@go-to-k/cdkd 0.301.15 → 0.302.1

package/dist/{provider-classes-CBbWGsK0.js → provider-classes-B2_u4Fg0.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { A as SECRET_REF_MAX_CODE_POINTS, H as safeMsg, I as displayIdent, L as displaySafe, R as displayStackName, S as generateResourceNameWithFallback, V as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, r as describeAwsStatusReason, s as getLogger, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dap4bLyq.js";
+import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback } from "./aws-failure-text-e_ddrDDo.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-CmHNH1DY.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-Dy7N7-Il.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8Icvrf7.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CXvao3wc.js";
-import { RDSProvider } from "./rds-provider-BMQvQTTS.js";
-import { NeptuneProvider } from "./neptune-provider-CtnwSAGM.js";
-import { ASGProvider } from "./asg-provider-ClDYCUia.js";
+import { Ar as markDeleteStarted, Bo as toCfnInteger, C as hasCdkAutoDeleteTag, Ci as s3BucketDomainName, Cr as reserveStackCreateToken, Cs as redactForState, Dt as withApiLimit, E as markRefusedBeforeApplying, Ei as s3BucketWebsiteUrl, Eo as findSilentDropProperties, Et as lookupEachName, F as findNestedTemplateTreeDefect, Fr as refuseMalformedDesiredTags, Go as configIntegerRefusal, Gr as waitForLambdaFunctionActive, Ho as coerceCfnBoolean, Hs as withoutPhysicalNameCopies, I as isAbsoluteAssetPath, Ir as tagMapAsList, Jo as replayWarn, Jt as redactedDeleteAddressFields, Ka as refuseMalformedNestedChildOutputs, Kl as canonicalizeRegion, Ko as configStringRefusal, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, L as listNestedTemplateRows, Lo as WARM_THROUGHPUT_MEMBERS, Lr as tagPlanWarning, Mr as DBPROXY_TAG_OPTIONS, Nn as replacedDeleteFailureVerdict, Nr as planTagDiff, Oo as withoutSilentDropProperties, Os as hasMaskableValues, Pr as readTagList, Qs as recordAttributeIdCopy, R as renderNestedTemplateTreeDefect, Ro as coerceWarmThroughput$1, Rr as definedAttributes, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as s3BucketArn, Ss as markSameGenerationBag, T as getPriorAttempts, Ti as s3BucketRegionalDomainName, Tr as acquireIdempotencyToken, Ts as snapshotPassProvenance, Tt as isAccessDeniedError, Ul as decodeListingKey, Uo as coerceCfnInteger, Vo as toFiniteNumber, Wc as rewriteTemplateAssetReferences, Wo as configBooleanRefusal, Ws as dynamicReferenceTokens, Wt as getCurrentProducerRegions, Xo as requireConfigObject, Xs as recoverMaskedOutput, Yo as requireConfigArray, Yr as getCurrentResourceSecrets, Yt as redactedDeleteAddressSkip, Zi as getAccountInfo, Zo as requireConfigString, Zs as physicalNameCopiesOf, _ as deleteTableWithIndexBusyRetry, _a as accountArgs, au as renderAssemblyPathEscape, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ci as withIndeterminateGuard, cr as secretNamedAttributeNamesOf, d as compensateRemovedDeletionProtection, f as deleteBudgetKey, fi as ec2InstanceProtectionSite, fo as refuseMalformedResourcesForDestroy, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reEnableInstanceApiTermination, gs as passedNoEchoParametersOf, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as reDisableInstanceApiTermination, is as sameLambdaFunctionAddress, iu as displayAssemblyPath, ji as outputReferenceProvenanceOf, jn as getStackRecords, jr as DBPROXY_TAGS_WHAT, kn as awaitInFlightSibling, kr as isRefusedByName, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as isWaitAbandonedError, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mi as observeThenDisableInstanceApiTermination, mt as withNestedStackContext, ni as unchangedBehindSecretReference, ns as canonicalLambdaFunctionName, ot as getNestedRevertRun, ou as resolveAssemblyPath, p as resolveDynamoDbDeleteBudgetClock, pi as isTerminationProtectionPropagationError, pt as getCurrentNestedStackContext, ql as derivePartitionAndUrlSuffix, qo as readConfigString, qt as isRedactedRecordedValue, rs as lambdaFunctionNameForMask, ru as describeFileReadFailure, sa as parseWebACLArn, si as deleteSkipReason, t as DeployEngine, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, ts as withRetry, u as beginDeleteWait, ua as passedParameterClassesOf, ui as markWaitAbandoned, v as maskedLogger, w as isTruthyCfnBoolean, wi as s3BucketDualStackDomainName, wo as withheldAccountClause, ws as recordReferenceProvenanceEntry, wt as chunks, x as ECR_AUTO_DELETE_IMAGES_TAG, xi as isSettledInstanceState, xr as earliestDefined, y as relayedIndexBusyDelete, zc as stringifyValue, zo as isWarmThroughputDecrease, zr as stringifyIfAssigned } from "./deploy-engine-CYVt2NQR.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-R1GC6KcT.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CvRs5pV_.js";
+import { RDSProvider } from "./rds-provider-CmKbYAvr.js";
+import { NeptuneProvider } from "./neptune-provider-DzTl6-74.js";
+import { ASGProvider } from "./asg-provider-BpRcm_UB.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -17,7 +17,7 @@ import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCo
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
-import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
+import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
