@go-to-k/cdkd 0.305.0 → 0.307.0

package/dist/{provider-classes-L1a3Wl0g.js → provider-classes-CPMW_2-R.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients } from "./aws-clients-WQOzP1x4.js";
-import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-Durl920o.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-OyoL9Woo.js";
+import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
+import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
+import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-TFGunWmV.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-BdqMXegu.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-mYhK_-VN.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CUklr39z.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DfY7rzvu.js";
-import { RDSProvider } from "./rds-provider-CjasAFV5.js";
-import { NeptuneProvider } from "./neptune-provider-DvFVCaYo.js";
-import { ASGProvider } from "./asg-provider-C8HDzpYh.js";
+import { $n as awaitInFlightSibling, $o as withoutSilentDropProperties, $r as isRefusedByName, $s as hasMaskableValues, Bi as reEnableInstanceApiTermination, C as hasCdkAutoDeleteTag, Cc as physicalNameCopiesOf, Dc as carriesSecretMask, Ds as canonicalLambdaFunctionName, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Ei as unchangedBehindSecretReference, Es as withRetry, Et as chunks, F as findNestedTemplateTreeDefect, Fa as passedParameterClassesOf, Fu as describeFileReadFailure, G as enclosingDeadlineRemainingMs, Gi as isSettledInstanceState, Gr as earliestDefined, Ha as accountArgs, I as isAbsoluteAssetPath, Ii as ec2InstanceProtectionSite, Iu as displayAssemblyPath, Ji as s3BucketDualStackDomainName, Js as redactForState, Ki as s3BucketArn, L as listNestedTemplateRows, Li as isTerminationProtectionPropagationError, Lo as refuseMalformedResourcesForDestroy, Lu as renderAssemblyPathEscape, Ma as parseWebACLArn, Mi as withIndeterminateGuard, Mr as secretNamedAttributeNamesOf, Ni as isWaitAbandonedError, Os as lambdaFunctionNameForMask, Ot as lookupEachName, Pi as markWaitAbandoned, R as renderNestedTemplateTreeDefect, Ri as observeThenDisableInstanceApiTermination, Ru as resolveAssemblyPath, S as S3_AUTO_DELETE_OBJECTS_TAG, Sc as recoverMaskedOutput, Ss as requireConfigString, Su as derivePartitionAndUrlSuffix, T as getPriorAttempts, Ti as slowCcOperationTimeoutMs, Vs as passedNoEchoParametersOf, W as enclosingDeadlineExpired, Xi as s3BucketWebsiteUrl, Xs as snapshotPassProvenance, Yi as s3BucketRegionalDomainName, Yo as withheldAccountClause, Yr as acquireIdempotencyToken, Ys as recordReferenceProvenanceEntry, Zo as findSilentDropProperties, _ as deleteTableWithIndexBusyRetry, _o as refuseMalformedNestedChildOutputs, _s as configStringRefusal, ai as refuseMalformedDesiredTags, an as REDACTED_DELETE_ADDRESS_SKIP_REASON, b as waitForIndexesSettled, bs as requireConfigArray, c as DynamoDBGlobalTableProvider, ci as definedAttributes, cn as redactedDeleteAddressSkip, cs as WARM_THROUGHPUT_MEMBERS, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dl as timePhase, ds as toCfnInteger, dt as revertNestedChildFromJournal, ei as markDeleteStarted, f as deleteBudgetKey, fs as toFiniteNumber, g as INDEX_SETTLE_POLL_INTERVAL_MS, gs as configIntegerRefusal, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hc as dynamicReferenceTokens, hi as waitForLambdaFunctionActive, hs as configBooleanRefusal, ht as getCurrentNestedStackContext, ii as readTagList, ji as deleteSkipReason, ks as sameLambdaFunctionAddress, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as stringifyIfAssigned, ls as coerceWarmThroughput$1, m as resolveDynamoDbDeleteBudgetMs, ml as stringifyValue, ms as coerceCfnInteger, ni as DBPROXY_TAG_OPTIONS, oi as tagMapAsList, on as isRedactedRecordedValue, p as resolveDynamoDbDeleteBudgetClock, pc as withoutPhysicalNameCopies, ps as coerceCfnBoolean, qi as s3BucketDomainName, qr as reserveStackCreateToken, qs as markSameGenerationBag, ri as planTagDiff, rn as getCurrentProducerRegions, rr as replacedDeleteFailureVerdict, si as tagPlanWarning, sn as redactedDeleteAddressFields, t as DeployEngine, ta as outputReferenceProvenanceOf, ti as DBPROXY_TAGS_WHAT, tr as getStackRecords, u as beginDeleteWait, us as isWarmThroughputDecrease, v as maskedLogger, vs as readConfigString, vu as decodeListingKey, w as isTruthyCfnBoolean, wc as recordAttributeIdCopy, x as ECR_AUTO_DELETE_IMAGES_TAG, xa as getAccountInfo, xs as requireConfigObject, xu as canonicalizeRegion, y as relayedIndexBusyDelete, yi as getCurrentResourceSecrets, yl as rewriteTemplateAssetReferences, ys as replayWarn, zi as reDisableInstanceApiTermination } from "./deploy-engine-BOgsnnk0.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DfDYgfqK.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DU5UlgkO.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DOJPkECL.js";
+import { RDSProvider } from "./rds-provider-DcBsBQLi.js";
+import { NeptuneProvider } from "./neptune-provider-DvuvSkfJ.js";
+import { ASGProvider } from "./asg-provider-oKlrkJeO.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -16,7 +16,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -50,20 +50,20 @@ import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePub
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -2924,6 +2924,13 @@ var IAMUserGroupProvider = class {
 	}
 };
 
+//#endregion
+//#region src/utils/cfn-timestamp.ts
+const OFFSETLESS_DATE_TIME = /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/;
+function parseCfnTimestamp(value) {
+	return new Date(OFFSETLESS_DATE_TIME.test(value) ? `${value}Z` : value);
+}
+
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
 function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
@@ -2936,7 +2943,7 @@ function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
 	return command ? `${lead}: ${command}` : `${lead}, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.`;
 }
 function configItemId(item) {
-	if (!isPlainObject$2(item)) return void 0;
+	if (!isPlainObject$3(item)) return void 0;
 	const id = item["Id"];
 	if (typeof id === "string") return id;
 	if (typeof id === "number" && Number.isFinite(id)) return String(id);
@@ -2944,11 +2951,11 @@ function configItemId(item) {
 function declaresBucketObjectLock(properties) {
 	return properties["ObjectLockEnabled"] === true || properties["ObjectLockEnabled"] === "true";
 }
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function effectiveS3BucketDestination(declared, sentFormat) {
-	if (!isPlainObject$2(declared)) return declared;
+	if (!isPlainObject$3(declared)) return declared;
 	if (!declared["BucketArn"]) return declared;
 	const out = { BucketArn: declared["BucketArn"] };
 	if (declared["BucketAccountId"] !== void 0) out["BucketAccountId"] = declared["BucketAccountId"];
@@ -2984,7 +2991,7 @@ function effectiveInventoryItem(item, sent) {
 	const scheduleContainerUsable = configStringRefusal(declaredSchedule, "Frequency", INVENTORY_DEFAULT_SCHEDULE_FREQUENCY, "AWS::S3::Bucket InventoryConfigurations[].Schedule") === void 0;
 	const canFoldSchedule = sent?.frequency !== void 0 || scheduleFrequencyUsable || !declaresScheduleFrequency && scheduleContainerUsable;
 	if (canFoldSchedule) {
-		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$2(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
+		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$3(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
 		const frequency = sent?.frequency ?? declaredFrequency;
 		if (!Object.is(item["ScheduleFrequency"], frequency)) patch["ScheduleFrequency"] = frequency;
 	}
@@ -3001,9 +3008,9 @@ function effectiveInventoryItem(item, sent) {
 }
 function effectiveAnalyticsItem(item, sent) {
