors.join("; ")})` : ""));
+				const errors = (resp.errors ?? []).map((e) => `${e.errorCode ?? ""} ${e.errorMessage ?? ""}`.trim()).filter((e) => e !== "");
+				const reasonText = resp.stateReason || errors.length > 0 ? `${resp.stateReason || "no reason given"}` + (errors.length > 0 ? ` (${errors.join("; ")})` : "") : void 0;
+				throw this.wrapStatusReasonError(mask, {
+					code: resp.errors?.find((e) => e.errorCode)?.errorCode,
+					message: reasonText
+				}, (text, cause) => new ProvisioningError(`Lambda web function revision ${logicalIdShown(logicalId)} entered Failed: ${text}`, resourceType, logicalId, revisionArn, cause));
 			}
 			await sleep$1(500);
 		}
@@ -10593,10 +10627,23 @@ var LambdaWebFunctionRevisionProvider = class {
 		}
 		throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
 	}
-	wrapError(operation, logicalId, resourceType, physicalId, error) {
+	wrapStatusReasonError(mask, reason, build) {
+		const text = describeAwsStatusReason(reason, "no reason given");
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = mask ?? ((value) => value);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error, mask) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} Lambda web function revision ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} Lambda web function revision ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 };
 function buildAttributes$2(resp) {
@@ -10713,13 +10760,13 @@ var LambdaWebFunctionEndpointProvider = class {
 		try {
 			createdArn = (await this.client.send(new CreateWebFunctionEndpointCommand(input))).endpointArn;
 			if (!createdArn) throw new ProvisioningError(`CreateWebFunctionEndpoint succeeded but returned no endpoint ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
-			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, "create");
+			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, resourceType, "create", void 0, context?.maskSecrets);
 			return {
 				physicalId: createdArn,
 				attributes: buildAttributes$1(settled)
 			};
 		} catch (error) {
-			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error, context?.maskSecrets);
 			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
 			throw thrown;
 		}
@@ -10753,10 +10800,10 @@ var LambdaWebFunctionEndpointProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: buildAttributes$1(await this.waitForSettled(parts.functionArn, parts.childId, logicalId, "update", input.revisionWeights))
+				attributes: buildAttributes$1(await this.waitForSettled(parts.functionArn, parts.childId, logicalId, resourceType, "update", input.revisionWeights, context?.maskSecrets, physicalId))
 			};
 		} catch (error) {
-			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -10779,7 +10826,7 @@ var LambdaWebFunctionEndpointProvider = class {
 			}
 			await this.waitForGone(parts.functionArn, parts.childId, logicalId);
 		} catch (error) {
-			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -10876,7 +10923,7 @@ var LambdaWebFunctionEndpointProvider = class {
 			n
 		};
 	}
-	async waitForSettled(functionName, endpointName, logicalId, operation, sentWeights) {
+	async waitForSettled(functionName, endpointName, logicalId, resourceType, operation, sentWeights, mask, physicalId) {
 		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
 			let resp;
 			try {
@@ -10891,8 +10938,8 @@ var LambdaWebFunctionEndpointProvider = class {
 				}
 				throw error;
 			}
-			if (resp.state === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}`);
-			if (resp.updateStatus === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} ${operation} failed: ${resp.updateStatusReason ?? "no reason given"}`);
+			if (resp.state === "Failed") throw this.wrapStatusReasonError(mask, { message: resp.stateReason }, (text, cause) => new ProvisioningError(`Lambda web function endpoint ${logicalIdShown(logicalId)} entered Failed: ${text}`, resourceType, logicalId, physicalId, cause));
+			if (resp.updateStatus === "Failed") throw this.wrapStatusReasonError(mask, { message: resp.updateStatusReason }, (text, cause) => new ProvisioningError(`Lambda web function endpoint ${logicalIdShown(logicalId)} ${operation} failed: ${text}`, resourceType, logicalId, physicalId, cause));
 			if (resp.state === "Active" && resp.updateStatus !== "InProgress" && (sentWeights === void 0 || sameWeights(sentWeights, resp.revisionWeights))) return resp;
 			await sleep$1(500);
 		}
@@ -10913,10 +10960,23 @@ var LambdaWebFunctionEndpointProvider = class {
 		}
 		throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
 	}
-	wrapError(operation, logicalId, resourceType, physicalId, error) {
+	wrapStatusReasonError(mask, reason, build) {
+		const text = describeAwsStatusReason(reason, "no reason given");
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = mask ?? ((value) => value);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error, mask) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} Lambda web function endpoint ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} Lambda web function endpoint ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 };
 function readRevisionWeights(value, fail) {
@@ -15969,7 +16029,7 @@ var EC2Provider = class {
 		])],
 		["AWS::EC2::SubnetNetworkAclAssociation", /* @__PURE__ */ new Set(["SubnetId", "NetworkAclId"])]
 	]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])], ["AWS::EC2::Instance", /* @__PURE__ */ new Map([["Monitoring", false]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([
 		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
 		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
@@ -16145,7 +16205,7 @@ var EC2Provider = class {
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.replayingState === true, context?.recordedAttributes);
-			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NetworkAclEntry": return this.updateNetworkAclEntry(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NetworkAcl":
 			case "AWS::EC2::SubnetNetworkAclAssociation": throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS provides no in-place Update API for this EC2 sub-resource type; every property change requires Delete + Create. Re-deploy with cdkd deploy --replace, or destroy + redeploy.");
@@ -17914,9 +17974,10 @@ var EC2Provider = class {
 	isInstanceProfilePropagationError(msg) {
 		return msg.includes("Invalid IAM Instance Profile") || msg.includes("NoSuchEntity") || msg.includes("not authorized") || msg.includes("InvalidParameterValue") && msg.includes("instance profile");
 	}
-	async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		this.guardTerminationProtectionRemoval(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		try {
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			await this.updateInstanceSecurityProps(physicalId, properties, previousProperties);
@@ -17931,6 +17992,14 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	guardTerminationProtectionRemoval(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (!(context?.removedProperties !== void 0 ? context.removedProperties.has("DisableApiTermination") : previousProperties["DisableApiTermination"] !== void 0 && properties["DisableApiTermination"] === void 0)) return;
