@go-to-k/cdkd 0.302.2 → 0.302.4

package/dist/{provider-classes-CUKmyCQ8.js → provider-classes-B52ogqNj.js}

@@ -1,14 +1,15 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback } from "./aws-failure-text-e_ddrDDo.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, kt as isAuxiliaryFailure, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-OtGPguLH.js";
+import { $ as UNNAMEABLE_ID_CLAUSE, $n as isNameCollisionError, A as isQuotableImportValue, B as deleteWithProtectionCompensation, Bn as hasClauseBreak, C as setBounded, Cn as ProvisioningError, Cr as markRedactedCause, Ct as isSecretDerivedValue, D as VALUE_NOT_SHOWN, E as assertRegionMatch, Et as withDerivedNameMasks, F as resolveExplicitPhysicalId, Ft as markAuxiliaryFailure, G as logGroupProtectionSite, Hn as pasteableCommand, It as markCreatedBeforeFailure, J as rdsFamilyProtectionSite, Jn as withheldTargetClause, K as observeThenDisableProtection, L as ProtectionFlipRegistry, Lt as markSupersedesEarlierCreate, M as quotedRemedyLogicalId, N as refusalTypeShown, Nt as isAuxiliaryFailure, O as isPlainImportJson, P as remedyLogicalId, S as replayedSendWindow, Sr as markNonRetryable, St as createMaskedRetryLogger, T as RESOURCE_NOT_FOUND, Tn as ResourceUpdateNotSupportedError, Tt as maskerOrIdentity, Vn as isInertUnquoted, W as isTerminalDeleteFailure, Wn as plainOrDescribed, Xt as injectiveKey, Z as userPoolProtectionSite, Zt as injectiveKeyPrefix, _ as RecentIdSet, _r as isTransientServerError, _t as packCompositeId, a as onlySecretDerived, an as credentialFingerprint, ar as markReplayMayCollide, b as isInsideWindow, br as isMarkedNonRetryable, bt as stateOrphanRecordRemedy, c as recordedPrincipalsRepair, cn as CdkdError, ct as isInterruptedWaitError, et as WITHHELD_AWS_COMMAND, ft as canonicalizeRoute53QueryName, g as AmbiguousCreateLatch, gr as isRetryableTransientError, gt as logicalIdShown, h as AMBIGUOUS_LATCH_TTL_MS, ht as compositeIdSkipResult, i as holdsSecretDerivedEntry, in as clientDefaultsFor, ir as markNameCollision, it as renderDisableCommand, j as normalizeAwsTagsToCfn, k as isPlainImportValue, kt as clearCreatedBeforeFailure, lt as startInterruptWatch, mr as isExplicitDenyError, mt as compositeIdSeparatorRefusal, nn as ambientClientDefaults, nt as pasteableAwsCommand, o as readPrincipalLists, on as AccountIdUnavailableError, or as relayedNameCollision, p as withRemovalDefaults, pr as isAmbiguousOutcomeError, pt as compositeIdFormatMessage, q as protectionFlipKey, qn as shellQuote, r as SECRET_DERIVED_READ_LIVE, rn as ambientCredentialConfig, rt as protectedReplacementAdvice, tn as withPasteableAwsProfile, tt as isAwsCliLiteral, u as clearOnUpdateRemoval, ur as explicitDenyPolicyKind, ut as ElapsedBudgetRegistry, v as ambiguousAttemptLead, w as withoutServerErrorRetries, wr as wrapMaskedAwsError, wt as maskDeep, x as replayFollowedAmbiguousAttempt, xr as isThrottlingError, xt as createMaskedLogSinks, y as createAttemptKey, yr as THROTTLING_ERROR_NAMES, yt as segmentAfterAnchor, z as deleteAfterProtectionFlipWithFinalSnapshot, zn as commandHole } from "./iam-policy-targets-DBAi38y_.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-B_xWnZ4Q.js";
+import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-CN2w5GAK.js";
 import { D as markSameGenerationBag, F as redactForState, H as recordReferenceProvenanceEntry, Jt as physicalNameCopiesOf, Tt as dynamicReferenceTokens, W as snapshotPassProvenance, Y as hasMaskableValues, Yt as recordAttributeIdCopy, m as passedNoEchoParametersOf, nn as carriesSecretMask, qt as recoverMaskedOutput, xt as withoutPhysicalNameCopies } from "./secret-redaction-BHWS-PZK.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-TdX7t0Ac.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DDJHp1K3.js";
-import { RDSProvider } from "./rds-provider-Bxh9YW5y.js";
-import { NeptuneProvider } from "./neptune-provider-CUoBJ6Ys.js";
-import { ASGProvider } from "./asg-provider-B5RKfCs2.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Cv7YzUwO.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CAibYjpk.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D0e5Ryd_.js";
+import { RDSProvider } from "./rds-provider-C6jYh60H.js";
+import { NeptuneProvider } from "./neptune-provider-BcENx6g8.js";
+import { ASGProvider } from "./asg-provider-CGqU-6sj.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -49,8 +50,8 @@ import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPo
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
@@ -59,11 +60,11 @@ import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as Ad
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
-import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -117,7 +118,11 @@ var IAMPolicyProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMPolicyProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::Policy", /* @__PURE__ */ new Set([