@@ -39,7 +39,7 @@ import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepository
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
 import * as zlib from "node:zlib";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
@@ -133,7 +133,7 @@ var IAMPolicyProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Creating IAM policy ${logicalId}`);
-		const policyName = properties["PolicyName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const policyName = properties["PolicyName"] || generatedNameFor("AWS::IAM::Policy", logicalId);
 		const policyDocument = properties["PolicyDocument"];
 		const targets = readPolicyTargetLists(properties);
 		if ("malformed" in targets) throw new ProvisioningError(`${targets.malformed.join(" / ")} of IAM policy ${logicalId} is not a list of IAM names — no inline policy was attached`, resourceType, logicalId);
@@ -239,7 +239,15 @@ var IAMPolicyProvider = class {
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["PolicyName"], oldPolicyName]]);
 		const { value: v } = log;
 		log.debug(`Updating IAM policy ${logicalId}: ${v(physicalId)}`);
-		const newPolicyName = properties["PolicyName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const derivedPolicyName = properties["PolicyName"] || generatedNameFor("AWS::IAM::Policy", logicalId);
+		const newPolicyName = oldPolicyName !== void 0 && recordedGeneratedNameKept({
+			recorded: oldPolicyName,
+			derived: derivedPolicyName,
+			declaredName: properties["PolicyName"],
+			previousDeclaredName: previousProperties["PolicyName"],
+			logicalId,
+			options: { maxLength: 64 }
+		}) ? oldPolicyName : derivedPolicyName;
 		const recordedPolicyName = previousProperties["PolicyName"];
 		const oldPolicyNames = [...new Set([oldPolicyName, recordedPolicyName].filter((name) => typeof name === "string" && IAM_POLICY_NAME.test(name)))];
 		const newTargets = readPolicyTargetLists(properties);
@@ -675,7 +683,16 @@ var IAMManagedPolicyProvider = class {
 		log.debug(`Updating IAM managed policy ${logicalId}: ${v(physicalId)}`);
 		const revertKeepsName = context?.desiredFromAwsReadback === true && derivedPolicyName !== oldPolicyName;
 		if (revertKeepsName) log.warn(`IAM managed policy ${logicalId}: ManagedPolicyName is not reverted — the policy ${v(oldPolicyName)} keeps its name (the reverted properties derive ${v(derivedPolicyName)}), since a drift revert never replaces a policy. 'cdkd drift' keeps reporting the name until 'cdkd drift --accept' records the live one; only a deploy renames the policy.`);
-		const newPolicyName = revertKeepsName ? oldPolicyName : derivedPolicyName;
+		const generatedNameKept = recordedGeneratedNameKept({
+			recorded: oldPolicyName,
+			derived: derivedPolicyName,
+			declaredName: properties["ManagedPolicyName"],
+			previousDeclaredName: previousProperties["ManagedPolicyName"],
+			logicalId,
+			options: { maxLength: 128 }
+		});
+		if (generatedNameKept) log.debug(`IAM managed policy ${logicalId}: keeping its generated name ${v(oldPolicyName)} (the template names no policy)`);
+		const newPolicyName = revertKeepsName || generatedNameKept ? oldPolicyName : derivedPolicyName;
 		const newPrincipals = principalsOf(properties);
 		const oldPrincipals = principalsOf(previousProperties);
 		const liveKinds = !("malformed" in newPrincipals) && onlySecretDerived(oldPrincipals) ? oldPrincipals.malformed : [];
@@ -5403,11 +5420,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["BucketName"]) return void 0;
-		return generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true,
-			allowedPattern: /[^a-z0-9.-]/g
-		});
+		return generatedNameFor("AWS::S3::Bucket", logicalId);
 	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
@@ -5754,7 +5767,7 @@ var SQSQueueProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["QueueName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 80 });
+		return generatedNameFor("AWS::SQS::Queue", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const resp = await this.sqsClient.send(new GetQueueAttributesCommand({
@@ -5835,7 +5848,7 @@ var SQSQueueProvider = class {
 				QueueUrl: physicalId,
 				AttributeNames: ["QueueArn"]
 			}));
-			const queueName = properties["QueueName"] || generateResourceName(logicalId, { maxLength: 80 });
+			const queueName = properties["QueueName"] || physicalId.split("/").pop() || generatedNameFor("AWS::SQS::Queue", logicalId);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -6845,7 +6858,7 @@ var SNSTopicProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["TopicName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 256 });
+		return generatedNameFor("AWS::SNS::Topic", logicalId);
 	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7837,7 +7850,7 @@ var LambdaFunctionProvider = class {
 		this.ec2Client = awsClients.ec2;
 	}
 	async create(logicalId, resourceType, properties, context) {
-		const functionName = properties["FunctionName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const functionName = properties["FunctionName"] || generatedNameFor("AWS::Lambda::Function", logicalId);
 		const log = lambdaOperationSinks(this.logger, context?.maskSecrets, [[properties["FunctionName"], functionName]], properties);
 		log.debug(`Creating Lambda function ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -8596,13 +8609,7 @@ var LambdaPermissionProvider = class {