+		if (context?.replayingState === true) {
+			if (this.coerceBool(previousProperties["DisableApiTermination"]) === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare DisableApiTermination; the rollback leaves termination protection at its current AWS value. Set DisableApiTermination to false to turn termination protection off.`);
+			return;
+		}
+		throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): DisableApiTermination was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared, and set it to false to turn termination protection off. The instance was not updated.`, resourceType, logicalId, physicalId));
+	}
 	async updateInstanceSecurityProps(physicalId, properties, previousProperties) {
 		const newDisableApiTermination = this.coerceBool(properties["DisableApiTermination"]);
 		const oldDisableApiTermination = this.coerceBool(previousProperties["DisableApiTermination"]);
@@ -19480,6 +19549,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		])]
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"], ["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"]])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGateway::Account", /* @__PURE__ */ new Map([["CloudWatchRoleArn", ""]])]]);
 	static MAX_IAM_RETRIES = 3;
 	static IAM_RETRY_DELAY_MS = 1e4;
 	constructor() {
@@ -19528,7 +19598,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		switch (resourceType) {
-			case "AWS::ApiGateway::Account": return this.updateAccount(logicalId, physicalId, resourceType, properties, log);
+			case "AWS::ApiGateway::Account":
+				properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+				return this.updateAccount(logicalId, physicalId, resourceType, properties, log);
 			case "AWS::ApiGateway::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGateway::Resource": return this.updateResource(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGateway::Deployment": return this.updateDeployment(logicalId, physicalId, resourceType);
@@ -20849,6 +20921,7 @@ var ApiGatewayV2Provider = class {
 			"IdentityValidationExpression"
 		])]
 	]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Map([["IdentitySource", []]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Map([
 		["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 		["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
@@ -20905,9 +20978,9 @@ var ApiGatewayV2Provider = class {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true, context);
 			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
-			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log, context);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
 		}
 	}
@@ -21669,7 +21742,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false, context) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -21732,7 +21805,32 @@ var ApiGatewayV2Provider = class {
 			input.IntegrationSubtype = properties["IntegrationSubtype"];
 			changed = true;
 		}
-		if (input.IntegrationSubtype === void 0) {
+		const subtypeRemoved = context?.removedProperties !== void 0 ? context.removedProperties.has("IntegrationSubtype") : previousProperties["IntegrationSubtype"] != null && properties["IntegrationSubtype"] == null;
+		let effectiveProperties;
+		if (subtypeRemoved && (context?.replayingState !== true || properties["IntegrationUri"] != null)) {
+			if (properties["IntegrationUri"] == null) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): the previous deploy recorded IntegrationSubtype and this template does not declare it. CloudFormation fails that update (AWS refuses a service integration without its subtype: Invalid integration URI specified). Keep IntegrationSubtype declared, or declare an IntegrationUri to turn this into a URI-based integration. The integration was not updated.`, resourceType, logicalId, physicalId));
+			input.IntegrationUri = properties["IntegrationUri"];
+			changed = true;
+		} else if (subtypeRemoved) {
+			let liveSubtype;
+			try {
+				liveSubtype = (await this.getClient().send(new GetIntegrationCommand({
+					ApiId: apiId,
+					IntegrationId: physicalId
+				}))).IntegrationSubtype;
+			} catch (error) {
+				const cause = error instanceof Error ? error : void 0;
+				throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to read API Gateway V2 Integration ${logicalId} before restoring it: ${text}`, resourceType, logicalId, physicalId, cause));
+			}
+			if (liveSubtype) {
+				input.IntegrationSubtype = liveSubtype;
+				effectiveProperties = {
+					...properties,
+					IntegrationSubtype: liveSubtype
+				};
+				log.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare IntegrationSubtype; the rollback keeps the integration's current subtype, because AWS refuses a service integration without it.`);
+			}
+		} else if (input.IntegrationSubtype === void 0) {
 			const liveSubtype = properties["IntegrationSubtype"] ?? previousProperties["IntegrationSubtype"];
 			if (liveSubtype !== void 0) input.IntegrationSubtype = liveSubtype;
 		}
@@ -21757,11 +21855,13 @@ var ApiGatewayV2Provider = class {
 			input.TlsConfig = properties["TlsConfig"];
 			changed = true;
 		}
+		if (changed && input.IntegrationSubtype !== void 0) input.RequestParameters = this.serviceIntegrationParameters(logicalId, physicalId, resourceType, input.RequestParameters ?? properties["RequestParameters"]);
 		if (!changed) {
 			log.debug(`No mutable Integration fields changed for ${logicalId}; skipping UpdateIntegration`);
 			return {
 				physicalId,
-				wasReplaced: false
+				wasReplaced: false,
+				...effectiveProperties && { effectiveProperties }
 			};
 		}
 		log.debug(`Updating API Gateway V2 Integration ${logicalId}: ${physicalId}`);
@@ -21769,7 +21869,8 @@ var ApiGatewayV2Provider = class {
 			await this.getClient().send(new UpdateIntegrationCommand(input));
 			return {
 				physicalId,
-				wasReplaced: false
+				wasReplaced: false,
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -21874,7 +21975,8 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Route ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log, context) {
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Authorizer ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Authorizer; re-deploy with cdkd deploy --replace");
@@ -21946,6 +22048,15 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Authorizer ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	serviceIntegrationParameters(logicalId, physicalId, resourceType, sent) {
+		if (sent == null) return void 0;
+		const redacted = Object.keys(sent).filter((key) => {
+			const value = sent[key];
+			return typeof value === "string" && (dynamicReferenceTokens(value).length > 0 || value === "***");
+		});
+		if (redacted.length > 0) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): this update must re-send the service integration's RequestParameters (AWS re-validates the full mapping beside IntegrationSubtype), but the value of ${redacted.join(", ")} is a redacted secret reference that cdkd cannot send. The integration was not updated.`, resourceType, logicalId, physicalId));
+		return sent;
+	}
 	clearableUpdate(next, previous, resetValue) {