 		"PolicyName",
@@ -516,7 +521,8 @@ var IAMPolicyProvider = class {
 			this.logger.debug(`Successfully deleted IAM policy ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(describeAwsFailure(error).detail)}`, resourceType, logicalId, physicalId, cause);
+			const opMask = createMaskedLogSinks(this.logger, context?.maskSecrets).mask;
+			const failure = this.wrapMaskedError((text) => mask(opMask(text)), error, (text) => new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
@@ -1213,7 +1219,11 @@ var IAMInstanceProfileProvider = class {
 	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMInstanceProfileProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::InstanceProfile", /* @__PURE__ */ new Set([
 		"InstanceProfileName",
@@ -1346,7 +1356,8 @@ var IAMInstanceProfileProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		log.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
 		let stripped = false;
 		try {
 			let roles = [];
@@ -1356,7 +1367,7 @@ var IAMInstanceProfileProvider = class {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logGoneOnDelete(logicalId, physicalId, context);
+					this.logGoneOnDelete(logicalId, physicalId, context, log);
 					return;
 				}
 				throw error;
@@ -1367,27 +1378,28 @@ var IAMInstanceProfileProvider = class {
 					RoleName: roleName
 				}));
 				stripped = true;
-				this.logger.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
+				log.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
 			await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: physicalId }));
-			this.logger.debug(`Successfully deleted IAM instance profile ${logicalId}`);
+			log.debug(`Successfully deleted IAM instance profile ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
 				const clientRegion = await this.iamClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logGoneOnDelete(logicalId, physicalId, context);
+				this.logGoneOnDelete(logicalId, physicalId, context, log);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const { mask } = log;
+			const failure = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(mask(`Failed to delete IAM instance profile ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	logGoneOnDelete(logicalId, physicalId, context) {
+	logGoneOnDelete(logicalId, physicalId, context, log) {
 		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM instance profile ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
-		else this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+		else log.debug(`Instance profile ${log.value(physicalId)} does not exist, skipping deletion`);
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
 		if (resourceType !== INSTANCE_PROFILE_TYPE) return "unknown";
@@ -1825,7 +1837,11 @@ var IAMUserGroupProvider = class {
 	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMUserGroupProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::IAM::User", /* @__PURE__ */ new Set([
@@ -2086,7 +2102,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -2367,7 +2383,7 @@ var IAMUserGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -2651,7 +2667,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM UserToGroupAddition ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(describeAwsFailure(error).detail)}`, resourceType, logicalId, physicalId, cause);
+			const opMask = createMaskedLogSinks(this.logger, context?.maskSecrets).mask;
+			const failure = this.wrapMaskedError((text) => mask(opMask(text)), error, (text) => new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
@@ -24788,7 +24805,7 @@ var ECSProvider = class {
 		const serviceConnectConfigurationInput = JSON.stringify(previousProperties["ServiceConnectConfiguration"] ?? null) !== JSON.stringify(properties["ServiceConnectConfiguration"] ?? null) ? clearOnUpdateRemoval(this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]), previousProperties["ServiceConnectConfiguration"], { enabled: false }) : void 0;
 		const volumeConfigurationsInput = JSON.stringify(previousProperties["VolumeConfigurations"] ?? null) !== JSON.stringify(properties["VolumeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]), previousProperties["VolumeConfigurations"], []) : void 0;
 		const vpcLatticeConfigurationsInput = JSON.stringify(previousProperties["VpcLatticeConfigurations"] ?? null) !== JSON.stringify(properties["VpcLatticeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]), previousProperties["VpcLatticeConfigurations"], []) : void 0;
-		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) && properties["Monitoring"] != null ? this.convertMonitoringConfiguration(properties["Monitoring"]) : void 0;
