@go-to-k/cdkd 0.301.14 → 0.301.15

package/dist/{provider-classes-Dmz-lVVh.js → provider-classes-CBbWGsK0.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { A as SECRET_REF_MAX_CODE_POINTS, H as safeMsg, I as displayIdent, L as displaySafe, R as displayStackName, S as generateResourceNameWithFallback, V as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, r as describeAwsStatusReason, s as getLogger, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
 import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dap4bLyq.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-B0ObJCy0.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CukWclVP.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-9BJEui0z.js";
-import { RDSProvider } from "./rds-provider-D0srL6Rb.js";
-import { NeptuneProvider } from "./neptune-provider-BTkMpImX.js";
-import { ASGProvider } from "./asg-provider-ak7zMqaQ.js";
+import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-Dy7N7-Il.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8Icvrf7.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CXvao3wc.js";
+import { RDSProvider } from "./rds-provider-BMQvQTTS.js";
+import { NeptuneProvider } from "./neptune-provider-CtnwSAGM.js";
+import { ASGProvider } from "./asg-provider-ClDYCUia.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, DisabledException, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
@@ -9134,6 +9134,14 @@ const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = /* @__PURE__ */ new Set([
 	"dynamodb"
 ]);
 const KINDS_WITH_STREAM_NUMERICS = /* @__PURE__ */ new Set(["kinesis", "dynamodb"]);
+const DEFAULT_BATCH_SIZE_BY_KIND = /* @__PURE__ */ new Map([
+	["sqs", 10],
+	["kinesis", 100],
+	["dynamodb", 100],
+	["kafka", 100],
+	["mq", 100],
+	["documentdb", 100]
+]);
 var LambdaEventSourceMappingProvider = class {
 	lambdaClient;
 	createClient;
@@ -9353,6 +9361,14 @@ var LambdaEventSourceMappingProvider = class {
 			if (wasSet("TumblingWindowInSeconds")) updateParams.TumblingWindowInSeconds = 0;
 		}
 		if (wasSet("MaximumBatchingWindowInSeconds") && KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT.has(prevKind)) updateParams.MaximumBatchingWindowInSeconds = 0;
+		if (wasSet("BatchSize")) {
+			const defaultBatchSize = DEFAULT_BATCH_SIZE_BY_KIND.get(prevKind);
+			if (defaultBatchSize !== void 0) updateParams.BatchSize = defaultBatchSize;
+		}
+		if (prevKind === "kafka") {
+			if (wasSet("LoggingConfig")) updateParams.LoggingConfig = {};
+			if (wasSet("ProvisionedPollerConfig")) updateParams.ProvisionedPollerConfig = {};
+		}
 		const updateResp = await this.lambdaClient.send(new UpdateEventSourceMappingCommand(updateParams));
 		const eventSourceMappingArn = updateResp.EventSourceMappingArn;
 		if (eventSourceMappingArn) await this.applyTagDiff(eventSourceMappingArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
@@ -20905,6 +20921,7 @@ var ApiGatewayV2Provider = class {
 			"IdentityValidationExpression"
 		])]
 	]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Map([["IdentitySource", []]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Map([
 		["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 		["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
@@ -20961,9 +20978,9 @@ var ApiGatewayV2Provider = class {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true, context);
 			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
-			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log, context);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
 		}
 	}
@@ -21725,7 +21742,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false, context) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -21788,7 +21805,32 @@ var ApiGatewayV2Provider = class {
 			input.IntegrationSubtype = properties["IntegrationSubtype"];
 			changed = true;
 		}
-		if (input.IntegrationSubtype === void 0) {
+		const subtypeRemoved = context?.removedProperties !== void 0 ? context.removedProperties.has("IntegrationSubtype") : previousProperties["IntegrationSubtype"] != null && properties["IntegrationSubtype"] == null;
+		let effectiveProperties;
+		if (subtypeRemoved && (context?.replayingState !== true || properties["IntegrationUri"] != null)) {
+			if (properties["IntegrationUri"] == null) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): the previous deploy recorded IntegrationSubtype and this template does not declare it. CloudFormation fails that update (AWS refuses a service integration without its subtype: Invalid integration URI specified). Keep IntegrationSubtype declared, or declare an IntegrationUri to turn this into a URI-based integration. The integration was not updated.`, resourceType, logicalId, physicalId));
+			input.IntegrationUri = properties["IntegrationUri"];
+			changed = true;
+		} else if (subtypeRemoved) {