 		const resolved = next !== void 0 ? next : previous !== void 0 ? resetValue : void 0;
 		return {
@@ -23397,6 +23508,14 @@ var AgentCoreEvaluatorProvider = class {
 		"KmsKeyArn",
 		"Tags"
 	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Set([
+		"EvaluatorName",
+		"EvaluatorConfig",
+		"Level",
+		"Description",
+		"KmsKeyArn",
+		"Tags"
+	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.client = awsClients.bedrockAgentCoreControl;
@@ -25485,7 +25604,7 @@ const CLEARED_BY_TLS_DOWNGRADE = /* @__PURE__ */ new Set(["SslPolicy", "Certific
 const listenerLeftInPlaceWarning = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyListener keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyListener keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 var ELBv2Provider = class {
 	elbv2Client;
@@ -28645,6 +28764,10 @@ function templateZoneVisibility(properties) {
 	if (!Array.isArray(vpcs)) return void 0;
 	return vpcs.some((v) => typeof v === "object" && v !== null && !Array.isArray(v) && !isIntrinsicOnly(v)) ? true : void 0;
 }
+const VPCS_KEPT_ON_REMOVAL_NOTE = "A private hosted zone stays private and keeps at least one VPC; to change its associations, declare the VPCs you want and deploy.";
+function declaresNoVpcs(vpcs) {
+	return vpcs == null || Array.isArray(vpcs) && vpcs.length === 0;
+}
 function sentence$1(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -28725,7 +28848,7 @@ var Route53Provider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context);
 			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -28870,7 +28993,7 @@ var Route53Provider = class {
 			} : void 0;
 		}
 	}
-	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask, context) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
 			const hostedZoneConfig = properties["HostedZoneConfig"];
@@ -28890,6 +29013,7 @@ var Route53Provider = class {
 			}));
 			const nameServers = (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully updated hosted zone ${logicalId}`);
+			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -31608,6 +31732,10 @@ var ElastiCacheProvider = class {
 //#region src/provisioning/providers/servicediscovery-provider.ts
 const PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL = 60;
 const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
+const CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES = 9;
+const CREATE_SERVICE_NAMESPACE_LAG_INITIAL_DELAY_MS = 500;
+const CREATE_SERVICE_NAMESPACE_LAG_MAX_DELAY_MS = 4e3;
+const CREATE_SERVICE_NAMESPACE_LAG_BACKOFF_SECONDS = Array.from({ length: CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES }, (_, i) => Math.min(CREATE_SERVICE_NAMESPACE_LAG_INITIAL_DELAY_MS * 2 ** i, CREATE_SERVICE_NAMESPACE_LAG_MAX_DELAY_MS)).reduce((a, b) => a + b, 0) / 1e3;
 const NAMESPACE_TYPES = [
 	"AWS::ServiceDiscovery::PrivateDnsNamespace",
 	"AWS::ServiceDiscovery::HttpNamespace",
@@ -31618,6 +31746,19 @@ const NAMESPACE_KIND_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::ServiceDiscovery::PublicDnsNamespace", "DNS_PUBLIC"],
 	["AWS::ServiceDiscovery::HttpNamespace", "HTTP"]
 ]);
+function sameAsRecorded(desired, recorded) {
+	if (typeof recorded === "string" && isRecordedStandIn(recorded)) return false;
+	if (Array.isArray(desired) && Array.isArray(recorded)) return desired.length === recorded.length && desired.every((item, i) => sameAsRecorded(item, recorded[i]));
+	if (desired !== null && recorded !== null && typeof desired === "object" && typeof recorded === "object" && !Array.isArray(desired) && !Array.isArray(recorded)) {
+		const d = desired;
+		const r = recorded;
+		return [.../* @__PURE__ */ new Set([...Object.keys(d), ...Object.keys(r)])].every((key) => Object.hasOwn(d, key) === Object.hasOwn(r, key) && sameAsRecorded(d[key], r[key]));
+	}
+	return isDeepStrictEqual(desired, recorded);
+}
+function isRecordedStandIn(value) {
+	return dynamicReferenceTokens(value).length > 0 || value.includes("***");
+}
 const NAMESPACE_ID_PATTERN = /^ns-[a-z0-9]{16}$/;
 const SERVICE_ID_PATTERN = /^srv-[a-z0-9]{16}$/;
 var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
@@ -31669,6 +31810,17 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			"Name",
 			"Tags",
 			"Properties"
+		])],
+		["AWS::ServiceDiscovery::Service", /* @__PURE__ */ new Set([
+			"Name",
+			"NamespaceId",
+			"Type",
+			"HealthCheckCustomConfig",
+			"Tags",
+			"ServiceAttributes",
+			"Description",
+			"DnsConfig",
+			"HealthCheckConfig"
 		])]
 	]);
 	getClient() {
@@ -31970,16 +32122,31 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		if (!name) throw new ProvisioningError(`Name is required for ServiceDiscovery Service ${logicalId}`, resourceType, logicalId);
 		let leftBehindServiceId;
 		try {
-			const service = (await client.send(new CreateServiceCommand$1({
-				Name: name,
-				...namespaceId && { NamespaceId: namespaceId },
-				...description && { Description: description },
-				...dnsConfig && { DnsConfig: dnsConfig },
-				...healthCheckCustomConfig && { HealthCheckCustomConfig: healthCheckCustomConfig },
-				...healthCheckConfig && { HealthCheckConfig: healthCheckConfig },
-				...tags.length > 0 && { Tags: tags },
-				...type && { Type: type }
-			}))).Service;
+			const watch = startInterruptWatch(`Cloud Map service ${logicalId}`);
+			let response;
+			try {
+				response = await withRetry(() => client.send(new CreateServiceCommand$1({
+					Name: name,
+					...namespaceId && { NamespaceId: namespaceId },
+					...description && { Description: description },
+					...dnsConfig && { DnsConfig: dnsConfig },
+					...healthCheckCustomConfig && { HealthCheckCustomConfig: healthCheckCustomConfig },
+					...healthCheckConfig && { HealthCheckConfig: healthCheckConfig },
+					...tags.length > 0 && { Tags: tags },
+					...type && { Type: type }
+				})), logicalId, {
+					maxRetries: CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES,
+					initialDelayMs: CREATE_SERVICE_NAMESPACE_LAG_INITIAL_DELAY_MS,
+					maxDelayMs: CREATE_SERVICE_NAMESPACE_LAG_MAX_DELAY_MS,
+					isRetryable: (_text, error) => error instanceof NamespaceNotFound,
+					logger: this.maskedRetryLogger(maskSecrets),
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted
+				});
+			} finally {
+				watch.dispose();
+			}
+			const service = response.Service;
 			if (!service || !service.Id) throw new Error("CreateService did not return Service ID");
 			const serviceId = service.Id;
 			leftBehindServiceId = serviceId;
@@ -32023,7 +32190,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const retriedNote = error instanceof NamespaceNotFound ? ` (Cloud Map still rejected the namespace after ${CREATE_SERVICE_NAMESPACE_LAG_BACKOFF_SECONDS}s of retries)` : "";
+			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${text}${retriedNote}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindServiceId) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindServiceId);
 			throw thrown;
 		}
@@ -32032,17 +32200,14 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const client = this.getClient();
-		const serviceChange = {};
-		if (properties["Description"] !== void 0) serviceChange.Description = properties["Description"];