+		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) ? clearOnUpdateRemoval(this.convertMonitoringConfiguration(properties["Monitoring"]), previousProperties["Monitoring"], { metricConfigurations: [] }) : void 0;
 		const forceNewDeploymentInput = this.resolveForceNewDeployment(properties, previousProperties, log);
 		const deploymentConfigurationInput = this.resolveDeploymentConfiguration(properties, previousProperties);
 		try {
@@ -27094,6 +27111,16 @@ const RETAINED_ON_REMOVAL = [
 	"DebugLogging",
 	"VpcSecurityGroupIds"
 ];
+const CFN_KEEPS_ON_REMOVAL$1 = /* @__PURE__ */ new Set([
+	"RequireTLS",
+	"IdleClientTimeout",
+	"DebugLogging",
+	"VpcSecurityGroupIds"
+]);
+const authRemovalRefused = (properties) => {
+	const scheme = properties["DefaultAuthScheme"];
+	return scheme === void 0 || scheme === "NONE";
+};
 var RDSDBProxyProvider = class {
 	rdsClient;
 	createClient;
@@ -27197,6 +27224,7 @@ var RDSDBProxyProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && this.removedRetained(properties, previousProperties, context).includes("Auth") && authRemovalRefused(properties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): Auth was removed from the template, but AWS requires Auth while DefaultAuthScheme is NONE or unset, and CloudFormation's update fails on the same change. Declare Auth again; nothing was changed.`, resourceType, logicalId, physicalId));
 		const client = this.getClient();
 		const { mask } = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["DBProxyName"], physicalId]]);
 		for (const field of [
@@ -27245,13 +27273,17 @@ var RDSDBProxyProvider = class {
 		};
 	}
 	warnOnRetainedRemovals(logicalId, resourceType, properties, previousProperties, context) {
-		const removed = context?.removedProperties;
-		const retained = [];
-		for (const key of RETAINED_ON_REMOVAL) if (removed !== void 0 ? removed.has(key) : previousProperties[key] !== void 0 && properties[key] === void 0) retained.push(key);
+		const retained = this.removedRetained(properties, previousProperties, context);
 		if (retained.length === 0) return;
 		const one = retained.length === 1;
 		const names = `${one ? "property" : "properties"} ${retained.join(", ")}`;
-		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ModifyDBProxy keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; ModifyDBProxy keeps a setting it is not sent, so the proxy keeps its current value. Declare the property with the value you want to change it.`);
+		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ModifyDBProxy keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : retained.every((key) => CFN_KEEPS_ON_REMOVAL$1.has(key)) ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyDBProxy keeps a setting it is not sent. Declare the property with the value you want to change it.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; ModifyDBProxy keeps a setting it is not sent, so the proxy keeps its current value. Declare the property with the value you want to change it.`);
+	}
+	removedRetained(properties, previousProperties, context) {
+		const removed = context?.removedProperties;
+		const retained = [];
+		for (const key of RETAINED_ON_REMOVAL) if (removed !== void 0 ? removed.has(key) : previousProperties[key] !== void 0 && properties[key] === void 0) retained.push(key);
+		return retained;
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const client = this.getClient();
@@ -27794,7 +27826,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					ConnectionPoolConfig: connectionPoolConfig
 				}));
 			} catch (error) {
-				throw markAuxiliaryFailure(this.wrapError(error, "CREATE (pool config)", resourceType, logicalId, void 0), logicalId);
+				throw markAuxiliaryFailure(this.wrapError(error, "CREATE (pool config)", resourceType, logicalId, void 0, mask), logicalId);
 			}
 		}
 		if (dbClusterIdentifiers.length > 0 || dbInstanceIdentifiers.length > 0) {
@@ -27807,7 +27839,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					DBInstanceIdentifiers: dbInstanceIdentifiers.length > 0 ? dbInstanceIdentifiers : void 0
 				}));
 			} catch (error) {
-				throw this.wrapError(error, "CREATE (register targets)", resourceType, logicalId, void 0);
+				throw this.wrapError(error, "CREATE (register targets)", resourceType, logicalId, void 0, mask);
 			}
 		}
 		let targetGroupArn;
@@ -27817,7 +27849,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				TargetGroupName: targetGroupName
 			}))).TargetGroups?.[0]?.TargetGroupArn;
 		} catch (error) {
-			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
+			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0, mask), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
 		}
 		if (!targetGroupArn) throw await this.retireRegistrationAfterFailedCreate(new ProvisioningError(`Failed to recover TargetGroupArn for ${dbProxyName}/${targetGroupName} after create`, resourceType, logicalId), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
