@go-to-k/cdkd 0.304.1 → 0.306.0

package/dist/{provider-classes-Rf-SVs3I.js → provider-classes-C_AbFNEi.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients } from "./aws-clients-WQOzP1x4.js";
+import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DhsLtXsN.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-Durl920o.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-OyoL9Woo.js";
+import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-BbtwI9vN.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-Dwe6OnF_.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-bQvjvq2x.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DuL51vnF.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DfY7rzvu.js";
-import { RDSProvider } from "./rds-provider-p_5gnXcp.js";
-import { NeptuneProvider } from "./neptune-provider-CIAyTNad.js";
-import { ASGProvider } from "./asg-provider-BKJrVAH4.js";
+import { $r as markDeleteStarted, Ai as deleteSkipReason, Bs as passedNoEchoParametersOf, C as hasCdkAutoDeleteTag, Cc as recordAttributeIdCopy, Ds as lambdaFunctionNameForMask, Dt as lookupEachName, E as markRefusedBeforeApplying, Ec as carriesSecretMask, Es as canonicalLambdaFunctionName, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fu as displayAssemblyPath, Gi as s3BucketArn, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Io as refuseMalformedResourcesForDestroy, Iu as renderAssemblyPathEscape, Ji as s3BucketRegionalDomainName, Jo as withheldAccountClause, Jr as acquireIdempotencyToken, Js as recordReferenceProvenanceEntry, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as markSameGenerationBag, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Lu as resolveAssemblyPath, Mi as isWaitAbandonedError, Ni as markWaitAbandoned, Os as sameLambdaFunctionAddress, Ot as withApiLimit, Pa as passedParameterClassesOf, Pu as describeFileReadFailure, Qn as awaitInFlightSibling, Qo as withoutSilentDropProperties, Qr as isRefusedByName, Qs as hasMaskableValues, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, Sc as physicalNameCopiesOf, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as withRetry, Tt as chunks, Va as accountArgs, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Xo as findSilentDropProperties, Yi as s3BucketWebsiteUrl, Ys as snapshotPassProvenance, _ as deleteTableWithIndexBusyRetry, _s as readConfigString, _u as decodeListingKey, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bs as requireConfigObject, bu as canonicalizeRegion, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cs as coerceWarmThroughput$1, d as compensateRemovedDeletionProtection, ds as toFiniteNumber, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fc as withoutPhysicalNameCopies, fs as coerceCfnBoolean, g as INDEX_SETTLE_POLL_INTERVAL_MS, go as refuseMalformedNestedChildOutputs, gs as configStringRefusal, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hs as configIntegerRefusal, ht as withNestedStackContext, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ja as parseWebACLArn, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as isWarmThroughputDecrease, m as resolveDynamoDbDeleteBudgetMs, mc as dynamicReferenceTokens, mi as waitForLambdaFunctionActive, ms as configBooleanRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, p as resolveDynamoDbDeleteBudgetClock, pl as stringifyValue, ps as coerceCfnInteger, qi as s3BucketDualStackDomainName, qs as redactForState, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as WARM_THROUGHPUT_MEMBERS, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, ul as timePhase, us as toCfnInteger, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vl as rewriteTemplateAssetReferences, vs as replayWarn, w as isTruthyCfnBoolean, wi as slowCcOperationTimeoutMs, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recoverMaskedOutput, xs as requireConfigString, xu as derivePartitionAndUrlSuffix, y as relayedIndexBusyDelete, ys as requireConfigArray, zi as reEnableInstanceApiTermination } from "./deploy-engine-Bjr-FAuZ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BJ26M4Ez.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CcYD-_fU.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DvidzfJp.js";
+import { RDSProvider } from "./rds-provider-Dps9UxBz.js";
+import { NeptuneProvider } from "./neptune-provider-D_3VAhFf.js";
+import { ASGProvider } from "./asg-provider-DrREeZeh.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -50,7 +50,7 @@ import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePub
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
@@ -58,12 +58,12 @@ import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemF
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -2924,6 +2924,13 @@ var IAMUserGroupProvider = class {
 	}
 };
 
+//#endregion
+//#region src/utils/cfn-timestamp.ts
+const OFFSETLESS_DATE_TIME = /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/;
+function parseCfnTimestamp(value) {
+	return new Date(OFFSETLESS_DATE_TIME.test(value) ? `${value}Z` : value);
+}
+
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
 function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
@@ -3136,11 +3143,14 @@ function deepSameValue(a, b) {
 	}
 	return false;
 }
-const TIMEZONE_INDEPENDENT_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?$/;
+const TIMEZONE_INDEPENDENT_DATE = /^\d{4}-\d{2}-\d{2}([Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?$/;