 	const storageClassAnalysis = item["StorageClassAnalysis"];
-	if (!isPlainObject$2(storageClassAnalysis)) return item;
+	if (!isPlainObject$3(storageClassAnalysis)) return item;
 	const dataExport = storageClassAnalysis["DataExport"];
-	if (!isPlainObject$2(dataExport)) return item;
+	if (!isPlainObject$3(dataExport)) return item;
 	const patch = {};
 	const outputSchemaVersion = sent?.outputSchemaVersion ?? declaredOrDefault(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION);
 	if (!Object.is(dataExport["OutputSchemaVersion"], outputSchemaVersion)) patch["OutputSchemaVersion"] = outputSchemaVersion;
@@ -3045,7 +3052,7 @@ const EVENTBRIDGE_CONFIG_PATH = "AWS::S3::Bucket NotificationConfiguration.Event
 const EVENTBRIDGE_CONFIG_KEY = "EventBridgeConfiguration";
 const EVENTBRIDGE_DEFAULT_ENABLED = true;
 function eventBridgeEnabledOf(eb) {
-	const declared = isPlainObject$2(eb) ? eb["EventBridgeEnabled"] : void 0;
+	const declared = isPlainObject$3(eb) ? eb["EventBridgeEnabled"] : void 0;
 	return coerceCfnBoolean(declared) ?? EVENTBRIDGE_DEFAULT_ENABLED;
 }
 const NOTIFICATION_LIST_KEYS = [
@@ -3075,7 +3082,7 @@ function foldNotificationEvents(item) {
 	return out;
 }
 function effectiveNotificationConfiguration(config) {
-	if (!isPlainObject$2(config)) return config;
+	if (!isPlainObject$3(config)) return config;
 	let out = config;
 	for (const listKey of NOTIFICATION_LIST_KEYS) out = canonicalizeItemList(out, listKey, foldNotificationEvents);
 	out = dropEmptyNotificationFamilies(out);
@@ -3086,8 +3093,8 @@ function foldEventBridgeConfiguration(config) {
 	if (eb === void 0) return config;
 	if (eb !== null && configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH)) return config;
 	const enabled = eb === null ? false : eventBridgeEnabledOf(eb);
-	const declared = isPlainObject$2(eb) ? eb["EventBridgeEnabled"] : void 0;
-	if (isPlainObject$2(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
+	const declared = isPlainObject$3(eb) ? eb["EventBridgeEnabled"] : void 0;
+	if (isPlainObject$3(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
 	return {
 		...config,
 		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
@@ -3129,18 +3136,21 @@ function deepSameValue(a, b) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((element, index) => deepSameValue(element, b[index]));
 	}
-	if (isPlainObject$2(a) && isPlainObject$2(b)) {
+	if (isPlainObject$3(a) && isPlainObject$3(b)) {
 		const keysA = Object.keys(a);
 		if (keysA.length !== Object.keys(b).length) return false;
 		return keysA.every((key) => Object.hasOwn(b, key) && deepSameValue(a[key], b[key]));
 	}
 	return false;
 }
-const TIMEZONE_INDEPENDENT_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?$/;
+const TIMEZONE_INDEPENDENT_DATE = /^\d{4}-\d{2}-\d{2}([Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?$/;
 function cfnDateToIso(value) {
-	if (typeof value === "string" && !TIMEZONE_INDEPENDENT_DATE.test(value)) return void 0;
-	if (typeof value !== "string" && typeof value !== "number") return void 0;
-	const parsed = new Date(value);
+	let parsed;
+	if (typeof value === "string") {
+		if (!TIMEZONE_INDEPENDENT_DATE.test(value)) return void 0;
+		parsed = parseCfnTimestamp(value);
+	} else if (typeof value === "number") parsed = new Date(value);
+	else return;
 	return Number.isNaN(parsed.getTime()) ? void 0 : parsed.toISOString();
 }
 const LEGACY_SINGULAR_TRANSITIONS = [["Transitions", "Transition"], ["NoncurrentVersionTransitions", "NoncurrentVersionTransition"]];
@@ -3148,9 +3158,9 @@ function foldLegacySingularTransitions(rule) {
 	let out;
 	for (const [pluralKey, singularKey] of LEGACY_SINGULAR_TRANSITIONS) {
 		const singular = rule[singularKey];
-		const hasSingular = isPlainObject$2(singular);
+		const hasSingular = isPlainObject$3(singular);
 		const plural = rule[pluralKey];
-		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$2(element));
+		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$3(element));
 		if (!hasSingular && !needsFilter) continue;
 		let collided = false;
 		const merged = mergeLegacySingular(plural, hasSingular ? singular : void 0, () => {
@@ -3199,7 +3209,7 @@ function foldLifecycleExpiration(rule) {
 		const iso = cfnDateToIso(expiration);
 		if (iso === void 0) return rule;
 		date = iso;
-	} else if (isPlainObject$2(expiration)) {
+	} else if (isPlainObject$3(expiration)) {
 		if (expiration["Days"] !== void 0) days = expiration["Days"];
 		if (expiration["Date"]) {
 			const iso = cfnDateToIso(expiration["Date"]);
@@ -3232,10 +3242,10 @@ function foldNoncurrentVersionExpiration(rule) {
 	const legacy = rule["NoncurrentVersionExpirationInDays"];
 	if (legacy === void 0) return rule;
 	const declaredObject = rule["NoncurrentVersionExpiration"];
-	if (declaredObject !== void 0 && !isPlainObject$2(declaredObject)) return rule;
+	if (declaredObject !== void 0 && !isPlainObject$3(declaredObject)) return rule;
 	const out = { ...rule };
 	delete out["NoncurrentVersionExpirationInDays"];
-	if (isPlainObject$2(declaredObject)) return out;
+	if (isPlainObject$3(declaredObject)) return out;
 	const days = coerceCfnNumber(legacy);
 	if (days === void 0) return rule;
 	out["NoncurrentVersionExpiration"] = { NoncurrentDays: days };
@@ -3267,10 +3277,10 @@ function foldLifecycleScope(rule, useFilterForm) {
 	return out;
 }
 function effectiveLifecycleConfiguration(config) {
-	if (!isPlainObject$2(config)) return config;
+	if (!isPlainObject$3(config)) return config;
 	const rules = config["Rules"];
 	if (!Array.isArray(rules)) return config;
-	const objectRules = rules.filter(isPlainObject$2);
+	const objectRules = rules.filter(isPlainObject$3);
 	if (objectRules.length !== rules.length || objectRules.length === 0) return config;
 	if (objectRules.some(lifecycleRuleRefused)) return config;
 	const useFilterForm = lifecycleUsesFilterForm(objectRules);
@@ -3302,7 +3312,7 @@ function canonicalizeItemList(properties, key, fold) {
 	if (!Array.isArray(list)) return properties;
 	let changed = false;
 	const mapped = list.map((element) => {
-		if (!isPlainObject$2(element)) return element;
+		if (!isPlainObject$3(element)) return element;
 		const next = fold(element);
 		if (next !== element) changed = true;
 		return next;
@@ -3316,7 +3326,7 @@ function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return `a string ${displaySafe(JSON.stringify(maskDeep(value, maskSecrets)))}`;
-	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => displaySafe(maskSecrets(key))).join(", ")}]`;
+	if (isPlainObject$3(value)) return `an object with keys [${Object.keys(value).map((key) => displaySafe(maskSecrets(key))).join(", ")}]`;
 	return `a ${typeof value} (${maskSecrets(String(value))})`;
 }
 function coerceCfnNumber(value) {
@@ -3326,8 +3336,8 @@ function coerceCfnNumber(value) {
 	return Number.isFinite(n) ? n : void 0;
 }
 function mergeLegacySingular(plural, singular, onCollision) {
-	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$2);
-	if (!isPlainObject$2(singular)) return out;
+	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$3);
+	if (!isPlainObject$3(singular)) return out;
 	const sc = singular["StorageClass"];
 	if (typeof sc === "string" && out.some((e) => e["StorageClass"] === sc)) {
 		onCollision(sc);
@@ -3669,12 +3679,12 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
 			if (typeof expiration === "number") sdkRule.Expiration = { Days: expiration };
-			else if (typeof expiration === "string") sdkRule.Expiration = { Date: new Date(expiration) };
+			else if (typeof expiration === "string") sdkRule.Expiration = { Date: parseCfnTimestamp(expiration) };
 			else if (expiration && typeof expiration === "object") {
 				const exp = expiration;