 		if (tags.length > 0) try {
@@ -27826,7 +27858,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				Tags: tags
 			}));
 		} catch (error) {
-			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (add tags)", resourceType, logicalId, void 0), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets, {
+			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (add tags)", resourceType, logicalId, void 0, mask), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets, {
 				logicalId,
 				resourceType,
 				physicalId: targetGroupArn
@@ -27941,7 +27973,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					ConnectionPoolConfig: newPool ?? {}
 				}));
 			} catch (error) {
-				throw this.wrapError(error, "UPDATE (pool config)", resourceType, logicalId, physicalId);
+				throw this.wrapError(error, "UPDATE (pool config)", resourceType, logicalId, physicalId, mask);
 			}
 		}
 		const clustersToRemove = missingIdentifiers(prev.lists.DBClusterIdentifiers, next.lists.DBClusterIdentifiers);
@@ -27958,7 +27990,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					DBInstanceIdentifiers: instancesToRemove.length > 0 ? instancesToRemove : void 0
 				}));
 			} catch (error) {
-				if (!(error instanceof DBProxyTargetNotFoundFault)) throw this.wrapError(error, "UPDATE (deregister)", resourceType, logicalId, physicalId);
+				if (!(error instanceof DBProxyTargetNotFoundFault)) throw this.wrapError(error, "UPDATE (deregister)", resourceType, logicalId, physicalId, mask);
 			}
 		}
 		if (clustersToAdd.length > 0 || instancesToAdd.length > 0) {
@@ -27971,7 +28003,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					DBInstanceIdentifiers: instancesToAdd.length > 0 ? instancesToAdd : void 0
 				}));
 			} catch (error) {
-				throw this.wrapError(error, "UPDATE (register)", resourceType, logicalId, physicalId);
+				throw this.wrapError(error, "UPDATE (register)", resourceType, logicalId, physicalId, mask);
 			}
 		}
 		const tagsToRemove = tagPlan.remove;
@@ -27985,7 +28017,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				TagKeys: tagsToRemove
 			}));
 		} catch (error) {
-			throw this.wrapError(error, "UPDATE (remove tags)", resourceType, logicalId, physicalId);
+			throw this.wrapError(error, "UPDATE (remove tags)", resourceType, logicalId, physicalId, mask);
 		}
 		if (tagsToAdd.length > 0) try {
 			await client.send(new AddTagsToResourceCommand$2({
@@ -27993,7 +28025,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				Tags: tagsToAdd
 			}));
 		} catch (error) {
-			throw this.wrapError(error, "UPDATE (add tags)", resourceType, logicalId, physicalId);
+			throw this.wrapError(error, "UPDATE (add tags)", resourceType, logicalId, physicalId, mask);
 		}
 		return {
 			physicalId,
@@ -28057,7 +28089,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				this.logger.debug(mask(`${mask(dbProxyName)}/${mask(targetGroupName)} or its target is already gone, treating as success`));
 				return;
 			}
-			throw this.wrapError(error, "DELETE", resourceType, logicalId, physicalId);
+			throw this.wrapError(error, "DELETE", resourceType, logicalId, physicalId, mask);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -28150,7 +28182,9 @@ var RDSDBProxyTargetGroupProvider = class {
 				targets = aws`${targets} --db-instance-identifiers`;
 				for (const id of instances) targets = aws`${targets} ${id}`;
 			}
-			original.message += ` The targets this create registered are still registered and could not be deregistered (${describeAwsFailure(cleanupError).detail}). Manual cleanup: ` + aws`aws rds deregister-db-proxy-targets --db-proxy-name ${dbProxyName} --target-group-name ${targetGroupName}${targets}`.render();
+			const cleanupFailure = describeAwsFailure(cleanupError);
+			if (cleanupFailure.redacted) this.logger.debug(maskerOrIdentity(maskSecrets)(`Deregistering the targets a failed create registered failed: ${cleanupFailure.detail}`));
+			original.message += ` The targets this create registered are still registered and could not be deregistered (${cleanupFailure.summary.replace(/\.$/, "")}). Manual cleanup: ` + aws`aws rds deregister-db-proxy-targets --db-proxy-name ${dbProxyName} --target-group-name ${targetGroupName}${targets}`.render();
 			if (leftBehind) markCreatedBeforeFailure(original, leftBehind.logicalId, leftBehind.resourceType, leftBehind.physicalId);
 			return original;
 		}
@@ -28166,7 +28200,8 @@ var RDSDBProxyTargetGroupProvider = class {
 			if (error instanceof DBProxyNotFoundFault || targetGroupName !== void 0 && error instanceof DBProxyTargetGroupNotFoundFault) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`${dbProxyName}/${targetGroupName ?? "*"} is already gone; the record needs no deregistration`);