+			let liveSubtype;
+			try {
+				liveSubtype = (await this.getClient().send(new GetIntegrationCommand({
+					ApiId: apiId,
+					IntegrationId: physicalId
+				}))).IntegrationSubtype;
+			} catch (error) {
+				const cause = error instanceof Error ? error : void 0;
+				throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to read API Gateway V2 Integration ${logicalId} before restoring it: ${text}`, resourceType, logicalId, physicalId, cause));
+			}
+			if (liveSubtype) {
+				input.IntegrationSubtype = liveSubtype;
+				effectiveProperties = {
+					...properties,
+					IntegrationSubtype: liveSubtype
+				};
+				log.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare IntegrationSubtype; the rollback keeps the integration's current subtype, because AWS refuses a service integration without it.`);
+			}
+		} else if (input.IntegrationSubtype === void 0) {
 			const liveSubtype = properties["IntegrationSubtype"] ?? previousProperties["IntegrationSubtype"];
 			if (liveSubtype !== void 0) input.IntegrationSubtype = liveSubtype;
 		}
@@ -21813,11 +21855,13 @@ var ApiGatewayV2Provider = class {
 			input.TlsConfig = properties["TlsConfig"];
 			changed = true;
 		}
+		if (changed && input.IntegrationSubtype !== void 0) input.RequestParameters = this.serviceIntegrationParameters(logicalId, physicalId, resourceType, input.RequestParameters ?? properties["RequestParameters"]);
 		if (!changed) {
 			log.debug(`No mutable Integration fields changed for ${logicalId}; skipping UpdateIntegration`);
 			return {
 				physicalId,
-				wasReplaced: false
+				wasReplaced: false,
+				...effectiveProperties && { effectiveProperties }
 			};
 		}
 		log.debug(`Updating API Gateway V2 Integration ${logicalId}: ${physicalId}`);
@@ -21825,7 +21869,8 @@ var ApiGatewayV2Provider = class {
 			await this.getClient().send(new UpdateIntegrationCommand(input));
 			return {
 				physicalId,
-				wasReplaced: false
+				wasReplaced: false,
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -21930,7 +21975,8 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Route ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log, context) {
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Authorizer ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Authorizer; re-deploy with cdkd deploy --replace");
@@ -22002,6 +22048,15 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Authorizer ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	serviceIntegrationParameters(logicalId, physicalId, resourceType, sent) {
+		if (sent == null) return void 0;
+		const redacted = Object.keys(sent).filter((key) => {
+			const value = sent[key];
+			return typeof value === "string" && (dynamicReferenceTokens(value).length > 0 || value === "***");
+		});
+		if (redacted.length > 0) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): this update must re-send the service integration's RequestParameters (AWS re-validates the full mapping beside IntegrationSubtype), but the value of ${redacted.join(", ")} is a redacted secret reference that cdkd cannot send. The integration was not updated.`, resourceType, logicalId, physicalId));
+		return sent;
+	}
 	clearableUpdate(next, previous, resetValue) {
 		const resolved = next !== void 0 ? next : previous !== void 0 ? resetValue : void 0;
 		return {
@@ -25549,7 +25604,7 @@ const CLEARED_BY_TLS_DOWNGRADE = /* @__PURE__ */ new Set(["SslPolicy", "Certific
 const listenerLeftInPlaceWarning = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyListener keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyListener keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 var ELBv2Provider = class {
 	elbv2Client;
@@ -28709,6 +28764,10 @@ function templateZoneVisibility(properties) {
 	if (!Array.isArray(vpcs)) return void 0;
 	return vpcs.some((v) => typeof v === "object" && v !== null && !Array.isArray(v) && !isIntrinsicOnly(v)) ? true : void 0;
 }
+const VPCS_KEPT_ON_REMOVAL_NOTE = "A private hosted zone stays private and keeps at least one VPC; to change its associations, declare the VPCs you want and deploy.";
+function declaresNoVpcs(vpcs) {
+	return vpcs == null || Array.isArray(vpcs) && vpcs.length === 0;
+}
 function sentence$1(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -28789,7 +28848,7 @@ var Route53Provider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context);
 			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -28934,7 +28993,7 @@ var Route53Provider = class {
 			} : void 0;
 		}
 	}
-	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask, context) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
 			const hostedZoneConfig = properties["HostedZoneConfig"];
@@ -28954,6 +29013,7 @@ var Route53Provider = class {
 			}));
