@go-to-k/cdkd 0.301.14 → 0.302.0

package/dist/{provider-classes-Dmz-lVVh.js → provider-classes-CXSiWJVn.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { A as SECRET_REF_MAX_CODE_POINTS, H as safeMsg, I as displayIdent, L as displaySafe, R as displayStackName, S as generateResourceNameWithFallback, V as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, r as describeAwsStatusReason, s as getLogger, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dap4bLyq.js";
+import { C as generateResourceName, G as displayIdent, J as isPasteableIdent, K as displaySafe, T as generatedNameFor, X as plainIdentOr, Z as safeMsg, a as safeStringify, i as isAwsAuthoredFailure, j as recordedGeneratedNameKept, n as describeAwsFailure, q as displayStackName, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback, z as SECRET_REF_MAX_CODE_POINTS } from "./aws-failure-text-BDZdavf4.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dnk6FCsr.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-B0ObJCy0.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CukWclVP.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-9BJEui0z.js";
-import { RDSProvider } from "./rds-provider-D0srL6Rb.js";
-import { NeptuneProvider } from "./neptune-provider-BTkMpImX.js";
-import { ASGProvider } from "./asg-provider-ak7zMqaQ.js";
+import { Ar as markDeleteStarted, Bo as toCfnInteger, C as hasCdkAutoDeleteTag, Ci as s3BucketDomainName, Cs as redactForState, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Ei as s3BucketWebsiteUrl, Eo as findSilentDropProperties, Er as reserveStackCreateToken, Et as chunks, F as findNestedTemplateTreeDefect, Fn as replacedDeleteFailureVerdict, Fr as refuseMalformedDesiredTags, Go as configIntegerRefusal, Gr as waitForLambdaFunctionActive, Ho as coerceCfnBoolean, Hs as withoutPhysicalNameCopies, I as isAbsoluteAssetPath, Ir as tagMapAsList, Jo as replayWarn, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ka as refuseMalformedNestedChildOutputs, Kl as canonicalizeRegion, Ko as configStringRefusal, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Lo as WARM_THROUGHPUT_MEMBERS, Lr as tagPlanWarning, Mr as DBPROXY_TAG_OPTIONS, Nn as getStackRecords, Nr as planTagDiff, Oo as withoutSilentDropProperties, Or as acquireIdempotencyToken, Os as hasMaskableValues, Ot as lookupEachName, Pr as readTagList, Qs as recordAttributeIdCopy, R as renderNestedTemplateTreeDefect, Ro as coerceWarmThroughput$1, Rr as definedAttributes, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as s3BucketArn, Ss as markSameGenerationBag, T as getPriorAttempts, Ti as s3BucketRegionalDomainName, Ts as snapshotPassProvenance, Ul as decodeListingKey, Uo as coerceCfnInteger, Vo as toFiniteNumber, Wc as rewriteTemplateAssetReferences, Wo as configBooleanRefusal, Ws as dynamicReferenceTokens, Xo as requireConfigObject, Xs as recoverMaskedOutput, Xt as redactedDeleteAddressFields, Yo as requireConfigArray, Yr as getCurrentResourceSecrets, Yt as isRedactedRecordedValue, Zi as getAccountInfo, Zo as requireConfigString, Zs as physicalNameCopiesOf, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _a as accountArgs, au as renderAssemblyPathEscape, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ci as withIndeterminateGuard, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, f as deleteBudgetKey, fi as ec2InstanceProtectionSite, fo as refuseMalformedResourcesForDestroy, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reEnableInstanceApiTermination, gs as passedNoEchoParametersOf, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as reDisableInstanceApiTermination, ht as getCurrentNestedStackContext, is as sameLambdaFunctionAddress, iu as displayAssemblyPath, ji as outputReferenceProvenanceOf, jn as awaitInFlightSibling, jr as DBPROXY_TAGS_WHAT, kr as isRefusedByName, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as isWaitAbandonedError, m as resolveDynamoDbDeleteBudgetMs, mi as observeThenDisableInstanceApiTermination, ni as unchangedBehindSecretReference, ns as canonicalLambdaFunctionName, ou as resolveAssemblyPath, p as resolveDynamoDbDeleteBudgetClock, pi as isTerminationProtectionPropagationError, ql as derivePartitionAndUrlSuffix, qo as readConfigString, rs as lambdaFunctionNameForMask, ru as describeFileReadFailure, sa as parseWebACLArn, si as deleteSkipReason, t as DeployEngine, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, ts as withRetry, u as beginDeleteWait, ua as passedParameterClassesOf, ui as markWaitAbandoned, ur as secretNamedAttributeNamesOf, v as maskedLogger, w as isTruthyCfnBoolean, wi as s3BucketDualStackDomainName, wo as withheldAccountClause, wr as earliestDefined, ws as recordReferenceProvenanceEntry, x as ECR_AUTO_DELETE_IMAGES_TAG, xi as isSettledInstanceState, y as relayedIndexBusyDelete, zc as stringifyValue, zo as isWarmThroughputDecrease, zr as stringifyIfAssigned } from "./deploy-engine-DU0BoQqo.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-WGsb9RxZ.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BVLiidXb.js";
+import { RDSProvider } from "./rds-provider-6RgDTDCV.js";
+import { NeptuneProvider } from "./neptune-provider-WE1O3kXY.js";
+import { ASGProvider } from "./asg-provider-BRr_hsky.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, DisabledException, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
@@ -133,7 +133,7 @@ var IAMPolicyProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Creating IAM policy ${logicalId}`);
-		const policyName = properties["PolicyName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const policyName = properties["PolicyName"] || generatedNameFor("AWS::IAM::Policy", logicalId);
 		const policyDocument = properties["PolicyDocument"];
 		const targets = readPolicyTargetLists(properties);
 		if ("malformed" in targets) throw new ProvisioningError(`${targets.malformed.join(" / ")} of IAM policy ${logicalId} is not a list of IAM names — no inline policy was attached`, resourceType, logicalId);