 function cfnDateToIso(value) {
-	if (typeof value === "string" && !TIMEZONE_INDEPENDENT_DATE.test(value)) return void 0;
-	if (typeof value !== "string" && typeof value !== "number") return void 0;
-	const parsed = new Date(value);
+	let parsed;
+	if (typeof value === "string") {
+		if (!TIMEZONE_INDEPENDENT_DATE.test(value)) return void 0;
+		parsed = parseCfnTimestamp(value);
+	} else if (typeof value === "number") parsed = new Date(value);
+	else return;
 	return Number.isNaN(parsed.getTime()) ? void 0 : parsed.toISOString();
 }
 const LEGACY_SINGULAR_TRANSITIONS = [["Transitions", "Transition"], ["NoncurrentVersionTransitions", "NoncurrentVersionTransition"]];
@@ -3669,12 +3679,12 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
 			if (typeof expiration === "number") sdkRule.Expiration = { Days: expiration };
-			else if (typeof expiration === "string") sdkRule.Expiration = { Date: new Date(expiration) };
+			else if (typeof expiration === "string") sdkRule.Expiration = { Date: parseCfnTimestamp(expiration) };
 			else if (expiration && typeof expiration === "object") {
 				const exp = expiration;
 				sdkRule.Expiration = {
 					Days: exp["Days"],
-					Date: exp["Date"] ? new Date(exp["Date"]) : void 0,
+					Date: exp["Date"] ? parseCfnTimestamp(exp["Date"]) : void 0,
 					ExpiredObjectDeleteMarker: exp["ExpiredObjectDeleteMarker"]
 				};
 			}
@@ -3701,7 +3711,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (allNvts.length > 0) sdkRule.NoncurrentVersionTransitions = allNvts.map(toSdkNvt);
 			const toSdkTransition = (t) => ({
 				Days: t["TransitionInDays"] ?? t["Days"],
-				Date: t["TransitionDate"] ?? t["Date"] ? new Date(t["TransitionDate"] ?? t["Date"]) : void 0,
+				Date: t["TransitionDate"] ?? t["Date"] ? parseCfnTimestamp(t["TransitionDate"] ?? t["Date"]) : void 0,
 				StorageClass: t["StorageClass"]
 			});
 			const transitions = rule["Transitions"];
@@ -9402,7 +9412,7 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["Topics"]) params.Topics = properties["Topics"];
 			if (properties["StartingPositionTimestamp"] !== void 0) {
 				const raw = properties["StartingPositionTimestamp"];
-				params.StartingPositionTimestamp = typeof raw === "number" ? /* @__PURE__ */ new Date(raw * 1e3) : raw instanceof Date ? raw : new Date(raw);
+				params.StartingPositionTimestamp = typeof raw === "number" ? /* @__PURE__ */ new Date(raw * 1e3) : raw instanceof Date ? raw : parseCfnTimestamp(raw);
 			}
 			const orphanWindow = createEventSourceMappingLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleMappingOrphans(logicalId, orphanWindow, log, functionName, params.EventSourceArn);
@@ -14550,7 +14560,7 @@ function buildDeleteParams(properties) {
 function toDate(value, mask) {
 	if (value === void 0) return void 0;
 	if (value instanceof Date) return value;
-	const parsed = typeof value === "string" || typeof value === "number" ? new Date(value) : /* @__PURE__ */ new Date(NaN);
+	const parsed = typeof value === "string" ? parseCfnTimestamp(value) : typeof value === "number" ? new Date(value) : /* @__PURE__ */ new Date(NaN);
 	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${JSON.stringify(maskDeep(value, mask))}`);
 	return parsed;
 }
@@ -20182,10 +20192,11 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	}
 	createClient;
 	getCreateClient() {
-		this.createClient ??= this.apiGatewayClient.config.region().then((region) => withoutServerErrorRetries(new APIGatewayClient({
+		this.createClient ??= this.apiGatewayClient.config.region().then((region) => withoutServerErrorRetries(withApiGatewayPacing(new APIGatewayClient({
 			...ambientClientDefaults(),
-			region
-		})), (error) => {
+			region,
+			maxAttempts: 8
+		}))), (error) => {
 			this.createClient = void 0;
 			throw error;
 		});
@@ -20948,7 +20959,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		const methodPath = maskedIds.join("/");
 		let methodLeftBehind = false;
 		try {
-			await this.apiGatewayClient.send(new PutMethodCommand({
+			const putMethod = () => this.apiGatewayClient.send(new PutMethodCommand({
 				restApiId,
 				resourceId,
 				httpMethod,
@@ -20961,6 +20972,22 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				requestValidatorId,
 				authorizationScopes
 			}));
+			try {
+				await putMethod();
+			} catch (putError) {
+				if (!isMethodAlreadyExists(putError) || !await this.priorAttemptLeftMethod(logicalId, physicalId, log)) throw putError;
+				log.warn(`Replacing API Gateway Method ${logicalId} (${methodPath}), which an earlier failed attempt of it left behind`);
+				try {
+					await this.apiGatewayClient.send(new DeleteMethodCommand({
+						restApiId,
+						resourceId,
+						httpMethod
+					}));
+				} catch (deleteError) {
+					if (!(deleteError instanceof NotFoundException$1)) throw deleteError;
+				}
+				await putMethod();
+			}
 			try {
 				const integration = properties["Integration"];
 				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand(putIntegrationInput({
@@ -20992,6 +21019,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 					log.debug(`Cleaned up partially-created API Gateway Method ${logicalId} (${methodPath}) after wiring failure`);
 				} catch (cleanupError) {
 					methodLeftBehind = true;
+					getPriorAttempts(logicalId)?.notePossiblyLanded();
 					const cleanupFailure = describeAwsFailure(cleanupError);
 					const cleanupHead = `Failed to clean up partially-created API Gateway Method ${logicalId} (${methodPath}): `;