 			const nameServers = (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully updated hosted zone ${logicalId}`);
+			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -36450,6 +36510,7 @@ var KMSProvider = class {
 		"Origin",
 		"BypassPolicyLockoutSafetyCheck"
 	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::KMS::Key", /* @__PURE__ */ new Map([["RotationPeriodInDays", 365]])]]);
 	getClient() {
 		if (!this.client) this.client = new KMSClient({
 			...ambientClientDefaults(),
@@ -36474,7 +36535,7 @@ var KMSProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		switch (resourceType) {
-			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context?.maskSecrets);
+			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context);
 			case "AWS::KMS::Alias": return this.updateAlias(logicalId, physicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -36493,7 +36554,7 @@ var KMSProvider = class {
 		const keyPolicy = properties["KeyPolicy"];
 		const keySpec = properties["KeySpec"];
 		const keyUsage = properties["KeyUsage"];
-		const enableKeyRotation = properties["EnableKeyRotation"];
+		const enableKeyRotation = templateBool(properties["EnableKeyRotation"]);
 		const multiRegion = properties["MultiRegion"];
 		const origin = properties["Origin"];
 		const bypassPolicyLockoutSafetyCheck = properties["BypassPolicyLockoutSafetyCheck"];
@@ -36514,7 +36575,7 @@ var KMSProvider = class {
 		const inputDigest = createHash("sha256").update(JSON.stringify({
 			input,
 			enableKeyRotation: enableKeyRotation === true,
-			enabled: properties["Enabled"] !== false
+			enabled: templateBool(properties["Enabled"]) !== false
 		})).digest("hex");
 		let createdKeyId;
 		let supersededPending = false;
@@ -36550,7 +36611,7 @@ var KMSProvider = class {
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
 			createdKeyId = keyId;
-			if (enableKeyRotation) {
+			if (enableKeyRotation === true) {
 				const rotationPeriodInDays = properties["RotationPeriodInDays"];
 				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
 				await this.getClient().send(new EnableKeyRotationCommand({
@@ -36558,7 +36619,7 @@ var KMSProvider = class {
 					...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
 				}));
 			}
-			if (properties["Enabled"] === false) {
+			if (templateBool(properties["Enabled"]) === false) {
 				this.logger.debug(`Disabling KMS Key ${logicalId}`);
 				await this.getClient().send(new DisableKeyCommand({ KeyId: keyId }));
 			}
@@ -36698,9 +36759,13 @@ var KMSProvider = class {
 		const deletion = shown.map((keyId) => aws`aws kms schedule-key-deletion --key-id ${keyId}${region} --pending-window-in-days 7`.render()).join(" ; ");
 		this.logger.warn(safeMsg`${lead}, and KMS may have created a key then that no cdkd state records. ${candidates.length} customer managed key(s) created between ${since} and ${until} match this key's settings: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them, because a key has no name or token that ties it to ${logicalId} -- another key with the same settings is indistinguishable. ${window.replayedInSend === true ? "cdkd recorded the key the create returned, so the orphan (if any) and that key both exist." : "Creating a new key now, so the orphan (if any) and the new key will both exist."} First inspect each candidate: ${inspect}. Only after confirming a key is this deploy's orphan and no other deploy uses it, schedule its deletion: ${deletion}.${incomplete}`);
 	}
-	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating KMS Key ${logicalId}: ${physicalId}`);
+		const mask = context?.maskSecrets;
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const newEnabled = templateBool(properties["Enabled"]);
+		const enabledChange = newEnabled === templateBool(previousProperties["Enabled"]) ? void 0 : newEnabled === false ? "disable" : "enable";
 		try {
 			const newDescription = properties["Description"];
 			if (newDescription !== previousProperties["Description"]) {
@@ -36710,41 +36775,49 @@ var KMSProvider = class {
 					Description: newDescription ?? ""
 				}));
 			}
-			const newEnableKeyRotation = properties["EnableKeyRotation"];
-			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) {
-				if (newEnableKeyRotation) {
-					const rotationPeriodInDays = properties["RotationPeriodInDays"];
+			if (enabledChange === "enable") {
+				this.logger.debug(`Enabling KMS Key ${logicalId}`);
+				await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+			}
+			const newEnableKeyRotation = templateBool(properties["EnableKeyRotation"]);
+			const oldEnableKeyRotation = templateBool(previousProperties["EnableKeyRotation"]);
+			const rotationPeriodInDays = properties["RotationPeriodInDays"];
+			if (newEnableKeyRotation === true) {
+				if (newEnableKeyRotation !== oldEnableKeyRotation || rotationPeriodInDays !== void 0 && rotationPeriodInDays !== previousProperties["RotationPeriodInDays"]) {