@@ -239,7 +239,15 @@ var IAMPolicyProvider = class {
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["PolicyName"], oldPolicyName]]);
 		const { value: v } = log;
 		log.debug(`Updating IAM policy ${logicalId}: ${v(physicalId)}`);
-		const newPolicyName = properties["PolicyName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const derivedPolicyName = properties["PolicyName"] || generatedNameFor("AWS::IAM::Policy", logicalId);
+		const newPolicyName = oldPolicyName !== void 0 && recordedGeneratedNameKept({
+			recorded: oldPolicyName,
+			derived: derivedPolicyName,
+			declaredName: properties["PolicyName"],
+			previousDeclaredName: previousProperties["PolicyName"],
+			logicalId,
+			options: { maxLength: 64 }
+		}) ? oldPolicyName : derivedPolicyName;
 		const recordedPolicyName = previousProperties["PolicyName"];
 		const oldPolicyNames = [...new Set([oldPolicyName, recordedPolicyName].filter((name) => typeof name === "string" && IAM_POLICY_NAME.test(name)))];
 		const newTargets = readPolicyTargetLists(properties);
@@ -675,7 +683,16 @@ var IAMManagedPolicyProvider = class {
 		log.debug(`Updating IAM managed policy ${logicalId}: ${v(physicalId)}`);
 		const revertKeepsName = context?.desiredFromAwsReadback === true && derivedPolicyName !== oldPolicyName;
 		if (revertKeepsName) log.warn(`IAM managed policy ${logicalId}: ManagedPolicyName is not reverted — the policy ${v(oldPolicyName)} keeps its name (the reverted properties derive ${v(derivedPolicyName)}), since a drift revert never replaces a policy. 'cdkd drift' keeps reporting the name until 'cdkd drift --accept' records the live one; only a deploy renames the policy.`);
-		const newPolicyName = revertKeepsName ? oldPolicyName : derivedPolicyName;
+		const generatedNameKept = recordedGeneratedNameKept({
+			recorded: oldPolicyName,
+			derived: derivedPolicyName,
+			declaredName: properties["ManagedPolicyName"],
+			previousDeclaredName: previousProperties["ManagedPolicyName"],
+			logicalId,
+			options: { maxLength: 128 }
+		});
+		if (generatedNameKept) log.debug(`IAM managed policy ${logicalId}: keeping its generated name ${v(oldPolicyName)} (the template names no policy)`);
+		const newPolicyName = revertKeepsName || generatedNameKept ? oldPolicyName : derivedPolicyName;
 		const newPrincipals = principalsOf(properties);
 		const oldPrincipals = principalsOf(previousProperties);
 		const liveKinds = !("malformed" in newPrincipals) && onlySecretDerived(oldPrincipals) ? oldPrincipals.malformed : [];
@@ -5403,11 +5420,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["BucketName"]) return void 0;
-		return generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true,
-			allowedPattern: /[^a-z0-9.-]/g
-		});
+		return generatedNameFor("AWS::S3::Bucket", logicalId);
 	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
@@ -5754,7 +5767,7 @@ var SQSQueueProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["QueueName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 80 });
+		return generatedNameFor("AWS::SQS::Queue", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const resp = await this.sqsClient.send(new GetQueueAttributesCommand({
@@ -5835,7 +5848,7 @@ var SQSQueueProvider = class {
 				QueueUrl: physicalId,
 				AttributeNames: ["QueueArn"]
 			}));
-			const queueName = properties["QueueName"] || generateResourceName(logicalId, { maxLength: 80 });
+			const queueName = properties["QueueName"] || physicalId.split("/").pop() || generatedNameFor("AWS::SQS::Queue", logicalId);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -6845,7 +6858,7 @@ var SNSTopicProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["TopicName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 256 });
+		return generatedNameFor("AWS::SNS::Topic", logicalId);
 	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7837,7 +7850,7 @@ var LambdaFunctionProvider = class {
 		this.ec2Client = awsClients.ec2;
 	}
 	async create(logicalId, resourceType, properties, context) {
-		const functionName = properties["FunctionName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const functionName = properties["FunctionName"] || generatedNameFor("AWS::Lambda::Function", logicalId);
 		const log = lambdaOperationSinks(this.logger, context?.maskSecrets, [[properties["FunctionName"], functionName]], properties);
 		log.debug(`Creating Lambda function ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -9134,6 +9147,14 @@ const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = /* @__PURE__ */ new Set([
 	"dynamodb"
 ]);
 const KINDS_WITH_STREAM_NUMERICS = /* @__PURE__ */ new Set(["kinesis", "dynamodb"]);
+const DEFAULT_BATCH_SIZE_BY_KIND = /* @__PURE__ */ new Map([
+	["sqs", 10],
+	["kinesis", 100],
+	["dynamodb", 100],
+	["kafka", 100],
+	["mq", 100],
+	["documentdb", 100]
+]);
 var LambdaEventSourceMappingProvider = class {
 	lambdaClient;
 	createClient;
@@ -9353,6 +9374,14 @@ var LambdaEventSourceMappingProvider = class {
 			if (wasSet("TumblingWindowInSeconds")) updateParams.TumblingWindowInSeconds = 0;
 		}
 		if (wasSet("MaximumBatchingWindowInSeconds") && KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT.has(prevKind)) updateParams.MaximumBatchingWindowInSeconds = 0;
+		if (wasSet("BatchSize")) {
+			const defaultBatchSize = DEFAULT_BATCH_SIZE_BY_KIND.get(prevKind);
+			if (defaultBatchSize !== void 0) updateParams.BatchSize = defaultBatchSize;
+		}
+		if (prevKind === "kafka") {
+			if (wasSet("LoggingConfig")) updateParams.LoggingConfig = {};
+			if (wasSet("ProvisionedPollerConfig")) updateParams.ProvisionedPollerConfig = {};
+		}
 		const updateResp = await this.lambdaClient.send(new UpdateEventSourceMappingCommand(updateParams));
 		const eventSourceMappingArn = updateResp.EventSourceMappingArn;
 		if (eventSourceMappingArn) await this.applyTagDiff(eventSourceMappingArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
@@ -9560,7 +9589,7 @@ var LambdaLayerVersionProvider = class {
 		});