+				const mask = maskerOrIdentity(context?.maskSecrets);
+				this.logger.debug(mask(`${mask(dbProxyName)}/${targetGroupName === void 0 ? "*" : mask(targetGroupName)} is already gone; the record needs no deregistration`));
 				return true;
 			}
 			this.logger.debug(safeMsg`Could not confirm whether the proxy of DB proxy target group ${logicalId} still exists (${error instanceof Error ? error.name : "unknown error"}); keeping the skip`);
@@ -28195,10 +28230,13 @@ var RDSDBProxyTargetGroupProvider = class {
 		} while (marker);
 		return live;
 	}
-	wrapError(error, op, resourceType, logicalId, physicalId) {
-		const message = error instanceof Error ? error.message : String(error);
+	wrapError(error, op, resourceType, logicalId, physicalId, mask) {
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`${op} failed for ${logicalId}: ${message}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`${op} failed for ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		this.logger.debug(mask(build(failure.detail).message));
+		return markRedactedCause(build(`${failure.summary}${relayedNameCollision(failure.detail)}`));
 	}
 };
 function withoutKey(bag, key) {
@@ -28281,8 +28319,6 @@ function instanceAttributes(instance) {
 function isDbIdentifier(id) {
 	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
 }
-const FINAL_SNAPSHOT_SETTLE_WAIT_MS = 9e5;
-const FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS = 6e4;
 var DocDBProvider = class {
 	docdbClient;
 	createClient;
@@ -28481,14 +28517,15 @@ var DocDBProvider = class {
 				if (!isDocDBNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DocDB DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
 			}
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
-			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.waitForProtectionOffBeforeFinalSnapshot(logicalId, physicalId);
-			await this.getClient().send(new DeleteDBClusterCommand$1({
+			const sendDelete = () => this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
 				...finalSnapshotId ? {
 					SkipFinalSnapshot: false,
 					FinalDBSnapshotIdentifier: finalSnapshotId
 				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.deleteAfterProtectionFlip(logicalId, physicalId, sendDelete);
+			else await sendDelete();
 			flip.deleteAccepted = true;
 			if (finalSnapshotId) this.logger.info(`Deleting DocDB DBCluster ${logicalId} with a final snapshot (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DocDB DBCluster ${logicalId}`);
@@ -28541,13 +28578,21 @@ var DocDBProvider = class {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
-			await this.getClient().send(new ModifyDBInstanceCommand$1({
-				DBInstanceIdentifier: physicalId,
-				DBInstanceClass: properties["DBInstanceClass"],
-				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
-				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
-				ApplyImmediately: true
-			}));
+			await modifyDbInstanceWhenAvailable({
+				send: () => this.getClient().send(new ModifyDBInstanceCommand$1({
+					DBInstanceIdentifier: physicalId,
+					DBInstanceClass: properties["DBInstanceClass"],
+					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
+					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+					ApplyImmediately: true
+				})),
+				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
+				sleep: (ms) => this.sleep(ms),
+				logger: this.logger,
+				label: "DocDB DBInstance",
+				logicalId,
+				remainingMs: enclosingDeadlineRemainingMs()
+			});
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
@@ -28666,21 +28711,24 @@ var DocDBProvider = class {
 		}
 		throw new Error(`Timed out waiting for DocDB DBCluster ${logicalId} to apply its new VPC security groups`);
 	}
-	async waitForProtectionOffBeforeFinalSnapshot(logicalId, physicalId, maxWaitMs = FINAL_SNAPSHOT_SETTLE_WAIT_MS) {
-		const budgetMs = Math.min(maxWaitMs, enclosingDeadlineRemainingMs() - FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS);
-		if (budgetMs <= 0) throw new Error(`--remove-protection turned DeletionProtection off, but the resource timeout leaves no time to wait for the cluster to return to 'available', which the final snapshot its DeletionPolicy asks for needs. The delete was not sent and the guard is put back; re-run the destroy with a longer --resource-timeout`);
-		const startTime = Date.now();
-		let delay = 5e3;
-		for (;;) {
-			const current = await this.describeDBCluster(physicalId);
-			if (current === void 0) return;
-			if (current.DeletionProtection === false && current.Status !== "modifying") return;
-			if (Date.now() - startTime + delay >= budgetMs) break;
-			this.logger.debug(safeMsg`DocDB DBCluster ${logicalId}: waiting for the DeletionProtection change to settle before the final snapshot (status ${current.Status ?? "unknown"})`);