 					this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
-					await this.getClient().send(new EnableKeyRotationCommand({
+					await this.sendRotation(() => this.getClient().send(new EnableKeyRotationCommand({
 						KeyId: physicalId,
 						...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
-					}));
-				} else {
-					this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
-					await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+					})), enabledChange === "enable", resourceType, logicalId, physicalId);
 				}
+			} else if (newEnableKeyRotation !== oldEnableKeyRotation) {
+				this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
+				await this.sendRotation(() => this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId })), enabledChange === "enable", resourceType, logicalId, physicalId);
 			}
-			const newEnabled = properties["Enabled"];
-			if (newEnabled !== previousProperties["Enabled"]) {
-				if (newEnabled === false) {
-					this.logger.debug(`Disabling KMS Key ${logicalId}`);
-					await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
-				} else {
-					this.logger.debug(`Enabling KMS Key ${logicalId}`);
-					await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
-				}
+			if (enabledChange === "disable") {
+				this.logger.debug(`Disabling KMS Key ${logicalId}`);
+				await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const newKeyPolicy = properties["KeyPolicy"];
 			const oldKeyPolicy = previousProperties["KeyPolicy"];
 			const newPolicyStr = newKeyPolicy ? typeof newKeyPolicy === "string" ? newKeyPolicy : JSON.stringify(newKeyPolicy) : void 0;
-			if (newPolicyStr !== (oldKeyPolicy ? typeof oldKeyPolicy === "string" ? oldKeyPolicy : JSON.stringify(oldKeyPolicy) : void 0) && newPolicyStr) {
+			const oldPolicyStr = oldKeyPolicy ? typeof oldKeyPolicy === "string" ? oldKeyPolicy : JSON.stringify(oldKeyPolicy) : void 0;
+			const policyRemoved = context?.removedProperties !== void 0 ? context.removedProperties.has("KeyPolicy") : oldKeyPolicy !== void 0 && newKeyPolicy === void 0;
+			if (newPolicyStr !== oldPolicyStr && newPolicyStr) {
 				this.logger.debug(`Updating key policy for KMS Key ${logicalId}`);
 				await this.getClient().send(new PutKeyPolicyCommand({
 					KeyId: physicalId,
 					PolicyName: "default",
 					Policy: newPolicyStr
 				}));
+			} else if (policyRemoved && newKeyPolicy === void 0) {
+				this.logger.debug(safeMsg`Resetting key policy for KMS Key ${logicalId} to the default`);
+				await this.getClient().send(new PutKeyPolicyCommand({
+					KeyId: physicalId,
+					PolicyName: "default",
+					Policy: await this.defaultKeyPolicy(physicalId)
+				}));
 			}
 			this.logger.debug(`Successfully updated KMS Key ${logicalId}`);
 			return {
@@ -36752,10 +36825,35 @@ var KMSProvider = class {
 				wasReplaced: false
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async sendRotation(send, justEnabled, resourceType, logicalId, physicalId) {
+		try {
+			await send();
+		} catch (error) {
+			if (!(error instanceof DisabledException) || justEnabled) throw error;
+			throw markNonRetryable(new ProvisioningError(safeMsg`Failed to update KMS Key ${logicalId}: the key is currently disabled in AWS, and KMS refuses a key rotation change on a disabled key (CloudFormation fails this update too). Enable the key first (declare Enabled: true, or enable it in AWS), or drop the rotation change from this update.`, resourceType, logicalId, physicalId, error));
+		}
+	}
+	async defaultKeyPolicy(keyId) {
+		const resp = await this.getClient().send(new DescribeKeyCommand({ KeyId: keyId }));
+		const match = /^arn:([^:]+):kms:[^:]*:(\d{12}):key\//.exec(resp.KeyMetadata?.Arn ?? "");
+		if (match === null) throw new Error("DescribeKey returned no key ARN, so the default key policy cannot name the account");
+		return JSON.stringify({
+			Version: "2012-10-17",
+			Id: "key-default-1",
+			Statement: [{
+				Sid: "Enable IAM User Permissions",
+				Effect: "Allow",
+				Principal: { AWS: `arn:${match[1]}:iam::${match[2]}:root` },
+				Action: "kms:*",
+				Resource: "*"
+			}]
+		});
+	}
 	async deleteKey(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Scheduling deletion for KMS Key ${logicalId}: ${physicalId}`);
 		const pendingWindowInDays = properties?.["PendingWindowInDays"] ?? 7;
@@ -36962,6 +37060,11 @@ var KMSProvider = class {
 		return null;
 	}
 };
+function templateBool(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string") return value.toLowerCase() === "true";
+	return Boolean(value);
+}
 
 //#endregion
 //#region src/provisioning/providers/budgets-budget-provider.ts
@@ -47189,4 +47292,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dmz-lVVh.js.map
+//# sourceMappingURL=provider-classes-CBbWGsK0.js.map