 	}
 	async create(logicalId, resourceType, properties, context) {
-		const layerName = properties["LayerName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const layerName = properties["LayerName"] || generatedNameFor("AWS::Lambda::LayerVersion", logicalId);
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[properties["LayerName"], layerName], [properties["LayerName"], layerNameSegment(layerName)]]);
 		log.debug(`Creating Lambda layer version ${logicalId}`);
 		const content = properties["Content"];
@@ -11064,7 +11093,7 @@ var LambdaNetworkConnectorProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(safeMsg`Creating Lambda network connector ${logicalId}`);
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generateResourceName(logicalId, { maxLength: 64 });
+		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generatedNameFor("AWS::Lambda::NetworkConnector", logicalId);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
 		const createToken = acquireIdempotencyToken({
 			scope: "CreateNetworkConnector",
@@ -11948,6 +11977,10 @@ const deleteTableRetryDelays = {};
 function maskLeafValue(value, maskSecrets) {
 	return maskDeep(value, maskSecrets);
 }
+const tableNameReleaseWait = {
+	maxPolls: 600,
+	intervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
+};
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	createClient;
@@ -12008,7 +12041,7 @@ var DynamoDBTableProvider = class {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		this.logger.debug(`Creating DynamoDB table ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const tableName = properties["TableName"] || generatedNameFor("AWS::DynamoDB::Table", logicalId);
 		const keySchema = properties["KeySchema"];
 		const attributeDefinitions = properties["AttributeDefinitions"];
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
@@ -12356,6 +12389,22 @@ var DynamoDBTableProvider = class {
 			throw this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async waitForNameReleased(logicalId, physicalId, _resourceType, context) {
+		const mask = context.maskSecrets ?? ((text) => text);
+		this.logger.info(mask(`  Waiting for the deleted DynamoDB table ${physicalId} to release its name...`));
+		for (let poll = 0; poll < tableNameReleaseWait.maxPolls; poll++) {
+			if (context.isInterrupted()) return;
+			try {
+				await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$1) return;
+				this.logger.debug(mask(`DynamoDB table ${logicalId}: name-release check failed: ${describeAwsFailure(error).detail}`));
+				if (!isThrottlingError(error) && !isTransientServerError(error)) return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, tableNameReleaseWait.intervalMs));
+		}
+		this.logger.debug(mask(`DynamoDB table ${logicalId} (${physicalId}) still held its name after the wait`));
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
 		try {
@@ -13417,10 +13466,7 @@ var LogsLogGroupProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["LogGroupName"]) return void 0;
-		return `/cdkd/${generateResourceName(logicalId, {
-			maxLength: 506,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`;
+		return generatedNameFor("AWS::Logs::LogGroup", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const group = (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: physicalId }))).logGroups?.find((g) => g.logGroupName === physicalId);
@@ -14111,7 +14157,7 @@ var CloudWatchAlarmProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["AlarmName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 256 });
+		return generatedNameFor("AWS::CloudWatch::Alarm", logicalId);
 	}
 	async lookupNames(_resourceType, names) {
 		const wanted = new Set(names);
@@ -14430,10 +14476,7 @@ var SecretsManagerSecretProvider = class {
 		const { value: v } = log;
 		log.debug(`Creating secret ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = properties["Name"] || generateResourceName(logicalId, {
-			maxLength: 512,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		});
+		const name = properties["Name"] || generatedNameFor("AWS::SecretsManager::Secret", logicalId);
 		try {
 			let secretString;
 			const rawGenerate = properties["GenerateSecretString"];
@@ -14784,10 +14827,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 		const ssmTags = SSMParameterProvider.desiredSsmTags(properties["Tags"], resourceType, logicalId);
 		const debug = (message) => this.logger.debug(mask(message));
 		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
-		const name = properties["Name"] || `/${generateResourceName(logicalId, {
-			maxLength: 1023,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`;
+		const name = properties["Name"] || generatedNameFor("AWS::SSM::Parameter", logicalId);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
@@ -15175,7 +15215,8 @@ var EventBridgeRuleProvider = class {
 		this.logger.debug(`Updating EventBridge rule ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
-		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
+		const recordedRuleName = physicalId.split("/").pop() ?? "";
+		const ruleName = properties["Name"] || recordedRuleName || generatedNameFor("AWS::Events::Rule", logicalId);
 		const newTargets = properties["Targets"];
 		const oldTargets = previousProperties["Targets"];
 		try {
@@ -15338,7 +15379,7 @@ var EventBridgeRuleProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["Name"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 64 });
+		return generatedNameFor("AWS::Events::Rule", logicalId);
 	}
 	lookupNeedsResolvedProperties(_resourceType, properties) {
 		const bus = properties["EventBusName"];
@@ -17273,7 +17314,7 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "security-group", desiredTags, (TagSpecifications) => createClient.send(new CreateSecurityGroupCommand({
-				GroupName: properties["GroupName"] ?? logicalId,
+				GroupName: properties["GroupName"] ?? generatedNameFor("AWS::EC2::SecurityGroup", logicalId),