 		if (!action) throw new ProvisioningError(`Action is required for Lambda permission ${logicalId}`, resourceType, logicalId);
 		const principal = properties["Principal"];
 		if (!principal) throw new ProvisioningError(`Principal is required for Lambda permission ${logicalId}`, resourceType, logicalId);
-		let statementId = logicalId.replace(/[^a-zA-Z0-9_-]/g, "");
-		if (statementId.length > 100) {
-			let hashNum = 0;
-			for (let i = 0; i < logicalId.length; i++) hashNum = (hashNum << 5) - hashNum + logicalId.charCodeAt(i) | 0;
-			const hash = Math.abs(hashNum).toString(16).padStart(8, "0").substring(0, 8);
-			statementId = `${statementId.substring(0, 91)}-${hash}`;
-		}
+		const statementId = permissionStatementId(logicalId);
 		try {
 			const addParams = {
 				FunctionName: functionName,
@@ -8768,6 +8775,20 @@ var LambdaPermissionProvider = class {
 		return null;
 	}
 };
+function permissionStatementId(logicalId) {
+	if (getCurrentStackInstanceId() !== void 0 || isBeforeStateRead()) return generateResourceName(logicalId, {
+		maxLength: 100,
+		allowedPattern: /[^a-zA-Z0-9_-]/g
+	});
+	let statementId = logicalId.replace(/[^a-zA-Z0-9_-]/g, "");
+	if (statementId.length > 100) {
+		let hashNum = 0;
+		for (let i = 0; i < logicalId.length; i++) hashNum = (hashNum << 5) - hashNum + logicalId.charCodeAt(i) | 0;
+		const hash = Math.abs(hashNum).toString(16).padStart(8, "0").substring(0, 8);
+		statementId = `${statementId.substring(0, 91)}-${hash}`;
+	}
+	return statementId;
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-url-provider.ts
@@ -9576,7 +9597,7 @@ var LambdaLayerVersionProvider = class {
 		});
 	}
 	async create(logicalId, resourceType, properties, context) {
-		const layerName = properties["LayerName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const layerName = properties["LayerName"] || generatedNameFor("AWS::Lambda::LayerVersion", logicalId);
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[properties["LayerName"], layerName], [properties["LayerName"], layerNameSegment(layerName)]]);
 		log.debug(`Creating Lambda layer version ${logicalId}`);
 		const content = properties["Content"];
@@ -11080,7 +11101,7 @@ var LambdaNetworkConnectorProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(safeMsg`Creating Lambda network connector ${logicalId}`);
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generateResourceName(logicalId, { maxLength: 64 });
+		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generatedNameFor("AWS::Lambda::NetworkConnector", logicalId);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
 		const createToken = acquireIdempotencyToken({
 			scope: "CreateNetworkConnector",
@@ -11964,6 +11985,10 @@ const deleteTableRetryDelays = {};
 function maskLeafValue(value, maskSecrets) {
 	return maskDeep(value, maskSecrets);
 }
+const tableNameReleaseWait = {
+	maxPolls: 600,
+	intervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
+};
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	createClient;
@@ -12024,7 +12049,7 @@ var DynamoDBTableProvider = class {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		this.logger.debug(`Creating DynamoDB table ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const tableName = properties["TableName"] || generatedNameFor("AWS::DynamoDB::Table", logicalId);
 		const keySchema = properties["KeySchema"];
 		const attributeDefinitions = properties["AttributeDefinitions"];
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
@@ -12372,6 +12397,22 @@ var DynamoDBTableProvider = class {
 			throw this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async waitForNameReleased(logicalId, physicalId, _resourceType, context) {
+		const mask = context.maskSecrets ?? ((text) => text);
+		this.logger.info(mask(`  Waiting for the deleted DynamoDB table ${physicalId} to release its name...`));
+		for (let poll = 0; poll < tableNameReleaseWait.maxPolls; poll++) {
+			if (context.isInterrupted()) return;
+			try {
+				await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$1) return;
+				this.logger.debug(mask(`DynamoDB table ${logicalId}: name-release check failed: ${describeAwsFailure(error).detail}`));
+				if (!isThrottlingError(error) && !isTransientServerError(error)) return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, tableNameReleaseWait.intervalMs));
+		}
+		this.logger.debug(mask(`DynamoDB table ${logicalId} (${physicalId}) still held its name after the wait`));
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
 		try {
@@ -13433,10 +13474,7 @@ var LogsLogGroupProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["LogGroupName"]) return void 0;
-		return `/cdkd/${generateResourceName(logicalId, {
-			maxLength: 506,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`;
+		return generatedNameFor("AWS::Logs::LogGroup", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const group = (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: physicalId }))).logGroups?.find((g) => g.logGroupName === physicalId);
@@ -14127,7 +14165,7 @@ var CloudWatchAlarmProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["AlarmName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 256 });
+		return generatedNameFor("AWS::CloudWatch::Alarm", logicalId);
 	}
 	async lookupNames(_resourceType, names) {
 		const wanted = new Set(names);
@@ -14446,10 +14484,7 @@ var SecretsManagerSecretProvider = class {