 					if (cleanupFailure.redacted) log.debug(`${cleanupHead}${cleanupFailure.detail}`);
@@ -21011,6 +21039,18 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			throw thrown;
 		}
 	}
+	async priorAttemptLeftMethod(logicalId, physicalId, log) {
+		const lookup = getPriorAttempts(logicalId);
+		if (lookup === void 0) return false;
+		if (lookup.possiblyLanded()) return true;
+		if (lookup.provenOrphanIds === void 0) return false;
+		try {
+			return (await lookup.provenOrphanIds()).includes(physicalId);
+		} catch (error) {
+			log.debug(`API Gateway Method ${logicalId}: rollback journal read failed: ${describeAwsFailure(error).detail}`);
+			return false;
+		}
+	}
 	async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties, log) {
 		const parts = physicalId.split("|");
 		const maskedId = parts.map((p) => log.value(p)).join("|");
@@ -21321,6 +21361,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		return null;
 	}
 };
+function isMethodAlreadyExists(error) {
+	return error instanceof Error && error.name === "ConflictException" && /already exists/i.test(error.message);
+}
 function isPlainObjectBlock(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -24613,6 +24656,70 @@ var StepFunctionsProvider = class {
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
+	canonicalizeDriftProperties(_resourceType, properties) {
+		if (properties["DefinitionString"] === void 0 && properties["DefinitionSubstitutions"] === void 0) return properties;
+		const substitutions = properties["DefinitionSubstitutions"];
+		const maskedNames = substitutions !== null && typeof substitutions === "object" && !Array.isArray(substitutions) ? Object.keys(substitutions).filter((name) => substitutions[name] === "***") : [];
+		const body = inlineDefinitionBody(properties, maskedNames.length === 0 ? void 0 : {
+			...substitutions,
+			...Object.fromEntries(maskedNames.map((name) => [name, MASKED_SUBSTITUTION_SENTINEL]))
+		});
+		if (body === void 0) return properties;
+		let definition;
+		try {
+			definition = JSON.parse(body);
+		} catch {
+			definition = body;
+		}
+		if (maskedNames.length > 0) definition = maskSentinelLeaves(definition);
+		const folded = {
+			...properties,
+			Definition: definition
+		};
+		delete folded["DefinitionString"];
+		delete folded["DefinitionSubstitutions"];
+		return folded;
+	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		return {
+			baseline: this.canonicalizeDriftProperties(resourceType, baseline),
+			aws
+		};
+	}
+	getDriftSecretPathAliases(_resourceType, properties, secretPaths) {
+		const substitutions = properties["DefinitionSubstitutions"];
+		if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return [];
+		const secretNames = Object.keys(substitutions).filter((name) => secretPaths.has("DefinitionSubstitutions") || [...secretPaths].some((p) => p === `DefinitionSubstitutions.${name}` || p.startsWith(`DefinitionSubstitutions.${name}.`)));
+		if (secretNames.length === 0) return [];
+		const definitionString = properties["DefinitionString"];
+		const raw = definitionString !== void 0 ? definitionString : properties["Definition"];
+		let body = raw;
+		if (typeof raw === "string") try {
+			body = JSON.parse(raw);
+		} catch {
+			return ["Definition"];
+		}
+		if (body === void 0 || body === null || typeof body !== "object") return ["Definition"];
+		const tokens = secretNames.map((name) => `\${${name}}`);
+		const carries = (text) => tokens.some((t) => text.includes(t));
+		const aliases = [];
+		const walk = (value, path, arrayPath) => {
+			if (typeof value === "string") {
+				if (carries(value)) aliases.push(arrayPath ?? path);
+				return;
+			}
+			if (Array.isArray(value)) {
+				value.forEach((item, i) => walk(item, `${path}.${i}`, arrayPath ?? path));
+				return;
+			}
+			if (value !== null && typeof value === "object") for (const [key, child] of Object.entries(value)) {
+				if (carries(key)) aliases.push(arrayPath ?? path);
+				walk(child, `${path}.${key}`, arrayPath);
+			}
+		};
+		walk(body, "Definition", void 0);
+		return [...new Set(aliases)];
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let resp;
 		try {
@@ -24708,21 +24815,11 @@ var StepFunctionsProvider = class {
 		}
 	}
 	async buildDefinitionString(properties) {
-		const definitionString = properties["DefinitionString"];
-		const definition = properties["Definition"];
-		if (definitionString !== void 0) {
-			if (typeof definitionString === "string") return definitionString;
-			return JSON.stringify(definitionString);
-		}
-		if (definition !== void 0) {
-			if (typeof definition === "string") return definition;
-			return JSON.stringify(definition);
-		}
+		const inline = inlineDefinitionBody(properties);
+		if (inline !== void 0) return inline;
+		const substitutions = properties["DefinitionSubstitutions"];
 		const s3Location = properties["DefinitionS3Location"];
-		if (s3Location?.Bucket && s3Location.Key) {
-			const body = await this.fetchDefinitionFromS3(s3Location.Bucket, s3Location.Key, s3Location.Version);
-			return this.applyDefinitionSubstitutions(body, properties["DefinitionSubstitutions"]);
-		}
+		if (s3Location?.Bucket && s3Location.Key) return applyDefinitionSubstitutions(await this.fetchDefinitionFromS3(s3Location.Bucket, s3Location.Key, s3Location.Version), substitutions);
 		return "{}";
 	}
 	async fetchDefinitionFromS3(bucket, key, version) {