 				Description: groupDescription,
 				VpcId: properties["VpcId"] ?? void 0,
 				...TagSpecifications && { TagSpecifications }
@@ -20905,6 +20946,7 @@ var ApiGatewayV2Provider = class {
 			"IdentityValidationExpression"
 		])]
 	]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Map([["IdentitySource", []]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Map([
 		["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 		["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
@@ -20961,9 +21003,9 @@ var ApiGatewayV2Provider = class {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true, context);
 			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
-			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log, context);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
 		}
 	}
@@ -21725,7 +21767,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false, context) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -21788,7 +21830,32 @@ var ApiGatewayV2Provider = class {
 			input.IntegrationSubtype = properties["IntegrationSubtype"];
 			changed = true;
 		}
-		if (input.IntegrationSubtype === void 0) {
+		const subtypeRemoved = context?.removedProperties !== void 0 ? context.removedProperties.has("IntegrationSubtype") : previousProperties["IntegrationSubtype"] != null && properties["IntegrationSubtype"] == null;
+		let effectiveProperties;
+		if (subtypeRemoved && (context?.replayingState !== true || properties["IntegrationUri"] != null)) {
+			if (properties["IntegrationUri"] == null) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): the previous deploy recorded IntegrationSubtype and this template does not declare it. CloudFormation fails that update (AWS refuses a service integration without its subtype: Invalid integration URI specified). Keep IntegrationSubtype declared, or declare an IntegrationUri to turn this into a URI-based integration. The integration was not updated.`, resourceType, logicalId, physicalId));
+			input.IntegrationUri = properties["IntegrationUri"];
+			changed = true;
+		} else if (subtypeRemoved) {
+			let liveSubtype;
+			try {
+				liveSubtype = (await this.getClient().send(new GetIntegrationCommand({
+					ApiId: apiId,
+					IntegrationId: physicalId
+				}))).IntegrationSubtype;
+			} catch (error) {
+				const cause = error instanceof Error ? error : void 0;
+				throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to read API Gateway V2 Integration ${logicalId} before restoring it: ${text}`, resourceType, logicalId, physicalId, cause));
+			}
+			if (liveSubtype) {
+				input.IntegrationSubtype = liveSubtype;
+				effectiveProperties = {
+					...properties,
+					IntegrationSubtype: liveSubtype
+				};
+				log.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare IntegrationSubtype; the rollback keeps the integration's current subtype, because AWS refuses a service integration without it.`);
+			}
+		} else if (input.IntegrationSubtype === void 0) {
 			const liveSubtype = properties["IntegrationSubtype"] ?? previousProperties["IntegrationSubtype"];
 			if (liveSubtype !== void 0) input.IntegrationSubtype = liveSubtype;
 		}
@@ -21813,11 +21880,13 @@ var ApiGatewayV2Provider = class {
 			input.TlsConfig = properties["TlsConfig"];
 			changed = true;
 		}
+		if (changed && input.IntegrationSubtype !== void 0) input.RequestParameters = this.serviceIntegrationParameters(logicalId, physicalId, resourceType, input.RequestParameters ?? properties["RequestParameters"]);
 		if (!changed) {
 			log.debug(`No mutable Integration fields changed for ${logicalId}; skipping UpdateIntegration`);
 			return {
 				physicalId,
-				wasReplaced: false
+				wasReplaced: false,
+				...effectiveProperties && { effectiveProperties }
 			};
 		}
 		log.debug(`Updating API Gateway V2 Integration ${logicalId}: ${physicalId}`);
@@ -21825,7 +21894,8 @@ var ApiGatewayV2Provider = class {
 			await this.getClient().send(new UpdateIntegrationCommand(input));
 			return {
 				physicalId,
-				wasReplaced: false
+				wasReplaced: false,
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -21930,7 +22000,8 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Route ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log, context) {
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Authorizer ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Authorizer; re-deploy with cdkd deploy --replace");
@@ -22002,6 +22073,15 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Authorizer ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	serviceIntegrationParameters(logicalId, physicalId, resourceType, sent) {
+		if (sent == null) return void 0;
+		const redacted = Object.keys(sent).filter((key) => {
+			const value = sent[key];
+			return typeof value === "string" && (dynamicReferenceTokens(value).length > 0 || value === "***");
+		});
+		if (redacted.length > 0) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): this update must re-send the service integration's RequestParameters (AWS re-validates the full mapping beside IntegrationSubtype), but the value of ${redacted.join(", ")} is a redacted secret reference that cdkd cannot send. The integration was not updated.`, resourceType, logicalId, physicalId));
+		return sent;
+	}
 	clearableUpdate(next, previous, resetValue) {
 		const resolved = next !== void 0 ? next : previous !== void 0 ? resetValue : void 0;
 		return {
@@ -23797,7 +23877,7 @@ var StepFunctionsProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["StateMachineName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 80 });
+		return generatedNameFor("AWS::StepFunctions::StateMachine", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: physicalId }));
@@ -24300,7 +24380,7 @@ var ECSProvider = class {
 	async createTaskDefinition(logicalId, resourceType, properties, log) {
 		log.debug(`Creating ECS task definition ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const family = properties["Family"] || generateResourceName(logicalId, { maxLength: 255 });