 				sdkRule.Expiration = {
 					Days: exp["Days"],
-					Date: exp["Date"] ? new Date(exp["Date"]) : void 0,
+					Date: exp["Date"] ? parseCfnTimestamp(exp["Date"]) : void 0,
 					ExpiredObjectDeleteMarker: exp["ExpiredObjectDeleteMarker"]
 				};
 			}
@@ -3683,7 +3693,7 @@ var S3BucketProvider = class S3BucketProvider {
 				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
 				else this.logger.warn(`Lifecycle rule ${shownLifecycleRuleId(maskDeep(rule["Id"], this.shownMask))} on ${this.shown(bucketName)} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
 			}
-			const nve = isPlainObject$2(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
+			const nve = isPlainObject$3(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
 			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
 			if (nve) sdkRule.NoncurrentVersionExpiration = {
 				NoncurrentDays: nve["NoncurrentDays"],
@@ -3701,14 +3711,14 @@ var S3BucketProvider = class S3BucketProvider {
 			if (allNvts.length > 0) sdkRule.NoncurrentVersionTransitions = allNvts.map(toSdkNvt);
 			const toSdkTransition = (t) => ({
 				Days: t["TransitionInDays"] ?? t["Days"],
-				Date: t["TransitionDate"] ?? t["Date"] ? new Date(t["TransitionDate"] ?? t["Date"]) : void 0,
+				Date: t["TransitionDate"] ?? t["Date"] ? parseCfnTimestamp(t["TransitionDate"] ?? t["Date"]) : void 0,
 				StorageClass: t["StorageClass"]
 			});
 			const transitions = rule["Transitions"];
 			const singularTransition = rule["Transition"];
 			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule ${shownLifecycleRuleId(maskDeep(rule["Id"], this.shownMask))} on ${this.shown(bucketName)} declares both Transitions and the legacy Transition for storage class ${this.shown(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
-			const abort = isPlainObject$2(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
+			const abort = isPlainObject$3(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
 			const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
 			const hasTags = tagFilters != null && tagFilters.length > 0;
@@ -3940,7 +3950,7 @@ var S3BucketProvider = class S3BucketProvider {
 			throw new Error(message);
 		};
 		if (dest === void 0 || dest === null) return;
-		if (!isPlainObject$2(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$3(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		if (!dest["BucketArn"]) return drop(`${destinationPath} has no destination bucket (BucketArn) (got ${describeValue$1(dest, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
 		return dest;
 	}
@@ -8201,6 +8211,8 @@ var LambdaFunctionProvider = class {
 					S3Bucket: builtCode.S3Bucket,
 					S3Key: builtCode.S3Key,
 					S3ObjectVersion: builtCode.S3ObjectVersion,
+					S3ObjectStorageMode: builtCode.S3ObjectStorageMode,
+					SourceKMSKeyArn: builtCode.SourceKMSKeyArn,
 					ZipFile: builtCode.ZipFile,
 					ImageUri: builtCode.ImageUri,
 					Architectures: architecturesChanged ? normalizeArchitectures(properties["Architectures"]) : void 0
@@ -8461,6 +8473,8 @@ var LambdaFunctionProvider = class {
 		if (code["S3Bucket"]) result.S3Bucket = code["S3Bucket"];
 		if (code["S3Key"]) result.S3Key = code["S3Key"];
 		if (code["S3ObjectVersion"]) result.S3ObjectVersion = code["S3ObjectVersion"];
+		if (code["S3ObjectStorageMode"]) result.S3ObjectStorageMode = code["S3ObjectStorageMode"];
+		if (code["SourceKMSKeyArn"]) result.SourceKMSKeyArn = code["SourceKMSKeyArn"];
 		if (code["ZipFile"]) result.ZipFile = this.createZipFromInlineCode(code["ZipFile"], runtime);
 		if (code["ImageUri"]) result.ImageUri = code["ImageUri"];
 		return result;
@@ -8673,6 +8687,7 @@ var LambdaFunctionProvider = class {
 			"Code.S3Bucket",
 			"Code.S3Key",
 			"Code.S3ObjectVersion",
+			"Code.S3ObjectStorageMode",
 			"Code.ZipFile",
 			"Code.SourceKMSKeyArn"
 		];
@@ -9364,7 +9379,7 @@ var LambdaEventSourceMappingProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const log = this.operationSinks(context?.maskSecrets, properties);
 		log.debug(`Creating event source mapping ${logicalId}`);
-		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const functionName = properties["FunctionName"];
 		if (!functionName) throw new ProvisioningError(`FunctionName is required for event source mapping ${logicalId}`, resourceType, logicalId);
 		if (declaredConsumptionMode(properties) !== void 0) {
@@ -9378,7 +9393,7 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["BatchSize"]) params.BatchSize = properties["BatchSize"];
 			if (properties["StartingPosition"]) params.StartingPosition = properties["StartingPosition"];
 			if (properties["Enabled"] !== void 0) params.Enabled = properties["Enabled"];
-			if (properties["MaximumBatchingWindowInSeconds"]) params.MaximumBatchingWindowInSeconds = properties["MaximumBatchingWindowInSeconds"];
+			if (properties["MaximumBatchingWindowInSeconds"] !== void 0) params.MaximumBatchingWindowInSeconds = properties["MaximumBatchingWindowInSeconds"];
 			if (properties["MaximumRetryAttempts"] !== void 0) params.MaximumRetryAttempts = properties["MaximumRetryAttempts"];
 			if (properties["BisectBatchOnFunctionError"] !== void 0) params.BisectBatchOnFunctionError = properties["BisectBatchOnFunctionError"];
 			if (properties["MaximumRecordAgeInSeconds"]) params.MaximumRecordAgeInSeconds = properties["MaximumRecordAgeInSeconds"];
@@ -9402,7 +9417,7 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["Topics"]) params.Topics = properties["Topics"];
 			if (properties["StartingPositionTimestamp"] !== void 0) {
 				const raw = properties["StartingPositionTimestamp"];
-				params.StartingPositionTimestamp = typeof raw === "number" ? /* @__PURE__ */ new Date(raw * 1e3) : raw instanceof Date ? raw : new Date(raw);
+				params.StartingPositionTimestamp = typeof raw === "number" ? /* @__PURE__ */ new Date(raw * 1e3) : raw instanceof Date ? raw : parseCfnTimestamp(raw);
 			}
 			const orphanWindow = createEventSourceMappingLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleMappingOrphans(logicalId, orphanWindow, log, functionName, params.EventSourceArn);
@@ -9458,22 +9473,29 @@ var LambdaEventSourceMappingProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const log = this.operationSinks(context?.maskSecrets, properties, previousProperties);
-		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
+		const restoring = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		for (const key of ["Queues", "Topics"]) {
+			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
+			const reason = `${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`;
+			if (!restoring) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${reason}; deploy with --replace to delete and recreate the mapping`);
+			log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: ${reason}. Proceeding without it: this update restores a recorded or read-back configuration.`);
+		}
 		const desiredMode = declaredConsumptionMode(properties);
 		if (desiredMode !== void 0 && JSON.stringify(desiredMode) !== JSON.stringify(declaredConsumptionMode(previousProperties))) {
 			const message = consumptionModeRefusalMessage(logicalId, "update");
-			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
+			if (!restoring) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
 			log.warn(safeMsg`${message} Proceeding without it: this update restores a recorded or read-back configuration.`);
 		}
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, context);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, restoring);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, context) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, restoring) {