@@ -24737,16 +24834,36 @@ var StepFunctionsProvider = class {
 		if (body.length === 0) throw new Error(`DefinitionS3Location object s3://${bucket}/${key} returned an empty body`);
 		return body;
 	}
-	applyDefinitionSubstitutions(body, substitutions) {
-		if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return body;
-		let result = body;
-		for (const [name, value] of Object.entries(substitutions)) {
-			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") continue;
-			result = result.split(`\${${name}}`).join(String(value));
-		}
-		return result;
-	}
 };
+function applyDefinitionSubstitutions(body, substitutions) {
+	if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return body;
+	const map = substitutions;
+	return body.replace(/\$\{([^{}]+)\}/g, (token, name) => {
+		if (!Object.hasOwn(map, name)) return token;
+		const value = map[name];
+		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return token;
+		return String(value);
+	});
+}
+function inlineDefinitionBody(properties, substitutionsOverride) {
+	const substitutions = substitutionsOverride ?? properties["DefinitionSubstitutions"];
+	const definitionString = properties["DefinitionString"];
+	const definition = properties["Definition"];
+	const value = definitionString !== void 0 ? definitionString : definition;
+	if (value === void 0) return void 0;
+	return applyDefinitionSubstitutions(typeof value === "string" ? value : JSON.stringify(value), substitutions);
+}
+const MASKED_SUBSTITUTION_SENTINEL = "cdkd-masked-substitution";
+function maskSentinelLeaves(value) {
+	if (typeof value === "string") return value.includes(MASKED_SUBSTITUTION_SENTINEL) ? "***" : value;
+	if (Array.isArray(value)) return value.map((item) => maskSentinelLeaves(item));
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value);
+		if (entries.some(([key]) => key.includes(MASKED_SUBSTITUTION_SENTINEL))) return "***";
+		return Object.fromEntries(entries.map(([key, child]) => [key, maskSentinelLeaves(child)]));
+	}
+	return value;
+}
 function mapEncryptionConfiguration(value) {
 	if (value === null || value === void 0) return void 0;
 	if (typeof value !== "object") return void 0;
@@ -36580,7 +36697,7 @@ async function fetchGlueTags(client, stsClient, resource, name, accountId, logge
 		const resp = await client.send(new GetTagsCommand({ ResourceArn: arn }));
 		return normalizeAwsTagsToCfn(resp.Tags);
 	} catch (err) {
-		logger.debug(`GetTags failed for ${resource}/${name}: ${describeAwsFailure(err).detail}`);
+		logger.debug(`GetTags failed for a Glue ${resource}: ${describeAwsFailure(err).summary}`);
 		return [];
 	}
 }
@@ -37190,13 +37307,28 @@ function toCfnCrawlerTargets(targets) {
 var GlueConnectionProvider = class {
 	client;
 	createClient;
+	stsClient;
 	providerRegion = ambientRegion();
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueConnectionProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
-	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set([
+		"ConnectionInput",
+		"CatalogId",
+		"Tags"
+	])]]);
+	getStsClient() {
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
+		return this.stsClient;
+	}
+	resourceArn(name, catalogIdValue) {
+		return buildGlueResourceArn(this.getClient(), this.getStsClient(), "connection", name, catalogIdForApi(catalogIdValue));
+	}
 	getClient() {
 		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
@@ -37211,12 +37343,14 @@ var GlueConnectionProvider = class {
 		log.debug(`Creating Glue Connection ${logicalId}`);
 		const connectionInput = properties["ConnectionInput"];
 		if (!connectionInput) throw new ProvisioningError(`ConnectionInput is required for Glue Connection ${logicalId}`, resourceType, logicalId);
+		const tags = desiredGlueTags(properties["Tags"], resourceType, logicalId);
 		const name = connectionInput["Name"] ?? generatedNameFor("AWS::Glue::Connection", logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getCreateClient().send(new CreateConnectionCommand({
 				...catalogId && { CatalogId: catalogId },
-				ConnectionInput: buildConnectionInput(connectionInput, name)
+				ConnectionInput: buildConnectionInput(connectionInput, name),
+				...tags && { Tags: tags }
 			}));
 			log.debug(`Successfully created Glue Connection ${logicalId}: ${v(name)}`);
 			return {
@@ -37259,6 +37393,7 @@ var GlueConnectionProvider = class {
 			debug: log.debug,
 			mask: log.mask
 		});
+		desiredGlueTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const catalogId = updateCatalogId(properties["CatalogId"]);
 		try {
 			await this.getClient().send(new UpdateConnectionCommand({
@@ -37266,6 +37401,7 @@ var GlueConnectionProvider = class {
 				Name: physicalId,
 				ConnectionInput: buildConnectionInput(connectionInput, physicalId)
 			}));
+			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId, properties["CatalogId"]), previousProperties?.["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -37316,7 +37452,7 @@ var GlueConnectionProvider = class {
 			throw err;
 		}
 		if (!conn) return void 0;
-		return withRecordedCatalogId({ ConnectionInput: {
+		const ci = {
 			Name: conn.Name ?? physicalId,
 			ConnectionType: conn.ConnectionType ?? "",
 			Description: conn.Description ?? "",
@@ -37326,7 +37462,12 @@ var GlueConnectionProvider = class {
 			AthenaProperties: conn.AthenaProperties ?? {},
 			PythonProperties: conn.PythonProperties ?? {},
 			PhysicalConnectionRequirements: conn.PhysicalConnectionRequirements ? pickDefined(conn.PhysicalConnectionRequirements) : {}