+		const family = properties["Family"] || generatedNameFor("AWS::ECS::TaskDefinition", logicalId);
 		try {
 			const orphanWindow = registerTaskDefinitionLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleOrphanTaskDefinitions(logicalId, family, orphanWindow, log);
@@ -24377,7 +24457,7 @@ var ECSProvider = class {
 		log.debug(`Creating ECS service ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
-		const serviceName = properties["ServiceName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const serviceName = properties["ServiceName"] || generatedNameFor("AWS::ECS::Service", logicalId);
 		let survivorArn;
 		try {
 			const heldBefore = process.env["CDKD_FULL_WAIT"] === "true" ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
@@ -25313,7 +25393,7 @@ var ECSProvider = class {
 	}
 	generatedCreateName(resourceType, logicalId, properties) {
 		if (resourceType !== "AWS::ECS::Cluster" || properties["ClusterName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 255 });
+		return generatedNameFor("AWS::ECS::Cluster", logicalId);
 	}
 	async lookupNames(resourceType, names) {
 		const found = /* @__PURE__ */ new Map();
@@ -25549,7 +25629,7 @@ const CLEARED_BY_TLS_DOWNGRADE = /* @__PURE__ */ new Set(["SslPolicy", "Certific
 const listenerLeftInPlaceWarning = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyListener keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ModifyListener keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::ElasticLoadBalancingV2::Listener): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyListener keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 var ELBv2Provider = class {
 	elbv2Client;
@@ -26875,7 +26955,7 @@ var RDSDBProxyProvider = class {
 	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
-		const dbProxyName = properties["DBProxyName"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const dbProxyName = properties["DBProxyName"] ?? generatedNameFor("AWS::RDS::DBProxy", logicalId);
 		const engineFamily = properties["EngineFamily"];
 		if (!engineFamily) throw new ProvisioningError(`EngineFamily is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const auth = properties["Auth"];
@@ -27198,7 +27278,7 @@ var RDSDBProxyEndpointProvider = class {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyEndpoint ${logicalId}`, resourceType, logicalId);
-		const dbProxyEndpointName = properties["DBProxyEndpointName"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const dbProxyEndpointName = properties["DBProxyEndpointName"] ?? generatedNameFor("AWS::RDS::DBProxyEndpoint", logicalId);
 		const vpcSubnetIds = properties["VpcSubnetIds"];
 		if (!vpcSubnetIds || vpcSubnetIds.length === 0) throw new ProvisioningError(`VpcSubnetIds (at least one) is required for AWS::RDS::DBProxyEndpoint ${logicalId}`, resourceType, logicalId);
 		const client = this.getClient();
@@ -28090,10 +28170,7 @@ var DocDBProvider = class {
 	async createDBCluster(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating DocDB DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true
-		});
+		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
 		try {
@@ -28239,10 +28316,7 @@ var DocDBProvider = class {
 	async createDBInstance(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating DocDB DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true
-		});
+		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::DocDB::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
 		try {
@@ -28558,10 +28632,7 @@ var DocDBSubnetGroupProvider = class {
 		this.assertType(resourceType, logicalId);
 		this.logger.debug(safeMsg`Creating DocDB DBSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generateResourceName(logicalId, {
-			maxLength: 255,
-			lowercase: true
-		});
+		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generatedNameFor("AWS::DocDB::DBSubnetGroup", logicalId);
 		try {
 			await this.getCreateClient().send(new CreateDBSubnetGroupCommand$1({
 				DBSubnetGroupName: dbSubnetGroupName,
@@ -28709,6 +28780,10 @@ function templateZoneVisibility(properties) {
 	if (!Array.isArray(vpcs)) return void 0;
 	return vpcs.some((v) => typeof v === "object" && v !== null && !Array.isArray(v) && !isIntrinsicOnly(v)) ? true : void 0;
 }
+const VPCS_KEPT_ON_REMOVAL_NOTE = "A private hosted zone stays private and keeps at least one VPC; to change its associations, declare the VPCs you want and deploy.";
+function declaresNoVpcs(vpcs) {
+	return vpcs == null || Array.isArray(vpcs) && vpcs.length === 0;
+}
 function sentence$1(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -28789,7 +28864,7 @@ var Route53Provider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context);
 			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -28934,7 +29009,7 @@ var Route53Provider = class {
 			} : void 0;
 		}
 	}
-	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask, context) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
 			const hostedZoneConfig = properties["HostedZoneConfig"];
@@ -28954,6 +29029,7 @@ var Route53Provider = class {
 			}));
 			const nameServers = (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully updated hosted zone ${logicalId}`);
+			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -29964,7 +30040,7 @@ var WAFv2WebACLProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const name = properties["Name"] || generatedNameFor("AWS::WAFv2::WebACL", logicalId);
 		const scope = requireConfigString(properties["Scope"], "REGIONAL", "AWS::WAFv2::WebACL Scope", replayWarn(this.logger, context));
 		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
@@ -30503,7 +30579,7 @@ var CognitoUserPoolProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Cognito User Pool ${logicalId}`);
-		const poolName = properties["UserPoolName"] || generateResourceName(logicalId, { maxLength: 128 });
+		const poolName = properties["UserPoolName"] || generatedNameFor("AWS::Cognito::UserPool", logicalId);