-		const dnsConfig = properties["DnsConfig"];
-		if (dnsConfig?.DnsRecords !== void 0) serviceChange.DnsConfig = { DnsRecords: dnsConfig.DnsRecords };
-		if (properties["HealthCheckConfig"] !== void 0) serviceChange.HealthCheckConfig = properties["HealthCheckConfig"];
+		const servicePlan = this.planServiceChange(properties, previousProperties);
+		const serviceChange = servicePlan?.change ?? {};
 		const newAttrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 		const oldAttrs = this.normalizeServiceAttributes(previousProperties["ServiceAttributes"]);
 		const upsertAttrs = {};
 		for (const [k, v] of Object.entries(newAttrs)) if (oldAttrs[k] !== v) upsertAttrs[k] = v;
 		const removedAttrKeys = Object.keys(oldAttrs).filter((k) => !Object.hasOwn(newAttrs, k));
-		const hasServiceChange = Object.keys(serviceChange).length > 0;
+		const hasServiceChange = servicePlan !== void 0;
 		const hasAttrUpsert = Object.keys(upsertAttrs).length > 0;
 		const hasAttrRemove = removedAttrKeys.length > 0;
 		const tagPlan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
@@ -32056,8 +32221,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				wasReplaced: false
 			};
 		}
+		let knownArn;
 		try {
 			if (hasServiceChange) {
+				if (servicePlan.keepRemovedFromLive) knownArn = await this.keepUndeclaredServiceFields(physicalId, serviceChange);
 				const operationId = (await client.send(new UpdateServiceCommand$1({
 					Id: physicalId,
 					Service: serviceChange
@@ -32094,7 +32261,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}
 			}
 			if (hasTagChange) {
-				const arn = (await client.send(new GetServiceCommand({ Id: physicalId }))).Service?.Arn;
+				const arn = knownArn ?? (await client.send(new GetServiceCommand({ Id: physicalId }))).Service?.Arn;
 				if (!arn) throw new ProvisioningError(safeMsg`Could not resolve the ARN of service discovery service ${logicalId}; its Tags were not updated`, resourceType, logicalId, physicalId);
 				if (tagPlan.remove.length > 0) await client.send(new UntagResourceCommand$16({
 					ResourceARN: arn,
@@ -32119,6 +32286,30 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	planServiceChange(properties, previousProperties) {
+		const declaredDiffers = (key) => properties[key] !== void 0 && !sameAsRecorded(properties[key], previousProperties[key]);
+		const change = {};
+		if (properties["Description"] !== void 0) change.Description = properties["Description"];
+		const desiredRecords = properties["DnsConfig"]?.DnsRecords;
+		const previousRecords = previousProperties["DnsConfig"]?.DnsRecords;
+		if (desiredRecords !== void 0) change.DnsConfig = { DnsRecords: desiredRecords };
+		if (properties["HealthCheckConfig"] !== void 0) change.HealthCheckConfig = properties["HealthCheckConfig"];
+		if (declaredDiffers("Description") || declaredDiffers("HealthCheckConfig")) return {
+			change,
+			keepRemovedFromLive: false
+		};
+		if (desiredRecords !== void 0 && !sameAsRecorded(desiredRecords, previousRecords)) return {
+			change,
+			keepRemovedFromLive: true
+		};
+	}
+	async keepUndeclaredServiceFields(physicalId, serviceChange) {
+		if (serviceChange.Description !== void 0 && serviceChange.HealthCheckConfig !== void 0) return;
+		const live = (await this.getClient().send(new GetServiceCommand({ Id: physicalId }))).Service;
+		if (serviceChange.Description === void 0 && live?.Description !== void 0) serviceChange.Description = live.Description;
+		if (serviceChange.HealthCheckConfig === void 0 && live?.HealthCheckConfig !== void 0) serviceChange.HealthCheckConfig = live.HealthCheckConfig;
+		return live?.Arn;
+	}
 	async deleteService(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting service discovery service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
@@ -36319,6 +36510,7 @@ var KMSProvider = class {
 		"Origin",
 		"BypassPolicyLockoutSafetyCheck"
 	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::KMS::Key", /* @__PURE__ */ new Map([["RotationPeriodInDays", 365]])]]);
 	getClient() {
 		if (!this.client) this.client = new KMSClient({
 			...ambientClientDefaults(),
@@ -36343,7 +36535,7 @@ var KMSProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		switch (resourceType) {
-			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context?.maskSecrets);
+			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context);
 			case "AWS::KMS::Alias": return this.updateAlias(logicalId, physicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -36362,7 +36554,7 @@ var KMSProvider = class {
 		const keyPolicy = properties["KeyPolicy"];
 		const keySpec = properties["KeySpec"];
 		const keyUsage = properties["KeyUsage"];
-		const enableKeyRotation = properties["EnableKeyRotation"];
+		const enableKeyRotation = templateBool(properties["EnableKeyRotation"]);
 		const multiRegion = properties["MultiRegion"];
 		const origin = properties["Origin"];
 		const bypassPolicyLockoutSafetyCheck = properties["BypassPolicyLockoutSafetyCheck"];
@@ -36383,7 +36575,7 @@ var KMSProvider = class {
 		const inputDigest = createHash("sha256").update(JSON.stringify({
 			input,
 			enableKeyRotation: enableKeyRotation === true,
-			enabled: properties["Enabled"] !== false
+			enabled: templateBool(properties["Enabled"]) !== false
 		})).digest("hex");
 		let createdKeyId;
 		let supersededPending = false;
@@ -36419,7 +36611,7 @@ var KMSProvider = class {
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
 			createdKeyId = keyId;
-			if (enableKeyRotation) {
+			if (enableKeyRotation === true) {
 				const rotationPeriodInDays = properties["RotationPeriodInDays"];
 				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
 				await this.getClient().send(new EnableKeyRotationCommand({
@@ -36427,7 +36619,7 @@ var KMSProvider = class {
 					...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
 				}));
 			}
-			if (properties["Enabled"] === false) {
+			if (templateBool(properties["Enabled"]) === false) {
 				this.logger.debug(`Disabling KMS Key ${logicalId}`);
 				await this.getClient().send(new DisableKeyCommand({ KeyId: keyId }));
 			}
@@ -36567,9 +36759,13 @@ var KMSProvider = class {
 		const deletion = shown.map((keyId) => aws`aws kms schedule-key-deletion --key-id ${keyId}${region} --pending-window-in-days 7`.render()).join(" ; ");
 		this.logger.warn(safeMsg`${lead}, and KMS may have created a key then that no cdkd state records. ${candidates.length} customer managed key(s) created between ${since} and ${until} match this key's settings: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them, because a key has no name or token that ties it to ${logicalId} -- another key with the same settings is indistinguishable. ${window.replayedInSend === true ? "cdkd recorded the key the create returned, so the orphan (if any) and that key both exist." : "Creating a new key now, so the orphan (if any) and the new key will both exist."} First inspect each candidate: ${inspect}. Only after confirming a key is this deploy's orphan and no other deploy uses it, schedule its deletion: ${deletion}.${incomplete}`);
 	}
-	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating KMS Key ${logicalId}: ${physicalId}`);