-		} }, properties);
+		};
+		const name = conn.Name ?? physicalId;
+		return withRecordedCatalogId({
+			ConnectionInput: ci,
+			Tags: await fetchGlueTags(this.getClient(), this.getStsClient(), "connection", name, catalogId, this.logger)
+		}, properties);
 	}
 	async import(input) {
 		const explicitName = input.knownPhysicalId ?? input.properties["ConnectionInput"]?.["Name"];
@@ -37673,9 +37814,9 @@ var KMSProvider = class {
 		const keySpec = properties["KeySpec"];
 		const keyUsage = properties["KeyUsage"];
 		const enableKeyRotation = templateBool(properties["EnableKeyRotation"]);
-		const multiRegion = properties["MultiRegion"];
+		const multiRegion = templateBool(properties["MultiRegion"]);
 		const origin = properties["Origin"];
-		const bypassPolicyLockoutSafetyCheck = properties["BypassPolicyLockoutSafetyCheck"];
+		const bypassPolicyLockoutSafetyCheck = templateBool(properties["BypassPolicyLockoutSafetyCheck"]);
 		const input = {
 			Description: description,
 			KeySpec: keySpec,
@@ -37882,6 +38023,8 @@ var KMSProvider = class {
 		const mask = context?.maskSecrets;
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const immutableChanged = changedImmutableKeyProperties(properties, previousProperties);
+		if (immutableChanged.length > 0 && !await this.liveKeyMatches(physicalId, properties, immutableChanged, logicalId)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, immutableKeySuggestion(immutableChanged));
 		const newEnabled = templateBool(properties["Enabled"]);
 		const enabledChange = newEnabled === templateBool(previousProperties["Enabled"]) ? void 0 : newEnabled === false ? "disable" : "enable";
 		try {
@@ -37927,7 +38070,8 @@ var KMSProvider = class {
 				await this.getClient().send(new PutKeyPolicyCommand({
 					KeyId: physicalId,
 					PolicyName: "default",
-					Policy: newPolicyStr
+					Policy: newPolicyStr,
+					...templateBool(properties["BypassPolicyLockoutSafetyCheck"]) === true && { BypassPolicyLockoutSafetyCheck: true }
 				}));
 			} else if (policyRemoved && newKeyPolicy === void 0) {
 				this.logger.debug(safeMsg`Resetting key policy for KMS Key ${logicalId} to the default`);
@@ -37948,6 +38092,20 @@ var KMSProvider = class {
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async liveKeyMatches(physicalId, properties, changed, logicalId) {
+		let md;
+		try {
+			md = (await this.getClient().send(new DescribeKeyCommand({ KeyId: physicalId }))).KeyMetadata;
+		} catch {
+			return false;
+		}
+		if (!md) return false;
+		const live = immutableKeyShape(md);
+		const desired = immutableKeyShape(properties);
+		const matches = changed.every((name) => isDeepStrictEqual(desired[name], live[name]));
+		if (matches) this.logger.debug(safeMsg`KMS Key ${logicalId}: the live key already holds the desired ${changed.join(", ")}; the record differed`);
+		return matches;
+	}
 	async sendRotation(send, justEnabled, resourceType, logicalId, physicalId) {
 		try {
 			await send();
@@ -38178,6 +38336,23 @@ var KMSProvider = class {
 		return null;
 	}
 };
+function immutableKeyShape(properties) {
+	return {
+		KeySpec: properties["KeySpec"] ?? "SYMMETRIC_DEFAULT",
+		KeyUsage: properties["KeyUsage"] ?? "ENCRYPT_DECRYPT",
+		MultiRegion: templateBool(properties["MultiRegion"]) === true,
+		Origin: properties["Origin"] ?? "AWS_KMS"
+	};
+}
+function changedImmutableKeyProperties(properties, previousProperties) {
+	const desired = immutableKeyShape(properties);
+	const previous = immutableKeyShape(previousProperties);
+	return Object.keys(desired).filter((name) => !isDeepStrictEqual(desired[name], previous[name]));
+}
+function immutableKeySuggestion(changed) {
+	const one = changed.length === 1;
+	return `${changed.join(", ")} changed, and KMS fixes ${one ? "it" : "them"} when the key is created (CloudFormation fails this update too). To keep the key, restore the previous ${one ? "value" : "values"}. To replace it, re-deploy with --replace, plus --force-stateful-recreation unless the key's UpdateReplacePolicy is Retain; without Retain the old key is scheduled for deletion, and data encrypted under it cannot be decrypted once that deletion completes`;
+}
 function templateBool(value) {
 	if (value === void 0 || value === null) return void 0;
 	if (typeof value === "string") return value.toLowerCase() === "true";
@@ -38248,7 +38423,7 @@ function isoDate(value) {
 	else if (typeof value === "string" && /^\d+$/.test(value)) {
 		const n = Number(value);
 		date = new Date(n < 0xe8d4a51000 ? n * 1e3 : n);
-	} else if (typeof value === "string") date = new Date(value);
+	} else if (typeof value === "string") date = parseCfnTimestamp(value);
 	else if (value instanceof Date) date = value;
 	else return void 0;
 	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
@@ -38418,7 +38593,7 @@ var BudgetsBudgetProvider = class {
 		else if (typeof raw === "string" && /^\d+$/.test(raw)) {
 			const num = Number(raw);
 			date = new Date(num < 0xe8d4a51000 ? num * 1e3 : num);
-		} else if (typeof raw === "string") date = new Date(raw);
+		} else if (typeof raw === "string") date = parseCfnTimestamp(raw);
 		else throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: expected a date string or epoch timestamp, got ${JSON.stringify(maskDeep(raw, mask))}`, resourceType, logicalId);
 		if (Number.isNaN(date.getTime())) throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: ${JSON.stringify(maskDeep(raw, mask))} is not a parseable date`, resourceType, logicalId);