 		let mfaConfiguration;
 		try {
 			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], replayWarn(this.logger, context));
@@ -31266,10 +31342,7 @@ var ElastiCacheProvider = class {
 	async createSubnetGroup(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CacheSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generateResourceName(logicalId, {
-			maxLength: 255,
-			lowercase: true
-		});
+		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generatedNameFor("AWS::ElastiCache::SubnetGroup", logicalId);
 		try {
 			await this.getCreateClient().send(new CreateCacheSubnetGroupCommand({
 				CacheSubnetGroupName: cacheSubnetGroupName,
@@ -31333,10 +31406,7 @@ var ElastiCacheProvider = class {
 	async createCacheCluster(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CacheCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const cacheClusterId = properties["ClusterName"] || generateResourceName(logicalId, {
-			maxLength: 40,
-			lowercase: true
-		});
+		const cacheClusterId = properties["ClusterName"] || generatedNameFor("AWS::ElastiCache::CacheCluster", logicalId);
 		let clusterCreated = false;
 		try {
 			await this.getCreateClient().send(new CreateCacheClusterCommand({
@@ -35497,7 +35567,7 @@ var GlueJobProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Job ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Job", logicalId);
 		const role = properties["Role"];
 		const command = properties["Command"];
 		if (!role) throw new ProvisioningError(`Role is required for Glue Job ${logicalId}`, resourceType, logicalId);
@@ -35785,7 +35855,7 @@ var GlueCrawlerProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Crawler ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Crawler", logicalId);
 		const role = properties["Role"];
 		const targets = properties["Targets"];
 		if (!role) throw new ProvisioningError(`Role is required for Glue Crawler ${logicalId}`, resourceType, logicalId);
@@ -36035,7 +36105,7 @@ var GlueConnectionProvider = class {
 		log.debug(`Creating Glue Connection ${logicalId}`);
 		const connectionInput = properties["ConnectionInput"];
 		if (!connectionInput) throw new ProvisioningError(`ConnectionInput is required for Glue Connection ${logicalId}`, resourceType, logicalId);
-		const name = connectionInput["Name"] ?? logicalId;
+		const name = connectionInput["Name"] ?? generatedNameFor("AWS::Glue::Connection", logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getCreateClient().send(new CreateConnectionCommand({
@@ -36240,7 +36310,7 @@ var GlueTriggerProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Trigger ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Trigger", logicalId);
 		const type = properties["Type"];
 		const actions = properties["Actions"];
 		if (!type) throw new ProvisioningError(`Type is required for Glue Trigger ${logicalId}`, resourceType, logicalId);
@@ -36450,6 +36520,7 @@ var KMSProvider = class {
 		"Origin",
 		"BypassPolicyLockoutSafetyCheck"
 	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::KMS::Key", /* @__PURE__ */ new Map([["RotationPeriodInDays", 365]])]]);
 	getClient() {
 		if (!this.client) this.client = new KMSClient({
 			...ambientClientDefaults(),
@@ -36474,7 +36545,7 @@ var KMSProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		switch (resourceType) {
-			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context?.maskSecrets);
+			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context);
 			case "AWS::KMS::Alias": return this.updateAlias(logicalId, physicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -36493,7 +36564,7 @@ var KMSProvider = class {
 		const keyPolicy = properties["KeyPolicy"];
 		const keySpec = properties["KeySpec"];
 		const keyUsage = properties["KeyUsage"];
-		const enableKeyRotation = properties["EnableKeyRotation"];
+		const enableKeyRotation = templateBool(properties["EnableKeyRotation"]);
 		const multiRegion = properties["MultiRegion"];
 		const origin = properties["Origin"];
 		const bypassPolicyLockoutSafetyCheck = properties["BypassPolicyLockoutSafetyCheck"];
@@ -36514,7 +36585,7 @@ var KMSProvider = class {
 		const inputDigest = createHash("sha256").update(JSON.stringify({
 			input,
 			enableKeyRotation: enableKeyRotation === true,
-			enabled: properties["Enabled"] !== false
+			enabled: templateBool(properties["Enabled"]) !== false
 		})).digest("hex");
 		let createdKeyId;
 		let supersededPending = false;
@@ -36550,7 +36621,7 @@ var KMSProvider = class {
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
 			createdKeyId = keyId;
-			if (enableKeyRotation) {
+			if (enableKeyRotation === true) {
 				const rotationPeriodInDays = properties["RotationPeriodInDays"];
 				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
 				await this.getClient().send(new EnableKeyRotationCommand({
@@ -36558,7 +36629,7 @@ var KMSProvider = class {
 					...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
 				}));
 			}
-			if (properties["Enabled"] === false) {
+			if (templateBool(properties["Enabled"]) === false) {
 				this.logger.debug(`Disabling KMS Key ${logicalId}`);
 				await this.getClient().send(new DisableKeyCommand({ KeyId: keyId }));
 			}
@@ -36698,9 +36769,13 @@ var KMSProvider = class {
 		const deletion = shown.map((keyId) => aws`aws kms schedule-key-deletion --key-id ${keyId}${region} --pending-window-in-days 7`.render()).join(" ; ");
 		this.logger.warn(safeMsg`${lead}, and KMS may have created a key then that no cdkd state records. ${candidates.length} customer managed key(s) created between ${since} and ${until} match this key's settings: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them, because a key has no name or token that ties it to ${logicalId} -- another key with the same settings is indistinguishable. ${window.replayedInSend === true ? "cdkd recorded the key the create returned, so the orphan (if any) and that key both exist." : "Creating a new key now, so the orphan (if any) and the new key will both exist."} First inspect each candidate: ${inspect}. Only after confirming a key is this deploy's orphan and no other deploy uses it, schedule its deletion: ${deletion}.${incomplete}`);