 		log.debug(`Updating event source mapping ${logicalId}: ${physicalId}`);
 		const updateParams = {
 			UUID: physicalId,
@@ -9494,7 +9516,7 @@ var LambdaEventSourceMappingProvider = class {
 		if (properties["ScalingConfig"] !== void 0) updateParams.ScalingConfig = properties["ScalingConfig"];
 		if (properties["DocumentDBEventSourceConfig"] !== void 0) updateParams.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
 		for (const key of ["SelfManagedKafkaEventSourceConfig", "AmazonManagedKafkaEventSourceConfig"]) {
-			const block = kafkaConfigForUpdate(properties[key], previousProperties[key], { restoring: context?.replayingState === true || context?.desiredFromAwsReadback === true });
+			const block = kafkaConfigForUpdate(properties[key], previousProperties[key], { restoring });
 			if (block !== void 0) updateParams[key] = block;
 		}
 		if (properties["KmsKeyArn"] !== void 0) updateParams.KMSKeyArn = properties["KmsKeyArn"];
@@ -9539,7 +9561,7 @@ var LambdaEventSourceMappingProvider = class {
 		};
 	}
 	async applyTagDiff(arn, resourceType, logicalId, oldTagsRaw, newTagsRaw, log) {
-		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
+		const plan = planTagDiff(oldTagsRaw, newTagsRaw, DBPROXY_TAG_OPTIONS);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) log.warn(tagWarning);
 		const tagsToAdd = Object.fromEntries(plan.set);
@@ -9749,6 +9771,7 @@ var LambdaLayerVersionProvider = class {
 			if (content["S3Bucket"]) contentInput.S3Bucket = content["S3Bucket"];
 			if (content["S3Key"]) contentInput.S3Key = content["S3Key"];
 			if (content["S3ObjectVersion"]) contentInput.S3ObjectVersion = content["S3ObjectVersion"];
+			if (content["S3ObjectStorageMode"]) contentInput.S3ObjectStorageMode = content["S3ObjectStorageMode"];
 			const orphanWindow = publishLayerVersionLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleLayerOrphans(logicalId, orphanWindow, log, layerName);
 			const createClient = await this.getCreateClient();
@@ -11614,7 +11637,7 @@ const STREAM_POLICY_KEY = "ResourcePolicy";
 const STREAM_TAGS_KEY = "Tags";
 const POLICY_PATH = `${STREAM_SPECIFICATION_KEY}.${STREAM_POLICY_KEY}`;
 const TAGS_PATH = `${STREAM_SPECIFICATION_KEY}.${STREAM_TAGS_KEY}`;
-function isPlainObject$1(value) {
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function refusalOf(guard) {
@@ -11626,7 +11649,7 @@ function refusalOf(guard) {
 	}
 }
 function blockMembers(block) {
-	return isPlainObject$1(block) ? block : {};
+	return isPlainObject$2(block) ? block : {};
 }
 function readStreamPolicy(block) {
 	const value = blockMembers(block)[STREAM_POLICY_KEY];
@@ -11801,7 +11824,7 @@ function streamTagsMatchDeclared(liveTags, desiredBlock) {
 }
 function canonicalJson(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	if (isPlainObject$2(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
 	return JSON.stringify(value) ?? "null";
 }
 
@@ -12139,6 +12162,32 @@ function indexDeclares(desired, key, bagInformative) {
 function declaresIndexList(value) {
 	return Array.isArray(value) && value.length > 0;
 }
+function deletionProtectionRefusal(value, logicalId) {
+	return configBooleanRefusal({ DeletionProtectionEnabled: value }, "DeletionProtectionEnabled", `AWS::DynamoDB::Table ${logicalId}`);
+}
+function localSecondaryIndexesKey(value) {
+	if (value === void 0 || value === null) return "[]";
+	if (!Array.isArray(value)) return JSON.stringify(value);
+	const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+	const entries = value.map((entry) => {
+		if (!isRecord(entry)) return JSON.stringify(entry);
+		const keySchema = Array.isArray(entry["KeySchema"]) ? entry["KeySchema"].map((element) => isRecord(element) ? {
+			AttributeName: element["AttributeName"],
+			KeyType: element["KeyType"]
+		} : element) : entry["KeySchema"];
+		const projection = entry["Projection"];
+		const projectionKey = isRecord(projection) ? {
+			ProjectionType: projection["ProjectionType"],
+			NonKeyAttributes: Array.isArray(projection["NonKeyAttributes"]) ? projection["NonKeyAttributes"].length > 0 ? [...projection["NonKeyAttributes"]].map(String).sort() : void 0 : projection["NonKeyAttributes"]
+		} : projection;
+		return JSON.stringify({
+			IndexName: entry["IndexName"],
+			KeySchema: keySchema,
+			Projection: projectionKey
+		});
+	});
+	return JSON.stringify(entries.sort());
+}
 function desiredIndexEntriesByName(value) {
 	const byName = /* @__PURE__ */ new Map();
 	if (!declaresIndexList(value)) return byName;
@@ -12271,7 +12320,11 @@ var DynamoDBTableProvider = class {
 				Key: t.Key,
 				Value: t.Value
 			}));
-			if (properties["DeletionProtectionEnabled"] !== void 0) createParams.DeletionProtectionEnabled = properties["DeletionProtectionEnabled"];
+			if (properties["DeletionProtectionEnabled"] !== void 0) {
+				const protectionRefusal = deletionProtectionRefusal(properties["DeletionProtectionEnabled"], logicalId);
+				if (protectionRefusal !== void 0) throw new ProvisioningError(`${maskSecrets(protectionRefusal)}. Nothing was created; fix the template value`, resourceType, logicalId);
+				createParams.DeletionProtectionEnabled = coerceCfnBoolean(properties["DeletionProtectionEnabled"]);
+			}
 			if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
 			const createResourcePolicyDoc = this.extractResourcePolicyDocument(properties["ResourcePolicy"]);
 			if (createResourcePolicyDoc !== void 0) createParams.ResourcePolicy = createResourcePolicyDoc;
@@ -12345,7 +12398,18 @@ var DynamoDBTableProvider = class {
 				const ceilingRefusal = onDemandCeilingRefusal(properties, previousProperties, logicalId);
 				if (ceilingRefusal !== void 0) throw new ProvisioningError(`${ceilingRefusal}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
 			}
+			const deletionProtectionChanged = JSON.stringify(properties["DeletionProtectionEnabled"]) !== JSON.stringify(previousProperties["DeletionProtectionEnabled"]);
+			if (deletionProtectionChanged && context?.replayingState !== true && context?.desiredFromAwsReadback !== true) {
+				const protectionRefusal = deletionProtectionRefusal(properties["DeletionProtectionEnabled"], logicalId);
+				if (protectionRefusal !== void 0) throw new ProvisioningError(`${maskSecrets(protectionRefusal)}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
+			}
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			const desiredLsiKey = localSecondaryIndexesKey(properties["LocalSecondaryIndexes"]);
+			if (desiredLsiKey !== localSecondaryIndexesKey(previousProperties["LocalSecondaryIndexes"]) && (table === void 0 || desiredLsiKey !== localSecondaryIndexesKey(table.LocalSecondaryIndexes))) {
+				const lsiMessage = `AWS::DynamoDB::Table ${logicalId}: LocalSecondaryIndexes changed, but DynamoDB cannot add, remove or modify a local secondary index on an existing table, and CloudFormation fails the same update rather than replacing the table`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${lsiMessage}. Nothing was applied to the table; revert the LocalSecondaryIndexes change, or create a new table under a new logical ID (a new table starts empty)`, resourceType, logicalId, physicalId);
+				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
+			}
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
@@ -12493,6 +12557,19 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Updated SSESpecification on DynamoDB table ${physicalId}`);
 				}
 			}
+			if (deletionProtectionChanged) {
+				const rawDeletionProtection = properties["DeletionProtectionEnabled"];
+				const desiredDeletionProtection = rawDeletionProtection === void 0 ? false : coerceCfnBoolean(rawDeletionProtection);