+		const mask = context?.maskSecrets;
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const newEnabled = templateBool(properties["Enabled"]);
+		const enabledChange = newEnabled === templateBool(previousProperties["Enabled"]) ? void 0 : newEnabled === false ? "disable" : "enable";
 		try {
 			const newDescription = properties["Description"];
 			if (newDescription !== previousProperties["Description"]) {
@@ -36579,41 +36775,49 @@ var KMSProvider = class {
 					Description: newDescription ?? ""
 				}));
 			}
-			const newEnableKeyRotation = properties["EnableKeyRotation"];
-			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) {
-				if (newEnableKeyRotation) {
-					const rotationPeriodInDays = properties["RotationPeriodInDays"];
+			if (enabledChange === "enable") {
+				this.logger.debug(`Enabling KMS Key ${logicalId}`);
+				await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+			}
+			const newEnableKeyRotation = templateBool(properties["EnableKeyRotation"]);
+			const oldEnableKeyRotation = templateBool(previousProperties["EnableKeyRotation"]);
+			const rotationPeriodInDays = properties["RotationPeriodInDays"];
+			if (newEnableKeyRotation === true) {
+				if (newEnableKeyRotation !== oldEnableKeyRotation || rotationPeriodInDays !== void 0 && rotationPeriodInDays !== previousProperties["RotationPeriodInDays"]) {
 					this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
-					await this.getClient().send(new EnableKeyRotationCommand({
+					await this.sendRotation(() => this.getClient().send(new EnableKeyRotationCommand({
 						KeyId: physicalId,
 						...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
-					}));
-				} else {
-					this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
-					await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+					})), enabledChange === "enable", resourceType, logicalId, physicalId);
 				}
+			} else if (newEnableKeyRotation !== oldEnableKeyRotation) {
+				this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
+				await this.sendRotation(() => this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId })), enabledChange === "enable", resourceType, logicalId, physicalId);
 			}
-			const newEnabled = properties["Enabled"];
-			if (newEnabled !== previousProperties["Enabled"]) {
-				if (newEnabled === false) {
-					this.logger.debug(`Disabling KMS Key ${logicalId}`);
-					await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
-				} else {
-					this.logger.debug(`Enabling KMS Key ${logicalId}`);
-					await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
-				}
+			if (enabledChange === "disable") {
+				this.logger.debug(`Disabling KMS Key ${logicalId}`);
+				await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const newKeyPolicy = properties["KeyPolicy"];
 			const oldKeyPolicy = previousProperties["KeyPolicy"];
 			const newPolicyStr = newKeyPolicy ? typeof newKeyPolicy === "string" ? newKeyPolicy : JSON.stringify(newKeyPolicy) : void 0;
-			if (newPolicyStr !== (oldKeyPolicy ? typeof oldKeyPolicy === "string" ? oldKeyPolicy : JSON.stringify(oldKeyPolicy) : void 0) && newPolicyStr) {
+			const oldPolicyStr = oldKeyPolicy ? typeof oldKeyPolicy === "string" ? oldKeyPolicy : JSON.stringify(oldKeyPolicy) : void 0;
+			const policyRemoved = context?.removedProperties !== void 0 ? context.removedProperties.has("KeyPolicy") : oldKeyPolicy !== void 0 && newKeyPolicy === void 0;
+			if (newPolicyStr !== oldPolicyStr && newPolicyStr) {
 				this.logger.debug(`Updating key policy for KMS Key ${logicalId}`);
 				await this.getClient().send(new PutKeyPolicyCommand({
 					KeyId: physicalId,
 					PolicyName: "default",
 					Policy: newPolicyStr
 				}));
+			} else if (policyRemoved && newKeyPolicy === void 0) {
+				this.logger.debug(safeMsg`Resetting key policy for KMS Key ${logicalId} to the default`);
+				await this.getClient().send(new PutKeyPolicyCommand({
+					KeyId: physicalId,
+					PolicyName: "default",
+					Policy: await this.defaultKeyPolicy(physicalId)
+				}));
 			}
 			this.logger.debug(`Successfully updated KMS Key ${logicalId}`);
 			return {
@@ -36621,10 +36825,35 @@ var KMSProvider = class {
 				wasReplaced: false
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async sendRotation(send, justEnabled, resourceType, logicalId, physicalId) {
+		try {
+			await send();
+		} catch (error) {
+			if (!(error instanceof DisabledException) || justEnabled) throw error;
+			throw markNonRetryable(new ProvisioningError(safeMsg`Failed to update KMS Key ${logicalId}: the key is currently disabled in AWS, and KMS refuses a key rotation change on a disabled key (CloudFormation fails this update too). Enable the key first (declare Enabled: true, or enable it in AWS), or drop the rotation change from this update.`, resourceType, logicalId, physicalId, error));
+		}
+	}
+	async defaultKeyPolicy(keyId) {
+		const resp = await this.getClient().send(new DescribeKeyCommand({ KeyId: keyId }));
+		const match = /^arn:([^:]+):kms:[^:]*:(\d{12}):key\//.exec(resp.KeyMetadata?.Arn ?? "");
+		if (match === null) throw new Error("DescribeKey returned no key ARN, so the default key policy cannot name the account");
+		return JSON.stringify({
+			Version: "2012-10-17",
+			Id: "key-default-1",
+			Statement: [{
+				Sid: "Enable IAM User Permissions",
+				Effect: "Allow",
+				Principal: { AWS: `arn:${match[1]}:iam::${match[2]}:root` },
+				Action: "kms:*",
+				Resource: "*"
+			}]
+		});
+	}
 	async deleteKey(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Scheduling deletion for KMS Key ${logicalId}: ${physicalId}`);
 		const pendingWindowInDays = properties?.["PendingWindowInDays"] ?? 7;
@@ -36831,6 +37060,11 @@ var KMSProvider = class {
 		return null;
 	}
 };
+function templateBool(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string") return value.toLowerCase() === "true";
+	return Boolean(value);
+}
 
 //#endregion
 //#region src/provisioning/providers/budgets-budget-provider.ts
@@ -39205,8 +39439,12 @@ var EFSProvider = class {
 		this.getClient();
 		return this.mountTargetCreateClient;
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(log.mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		return markRedactedCause(build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
@@ -39278,7 +39516,7 @@ var EFSProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async updateMountTarget(logicalId, physicalId, resourceType, properties, log) {
@@ -39303,7 +39541,7 @@ var EFSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -39385,7 +39623,7 @@ var EFSProvider = class {
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (fileSystemLeftBehind && fileSystemId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, fileSystemId);
 			throw thrown;
 		}
@@ -39510,7 +39748,8 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, log) {
@@ -39549,7 +39788,7 @@ var EFSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdMountTargetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdMountTargetId);
 			throw thrown;
 		}