 		const { value: v } = log;
 		log.debug(`Creating secret ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = properties["Name"] || generateResourceName(logicalId, {
-			maxLength: 512,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		});
+		const name = properties["Name"] || generatedNameFor("AWS::SecretsManager::Secret", logicalId);
 		try {
 			let secretString;
 			const rawGenerate = properties["GenerateSecretString"];
@@ -14800,10 +14835,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 		const ssmTags = SSMParameterProvider.desiredSsmTags(properties["Tags"], resourceType, logicalId);
 		const debug = (message) => this.logger.debug(mask(message));
 		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
-		const name = properties["Name"] || `/${generateResourceName(logicalId, {
-			maxLength: 1023,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`;
+		const name = properties["Name"] || generatedNameFor("AWS::SSM::Parameter", logicalId);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
@@ -15191,7 +15223,8 @@ var EventBridgeRuleProvider = class {
 		this.logger.debug(`Updating EventBridge rule ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
-		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
+		const recordedRuleName = physicalId.split("/").pop() ?? "";
+		const ruleName = properties["Name"] || recordedRuleName || generatedNameFor("AWS::Events::Rule", logicalId);
 		const newTargets = properties["Targets"];
 		const oldTargets = previousProperties["Targets"];
 		try {
@@ -15354,7 +15387,7 @@ var EventBridgeRuleProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["Name"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 64 });
+		return generatedNameFor("AWS::Events::Rule", logicalId);
 	}
 	lookupNeedsResolvedProperties(_resourceType, properties) {
 		const bus = properties["EventBusName"];
@@ -17289,7 +17322,7 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "security-group", desiredTags, (TagSpecifications) => createClient.send(new CreateSecurityGroupCommand({
-				GroupName: properties["GroupName"] ?? logicalId,
+				GroupName: properties["GroupName"] ?? generatedNameFor("AWS::EC2::SecurityGroup", logicalId),
 				Description: groupDescription,
 				VpcId: properties["VpcId"] ?? void 0,
 				...TagSpecifications && { TagSpecifications }
@@ -20330,53 +20363,24 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			}));
 			try {
 				const integration = properties["Integration"];
-				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand({
+				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand(putIntegrationInput({
 					restApiId,
 					resourceId,
-					httpMethod,
-					type: integration["Type"],
-					integrationHttpMethod: integration["IntegrationHttpMethod"],
-					uri: integration["Uri"],
-					connectionType: integration["ConnectionType"],
-					connectionId: integration["ConnectionId"],
-					credentials: integration["Credentials"],
-					requestParameters: integration["RequestParameters"],
-					requestTemplates: integration["RequestTemplates"],
-					passthroughBehavior: integration["PassthroughBehavior"],
-					contentHandling: integration["ContentHandling"],
-					timeoutInMillis: integration["TimeoutInMillis"],
-					cacheNamespace: integration["CacheNamespace"],
-					cacheKeyParameters: integration["CacheKeyParameters"],
-					tlsConfig: integration["TlsConfig"] ? { insecureSkipVerification: integration["TlsConfig"]["InsecureSkipVerification"] } : void 0,
-					responseTransferMode: integration["ResponseTransferMode"]
-				}));
+					httpMethod
+				}, integration)));
 				const methodResponses = properties["MethodResponses"];
-				if (methodResponses) for (const resp of methodResponses) {
-					const statusCode = String(resp["StatusCode"]);
-					await this.apiGatewayClient.send(new PutMethodResponseCommand({
-						restApiId,
-						resourceId,
-						httpMethod,
-						statusCode,
-						responseModels: resp["ResponseModels"],
-						responseParameters: resp["ResponseParameters"]
-					}));
-				}
+				if (methodResponses) for (const resp of methodResponses) await this.apiGatewayClient.send(new PutMethodResponseCommand(putMethodResponseInput({
+					restApiId,
+					resourceId,
+					httpMethod
+				}, resp)));
 				if (integration) {
 					const integrationResponses = integration["IntegrationResponses"];
-					if (integrationResponses) for (const ir of integrationResponses) {
-						const statusCode = String(ir["StatusCode"]);
-						await this.apiGatewayClient.send(new PutIntegrationResponseCommand({
-							restApiId,
-							resourceId,
-							httpMethod,
-							statusCode,
-							selectionPattern: ir["SelectionPattern"],
-							responseParameters: ir["ResponseParameters"],
-							responseTemplates: ir["ResponseTemplates"],
-							contentHandling: ir["ContentHandling"]
-						}));
-					}
+					if (integrationResponses) for (const ir of integrationResponses) await this.apiGatewayClient.send(new PutIntegrationResponseCommand(putIntegrationResponseInput({
+						restApiId,
+						resourceId,
+						httpMethod
+					}, ir)));
 				}
 			} catch (innerError) {
 				try {
@@ -20449,7 +20453,12 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			path: "/authorizationScopes",
 			value: (newScopes ?? []).join(",")
 		});
-		if (patchOperations.length === 0) {
+		const childCalls = methodChildCalls({