 		return date;
@@ -39067,6 +39242,18 @@ function comparableRecordSize(value, mask) {
 	const read = readMaxRecordSize(value, mask);
 	return read.kind === "usable" ? read.size : void 0;
 }
+const DEFAULT_RECORD_DISTRIBUTION_STRATEGY = "USER_PARTITION_KEY";
+function readDistributionStrategy(value, mask) {
+	if (value == null) return { kind: "absent" };
+	if (typeof value === "string" && value.trim() !== "") return {
+		kind: "usable",
+		strategy: value
+	};
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream RecordDistributionStrategy must be a non-empty string, got ${JSON.stringify(maskDeep(value, mask))}`
+	};
+}
 const KINESIS_DELETE_POLL_INTERVAL_MS = 2e3;
 const KINESIS_DELETE_MAX_WAIT_MS = 3e5;
 function isStreamName(id) {
@@ -39085,8 +39272,10 @@ var KinesisStreamProvider = class {
 		"RetentionPeriodHours",
 		"StreamEncryption",
 		"DesiredShardLevelMetrics",
-		"MaxRecordSizeInKiB"
+		"MaxRecordSizeInKiB",
+		"RecordDistributionStrategy"
 	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Kinesis::Stream", /* @__PURE__ */ new Map([["WarmThroughputMiBps", "AWS accepts it only on an account enrolled in the Kinesis minimum throughput billing commitment, so the SDK path is not wired (go-to-k/cdkd#1695); Cloud Control forwards it."]])]]);
 	getClient() {
 		if (!this.client) this.client = new KinesisClient({
 			...ambientClientDefaults(),
@@ -39124,6 +39313,11 @@ var KinesisStreamProvider = class {
 		}
 		const encryptionRead = readEncryptionKeyId(properties["StreamEncryption"], mask);
 		if (encryptionRead.kind === "unusable") throw new ProvisioningError(encryptionRead.reason, resourceType, logicalId, streamName);
+		const strategyRead = readDistributionStrategy(properties["RecordDistributionStrategy"], mask);
+		if (strategyRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(strategyRead.reason, resourceType, logicalId, streamName);
+			warn(`${strategyRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default record distribution strategy rather than refusing the restore`);
+		}
 		let streamCreated = false;
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -39137,6 +39331,7 @@ var KinesisStreamProvider = class {
 				...shardCount !== void 0 && { ShardCount: shardCount },
 				StreamModeDetails: { StreamMode: streamMode },
 				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB },
+				...strategyRead.kind === "usable" && { RecordDistributionStrategy: strategyRead.strategy },
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			streamCreated = true;
@@ -39276,6 +39471,7 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
+			await this.reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn);
 			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 			let desiredMetrics;
 			if (desiredRead.kind === "unusable") warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
@@ -39396,6 +39592,30 @@ var KinesisStreamProvider = class {
 			throw error;
 		}
 	}
+	async reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn) {
+		const desired = readDistributionStrategy(properties["RecordDistributionStrategy"], mask);
+		if (desired.kind === "unusable") {
+			warn(`${desired.reason}. Leaving the record distribution strategy on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
+			return;
+		}
+		const previous = readDistributionStrategy(previousProperties["RecordDistributionStrategy"], mask);
+		const recorded = previous.kind === "usable" ? previous.strategy : void 0;
+		let target;
+		if (desired.kind === "usable") {
+			if (desired.strategy === recorded) return;
+			target = desired.strategy;
+		} else {
+			if (recorded === void 0 || recorded === DEFAULT_RECORD_DISTRIBUTION_STRATEGY) return;
+			if (streamMode !== "ON_DEMAND") return;
+			target = DEFAULT_RECORD_DISTRIBUTION_STRATEGY;
+		}
+		this.logger.debug(mask(safeMsg`Updating record distribution strategy for ${physicalId}: from ${recorded ?? "no value"} to ${target}`));
+		await this.getClient().send(new UpdateStreamRecordDistributionStrategyCommand({
+			StreamARN: await this.resolveStreamArn(physicalId),
+			RecordDistributionStrategy: target
+		}));
+		await this.waitForStreamActive(physicalId);
+	}
 	effectiveMetricsProperties(properties, expanded) {
 		if (expanded === void 0) return {};
 		if (expanded === properties["DesiredShardLevelMetrics"]) return {};
@@ -39462,8 +39682,11 @@ var KinesisStreamProvider = class {
 		}
 		result["DesiredShardLevelMetrics"] = (stream.EnhancedMonitoring ?? []).flatMap((entry) => entry.ShardLevelMetrics ?? []);
 		try {
-			const maxRecordSize = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.MaxRecordSizeInKiB;
+			const summaryResp = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }));
+			const maxRecordSize = summaryResp.StreamDescriptionSummary?.MaxRecordSizeInKiB;
 			if (maxRecordSize !== void 0) result["MaxRecordSizeInKiB"] = maxRecordSize;
+			const strategy = summaryResp.StreamDescriptionSummary?.RecordDistributionStrategy;
+			if (strategy !== void 0) result["RecordDistributionStrategy"] = strategy;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
@@ -39809,8 +40032,8 @@ var SchedulerScheduleProvider = class {
 			Target: this.toSdkTarget(properties["Target"]),
 			...properties["Description"] !== void 0 && { Description: properties["Description"] },
 			...properties["ScheduleExpressionTimezone"] !== void 0 && { ScheduleExpressionTimezone: properties["ScheduleExpressionTimezone"] },