@@ -39580,7 +39819,8 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS MountTarget ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async waitForMountTargetDeleted(mountTargetId, logicalId) {
@@ -39648,7 +39888,7 @@ var EFSProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async createOrAdoptAccessPoint(logicalId, resourceType, log, input) {
@@ -39709,7 +39949,8 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS AccessPoint ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
@@ -39986,6 +40227,21 @@ var FSxFileSystemProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$3;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$3;
 	}
+	wrapStatusReasonError(mask, message, build) {
+		const text = describeAwsStatusReason({ message }, "no failure details reported");
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::FSx::FileSystem", /* @__PURE__ */ new Set([
 		"BackupId",
 		"FileSystemType",
@@ -40019,7 +40275,7 @@ var FSxFileSystemProvider = class {
 	getMinResourceTimeoutMs() {
 		return this.maxWaitMs;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		if (resourceType !== "AWS::FSx::FileSystem") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		const backupId = properties["BackupId"];
@@ -40085,7 +40341,7 @@ var FSxFileSystemProvider = class {
 				throw markNonRetryable(new ProvisioningError(safeMsg`FSx answered the create of ${logicalId} with file system ${returnedId}, which ${createdAt === void 0 ? "carries no creation time" : "predates this create"}: the create token cdkd derives for this stack's file system is held by it, and it is NOT recorded in cdkd state. It is not one this deploy, or an interrupted earlier deploy of this stack, made: it was created under this token by an earlier cdkd version, or a completed deploy recorded it and cdkd later let go of it, and it may hold data, so cdkd neither records nor deletes it. Inspect it with: ${inspect} --file-system-ids ${returnedId} -- then import it into this stack, or delete it once you are sure its data is not needed, and deploy again.`, resourceType, logicalId));
 			}
 			fileSystemId = returnedId;
-			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType);
+			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, context?.maskSecrets);
 			this.logger.debug(`Successfully created FSx FileSystem ${logicalId}: ${fileSystemId}`);
 			this.createTokenFirstSentAt.delete(clientRequestToken);
 			return {
@@ -40107,13 +40363,9 @@ var FSxFileSystemProvider = class {
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const message = `Failed to create FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`;
-			if (survivorId !== void 0) {
-				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
-				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
-				throw thrown;
-			}
-			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create FSx FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (survivorId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+			throw thrown;
 		}
 	}
 	toCreateLustreConfiguration(config) {
@@ -40325,7 +40577,7 @@ var FSxFileSystemProvider = class {
 				}))).FileSystem?.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.Status === "PENDING" || a.Status === "IN_PROGRESS"));
 				const requestTimes = respPendingActions.map((a) => a.RequestTime?.getTime()).filter((t) => t !== void 0);
 				const actionThresholdMs = requestTimes.length > 0 ? Math.min(...requestTimes) : callTimeMs - 6e4;
-				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0);
+				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0, context?.maskSecrets);
 			}
 			if (tagsChanged) await this.applyTagDiff(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"]);
 			if (!updatedFs) try {
@@ -40343,7 +40595,7 @@ var FSxFileSystemProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	detectVariantConfigKey(properties, previousProperties) {
@@ -40536,9 +40788,9 @@ var FSxFileSystemProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
-		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType);
+		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType, context?.maskSecrets);
 		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -40581,23 +40833,20 @@ var FSxFileSystemProvider = class {
 			throw error;
 		}
 	}
-	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType) {
+	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
 			const fs = await this.describeForPoll(fileSystemId, transientState);
 			const lifecycle = fs?.Lifecycle;
 			if (fs && lifecycle === "AVAILABLE") return fs;
-			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") {
-				const detail = fs?.FailureDetails?.Message ?? "no failure details reported";
-				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${detail}`, resourceType, logicalId, fileSystemId);
-			}
+			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") throw this.wrapStatusReasonError(mask, fs?.FailureDetails?.Message, (text, cause) => new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${text}`, resourceType, logicalId, fileSystemId, cause));
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${lifecycle ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
 		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} to become AVAILABLE (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
 	}
-	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation) {
+	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		let seenTrackedAction = false;
@@ -40607,10 +40856,7 @@ var FSxFileSystemProvider = class {
 				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
 				if (updateActions.length > 0) seenTrackedAction = true;
 				const failed = updateActions.find((a) => a.Status === "FAILED");
-				if (failed) {
-					const detail = failed.FailureDetails?.Message ?? "no failure details reported";
-					throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${detail}`, resourceType, logicalId, fileSystemId);
-				}
+				if (failed) throw this.wrapStatusReasonError(mask, failed.FailureDetails?.Message, (text, cause) => new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${text}`, resourceType, logicalId, fileSystemId, cause));
 				if (!updateActions.some((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS") && (!requireActionObservation || seenTrackedAction) && fs.Lifecycle === "AVAILABLE") return fs;
 				this.logger.debug(`FSx FileSystem ${fileSystemId} update in progress (lifecycle: ${fs.Lifecycle ?? "unknown"}), waiting...`);
 			}
@@ -40618,7 +40864,7 @@ var FSxFileSystemProvider = class {
 		}
 		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} update to complete (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
 	}
-	async waitForFileSystemDeleted(fileSystemId, logicalId, resourceType) {
+	async waitForFileSystemDeleted(fileSystemId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
@@ -40630,17 +40876,14 @@ var FSxFileSystemProvider = class {
 			} catch (error) {
 				if (error instanceof FileSystemNotFound$1) return;
 				const cause = error instanceof Error ? error : void 0;
-				throw new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${describeAwsFailure(error).detail}`, resourceType, logicalId, fileSystemId, cause);