+			restApiId,
+			resourceId,
+			httpMethod
+		}, properties, previousProperties);
+		if (patchOperations.length === 0 && childCalls.length === 0) {
 			log.debug(`No changes detected for API Gateway Method ${logicalId}`);
 			return {
 				physicalId,
@@ -20457,13 +20466,18 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			};
 		}
 		try {
-			await this.apiGatewayClient.send(new UpdateMethodCommand({
+			if (patchOperations.length > 0) await this.apiGatewayClient.send(new UpdateMethodCommand({
 				restApiId,
 				resourceId,
 				httpMethod,
 				patchOperations
 			}));
-			log.debug(`Successfully updated API Gateway Method ${logicalId} (${patchOperations.length} patch ops)`);
+			for (const call of childCalls) try {
+				await this.apiGatewayClient.send(call.command);
+			} catch (error) {
+				if (!(call.kind === "delete" && error instanceof NotFoundException$1)) throw error;
+			}
+			log.debug(`Successfully updated API Gateway Method ${logicalId} (${patchOperations.length} patch ops, ${childCalls.length} sub-resource calls)`);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -20823,6 +20837,127 @@ function appendMapPatchOps(ops, basePath, next, prev) {
 		path: `${basePath}/${escape(key)}`
 	});
 }
+function putIntegrationInput(ids, integration) {
+	return {
+		...ids,
+		type: integration["Type"],
+		integrationHttpMethod: integration["IntegrationHttpMethod"],
+		uri: integration["Uri"],
+		connectionType: integration["ConnectionType"],
+		connectionId: integration["ConnectionId"],
+		credentials: integration["Credentials"],
+		requestParameters: integration["RequestParameters"],
+		requestTemplates: integration["RequestTemplates"],
+		passthroughBehavior: integration["PassthroughBehavior"],
+		contentHandling: integration["ContentHandling"],
+		timeoutInMillis: integration["TimeoutInMillis"],
+		cacheNamespace: integration["CacheNamespace"],
+		cacheKeyParameters: integration["CacheKeyParameters"],
+		tlsConfig: integration["TlsConfig"] ? { insecureSkipVerification: integration["TlsConfig"]["InsecureSkipVerification"] } : void 0,
+		responseTransferMode: integration["ResponseTransferMode"]
+	};
+}
+function putMethodResponseInput(ids, resp) {
+	return {
+		...ids,
+		statusCode: String(resp["StatusCode"]),
+		responseModels: resp["ResponseModels"],
+		responseParameters: resp["ResponseParameters"]
+	};
+}
+function putIntegrationResponseInput(ids, ir) {
+	return {
+		...ids,
+		statusCode: String(ir["StatusCode"]),
+		selectionPattern: ir["SelectionPattern"],
+		responseParameters: ir["ResponseParameters"],
+		responseTemplates: ir["ResponseTemplates"],
+		contentHandling: ir["ContentHandling"]
+	};
+}
+function isCfnMethodChildShape(props) {
+	const integration = integrationBlock(props["Integration"]);
+	if (integration !== void 0 && !("Type" in integration)) return false;
+	const responses = props["MethodResponses"];
+	return responses === void 0 || Array.isArray(responses);
+}
+function responsesByStatus(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const entry of value) if (entry !== null && typeof entry === "object" && !Array.isArray(entry)) {
+		const record = entry;
+		out.set(String(record["StatusCode"]), record);
+	}
+	return out;
+}
+function integrationBlock(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0 ? value : void 0;
+}
+function methodChildCalls(ids, desired, previous) {
+	if (!isCfnMethodChildShape(desired) || !isCfnMethodChildShape(previous)) return [];
+	const newInt = integrationBlock(desired["Integration"]);
+	const oldInt = integrationBlock(previous["Integration"]);
+	const newMr = responsesByStatus(desired["MethodResponses"]);
+	const oldMr = responsesByStatus(previous["MethodResponses"]);
+	const newIr = responsesByStatus(newInt?.["IntegrationResponses"]);
+	const oldIr = responsesByStatus(oldInt?.["IntegrationResponses"]);
+	const withoutResponses = (b) => {
+		if (b === void 0) return void 0;
+		const { IntegrationResponses: _dropped, ...rest } = b;
+		return rest;
+	};
+	const integrationChanged = !isDeepStrictEqual(withoutResponses(newInt), withoutResponses(oldInt));
+	const mrGoing = [...oldMr.keys()].filter((code) => !newMr.has(code) || !isDeepStrictEqual(newMr.get(code), oldMr.get(code)));
+	const mrComing = [...newMr.keys()].filter((code) => !oldMr.has(code) || !isDeepStrictEqual(newMr.get(code), oldMr.get(code)));
+	const calls = [];
+	const liveIr = new Map(oldInt === void 0 ? [] : oldIr);
+	if (oldInt !== void 0 && newInt === void 0) {
+		calls.push({
+			kind: "delete",
+			command: new DeleteIntegrationCommand(ids)
+		});
+		liveIr.clear();
+	} else if (oldInt !== void 0) {
+		for (const code of oldIr.keys()) if (!newIr.has(code) || mrGoing.includes(code)) {
+			calls.push({
+				kind: "delete",
+				command: new DeleteIntegrationResponseCommand({
+					...ids,
+					statusCode: code
+				})
+			});
+			liveIr.delete(code);
+		}
+	}
+	for (const code of mrGoing) calls.push({
+		kind: "delete",
+		command: new DeleteMethodResponseCommand({
+			...ids,
+			statusCode: code
+		})
+	});
+	for (const code of mrComing) calls.push({
+		kind: "put",
+		command: new PutMethodResponseCommand(putMethodResponseInput(ids, newMr.get(code)))
+	});
+	if (newInt !== void 0) {
+		if (integrationChanged) {
+			calls.push({
+				kind: "put",
+				command: new PutIntegrationCommand(putIntegrationInput(ids, newInt))