-			...properties["StartDate"] !== void 0 && { StartDate: new Date(properties["StartDate"]) },
-			...properties["EndDate"] !== void 0 && { EndDate: new Date(properties["EndDate"]) },
+			...properties["StartDate"] !== void 0 && { StartDate: parseCfnTimestamp(properties["StartDate"]) },
+			...properties["EndDate"] !== void 0 && { EndDate: parseCfnTimestamp(properties["EndDate"]) },
 			...properties["State"] !== void 0 && { State: properties["State"] },
 			...properties["KmsKeyArn"] !== void 0 && { KmsKeyArn: properties["KmsKeyArn"] }
 		};
@@ -40323,7 +40546,7 @@ function toSdkSourceParameters(value) {
 		...source,
 		KinesisStreamParameters: {
 			...kinesis,
-			StartingPositionTimestamp: new Date(kinesis["StartingPositionTimestamp"])
+			StartingPositionTimestamp: parseCfnTimestamp(kinesis["StartingPositionTimestamp"])
 		}
 	};
 }
@@ -45422,6 +45645,22 @@ var CloudTrailProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/codebuild-provider.ts
+const DEFAULT_PROJECT_VISIBILITY = "PRIVATE";
+function readVisibility(properties, mask) {
+	const visibility = properties["Visibility"];
+	const role = properties["ResourceAccessRole"];
+	const refuse = (key, value) => ({
+		kind: "unusable",
+		reason: `AWS::CodeBuild::Project ${key} must be a non-empty string, got ${JSON.stringify(maskDeep(value, mask))}`
+	});
+	if (visibility != null && (typeof visibility !== "string" || visibility.trim() === "")) return refuse("Visibility", visibility);
+	if (role != null && (typeof role !== "string" || role !== "" && role.trim() === "")) return refuse("ResourceAccessRole", role);
+	return {
+		kind: "usable",
+		visibility: visibility ?? DEFAULT_PROJECT_VISIBILITY,
+		...typeof role === "string" && role !== "" && { resourceAccessRole: role }
+	};
+}
 var CodeBuildProvider = class {
 	client;
 	createClient;
@@ -45450,7 +45689,9 @@ var CodeBuildProvider = class {
 		"BuildBatchConfig",
 		"BadgeEnabled",
 		"SourceVersion",
-		"AutoRetryLimit"
+		"AutoRetryLimit",
+		"Visibility",
+		"ResourceAccessRole"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -45641,29 +45882,59 @@ var CodeBuildProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating CodeBuild Project ${logicalId}`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const visibilityRead = readVisibility(properties, mask);
+		if (visibilityRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(visibilityRead.reason, resourceType, logicalId);
+			this.logger.warn(mask(`${visibilityRead.reason}. Replaying a state record, so CodeBuild Project ${logicalId} is left ${DEFAULT_PROJECT_VISIBILITY} with no resource access role rather than refusing the restore`));
+		}
+		let createdName;
 		try {
 			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
 			const result = await this.getCreateClient().send(new CreateProjectCommand(input));
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
+			createdName = projectName;
+			if (visibilityRead.kind === "usable" && (visibilityRead.visibility !== DEFAULT_PROJECT_VISIBILITY || visibilityRead.resourceAccessRole !== void 0)) await this.applyVisibility(projectArn, visibilityRead);
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
 			return {
 				physicalId: projectName,
 				attributes: { Arn: projectArn }
 			};
 		} catch (error) {
+			if (createdName !== void 0) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdName);
+			throw thrown;
 		}
 	}
+	async applyVisibility(projectArn, read) {
+		await this.getClient().send(new UpdateProjectVisibilityCommand({
+			projectArn,
+			projectVisibility: read.visibility,
+			...read.resourceAccessRole !== void 0 && { resourceAccessRole: read.resourceAccessRole }
+		}));
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
 			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
-			await this.getClient().send(new UpdateProjectCommand(input));
+			const updated = await this.getClient().send(new UpdateProjectCommand(input));
+			const desiredVisibility = readVisibility(properties, mask);
+			const recorded = readVisibility(previousProperties, mask);
+			if (desiredVisibility.kind === "unusable") {
+				const kept = recorded.kind === "usable" ? ` (recorded ${recorded.visibility})` : "";
+				this.logger.warn(mask(`${desiredVisibility.reason}. Leaving the visibility of CodeBuild Project ${physicalId} unchanged${kept}; the same value is REFUSED on a template-path create`));
+			} else if (recorded.kind !== "usable" || recorded.visibility !== desiredVisibility.visibility || recorded.resourceAccessRole !== desiredVisibility.resourceAccessRole) {
+				const projectArn = updated.project?.arn;
+				if (projectArn === void 0) throw new Error("UpdateProject returned no project ARN for the visibility update");
+				await this.applyVisibility(projectArn, desiredVisibility);
+			}
 			this.logger.debug(`Successfully updated CodeBuild Project ${logicalId}`);
 			return {
 				physicalId,
@@ -45671,7 +45942,7 @@ var CodeBuildProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	wrapCaughtError(mask, error, build) {
@@ -45868,6 +46139,7 @@ var CodeBuildProvider = class {
 			result["BuildBatchConfig"] = bbc;
 		} else result["BuildBatchConfig"] = {};
 		result["ResourceAccessRole"] = project.resourceAccessRole ?? "";
+		if (project.projectVisibility !== void 0) result["Visibility"] = project.projectVisibility;
 		result["Tags"] = normalizeAwsTagsToCfn(project.tags);