-			await this.sleep(delay);
-			delay = Math.min(delay * 2, 1e4);
-		}
-		throw new Error(`--remove-protection turned DeletionProtection off, but the cluster did not return to 'available' within ${Math.max(1, Math.round(budgetMs / 6e4))} minutes, and the final snapshot its DeletionPolicy asks for needs it. The delete was not sent and the guard is put back; re-run the destroy once the cluster is 'available'`);
+	async deleteAfterProtectionFlip(logicalId, physicalId, send) {
+		await deleteAfterProtectionFlipWithFinalSnapshot({
+			stateFault: "InvalidDBClusterStateFault",
+			send,
+			noun: "cluster",
+			label: "DocDB DBCluster",
+			logicalId,
+			read: async () => {
+				const current = await this.describeDBCluster(physicalId);
+				return current === void 0 ? void 0 : {
+					deletionProtection: current.DeletionProtection,
+					status: current.Status
+				};
+			},
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
 	}
 	async waitForClusterAvailable(dbClusterIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
@@ -37428,6 +37476,117 @@ function removableRecorded(kind, items) {
 		Subscribers: e["Subscribers"].filter((s) => !holdsSecretDerivedEntry(s["Address"]))
 	} : e);
 }
+function finiteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+function isoDate(value) {
+	let date;
+	if (typeof value === "number") date = new Date(value < 0xe8d4a51000 ? value * 1e3 : value);
+	else if (typeof value === "string" && /^\d+$/.test(value)) {
+		const n = Number(value);
+		date = new Date(n < 0xe8d4a51000 ? n * 1e3 : n);
+	} else if (typeof value === "string") date = new Date(value);
+	else if (value instanceof Date) date = value;
+	else return void 0;
+	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+}
+function canonicalSpend(spend) {
+	if (!isPlainRecord(spend)) return spend;
+	const amount = finiteNumber(spend["Amount"]);
+	return amount === void 0 || amount === spend["Amount"] ? spend : {
+		...spend,
+		Amount: amount
+	};
+}
+function canonicalizeBudgetDriftBag(side) {
+	let out = side;
+	const budget = side["Budget"];
+	if (isPlainRecord(budget)) {
+		let nextBudget = budget;
+		const set = (key, value) => {
+			if (value === nextBudget[key]) return;
+			if (nextBudget === budget) nextBudget = { ...budget };
+			nextBudget[key] = value;
+		};
+		set("BudgetLimit", canonicalSpend(budget["BudgetLimit"]));
+		const planned = budget["PlannedBudgetLimits"];
+		if (isPlainRecord(planned)) {
+			const entries = Object.entries(planned).map(([key, spend]) => [key, canonicalSpend(spend)]);
+			if (entries.some(([key, spend]) => spend !== planned[key])) set("PlannedBudgetLimits", Object.fromEntries(entries));
+		}
+		const period = budget["TimePeriod"];
+		if (isPlainRecord(period)) {
+			let nextPeriod = period;
+			for (const key of ["Start", "End"]) {
+				if (period[key] === void 0) continue;
+				const iso = isoDate(period[key]);
+				if (iso === void 0 || iso === period[key]) continue;
+				if (nextPeriod === period) nextPeriod = { ...period };
+				nextPeriod[key] = iso;
+			}
+			set("TimePeriod", nextPeriod);
+		}
+		if (nextBudget !== budget) out = {
+			...out,
+			Budget: nextBudget
+		};
+	}
+	const list = side["NotificationsWithSubscribers"];
+	if (Array.isArray(list)) {
+		let changed = false;
+		const nextList = list.map((entry) => {
+			if (!isPlainRecord(entry) || !isPlainRecord(entry["Notification"])) return entry;
+			const notification = entry["Notification"];
+			const threshold = finiteNumber(notification["Threshold"]);
+			const fillType = notification["ThresholdType"] == null;
+			const fixThreshold = threshold !== void 0 && threshold !== notification["Threshold"];
+			if (!fillType && !fixThreshold) return entry;
+			changed = true;
+			return {
+				...entry,
+				Notification: {
+					...notification,
+					...fixThreshold && { Threshold: threshold },
+					...fillType && { ThresholdType: "PERCENTAGE" }
+				}
+			};
+		});
+		if (changed) out = {
+			...out,
+			NotificationsWithSubscribers: nextList
+		};
+	}
+	return out;
+}
+function declaresLegacyFilterShape(properties) {
+	const budget = properties?.["Budget"];
+	if (!isPlainRecord(budget)) return false;
+	const legacy = budget["CostFilters"] != null || budget["CostTypes"] != null;
+	const current = budget["FilterExpression"] != null || budget["Metrics"] != null;
+	return legacy && !current;
+}
+function dropElapsedPlannedLimits(baseline, aws, nowMs) {
+	const budget = baseline["Budget"];
+	const awsBudget = aws["Budget"];
+	if (!isPlainRecord(budget) || !isPlainRecord(awsBudget)) return baseline;
+	const planned = budget["PlannedBudgetLimits"];
+	if (!isPlainRecord(planned)) return baseline;
+	const awsPlanned = isPlainRecord(awsBudget["PlannedBudgetLimits"]) ? awsBudget["PlannedBudgetLimits"] : {};