+			});
+			liveIr.clear();
+		}
+		for (const [code, ir] of newIr) {
+			if (liveIr.has(code) && isDeepStrictEqual(liveIr.get(code), ir)) continue;
+			calls.push({
+				kind: "put",
+				command: new PutIntegrationResponseCommand(putIntegrationResponseInput(ids, ir))
+			});
+		}
+	}
+	return calls;
+}
 
 //#endregion
 //#region src/provisioning/providers/apigatewayv2-provider.ts
@@ -21247,7 +21382,7 @@ var ApiGatewayV2Provider = class {
 		const apiId = properties?.["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to delete Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		try {
-			await this.getClient().send(new DeleteIntegrationCommand({
+			await this.getClient().send(new DeleteIntegrationCommand$1({
 				ApiId: apiId,
 				IntegrationId: physicalId
 			}));
@@ -23852,7 +23987,7 @@ var StepFunctionsProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["StateMachineName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 80 });
+		return generatedNameFor("AWS::StepFunctions::StateMachine", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: physicalId }));
@@ -24355,7 +24490,7 @@ var ECSProvider = class {
 	async createTaskDefinition(logicalId, resourceType, properties, log) {
 		log.debug(`Creating ECS task definition ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const family = properties["Family"] || generateResourceName(logicalId, { maxLength: 255 });
+		const family = properties["Family"] || generatedNameFor("AWS::ECS::TaskDefinition", logicalId);
 		try {
 			const orphanWindow = registerTaskDefinitionLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleOrphanTaskDefinitions(logicalId, family, orphanWindow, log);
@@ -24432,7 +24567,7 @@ var ECSProvider = class {
 		log.debug(`Creating ECS service ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
-		const serviceName = properties["ServiceName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const serviceName = properties["ServiceName"] || generatedNameFor("AWS::ECS::Service", logicalId);
 		let survivorArn;
 		try {
 			const heldBefore = process.env["CDKD_FULL_WAIT"] === "true" ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
@@ -25368,7 +25503,7 @@ var ECSProvider = class {
 	}
 	generatedCreateName(resourceType, logicalId, properties) {
 		if (resourceType !== "AWS::ECS::Cluster" || properties["ClusterName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 255 });
+		return generatedNameFor("AWS::ECS::Cluster", logicalId);
 	}
 	async lookupNames(resourceType, names) {
 		const found = /* @__PURE__ */ new Map();
@@ -26930,7 +27065,7 @@ var RDSDBProxyProvider = class {
 	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
-		const dbProxyName = properties["DBProxyName"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const dbProxyName = properties["DBProxyName"] ?? generatedNameFor("AWS::RDS::DBProxy", logicalId);
 		const engineFamily = properties["EngineFamily"];
 		if (!engineFamily) throw new ProvisioningError(`EngineFamily is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const auth = properties["Auth"];
@@ -27253,7 +27388,7 @@ var RDSDBProxyEndpointProvider = class {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyEndpoint ${logicalId}`, resourceType, logicalId);
-		const dbProxyEndpointName = properties["DBProxyEndpointName"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const dbProxyEndpointName = properties["DBProxyEndpointName"] ?? generatedNameFor("AWS::RDS::DBProxyEndpoint", logicalId);
 		const vpcSubnetIds = properties["VpcSubnetIds"];
 		if (!vpcSubnetIds || vpcSubnetIds.length === 0) throw new ProvisioningError(`VpcSubnetIds (at least one) is required for AWS::RDS::DBProxyEndpoint ${logicalId}`, resourceType, logicalId);
 		const client = this.getClient();
@@ -28145,10 +28280,7 @@ var DocDBProvider = class {
 	async createDBCluster(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating DocDB DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true
-		});
+		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
 		try {
@@ -28294,10 +28426,7 @@ var DocDBProvider = class {
 	async createDBInstance(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating DocDB DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true
-		});
+		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::DocDB::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
 		try {
@@ -28613,10 +28742,7 @@ var DocDBSubnetGroupProvider = class {
 		this.assertType(resourceType, logicalId);
 		this.logger.debug(safeMsg`Creating DocDB DBSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generateResourceName(logicalId, {
-			maxLength: 255,
-			lowercase: true
-		});
+		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generatedNameFor("AWS::DocDB::DBSubnetGroup", logicalId);
 		try {
 			await this.getCreateClient().send(new CreateDBSubnetGroupCommand$1({
 				DBSubnetGroupName: dbSubnetGroupName,
@@ -30024,7 +30150,7 @@ var WAFv2WebACLProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const name = properties["Name"] || generatedNameFor("AWS::WAFv2::WebACL", logicalId);
 		const scope = requireConfigString(properties["Scope"], "REGIONAL", "AWS::WAFv2::WebACL Scope", replayWarn(this.logger, context));
 		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
@@ -30563,7 +30689,7 @@ var CognitoUserPoolProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Cognito User Pool ${logicalId}`);