 		return result;
 	}
@@ -47014,7 +47286,7 @@ var S3DirectoryBucketProvider = class {
 					},
 					Location: {
 						Name: azId,
-						Type: "AvailabilityZone"
+						Type: dataRedundancy === "SingleLocalZone" ? "LocalZone" : "AvailabilityZone"
 					},
 					...includeTags ? { Tags: tags } : {}
 				}
@@ -47128,15 +47400,16 @@ var S3DirectoryBucketProvider = class {
 		} while (continuationToken);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let locationType;
 		try {
-			await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
+			locationType = (await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId })))?.BucketLocationType;
 		} catch (err) {
 			const e = err;
 			if (e.name === "NotFound" || e.name === "NoSuchBucket" || e.name === "BucketNotFound") return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		const result = { BucketName: physicalId };
-		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = "SingleAvailabilityZone";
+		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = locationType === "LocalZone" ? "SingleLocalZone" : "SingleAvailabilityZone";
 		result["Tags"] = await this.readTags(physicalId);
 		return result;
 	}
@@ -47275,16 +47548,32 @@ var S3TablesProvider = class {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		if (resourceType === "AWS::S3Tables::Table" || resourceType === "AWS::S3Tables::TableBucket") refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.recordedAttributes);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
-		if (resourceType === "AWS::S3Tables::Table") await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
-		else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask, recordedAttributes) {
+		if (resourceType === "AWS::S3Tables::Table") {
+			const rename = await this.planTableRename(logicalId, physicalId, resourceType, properties, mask);
+			await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+			if (rename === void 0) return {
+				physicalId,
+				wasReplaced: false
+			};
+			try {
+				await this.getClient().send(rename.command);
+			} catch (error) {
+				if (!(error instanceof NotFoundException$7) || !await this.renameAlreadyApplied(rename.target, recordedAttributes)) throw error;
+			}
+			this.logger.debug(safeMsg`Renamed S3 Tables Table ${logicalId}: ${physicalId} -> ${rename.physicalId}`);
+			return {
+				physicalId: rename.physicalId,
+				wasReplaced: false
+			};
+		} else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
 		else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
 		return {
 			physicalId,
@@ -47787,6 +48076,59 @@ var S3TablesProvider = class {
 		for (const t of tags) map[t.Key] = t.Value;
 		return map;
 	}
+	async planTableRename(logicalId, physicalId, resourceType, properties, mask) {
+		const desiredString = (key, value) => {
+			if (value === void 0) return void 0;
+			if (typeof value === "string" && value.length > 0) return value;
+			throw new ProvisioningError(safeMsg`${key} for S3 Tables Table ${logicalId} must be a non-empty string; refusing the update`, resourceType, logicalId, physicalId);
+		};
+		const desiredNamespace = desiredString("Namespace", properties["Namespace"]);
+		const desiredName = desiredString("TableName", properties["TableName"] ?? properties["Name"]);
+		if (desiredNamespace === void 0 && desiredName === void 0) return void 0;
+		const current = await this.resolveTableParts(physicalId);
+		if (current === "not-found" || current === "unparseable") throw new ProvisioningError(current === "not-found" ? safeMsg`S3 Tables Table '${physicalId}' no longer exists (state is out of sync); ` + `refusing to record a rename that did not happen` : compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+		const newNamespace = desiredNamespace ?? current.namespace;
+		const newName = desiredName ?? current.name;
+		if (newNamespace === current.namespace && newName === current.name) return void 0;
+		return {
+			physicalId: physicalId.includes("|") ? packCompositeId(resourceType, logicalId, [
+				{
+					name: "tableBucketARN",
+					value: current.tableBucketARN
+				},
+				{
+					name: "namespace",
+					value: newNamespace
+				},
+				{
+					name: "name",
+					value: newName
+				}
+			], { maskSecrets: mask }) : physicalId,
+			target: {
+				tableBucketARN: current.tableBucketARN,
+				namespace: newNamespace,
+				name: newName
+			},
+			command: new RenameTableCommand({
+				tableBucketARN: current.tableBucketARN,
+				namespace: current.namespace,
+				name: current.name,
+				...newNamespace !== current.namespace && { newNamespaceName: newNamespace },
+				...newName !== current.name && { newName }
+			})
+		};
+	}
+	async renameAlreadyApplied(target, recordedAttributes) {
+		const recordedArn = recordedAttributes?.["TableARN"];
+		if (typeof recordedArn !== "string" || recordedArn.length === 0) return false;
+		try {
+			return await this.lookupTableArn(target.tableBucketARN, target.namespace, target.name) === recordedArn;
+		} catch (lookupError) {
+			this.logger.debug(safeMsg`Could not check whether the rename of ${target.name} was already applied: ${describeAwsFailure(lookupError).summary}`);
+			return false;
+		}
+	}
 	async lookupTableArn(tableBucketARN, namespace, name) {
 		try {
 			return (await this.getClient().send(new GetTableCommand$1({
@@ -48983,4 +49325,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Rf-SVs3I.js.map
+//# sourceMappingURL=provider-classes-C_AbFNEi.js.map