+				throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${text}`, resourceType, logicalId, fileSystemId, cause));
 			}
 			if (!fs && sawResponse) return;
 			if (!fs) {
 				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 				continue;
 			}
-			if (fs.Lifecycle === "FAILED") {
-				const detail = fs.FailureDetails?.Message ?? "no failure details reported";
-				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${detail}`, resourceType, logicalId, fileSystemId);
-			}
+			if (fs.Lifecycle === "FAILED") throw this.wrapStatusReasonError(mask, fs.FailureDetails?.Message, (text, cause) => new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${text}`, resourceType, logicalId, fileSystemId, cause));
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${fs.Lifecycle ?? "unknown"}, waiting for deletion...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -40976,6 +41219,21 @@ var EMRClusterProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$2;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$2;
 	}
+	wrapStatusReasonError(mask, reason, fallback, build) {
+		const text = describeAwsStatusReason(reason, fallback);
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::Cluster", /* @__PURE__ */ new Set([
 		"AdditionalInfo",
 		"Applications",
@@ -41113,7 +41371,7 @@ var EMRClusterProvider = class {
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			if (!clusterId) throw new ProvisioningError(`EMR RunJobFlow for ${logicalId} returned no JobFlowId`, resourceType, logicalId);
-			const cluster = await this.waitForClusterReady(clusterId, logicalId, resourceType);
+			const cluster = await this.waitForClusterReady(clusterId, logicalId, resourceType, context?.maskSecrets);
 			this.logger.debug(`Successfully created EMR Cluster ${logicalId}: ${clusterId}`);
 			return {
 				physicalId: clusterId,
@@ -41140,14 +41398,12 @@ var EMRClusterProvider = class {
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const message = `Failed to create EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`;
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create EMR Cluster ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (survivorId !== void 0) {
-				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
 				markNonRetryable(thrown);
-				throw thrown;
 			}
-			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
+			throw thrown;
 		}
 	}
 	toJobFlowInstancesConfig(config) {
@@ -41338,7 +41594,7 @@ var EMRClusterProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyTagDiff(physicalId, resourceType, logicalId, prevTagsRaw, nextTagsRaw) {
@@ -41392,7 +41648,7 @@ var EMRClusterProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 		const currentState = current?.Status?.State;
 		if (currentState && TERMINAL_STATES.has(currentState)) {
@@ -41421,9 +41677,9 @@ var EMRClusterProvider = class {
 			flip.deleteAccepted = true;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
-		await this.waitForClusterTerminated(physicalId, logicalId, resourceType);
+		await this.waitForClusterTerminated(physicalId, logicalId, resourceType, context?.maskSecrets);
 		this.logger.debug(`Successfully deleted EMR Cluster ${logicalId}`);
 	}
 	async describeForPoll(clusterId, transientState, maxConsecutiveTransient = 5) {
@@ -41442,7 +41698,7 @@ var EMRClusterProvider = class {
 			throw error;
 		}
 	}
-	async waitForClusterReady(clusterId, logicalId, resourceType) {
+	async waitForClusterReady(clusterId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
@@ -41450,15 +41706,18 @@ var EMRClusterProvider = class {
 			const state = cluster?.Status?.State;
 			if (cluster && state && CREATE_READY_STATES.has(state)) return cluster;
 			if (state && TERMINAL_STATES.has(state)) {
-				const reason = cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
-				throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${reason}`, resourceType, logicalId, clusterId);
+				const reason = cluster?.Status?.StateChangeReason;
+				throw this.wrapStatusReasonError(mask, {
+					code: reason?.Code,
+					message: reason?.Message
+				}, "no state-change reason reported", (text, cause) => new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${text}`, resourceType, logicalId, clusterId, cause));
 			}
 			this.logger.debug(`EMR Cluster ${clusterId} state: ${state ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
 		throw new ProvisioningError(`Timed out waiting for EMR Cluster ${clusterId} to reach WAITING/RUNNING (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, clusterId);
 	}
-	async waitForClusterTerminated(clusterId, logicalId, resourceType) {
+	async waitForClusterTerminated(clusterId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
@@ -41468,7 +41727,7 @@ var EMRClusterProvider = class {
 			} catch (error) {
 				if (error instanceof InvalidRequestException) return;
 				const cause = error instanceof Error ? error : void 0;
-				throw new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${describeAwsFailure(error).detail}`, resourceType, logicalId, clusterId, cause);
+				throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${text}`, resourceType, logicalId, clusterId, cause));
 			}
 			const state = cluster?.Status?.State;
 			if (state && TERMINAL_STATES.has(state)) {
@@ -41719,6 +41978,21 @@ var EMRInstanceGroupConfigProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
 	}
+	wrapStatusReasonError(mask, reason, fallback, build) {
+		const text = describeAwsStatusReason(reason, fallback);
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceGroupConfig", /* @__PURE__ */ new Set([
 		"AutoScalingPolicy",
 		"BidPrice",
@@ -41802,7 +42076,7 @@ var EMRInstanceGroupConfigProvider = class {
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0 && group.InstanceRole === "TASK") await reportOrphans(replayWindow);
 			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
-			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, false, context?.maskSecrets);
 			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
 			return {
 				physicalId: groupId,
@@ -41812,7 +42086,7 @@ var EMRInstanceGroupConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${text}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
 			let leftBehindGroupId = createdGroupId;
 			if (leftBehindGroupId && properties["InstanceRole"] === "TASK") {
 				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
@@ -41891,7 +42165,7 @@ var EMRInstanceGroupConfigProvider = class {
 						InstanceCount: toNumber$1(properties["InstanceCount"]) ?? 0
 					}]
 				}));
-				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, true);
+				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, true, context?.maskSecrets);
 			}
 			if (autoScalingChanged) {
 				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
@@ -41918,7 +42192,7 @@ var EMRInstanceGroupConfigProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -41949,7 +42223,7 @@ var EMRInstanceGroupConfigProvider = class {
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		if (attributeName === "Id" || attributeName === "InstanceGroupId") return physicalId;
 	}
-	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount, toleratesStaleFailedState = false) {