+				if (desiredDeletionProtection === void 0) warn(`AWS::DynamoDB::Table ${logicalId}: DeletionProtectionEnabled is not a boolean, so it was not applied`);
+				else if (table?.DeletionProtectionEnabled !== desiredDeletionProtection) {
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						DeletionProtectionEnabled: desiredDeletionProtection
+					}));
+					await this.waitForTableActiveAfterUpdate(physicalId);
+					debug(`Set DeletionProtectionEnabled=${desiredDeletionProtection} on DynamoDB table ${physicalId}`);
+				}
+			}
 			if (JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
 				const newViewType = this.extractStreamViewType(properties["StreamSpecification"]);
 				const prevViewType = this.extractStreamViewType(previousProperties["StreamSpecification"]);
@@ -13277,6 +13354,11 @@ var DynamoDBTableProvider = class {
 	canonicalizeDriftProperties(resourceType, properties) {
 		if (resourceType !== "AWS::DynamoDB::Table") return properties;
 		let result = properties;
+		const protection = coerceCfnBoolean(result["DeletionProtectionEnabled"]);
+		if (protection !== void 0 && protection !== result["DeletionProtectionEnabled"]) result = {
+			...result,
+			DeletionProtectionEnabled: protection
+		};
 		for (const listKey of ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"]) {
 			const list = result[listKey];
 			if (!Array.isArray(list)) continue;
@@ -14550,7 +14632,7 @@ function buildDeleteParams(properties) {
 function toDate(value, mask) {
 	if (value === void 0) return void 0;
 	if (value instanceof Date) return value;
-	const parsed = typeof value === "string" || typeof value === "number" ? new Date(value) : /* @__PURE__ */ new Date(NaN);
+	const parsed = typeof value === "string" ? parseCfnTimestamp(value) : typeof value === "number" ? new Date(value) : /* @__PURE__ */ new Date(NaN);
 	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${JSON.stringify(maskDeep(value, mask))}`);
 	return parsed;
 }
@@ -16184,6 +16266,125 @@ function isNamedError(error, names) {
 	return typeof name === "string" && names.has(name);
 }
 const NAT_GATEWAY_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["NatGatewayNotFound"]);
+function readNatZoneAddresses(raw) {
+	if (raw === void 0 || raw === null) return { kind: "absent" };
+	const unusable = (reason) => ({
+		kind: "unusable",
+		reason
+	});
+	if (!Array.isArray(raw)) return unusable("is not a list");
+	if (raw.length === 0) return unusable("is an empty list");
+	const entries = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, item] of raw.entries()) {
+		if (typeof item !== "object" || item === null || Array.isArray(item)) return unusable(`entry ${index} is not an object`);
+		const record = item;
+		const zone = record["AvailabilityZone"];
+		const zoneId = record["AvailabilityZoneId"];
+		if (zone !== void 0 && (typeof zone !== "string" || zone === "")) return unusable(`entry ${index}'s AvailabilityZone is not a zone name`);
+		if (zoneId !== void 0 && (typeof zoneId !== "string" || zoneId === "")) return unusable(`entry ${index}'s AvailabilityZoneId is not a zone id`);
+		if (zone === void 0 && zoneId === void 0) return unusable(`entry ${index} names neither AvailabilityZone nor AvailabilityZoneId`);
+		const ids = record["AllocationIds"];
+		if (!Array.isArray(ids) || ids.length === 0 || ids.some((id) => typeof id !== "string" || id === "")) return unusable(`entry ${index}'s AllocationIds is not a non-empty list of allocation ids`);
+		for (const id of ids) {
+			if (seen.has(id)) return unusable(`declares allocation id ${id} more than once`);
+			seen.add(id);
+		}
+		entries.push({
+			...zone !== void 0 && { availabilityZone: zone },
+			...zoneId !== void 0 && { availabilityZoneId: zoneId },
+			allocationIds: [...ids]
+		});
+	}
+	return {
+		kind: "usable",
+		entries
+	};
+}
+function natGatewayAttributes(gateway) {
+	const addresses = gateway.NatGatewayAddresses ?? [];
+	const primary = addresses.find((a) => a.IsPrimary === true) ?? addresses[0];
+	return definedAttributes({
+		NatGatewayId: gateway.NatGatewayId,
+		EniId: gateway.AvailabilityMode === "regional" ? void 0 : primary?.NetworkInterfaceId,
+		RouteTableId: gateway.RouteTableId,
+		AutoProvisionZones: gateway.AutoProvisionZones,
+		AutoScalingIps: gateway.AutoScalingIps
+	});
+}
+const NAT_ADDRESS_SETTLE_POLLS = 90;
+const NAT_ADDRESS_SETTLE_DELAY_MS = 1e4;
+const NAT_ADDRESS_UNLISTED_POLLS = 6;
+function natAddressInZone(address, entry) {
+	return entry.availabilityZone !== void 0 && address.AvailabilityZone === entry.availabilityZone || entry.availabilityZoneId !== void 0 && address.AvailabilityZoneId === entry.availabilityZoneId;
+}
+function natAddressHeld(address) {
+	return typeof address.AllocationId === "string" && address.Status !== "disassociating" && address.Status !== "failed";
+}
+function planNatZoneAddressUpdate(desired, live) {
+	const held = live.filter(natAddressHeld);
+	const associate = [];
+	const moved = [];
+	const awaitingRelease = [];
+	const wanted = /* @__PURE__ */ new Set();
+	for (const entry of desired) {
+		const missing = [];
+		for (const allocationId of entry.allocationIds) {
+			wanted.add(allocationId);
+			const holder = held.find((a) => a.AllocationId === allocationId);
+			if (holder === void 0) {
+				missing.push(allocationId);
+				if (live.some((a) => a.AllocationId === allocationId && a.Status === "disassociating")) awaitingRelease.push(allocationId);
+			} else if (!natAddressInZone(holder, entry)) moved.push(allocationId);
+		}
+		if (missing.length > 0) associate.push({
+			...entry,
+			allocationIds: missing
+		});
+	}
+	return {
+		associate,
+		disassociate: held.filter((a) => !wanted.has(a.AllocationId)).map((a) => ({
+			allocationId: a.AllocationId,
+			associationId: a.AssociationId
+		})),
+		moved,
+		awaitingRelease,
+		keptSettled: held.some((a) => wanted.has(a.AllocationId) && a.Status === "succeeded")
+	};
+}
+function readbackNatZoneAddresses(live, recorded) {
+	const held = live.filter(natAddressHeld).filter((a) => a.AvailabilityZone !== void 0 || a.AvailabilityZoneId !== void 0);
+	const out = [];
+	const emit = (entry, addresses) => {
+		if (addresses.length === 0) return;
+		const ids = addresses.map((a) => a.AllocationId);
+		const ordered = [...entry.allocationIds.filter((id) => ids.includes(id)), ...ids.filter((id) => !entry.allocationIds.includes(id))];
+		out.push({
+			...entry.availabilityZone !== void 0 && { AvailabilityZone: entry.availabilityZone },
+			...entry.availabilityZoneId !== void 0 && { AvailabilityZoneId: entry.availabilityZoneId },
+			AllocationIds: ordered
+		});
+	};
+	let rest = held;
+	for (const entry of recorded) {
+		emit(entry, rest.filter((a) => natAddressInZone(a, entry)));
+		rest = rest.filter((a) => !natAddressInZone(a, entry));
+	}
+	const zones = [...new Set(rest.map((a) => a.AvailabilityZone ?? a.AvailabilityZoneId ?? ""))];
+	for (const zone of zones) {
+		const inZone = rest.filter((a) => (a.AvailabilityZone ?? a.AvailabilityZoneId ?? "") === zone);
+		const first = inZone[0];
+		emit(first.AvailabilityZone !== void 0 ? {
+			availabilityZone: first.AvailabilityZone,
+			allocationIds: []
+		} : {
+			availabilityZoneId: first.AvailabilityZoneId,
+			allocationIds: []
+		}, inZone);
+	}
+	return out;
+}
 const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
 const INSTANCE_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidInstanceID.NotFound"]);
 const VPC_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidVpcID.NotFound"]);
@@ -16265,7 +16466,10 @@ var EC2Provider = class {
 			"SecondaryAllocationIds",
 			"SecondaryPrivateIpAddresses",
 			"SecondaryPrivateIpAddressCount",
-			"Tags"
+			"Tags",
+			"AvailabilityMode",
+			"VpcId",
+			"AvailabilityZoneAddresses"
 		])],