-		const poolName = properties["UserPoolName"] || generateResourceName(logicalId, { maxLength: 128 });
+		const poolName = properties["UserPoolName"] || generatedNameFor("AWS::Cognito::UserPool", logicalId);
 		let mfaConfiguration;
 		try {
 			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], replayWarn(this.logger, context));
@@ -31326,10 +31452,7 @@ var ElastiCacheProvider = class {
 	async createSubnetGroup(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CacheSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generateResourceName(logicalId, {
-			maxLength: 255,
-			lowercase: true
-		});
+		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generatedNameFor("AWS::ElastiCache::SubnetGroup", logicalId);
 		try {
 			await this.getCreateClient().send(new CreateCacheSubnetGroupCommand({
 				CacheSubnetGroupName: cacheSubnetGroupName,
@@ -31393,10 +31516,7 @@ var ElastiCacheProvider = class {
 	async createCacheCluster(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CacheCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const cacheClusterId = properties["ClusterName"] || generateResourceName(logicalId, {
-			maxLength: 40,
-			lowercase: true
-		});
+		const cacheClusterId = properties["ClusterName"] || generatedNameFor("AWS::ElastiCache::CacheCluster", logicalId);
 		let clusterCreated = false;
 		try {
 			await this.getCreateClient().send(new CreateCacheClusterCommand({
@@ -31861,7 +31981,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
-			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.changedProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -32196,11 +32316,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw thrown;
 		}
 	}
-	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets, changedProperties) {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const client = this.getClient();
-		const servicePlan = this.planServiceChange(properties, previousProperties);
+		const servicePlan = this.planServiceChange(properties, previousProperties, changedProperties);
 		const serviceChange = servicePlan?.change ?? {};
 		const newAttrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 		const oldAttrs = this.normalizeServiceAttributes(previousProperties["ServiceAttributes"]);
@@ -32286,8 +32406,9 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	planServiceChange(properties, previousProperties) {
-		const declaredDiffers = (key) => properties[key] !== void 0 && !sameAsRecorded(properties[key], previousProperties[key]);
+	planServiceChange(properties, previousProperties, changedProperties) {
+		const changed = (key) => changedProperties !== void 0 ? changedProperties.has(key) : !sameAsRecorded(properties[key], previousProperties[key]);
+		const declaredDiffers = (key) => properties[key] !== void 0 && changed(key);
 		const change = {};
 		if (properties["Description"] !== void 0) change.Description = properties["Description"];
 		const desiredRecords = properties["DnsConfig"]?.DnsRecords;
@@ -32298,7 +32419,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			change,
 			keepRemovedFromLive: false
 		};
-		if (desiredRecords !== void 0 && !sameAsRecorded(desiredRecords, previousRecords)) return {
+		if (desiredRecords !== void 0 && (changedProperties === void 0 || changedProperties.has("DnsConfig")) && !sameAsRecorded(desiredRecords, previousRecords)) return {
 			change,
 			keepRemovedFromLive: true
 		};
@@ -35557,7 +35678,7 @@ var GlueJobProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Job ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Job", logicalId);
 		const role = properties["Role"];
 		const command = properties["Command"];
 		if (!role) throw new ProvisioningError(`Role is required for Glue Job ${logicalId}`, resourceType, logicalId);
@@ -35845,7 +35966,7 @@ var GlueCrawlerProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Crawler ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Crawler", logicalId);
 		const role = properties["Role"];
 		const targets = properties["Targets"];
 		if (!role) throw new ProvisioningError(`Role is required for Glue Crawler ${logicalId}`, resourceType, logicalId);
@@ -36095,7 +36216,7 @@ var GlueConnectionProvider = class {
 		log.debug(`Creating Glue Connection ${logicalId}`);
 		const connectionInput = properties["ConnectionInput"];
 		if (!connectionInput) throw new ProvisioningError(`ConnectionInput is required for Glue Connection ${logicalId}`, resourceType, logicalId);
-		const name = connectionInput["Name"] ?? logicalId;
+		const name = connectionInput["Name"] ?? generatedNameFor("AWS::Glue::Connection", logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getCreateClient().send(new CreateConnectionCommand({
@@ -36300,7 +36421,7 @@ var GlueTriggerProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Trigger ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Trigger", logicalId);
 		const type = properties["Type"];
 		const actions = properties["Actions"];
 		if (!type) throw new ProvisioningError(`Type is required for Glue Trigger ${logicalId}`, resourceType, logicalId);
@@ -37709,7 +37830,7 @@ var KinesisStreamProvider = class {
 		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const streamName = properties["Name"] || generatedNameFor("AWS::Kinesis::Stream", logicalId);