+	const elapsed = (key) => !Object.hasOwn(awsPlanned, key) && /^\d+$/.test(key) && Number(key) * 1e3 < nowMs;
+	const kept = Object.entries(planned).filter(([key]) => !elapsed(key));
+	if (kept.length === Object.keys(planned).length) return baseline;
+	return {
+		...baseline,
+		Budget: {
+			...budget,
+			PlannedBudgetLimits: Object.fromEntries(kept)
+		}
+	};
+}
 var BudgetsBudgetProvider = class {
 	client;
 	createClient;
@@ -37820,6 +37979,166 @@ var BudgetsBudgetProvider = class {
 			throw this.wrapMaskedError(maskerOrIdentity(void 0), error, (text) => new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::Budgets::Budget") return void 0;
+		const accountId = await this.resolveAccountId();
+		const client = this.getClient();
+		const describe = async () => {
+			try {
+				return (await client.send(new DescribeBudgetCommand({
+					AccountId: accountId,
+					BudgetName: physicalId,
+					ShowFilterExpression: !declaresLegacyFilterShape(properties)
+				}))).Budget;
+			} catch (error) {
+				if (error instanceof NotFoundException$5) return RESOURCE_NOT_FOUND;
+				throw error;
+			}
+		};
+		const budget = await describe();
+		if (budget === RESOURCE_NOT_FOUND || budget === void 0) return budget;
+		const notifications = await this.listNotifications(accountId, physicalId);
+		if (notifications === void 0 && await describe() === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+		const notificationsWithSubscribers = (await Promise.all((notifications ?? []).map(async (notification) => {
+			const subscribers = await this.listSubscribers(accountId, physicalId, notification);
+			return subscribers === void 0 ? void 0 : {
+				notification,
+				subscribers
+			};
+		}))).filter((e) => e !== void 0).map(({ notification, subscribers }) => ({
+			Notification: {
+				NotificationType: notification.NotificationType,
+				ComparisonOperator: notification.ComparisonOperator,
+				Threshold: notification.Threshold,
+				...notification.ThresholdType !== void 0 && notification.ThresholdType !== "PERCENTAGE" && { ThresholdType: notification.ThresholdType }
+			},
+			Subscribers: subscribers.map((s) => ({
+				SubscriptionType: s.SubscriptionType,
+				Address: s.Address
+			}))
+		}));
+		let tags;
+		try {
+			tags = await client.send(new ListTagsForResourceCommand$15({ ResourceARN: await this.budgetArn(accountId, physicalId) }));
+		} catch (error) {
+			if (error instanceof NotFoundException$5 && await describe() === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		return {
+			Budget: this.budgetFromSdk(budget),
+			NotificationsWithSubscribers: notificationsWithSubscribers,
+			ResourceTags: (tags.ResourceTags ?? []).map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		};
+	}
+	async listNotifications(accountId, budgetName) {
+		const out = [];
+		let token;
+		try {
+			do {
+				const page = await this.getClient().send(new DescribeNotificationsForBudgetCommand({
+					AccountId: accountId,
+					BudgetName: budgetName,
+					MaxResults: 100,
+					...token !== void 0 && { NextToken: token }
+				}));
+				out.push(...page.Notifications ?? []);
+				token = page.NextToken;
+			} while (token);
+		} catch (error) {
+			if (error instanceof NotFoundException$5) return void 0;
+			throw error;
+		}
+		return out;
+	}
+	async listSubscribers(accountId, budgetName, notification) {
+		const out = [];
+		let token;
+		try {
+			do {
+				const page = await this.getClient().send(new DescribeSubscribersForNotificationCommand({
+					AccountId: accountId,
+					BudgetName: budgetName,
+					Notification: {
+						NotificationType: notification.NotificationType,
+						ComparisonOperator: notification.ComparisonOperator,
+						Threshold: notification.Threshold,
+						...notification.ThresholdType !== void 0 && { ThresholdType: notification.ThresholdType }
+					},
+					MaxResults: 100,
+					...token !== void 0 && { NextToken: token }
+				}));
+				out.push(...page.Subscribers ?? []);
+				token = page.NextToken;
+			} while (token);
+		} catch (error) {
+			if (error instanceof NotFoundException$5) return void 0;
+			throw error;
+		}
+		return out;
+	}
+	budgetFromSdk(budget) {
+		const raw = budget;
+		const spend = (s) => s === void 0 ? void 0 : {
+			Amount: finiteNumber(s.Amount) ?? s.Amount,
+			Unit: s.Unit
+		};
+		const out = {
+			BudgetName: budget.BudgetName,
+			BudgetType: raw["BudgetType"],
+			TimeUnit: budget.TimeUnit
+		};
+		if (budget.BudgetLimit) out["BudgetLimit"] = spend(budget.BudgetLimit);
+		if (budget.PlannedBudgetLimits && Object.keys(budget.PlannedBudgetLimits).length > 0) out["PlannedBudgetLimits"] = Object.fromEntries(Object.entries(budget.PlannedBudgetLimits).map(([key, s]) => [key, spend(s)]));
+		if (budget.TimePeriod) out["TimePeriod"] = {