 		["AWS::EC2::RouteTable", /* @__PURE__ */ new Set(["VpcId", "Tags"])],
 		["AWS::EC2::Route", /* @__PURE__ */ new Set([
@@ -16343,7 +16547,7 @@ var EC2Provider = class {
 	unhandledByDesign = /* @__PURE__ */ new Map([
 		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
 		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
-		["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"], ["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and cdkd rejects NatGateway updates outright — routed via Cloud Control instead"]])],
+		["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and the cdkd NatGateway update releases only the AvailabilityZoneAddresses of a regional gateway, never the secondary addresses of a zonal one — routed via Cloud Control instead"]])],
 		["AWS::EC2::EIP", /* @__PURE__ */ new Map([
 			["Address", "Bring-your-own-IP: allocating a specific address you own is not yet supported; cdkd allocates an Amazon-owned address"],
 			["IpamPoolId", "Allocation from an IPAM pool is not yet supported"],
@@ -16509,7 +16713,7 @@ var EC2Provider = class {
 			case "AWS::EC2::InternetGateway": return this.updateInternetGateway(logicalId, physicalId);
 			case "AWS::EC2::EIP": return this.updateEip(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId);
+			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
 			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
@@ -16551,9 +16755,15 @@ var EC2Provider = class {
 			case "AWS::EC2::SecurityGroup": return this.getSecurityGroupAttribute(physicalId, attributeName);
 			case "AWS::EC2::Instance": return this.getInstanceAttribute(physicalId, attributeName);
 			case "AWS::EC2::EIP": return this.getEipAttribute(physicalId, attributeName);
+			case "AWS::EC2::NatGateway": return this.getNatGatewayAttribute(physicalId, attributeName);
 			default: return;
 		}
 	}
+	async getNatGatewayAttribute(physicalId, attributeName) {
+		if (attributeName === "NatGatewayId") return physicalId;
+		const gateway = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.NatGatewayId === physicalId);
+		return gateway === void 0 ? void 0 : natGatewayAttributes(gateway)[attributeName];
+	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
 		let read;
 		let identity;
@@ -17050,7 +17260,7 @@ var EC2Provider = class {
 		}
 	}
 	updateInternetGateway(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::InternetGateway", logicalId, "destroy + redeploy the InternetGateway. IGW properties are immutable in AWS."));
+		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::InternetGateway", logicalId, "destroy + redeploy the InternetGateway. IGW properties are immutable in AWS"));
 	}
 	async deleteInternetGateway(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting InternetGateway ${logicalId}: ${physicalId}`);
@@ -17559,8 +17769,11 @@ var EC2Provider = class {
 	async createNatGateway(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating NatGateway ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const regional = properties["AvailabilityMode"] === "regional";
 		const subnetId = properties["SubnetId"];
-		if (!subnetId) throw new ProvisioningError(`SubnetId is required for NatGateway ${logicalId}`, resourceType, logicalId);
+		if (!subnetId && !regional) throw new ProvisioningError(`SubnetId is required for NatGateway ${logicalId} (a regional NAT gateway, AvailabilityMode: regional, takes VpcId instead)`, resourceType, logicalId);
+		const zoneAddresses = readNatZoneAddresses(properties["AvailabilityZoneAddresses"]);
+		if (zoneAddresses.kind === "unusable") throw new ProvisioningError(`AvailabilityZoneAddresses of NatGateway ${logicalId} ${zoneAddresses.reason}; each entry needs AvailabilityZone or AvailabilityZoneId and a non-empty AllocationIds list`, resourceType, logicalId);
 		const natGatewayToken = acquireIdempotencyToken({
 			scope: "CreateNatGateway",
 			logicalId
@@ -17571,6 +17784,13 @@ var EC2Provider = class {
 				...TagSpecifications && { TagSpecifications },
 				ClientToken: natGatewayToken.value,
 				SubnetId: subnetId,
+				AvailabilityMode: properties["AvailabilityMode"],
+				VpcId: properties["VpcId"],
+				...zoneAddresses.kind === "usable" && { AvailabilityZoneAddresses: zoneAddresses.entries.map((entry) => ({
+					AvailabilityZone: entry.availabilityZone,
+					AvailabilityZoneId: entry.availabilityZoneId,
+					AllocationIds: entry.allocationIds
+				})) },
 				AllocationId: properties["AllocationId"],
 				ConnectivityType: properties["ConnectivityType"] ?? void 0,
 				PrivateIpAddress: properties["PrivateIpAddress"],
@@ -17581,21 +17801,26 @@ var EC2Provider = class {
 			const natGatewayId = response.NatGateway.NatGatewayId;
 			createdId = natGatewayId;
 			if (!tagsApplied) await this.applyTags(natGatewayId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
+			let described;
 			if (process.env["CDKD_NO_WAIT"] !== "true") {
 				this.logger.debug(`Waiting for NatGateway ${natGatewayId} to reach available state...`);
-				await waitUntilNatGatewayAvailable({
+				described = (await waitUntilNatGatewayAvailable({
 					client: this.ec2Client,
 					maxWaitTime: 900,
 					minDelay: 5,
 					maxDelay: 10
-				}, { NatGatewayIds: [natGatewayId] });
+				}, { NatGatewayIds: [natGatewayId] })).reason?.NatGateways?.find((g) => g.NatGatewayId === natGatewayId);
 				this.logger.debug(`NatGateway ${natGatewayId} is available`);
 			} else this.logger.debug(`NatGateway ${natGatewayId} created (skipping available-state wait per --no-wait)`);
 			this.logger.debug(`Successfully created NatGateway ${logicalId}: ${natGatewayId}`);
 			natGatewayToken.release();
 			return {
 				physicalId: natGatewayId,
-				attributes: { NatGatewayId: natGatewayId }
+				attributes: {
+					...natGatewayAttributes(response.NatGateway ?? {}),
+					...described !== void 0 && natGatewayAttributes(described),
+					NatGatewayId: natGatewayId
+				}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -17604,8 +17829,125 @@ var EC2Provider = class {
 			throw thrown;
 		}
 	}
-	updateNatGateway(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::NatGateway", logicalId, "destroy + redeploy the NatGateway (and the dependent Routes). NAT Gateway properties are immutable in AWS."));
+	async updateNatGateway(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		this.logger.debug(safeMsg`Updating NatGateway ${logicalId}: ${physicalId}`);
+		const refuse = (property) => {
+			throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `destroy + redeploy the NatGateway (and the dependent Routes). cdkd cannot change ${property} of an existing NAT gateway`);
+		};
+		for (const key of [
+			"SubnetId",
+			"ConnectivityType",
+			"AllocationId",
+			"PrivateIpAddress",
+			"AvailabilityMode",
+			"VpcId"
+		]) {
+			const next = properties[key];
+			const prev = previousProperties[key];
+			if (next !== void 0 && prev !== void 0 && JSON.stringify(next) !== JSON.stringify(prev)) refuse(key);
+		}
+		if (previousProperties["AvailabilityZoneAddresses"] == null && properties["AvailabilityZoneAddresses"] != null) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "destroy + redeploy the NatGateway (and the dependent Routes). Adding AvailabilityZoneAddresses to a gateway created without it replaces the gateway");
+		for (const key of [
+			"SecondaryAllocationIds",
+			"SecondaryPrivateIpAddresses",
+			"SecondaryPrivateIpAddressCount"
+		]) if (JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key])) refuse(key);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		try {
+			let zonePlan;
+			if (JSON.stringify(properties["AvailabilityZoneAddresses"]) !== JSON.stringify(previousProperties["AvailabilityZoneAddresses"])) zonePlan = await this.planNatGatewayZoneAddresses(logicalId, physicalId, resourceType, properties["AvailabilityZoneAddresses"]);