 		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 		if (desiredRead.kind === "unusable") {
 			if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
@@ -38455,7 +38576,7 @@ var SchedulerScheduleProvider = class {
 		return result;
 	}
 	async create(logicalId, resourceType, properties) {
-		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const name = properties["Name"] ?? generatedNameFor("AWS::Scheduler::Schedule", logicalId);
 		const groupName = this.groupNameOf(properties);
 		this.logger.debug(`Creating Schedule ${logicalId}: ${name}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
@@ -38995,7 +39116,7 @@ var PipesPipeProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
-		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const name = properties["Name"] ?? generatedNameFor("AWS::Pipes::Pipe", logicalId);
 		const tags = desiredTagMap(properties["Tags"], logicalId);
 		this.logger.debug(mask(`Creating Pipe ${logicalId}: ${name}`));
 		let createdIdentity;
@@ -41165,7 +41286,7 @@ const leftInPlaceWarning$1 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyCluster keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyCluster keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyCluster keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyCluster keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 const toNumber$2 = (v) => {
 	if (v === void 0) return void 0;
@@ -42297,7 +42418,7 @@ const leftInPlaceWarning = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyInstanceFleet keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyInstanceFleet keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyInstanceFleet keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyInstanceFleet keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 const addInstanceFleetLatch = new AmbiguousCreateLatch("emr:AddInstanceFleet");
 const fleetsCreatedByThisProcess = new RecentIdSet();
@@ -42682,7 +42803,7 @@ var FirehoseProvider = class {
 		let createdStreamName;
 		try {
 			const input = {
-				DeliveryStreamName: deliveryStreamName || logicalId,
+				DeliveryStreamName: deliveryStreamName || generatedNameFor("AWS::KinesisFirehose::DeliveryStream", logicalId),
 				DeliveryStreamType: deliveryStreamType
 			};
 			if (properties["S3DestinationConfiguration"]) {
@@ -43578,7 +43699,7 @@ var CloudTrailProvider = class {
 		let createdTrailArn;
 		try {
 			const result = await this.getCreateClient().send(new CreateTrailCommand({
-				Name: trailName ?? logicalId,
+				Name: trailName ?? generatedNameFor("AWS::CloudTrail::Trail", logicalId),
 				S3BucketName: s3BucketName,
 				S3KeyPrefix: s3KeyPrefix,
 				IsMultiRegionTrail: isMultiRegionTrail,
@@ -43923,8 +44044,8 @@ var CodeBuildProvider = class {
 			artifactIdentifier: artifacts["ArtifactIdentifier"]
 		};
 	}
-	mapProperties(logicalId, properties) {
-		const name = properties["Name"] ?? logicalId;
+	mapProperties(undeclaredName, properties) {
+		const name = properties["Name"] ?? undeclaredName();
 		const source = properties["Source"];
 		const environment = properties["Environment"];
 		const sanitizeOptionalString = (value) => {
@@ -44053,7 +44174,7 @@ var CodeBuildProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CodeBuild Project ${logicalId}`);
 		try {
-			const input = this.mapProperties(logicalId, properties);
+			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
 			const result = await this.getCreateClient().send(new CreateProjectCommand(input));
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
@@ -44071,7 +44192,7 @@ var CodeBuildProvider = class {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
-			const input = this.mapProperties(logicalId, properties);
+			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
 			await this.getClient().send(new UpdateProjectCommand(input));
@@ -44425,7 +44546,7 @@ var CodeCommitRepositoryProvider = class {
 	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CodeCommit Repository ${logicalId}`);
-		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 100 });
+		const repositoryName = properties["RepositoryName"] || generatedNameFor("AWS::CodeCommit::Repository", logicalId);
 		const lists = this.readDesiredLists(logicalId, resourceType, {
 			Triggers: properties["Triggers"],
 			Tags: properties["Tags"]
@@ -45367,10 +45488,7 @@ var S3DirectoryBucketProvider = class {
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
 		let bucketName = properties["BucketName"];
-		if (!bucketName) bucketName = `${generateResourceName(logicalId, {
-			maxLength: 64,
-			lowercase: true
-		})}--${azId}--x-s3`;
+		if (!bucketName) bucketName = generatedNameFor("AWS::S3Express::DirectoryBucket", logicalId, { zoneId: azId });
 		const tags = desiredTags;
 		const includeTags = tags.length > 0;
 		try {
@@ -46304,7 +46422,7 @@ var ECRProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating ECR Repository ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 256 }).toLowerCase();
+		const repositoryName = properties["RepositoryName"] || generatedNameFor("AWS::ECR::Repository", logicalId);
 		let repositoryCreated = false;
 		try {
 			const tags = properties["Tags"] !== void 0 && properties["Tags"] !== null ? desiredTags : void 0;
@@ -47292,4 +47410,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CBbWGsK0.js.map
+//# sourceMappingURL=provider-classes-B2_u4Fg0.js.map