 	}
-	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating KMS Key ${logicalId}: ${physicalId}`);
+		const mask = context?.maskSecrets;
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const newEnabled = templateBool(properties["Enabled"]);
+		const enabledChange = newEnabled === templateBool(previousProperties["Enabled"]) ? void 0 : newEnabled === false ? "disable" : "enable";
 		try {
 			const newDescription = properties["Description"];
 			if (newDescription !== previousProperties["Description"]) {
@@ -36710,41 +36785,49 @@ var KMSProvider = class {
 					Description: newDescription ?? ""
 				}));
 			}
-			const newEnableKeyRotation = properties["EnableKeyRotation"];
-			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) {
-				if (newEnableKeyRotation) {
-					const rotationPeriodInDays = properties["RotationPeriodInDays"];
+			if (enabledChange === "enable") {
+				this.logger.debug(`Enabling KMS Key ${logicalId}`);
+				await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+			}
+			const newEnableKeyRotation = templateBool(properties["EnableKeyRotation"]);
+			const oldEnableKeyRotation = templateBool(previousProperties["EnableKeyRotation"]);
+			const rotationPeriodInDays = properties["RotationPeriodInDays"];
+			if (newEnableKeyRotation === true) {
+				if (newEnableKeyRotation !== oldEnableKeyRotation || rotationPeriodInDays !== void 0 && rotationPeriodInDays !== previousProperties["RotationPeriodInDays"]) {
 					this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
-					await this.getClient().send(new EnableKeyRotationCommand({
+					await this.sendRotation(() => this.getClient().send(new EnableKeyRotationCommand({
 						KeyId: physicalId,
 						...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
-					}));
-				} else {
-					this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
-					await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+					})), enabledChange === "enable", resourceType, logicalId, physicalId);
 				}
+			} else if (newEnableKeyRotation !== oldEnableKeyRotation) {
+				this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
+				await this.sendRotation(() => this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId })), enabledChange === "enable", resourceType, logicalId, physicalId);
 			}
-			const newEnabled = properties["Enabled"];
-			if (newEnabled !== previousProperties["Enabled"]) {
-				if (newEnabled === false) {
-					this.logger.debug(`Disabling KMS Key ${logicalId}`);
-					await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
-				} else {
-					this.logger.debug(`Enabling KMS Key ${logicalId}`);
-					await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
-				}
+			if (enabledChange === "disable") {
+				this.logger.debug(`Disabling KMS Key ${logicalId}`);
+				await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const newKeyPolicy = properties["KeyPolicy"];
 			const oldKeyPolicy = previousProperties["KeyPolicy"];
 			const newPolicyStr = newKeyPolicy ? typeof newKeyPolicy === "string" ? newKeyPolicy : JSON.stringify(newKeyPolicy) : void 0;
-			if (newPolicyStr !== (oldKeyPolicy ? typeof oldKeyPolicy === "string" ? oldKeyPolicy : JSON.stringify(oldKeyPolicy) : void 0) && newPolicyStr) {
+			const oldPolicyStr = oldKeyPolicy ? typeof oldKeyPolicy === "string" ? oldKeyPolicy : JSON.stringify(oldKeyPolicy) : void 0;
+			const policyRemoved = context?.removedProperties !== void 0 ? context.removedProperties.has("KeyPolicy") : oldKeyPolicy !== void 0 && newKeyPolicy === void 0;
+			if (newPolicyStr !== oldPolicyStr && newPolicyStr) {
 				this.logger.debug(`Updating key policy for KMS Key ${logicalId}`);
 				await this.getClient().send(new PutKeyPolicyCommand({
 					KeyId: physicalId,
 					PolicyName: "default",
 					Policy: newPolicyStr
 				}));
+			} else if (policyRemoved && newKeyPolicy === void 0) {
+				this.logger.debug(safeMsg`Resetting key policy for KMS Key ${logicalId} to the default`);
+				await this.getClient().send(new PutKeyPolicyCommand({
+					KeyId: physicalId,
+					PolicyName: "default",
+					Policy: await this.defaultKeyPolicy(physicalId)
+				}));
 			}
 			this.logger.debug(`Successfully updated KMS Key ${logicalId}`);
 			return {
@@ -36752,10 +36835,35 @@ var KMSProvider = class {
 				wasReplaced: false
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async sendRotation(send, justEnabled, resourceType, logicalId, physicalId) {
+		try {
+			await send();
+		} catch (error) {
+			if (!(error instanceof DisabledException) || justEnabled) throw error;
+			throw markNonRetryable(new ProvisioningError(safeMsg`Failed to update KMS Key ${logicalId}: the key is currently disabled in AWS, and KMS refuses a key rotation change on a disabled key (CloudFormation fails this update too). Enable the key first (declare Enabled: true, or enable it in AWS), or drop the rotation change from this update.`, resourceType, logicalId, physicalId, error));
+		}
+	}
+	async defaultKeyPolicy(keyId) {
+		const resp = await this.getClient().send(new DescribeKeyCommand({ KeyId: keyId }));
+		const match = /^arn:([^:]+):kms:[^:]*:(\d{12}):key\//.exec(resp.KeyMetadata?.Arn ?? "");
+		if (match === null) throw new Error("DescribeKey returned no key ARN, so the default key policy cannot name the account");
+		return JSON.stringify({
+			Version: "2012-10-17",
+			Id: "key-default-1",
+			Statement: [{
+				Sid: "Enable IAM User Permissions",
+				Effect: "Allow",
+				Principal: { AWS: `arn:${match[1]}:iam::${match[2]}:root` },
+				Action: "kms:*",
+				Resource: "*"
+			}]
+		});
+	}
 	async deleteKey(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Scheduling deletion for KMS Key ${logicalId}: ${physicalId}`);