+			if (zonePlan !== void 0) await this.applyNatGatewayZoneAddresses(logicalId, physicalId, resourceType, zonePlan);
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], mask);
+			this.logger.debug(safeMsg`Successfully updated NatGateway ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update NatGateway ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async planNatGatewayZoneAddresses(logicalId, physicalId, resourceType, rawDesired) {
+		const desired = readNatZoneAddresses(rawDesired);
+		if (desired.kind === "unusable") throw markNonRetryable(new ProvisioningError(`AvailabilityZoneAddresses of NatGateway ${logicalId} ${desired.reason}; each entry needs AvailabilityZone or AvailabilityZoneId and a non-empty AllocationIds list`, resourceType, logicalId, physicalId));
+		if (desired.kind === "absent") throw markNonRetryable(new ProvisioningError(`NatGateway ${logicalId} cannot drop AvailabilityZoneAddresses: a regional NAT gateway created with explicit zones does not return to automatic zone expansion, and CloudFormation refuses the same update. Keep at least one zone declared, or rename the logical id or change a create-only property to replace the gateway`, resourceType, logicalId, physicalId));
+		const gateway = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.NatGatewayId === physicalId);
+		if (gateway === void 0) throw new ProvisioningError(`NatGateway ${logicalId} (${physicalId}) was not returned by DescribeNatGateways, so its addresses cannot be updated`, resourceType, logicalId, physicalId);
+		const plan = planNatZoneAddressUpdate(desired.entries, gateway.NatGatewayAddresses ?? []);
+		for (const d of plan.disassociate) {
+			const status = gateway.NatGatewayAddresses?.find((x) => x.AllocationId === d.allocationId)?.Status ?? "unknown";
+			this.logger.debug(safeMsg`NatGateway ${physicalId} plans to release ${d.allocationId} (live status ${status})`);
+		}
+		for (const id of plan.awaitingRelease) this.logger.debug(safeMsg`NatGateway ${physicalId} plans to associate ${id}, which AWS is still releasing`);
+		if (plan.moved.length > 0) throw markNonRetryable(new ProvisioningError(`NatGateway ${logicalId} declares ${plan.moved.join(", ")} in a different zone from the one that holds it; cdkd does not move an Elastic IP between zones in one update. Remove it from AvailabilityZoneAddresses in one deploy and add it to the new zone in the next`, resourceType, logicalId, physicalId));
+		return plan;
+	}
+	async applyNatGatewayZoneAddresses(logicalId, physicalId, resourceType, plan) {
+		const budget = { polls: NAT_ADDRESS_SETTLE_POLLS };
+		if (plan.awaitingRelease.length > 0) {
+			const ids = new Set(plan.awaitingRelease);
+			await this.pollNatGateway(logicalId, physicalId, resourceType, budget, `the release of ${plan.awaitingRelease.join(", ")}`, "nothing was associated or released", (gateway) => (gateway.NatGatewayAddresses ?? []).some((a) => typeof a.AllocationId === "string" && ids.has(a.AllocationId) && a.Status === "disassociating") ? "wait" : "done");
+		}
+		for (const entry of plan.associate) await this.ec2Client.send(new AssociateNatGatewayAddressCommand({
+			NatGatewayId: physicalId,
+			AllocationIds: entry.allocationIds,
+			AvailabilityZone: entry.availabilityZone,
+			AvailabilityZoneId: entry.availabilityZoneId
+		}));
+		if (plan.disassociate.length === 0) return;
+		let associationIds = plan.disassociate.map((d) => d.associationId).filter((id) => id !== void 0);
+		const unassociated = plan.disassociate.filter((d) => d.associationId === void 0);
+		if (unassociated.length > 0) {
+			const targets = new Set(unassociated.map((d) => d.allocationId));
+			const gateway = await this.pollNatGateway(logicalId, physicalId, resourceType, budget, `the association of ${unassociated.map((d) => d.allocationId).join(", ")} before releasing it`, "the release was not sent", (gw) => (gw.NatGatewayAddresses ?? []).some((a) => typeof a.AllocationId === "string" && targets.has(a.AllocationId) && natAddressHeld(a) && !(a.Status === "succeeded" && typeof a.AssociationId === "string")) ? "wait" : "done");
+			for (const a of gateway.NatGatewayAddresses ?? []) if (typeof a.AllocationId === "string" && targets.has(a.AllocationId) && natAddressHeld(a) && typeof a.AssociationId === "string") associationIds.push(a.AssociationId);
+			associationIds = [...new Set(associationIds)];
+		}
+		if (associationIds.length === 0) return;
+		if (!plan.keptSettled) {
+			const releasing = new Set(plan.disassociate.map((d) => d.allocationId));
+			const added = plan.associate.flatMap((e) => e.allocationIds);
+			let unlisted = 0;
+			await this.pollNatGateway(logicalId, physicalId, resourceType, budget, "an address the template keeps to associate before releasing the last associated one", "the release was not sent", (gw) => {
+				const kept = (gw.NatGatewayAddresses ?? []).filter((a) => typeof a.AllocationId === "string" && !releasing.has(a.AllocationId));
+				if (kept.some((a) => a.Status === "succeeded")) return "done";
+				if (kept.some((a) => a.Status === "associating")) return "wait";
+				const missing = added.filter((id) => !kept.some((a) => a.AllocationId === id));
+				if (missing.length > 0) {
+					unlisted++;
+					if (unlisted <= NAT_ADDRESS_UNLISTED_POLLS) return "wait";
+					return markNonRetryable(new ProvisioningError(`NatGateway ${logicalId} does not list ${missing.join(", ")} after associating it, so its last associated address was not released. Check \`aws ec2 describe-nat-gateways --nat-gateway-ids ${physicalId}\` and re-run the deploy`, resourceType, logicalId, physicalId));
+				}
+				const failed = added.filter((id) => kept.find((a) => a.AllocationId === id)?.Status === "failed");
+				return markNonRetryable(new ProvisioningError(failed.length > 0 ? `NatGateway ${logicalId} could not associate ${failed.join(", ")}, so its last associated address was not released. Read the failure with \`aws ec2 describe-nat-gateways --nat-gateway-ids ${physicalId}\` and fix the declared Elastic IP` : `NatGateway ${logicalId} has no other associated or associating address, so its last associated address was not released. Declare an Elastic IP the gateway can associate`, resourceType, logicalId, physicalId));
+			});
+		}
+		await this.ec2Client.send(new DisassociateNatGatewayAddressCommand({
+			NatGatewayId: physicalId,
+			AssociationIds: associationIds
+		}));
+	}
+	async pollNatGateway(logicalId, physicalId, resourceType, budget, what, unsent, decide) {
+		this.logger.debug(safeMsg`Waiting for NatGateway ${physicalId}: ${what}...`);
+		const watch = startInterruptWatch(`NatGateway ${logicalId} address wait`);
+		try {
+			while (budget.polls > 0) {
+				budget.polls--;
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				const gateway = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.NatGatewayId === physicalId);
+				if (gateway === void 0 || gateway.State === "deleting" || gateway.State === "deleted" || gateway.State === "failed") throw markNonRetryable(new ProvisioningError(`NatGateway ${logicalId} (${physicalId}) is ${gateway?.State ?? "no longer returned by DescribeNatGateways"}, so cdkd stopped waiting for ${what}`, resourceType, logicalId, physicalId));
+				const verdict = decide(gateway);
+				if (verdict === "done") return gateway;
+				if (verdict !== "wait") throw verdict;
+				await this.sleep(NAT_ADDRESS_SETTLE_DELAY_MS);
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw markNonRetryable(new ProvisioningError(`NatGateway ${logicalId} ran out of its ${NAT_ADDRESS_SETTLE_POLLS * NAT_ADDRESS_SETTLE_DELAY_MS / 6e4}-minute address wait while waiting for ${what}; ${unsent}. Re-run the deploy once \`aws ec2 describe-nat-gateways --nat-gateway-ids ${physicalId}\` shows its addresses settled`, resourceType, logicalId, physicalId));