+	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount, toleratesStaleFailedState = false, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		let initialState;
@@ -41964,8 +42238,11 @@ var EMRInstanceGroupConfigProvider = class {
 			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
 			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) {
-				const reason = group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
-				throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${reason}`, resourceType, logicalId, groupId);
+				const reason = group?.Status?.StateChangeReason;
+				throw this.wrapStatusReasonError(mask, {
+					code: reason?.Code,
+					message: reason?.Message
+				}, "no state-change reason reported", (text, cause) => new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${text}`, resourceType, logicalId, groupId, cause));
 			}
 			if (state && !enforceFailedStates && FAILED_STATES$1.has(state)) this.logger.debug(`EMR instance group ${groupId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
@@ -42036,6 +42313,21 @@ var EMRInstanceFleetConfigProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
 	}
+	wrapStatusReasonError(mask, reason, fallback, build) {
+		const text = describeAwsStatusReason(reason, fallback);
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceFleetConfig", /* @__PURE__ */ new Set([
 		"ClusterId",
 		"InstanceFleetType",
@@ -42128,7 +42420,7 @@ var EMRInstanceFleetConfigProvider = class {
 			await this.waitForFleetReady(clusterId, fleetId, logicalId, resourceType, this.targetCapacities(properties), {
 				onDemand: 0,
 				spot: 0
-			});
+			}, false, context?.maskSecrets);
 			this.logger.debug(`Successfully added EMR instance fleet ${logicalId}: ${fleetId}`);
 			return {
 				physicalId: fleetId,
@@ -42138,7 +42430,7 @@ var EMRInstanceFleetConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${text}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
 			if (createdFleetId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
 				markNonRetryable(thrown);
@@ -42212,7 +42504,7 @@ var EMRInstanceFleetConfigProvider = class {
 				ClusterId: clusterId,
 				InstanceFleet: modify
 			}));
-			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, this.targetCapacities(properties), this.targetCapacities(previousProperties), true);
+			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, this.targetCapacities(properties), this.targetCapacities(previousProperties), true, context?.maskSecrets);
 			this.logger.debug(`Successfully updated EMR instance fleet ${logicalId}`);
 			warnLeftInPlace();
 			return {
@@ -42226,7 +42518,7 @@ var EMRInstanceFleetConfigProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -42264,7 +42556,7 @@ var EMRInstanceFleetConfigProvider = class {
 			spot: toNumber(properties["TargetSpotCapacity"]) ?? 0
 		};
 	}
-	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, target, previous, toleratesStaleFailedState = false) {
+	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, target, previous, toleratesStaleFailedState = false, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		let initialState;
@@ -42284,8 +42576,11 @@ var EMRInstanceFleetConfigProvider = class {
 			if (state && READY_STATES.has(state) && capacityReady) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
 			if (state && enforceFailedStates && FAILED_STATES.has(state)) {
-				const reason = fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
-				throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${reason}`, resourceType, logicalId, fleetId);
+				const reason = fleet?.Status?.StateChangeReason;
+				throw this.wrapStatusReasonError(mask, {
+					code: reason?.Code,
+					message: reason?.Message
+				}, "no state-change reason reported", (text, cause) => new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${text}`, resourceType, logicalId, fleetId, cause));
 			}
 			if (state && !enforceFailedStates && FAILED_STATES.has(state)) this.logger.debug(`EMR instance fleet ${fleetId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${onDemand}/${target.onDemand} on-demand + ${spot}/${target.spot} spot (${provisioned} total), waiting...`);
@@ -46666,6 +46961,13 @@ var ACMCertificateProvider = class {
 	logger = getLogger().child("ACMCertificateProvider");
 	maxPollAttempts = Number(process.env["CDKD_ACM_POLL_ATTEMPTS"] ?? 60);
 	pollIntervalMs = Number(process.env["CDKD_ACM_POLL_INTERVAL_MS"] ?? 1e4);
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	constructor() {
 		this.acmClient = getAwsClients().acm;
 	}
@@ -46691,7 +46993,7 @@ var ACMCertificateProvider = class {
 		"KeyAlgorithm",
 		"Tags"
 	])]]);
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Requesting ACM certificate ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const domainName = properties["DomainName"];
@@ -46743,14 +47045,11 @@ var ACMCertificateProvider = class {
 				throw thrown;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const detail = describeAwsFailure(error).detail;
-			const message = `Failed to create ACM certificate ${logicalIdShown(logicalId)}: ${detail}`;
-			if (requestedArn && survivorNote !== void 0) {
-				const thrown = new ProvisioningError(`${message} ${survivorNote}`, resourceType, logicalId, requestedArn, cause);
-				markCreatedBeforeFailure(thrown, logicalId, resourceType, requestedArn);
-				throw thrown;
-			}
-			throw new ProvisioningError(message, resourceType, logicalId, requestedArn, cause);
+			const build = (text) => new ProvisioningError(`Failed to create ACM certificate ${logicalIdShown(logicalId)}: ` + (survivorNote !== void 0 ? `${text} ${survivorNote}` : text), resourceType, logicalId, requestedArn, cause);
+			if (!requestedArn || survivorNote === void 0) throw this.wrapCaughtError(context?.maskSecrets, error, build);
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, build);
+			markCreatedBeforeFailure(thrown, logicalId, resourceType, requestedArn);
+			throw thrown;
 		}
 	}
 	regionOfArn(arn) {
@@ -46802,7 +47101,7 @@ var ACMCertificateProvider = class {
 		}
 		if (changedImmutable) {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
-			const createResult = await this.create(logicalId, resourceType, properties);
+			const createResult = await this.create(logicalId, resourceType, properties, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 			let orphanReason;
 			let oldResourceSurvivor = "unconfirmed";
 			try {
@@ -46851,7 +47150,7 @@ var ACMCertificateProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update ACM certificate ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update ACM certificate ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -46871,7 +47170,7 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`Successfully deleted ACM certificate ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ACM certificate ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete ACM certificate ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -46993,4 +47292,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-BUvql6rX.js.map
+//# sourceMappingURL=provider-classes-CBbWGsK0.js.map