+			...budget.TimePeriod.Start && { Start: isoDate(budget.TimePeriod.Start) },
+			...budget.TimePeriod.End && { End: isoDate(budget.TimePeriod.End) }
+		};
+		if (budget.CostFilters && Object.keys(budget.CostFilters).length > 0) out["CostFilters"] = budget.CostFilters;
+		if (budget.CostTypes) out["CostTypes"] = { ...budget.CostTypes };
+		const autoAdjust = raw["AutoAdjustData"];
+		if (isPlainRecord(autoAdjust)) {
+			const historical = autoAdjust["HistoricalOptions"];
+			out["AutoAdjustData"] = {
+				AutoAdjustType: autoAdjust["AutoAdjustType"],
+				...isPlainRecord(historical) && { HistoricalOptions: { BudgetAdjustmentPeriod: historical["BudgetAdjustmentPeriod"] } }
+			};
+		}
+		if (raw["FilterExpression"] !== void 0) out["FilterExpression"] = raw["FilterExpression"];
+		if (Array.isArray(raw["Metrics"]) && raw["Metrics"].length > 0) out["Metrics"] = raw["Metrics"];
+		if (raw["BillingViewArn"] !== void 0) out["BillingViewArn"] = raw["BillingViewArn"];
+		return out;
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::Budgets::Budget" ? ["NotificationsWithSubscribers"] : [];
+	}
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType !== "AWS::Budgets::Budget") return [];
+		const budget = properties?.["Budget"];
+		if (!isPlainRecord(budget)) return [];
+		const paths = [];
+		if (budget["AutoAdjustData"] != null || budget["PlannedBudgetLimits"] != null) paths.push("Budget.BudgetLimit");
+		if (budget["FilterExpression"] != null || budget["Metrics"] != null) {
+			if (budget["CostTypes"] != null) paths.push("Budget.CostTypes");
+			if (budget["CostFilters"] != null) paths.push("Budget.CostFilters");
+		}
+		return paths;
+	}
+	canonicalizeDriftProperties(resourceType, side) {
+		return resourceType === "AWS::Budgets::Budget" ? canonicalizeBudgetDriftBag(side) : side;
+	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		if (resourceType !== "AWS::Budgets::Budget") return {
+			baseline,
+			aws
+		};
+		return {
+			baseline: dropElapsedPlannedLimits(baseline, aws, Date.now()),
+			aws
+		};
+	}
 	async import(input) {
 		const rawBudget = input.properties["Budget"] ?? {};
 		const explicit = input.knownPhysicalId ?? (typeof rawBudget["BudgetName"] === "string" && rawBudget["BudgetName"].length > 0 ? rawBudget["BudgetName"] : void 0);
@@ -38595,7 +38914,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
@@ -40542,11 +40861,24 @@ const TOP_LEVEL_LEFT_IN_PLACE_PROPS = [
 	"FileSystemTypeVersion",
 	"NetworkType"
 ];
+const CFN_KEEPS_ON_REMOVAL = /* @__PURE__ */ new Set([
+	"FileSystemTypeVersion",
+	"LustreConfiguration.AutoImportPolicy",
+	"LustreConfiguration.DataCompressionType",
+	"LustreConfiguration.WeeklyMaintenanceStartTime",
+	"OpenZFSConfiguration.AutomaticBackupRetentionDays",
+	"OpenZFSConfiguration.CopyTagsToBackups",
+	"OpenZFSConfiguration.CopyTagsToVolumes",
+	"OpenZFSConfiguration.DailyAutomaticBackupStartTime",
+	"OpenZFSConfiguration.DiskIopsConfiguration",
+	"OpenZFSConfiguration.WeeklyMaintenanceStartTime"
+]);
 const leftInPlaceWarning$2 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; UpdateFileSystem keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} no longer declared; UpdateFileSystem keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	if (caller === "rollback") return safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; UpdateFileSystem keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.`;
+	return names.every((name) => CFN_KEEPS_ON_REMOVAL.has(name)) ? safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} no longer declared and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; UpdateFileSystem keeps a setting it is not sent. Declare the intended value explicitly to change it.` : safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} no longer declared; UpdateFileSystem keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
 };
 const toNumber$3 = (v) => v === void 0 ? void 0 : Number(v);
 const toBoolean$1 = (v) => {
@@ -45097,7 +45429,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }));
 			tags = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return RESOURCE_NOT_FOUND;
@@ -45613,7 +45945,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${describeAwsFailure(err).detail}`);
@@ -45885,7 +46217,7 @@ var S3DirectoryBucketProvider = class {
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
-		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
+		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$19({
 			AccountId: accountId,
 			ResourceArn: resourceArn
 		}));
@@ -46540,7 +46872,7 @@ var S3TablesProvider = class {
 	}
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -47665,4 +47997,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CUKmyCQ8.js.map
+//# sourceMappingURL=provider-classes-B52ogqNj.js.map