 		const pendingWindowInDays = properties?.["PendingWindowInDays"] ?? 7;
@@ -36962,6 +37070,11 @@ var KMSProvider = class {
 		return null;
 	}
 };
+function templateBool(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string") return value.toLowerCase() === "true";
+	return Boolean(value);
+}
 
 //#endregion
 //#region src/provisioning/providers/budgets-budget-provider.ts
@@ -37606,7 +37719,7 @@ var KinesisStreamProvider = class {
 		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const streamName = properties["Name"] || generatedNameFor("AWS::Kinesis::Stream", logicalId);
 		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 		if (desiredRead.kind === "unusable") {
 			if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
@@ -38352,7 +38465,7 @@ var SchedulerScheduleProvider = class {
 		return result;
 	}
 	async create(logicalId, resourceType, properties) {
-		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const name = properties["Name"] ?? generatedNameFor("AWS::Scheduler::Schedule", logicalId);
 		const groupName = this.groupNameOf(properties);
 		this.logger.debug(`Creating Schedule ${logicalId}: ${name}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
@@ -38892,7 +39005,7 @@ var PipesPipeProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
-		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const name = properties["Name"] ?? generatedNameFor("AWS::Pipes::Pipe", logicalId);
 		const tags = desiredTagMap(properties["Tags"], logicalId);
 		this.logger.debug(mask(`Creating Pipe ${logicalId}: ${name}`));
 		let createdIdentity;
@@ -41062,7 +41175,7 @@ const leftInPlaceWarning$1 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyCluster keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyCluster keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyCluster keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyCluster keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 const toNumber$2 = (v) => {
 	if (v === void 0) return void 0;
@@ -42194,7 +42307,7 @@ const leftInPlaceWarning = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyInstanceFleet keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyInstanceFleet keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyInstanceFleet keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyInstanceFleet keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 const addInstanceFleetLatch = new AmbiguousCreateLatch("emr:AddInstanceFleet");
 const fleetsCreatedByThisProcess = new RecentIdSet();
@@ -42579,7 +42692,7 @@ var FirehoseProvider = class {
 		let createdStreamName;
 		try {
 			const input = {
-				DeliveryStreamName: deliveryStreamName || logicalId,
+				DeliveryStreamName: deliveryStreamName || generatedNameFor("AWS::KinesisFirehose::DeliveryStream", logicalId),
 				DeliveryStreamType: deliveryStreamType
 			};
 			if (properties["S3DestinationConfiguration"]) {
@@ -43475,7 +43588,7 @@ var CloudTrailProvider = class {
 		let createdTrailArn;
 		try {
 			const result = await this.getCreateClient().send(new CreateTrailCommand({
-				Name: trailName ?? logicalId,
+				Name: trailName ?? generatedNameFor("AWS::CloudTrail::Trail", logicalId),
 				S3BucketName: s3BucketName,
 				S3KeyPrefix: s3KeyPrefix,
 				IsMultiRegionTrail: isMultiRegionTrail,
@@ -43820,8 +43933,8 @@ var CodeBuildProvider = class {
 			artifactIdentifier: artifacts["ArtifactIdentifier"]
 		};
 	}
-	mapProperties(logicalId, properties) {
-		const name = properties["Name"] ?? logicalId;
+	mapProperties(undeclaredName, properties) {
+		const name = properties["Name"] ?? undeclaredName();
 		const source = properties["Source"];
 		const environment = properties["Environment"];
 		const sanitizeOptionalString = (value) => {
@@ -43950,7 +44063,7 @@ var CodeBuildProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CodeBuild Project ${logicalId}`);
 		try {
-			const input = this.mapProperties(logicalId, properties);
+			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
 			const result = await this.getCreateClient().send(new CreateProjectCommand(input));
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
@@ -43968,7 +44081,7 @@ var CodeBuildProvider = class {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
-			const input = this.mapProperties(logicalId, properties);
+			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
 			await this.getClient().send(new UpdateProjectCommand(input));
@@ -44322,7 +44435,7 @@ var CodeCommitRepositoryProvider = class {
 	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CodeCommit Repository ${logicalId}`);
-		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 100 });
+		const repositoryName = properties["RepositoryName"] || generatedNameFor("AWS::CodeCommit::Repository", logicalId);
 		const lists = this.readDesiredLists(logicalId, resourceType, {
 			Triggers: properties["Triggers"],
 			Tags: properties["Tags"]
@@ -45264,10 +45377,7 @@ var S3DirectoryBucketProvider = class {
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
 		let bucketName = properties["BucketName"];
-		if (!bucketName) bucketName = `${generateResourceName(logicalId, {
-			maxLength: 64,
-			lowercase: true
-		})}--${azId}--x-s3`;
+		if (!bucketName) bucketName = generatedNameFor("AWS::S3Express::DirectoryBucket", logicalId, { zoneId: azId });
 		const tags = desiredTags;
 		const includeTags = tags.length > 0;
 		try {
@@ -46201,7 +46311,7 @@ var ECRProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating ECR Repository ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 256 }).toLowerCase();
+		const repositoryName = properties["RepositoryName"] || generatedNameFor("AWS::ECR::Repository", logicalId);
 		let repositoryCreated = false;
 		try {
 			const tags = properties["Tags"] !== void 0 && properties["Tags"] !== null ? desiredTags : void 0;
@@ -47189,4 +47299,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dmz-lVVh.js.map
+//# sourceMappingURL=provider-classes-CXSiWJVn.js.map