 	}
 	async deleteNatGateway(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting NatGateway ${logicalId}: ${physicalId}`);
@@ -19209,7 +19551,7 @@ var EC2Provider = class {
 				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
 				case "AWS::EC2::Subnet": return await this.readSubnetCurrentState(physicalId);
 				case "AWS::EC2::InternetGateway": return await this.readInternetGatewayCurrentState(physicalId);
-				case "AWS::EC2::NatGateway": return await this.readNatGatewayCurrentState(physicalId);
+				case "AWS::EC2::NatGateway": return await this.readNatGatewayCurrentState(physicalId, properties);
 				case "AWS::EC2::RouteTable": return await this.readRouteTableCurrentState(physicalId);
 				case "AWS::EC2::SecurityGroup": return await this.readSecurityGroupCurrentState(physicalId, properties);
 				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId);
@@ -19293,15 +19635,22 @@ var EC2Provider = class {
 		if (!(await this.ec2Client.send(new DescribeInternetGatewaysCommand({ InternetGatewayIds: [physicalId] }))).InternetGateways?.[0]) return RESOURCE_NOT_FOUND;
 		return {};
 	}
-	async readNatGatewayCurrentState(physicalId) {
+	async readNatGatewayCurrentState(physicalId, properties) {
 		const gw = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.State !== "deleted" && g.State !== "deleting");
 		if (!gw) return RESOURCE_NOT_FOUND;
 		const result = {};
 		if (gw.SubnetId !== void 0) result["SubnetId"] = gw.SubnetId;
 		if (gw.ConnectivityType !== void 0) result["ConnectivityType"] = gw.ConnectivityType;
-		const primary = gw.NatGatewayAddresses?.[0];
-		if (primary?.AllocationId !== void 0) result["AllocationId"] = primary.AllocationId;
-		if (primary?.PrivateIp !== void 0) result["PrivateIpAddress"] = primary.PrivateIp;
+		const regional = gw.AvailabilityMode === "regional";
+		const primary = gw.NatGatewayAddresses?.find((a) => a.IsPrimary === true) ?? gw.NatGatewayAddresses?.[0];
+		if (primary?.AllocationId !== void 0 && (!regional || properties?.["AllocationId"] != null)) result["AllocationId"] = primary.AllocationId;
+		if (primary?.PrivateIp !== void 0 && (!regional || properties?.["PrivateIpAddress"] != null)) result["PrivateIpAddress"] = primary.PrivateIp;
+		if (gw.AvailabilityMode !== void 0) result["AvailabilityMode"] = gw.AvailabilityMode;
+		if (gw.VpcId !== void 0) result["VpcId"] = gw.VpcId;
+		if (gw.AvailabilityMode === "regional" && gw.AutoProvisionZones === "disabled") {
+			const recorded = readNatZoneAddresses(properties?.["AvailabilityZoneAddresses"]);
+			result["AvailabilityZoneAddresses"] = readbackNatZoneAddresses(gw.NatGatewayAddresses ?? [], recorded.kind === "usable" ? recorded.entries : []);
+		}
 		return result;
 	}
 	async readEipCurrentState(physicalId, properties, afterOwnWrite) {
@@ -19693,10 +20042,13 @@ var EC2Provider = class {
 						attributes: { Id: rule.SecurityGroupRuleId }
 					};
 				}
-				case "AWS::EC2::NatGateway": return (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.State !== "deleted" && g.State !== "deleting") ? {
-					physicalId,
-					attributes: {}
-				} : null;
+				case "AWS::EC2::NatGateway": {
+					const gw = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.State !== "deleted" && g.State !== "deleting");
+					return gw ? {
+						physicalId,
+						attributes: natGatewayAttributes(gw)
+					} : null;
+				}
 				case "AWS::EC2::EIP": {
 					const { allocationId, publicIp } = this.parseEipPhysicalId(physicalId);
 					const filter = allocationId ? { AllocationIds: [allocationId] } : { PublicIps: publicIp ? [publicIp] : [] };
@@ -20182,10 +20534,11 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	}
 	createClient;
 	getCreateClient() {
-		this.createClient ??= this.apiGatewayClient.config.region().then((region) => withoutServerErrorRetries(new APIGatewayClient({
+		this.createClient ??= this.apiGatewayClient.config.region().then((region) => withoutServerErrorRetries(withApiGatewayPacing(new APIGatewayClient({
 			...ambientClientDefaults(),
-			region
-		})), (error) => {
+			region,
+			maxAttempts: 8
+		}))), (error) => {
 			this.createClient = void 0;
 			throw error;
 		});
@@ -20948,7 +21301,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		const methodPath = maskedIds.join("/");
 		let methodLeftBehind = false;
 		try {
-			await this.apiGatewayClient.send(new PutMethodCommand({
+			const putMethod = () => this.apiGatewayClient.send(new PutMethodCommand({
 				restApiId,
 				resourceId,
 				httpMethod,
@@ -20961,6 +21314,22 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				requestValidatorId,
 				authorizationScopes
 			}));
+			try {
+				await putMethod();
+			} catch (putError) {
+				if (!isMethodAlreadyExists(putError) || !await this.priorAttemptLeftMethod(logicalId, physicalId, log)) throw putError;
+				log.warn(`Replacing API Gateway Method ${logicalId} (${methodPath}), which an earlier failed attempt of it left behind`);
+				try {
+					await this.apiGatewayClient.send(new DeleteMethodCommand({
+						restApiId,
+						resourceId,
+						httpMethod
+					}));
+				} catch (deleteError) {
+					if (!(deleteError instanceof NotFoundException$1)) throw deleteError;
+				}
+				await putMethod();
+			}
 			try {
 				const integration = properties["Integration"];
 				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand(putIntegrationInput({
@@ -20992,6 +21361,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 					log.debug(`Cleaned up partially-created API Gateway Method ${logicalId} (${methodPath}) after wiring failure`);
 				} catch (cleanupError) {
 					methodLeftBehind = true;
+					getPriorAttempts(logicalId)?.notePossiblyLanded();
 					const cleanupFailure = describeAwsFailure(cleanupError);
 					const cleanupHead = `Failed to clean up partially-created API Gateway Method ${logicalId} (${methodPath}): `;
 					if (cleanupFailure.redacted) log.debug(`${cleanupHead}${cleanupFailure.detail}`);
@@ -21011,6 +21381,18 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			throw thrown;
 		}
 	}
+	async priorAttemptLeftMethod(logicalId, physicalId, log) {
+		const lookup = getPriorAttempts(logicalId);
+		if (lookup === void 0) return false;
+		if (lookup.possiblyLanded()) return true;
+		if (lookup.provenOrphanIds === void 0) return false;
+		try {
+			return (await lookup.provenOrphanIds()).includes(physicalId);
+		} catch (error) {
+			log.debug(`API Gateway Method ${logicalId}: rollback journal read failed: ${describeAwsFailure(error).detail}`);
+			return false;
+		}
+	}
 	async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties, log) {
 		const parts = physicalId.split("|");
 		const maskedId = parts.map((p) => log.value(p)).join("|");
@@ -21321,6 +21703,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		return null;
 	}
 };
+function isMethodAlreadyExists(error) {
+	return error instanceof Error && error.name === "ConflictException" && /already exists/i.test(error.message);
+}
 function isPlainObjectBlock(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -24613,6 +24998,70 @@ var StepFunctionsProvider = class {
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
+	canonicalizeDriftProperties(_resourceType, properties) {
+		if (properties["DefinitionString"] === void 0 && properties["DefinitionSubstitutions"] === void 0) return properties;
+		const substitutions = properties["DefinitionSubstitutions"];
+		const maskedNames = substitutions !== null && typeof substitutions === "object" && !Array.isArray(substitutions) ? Object.keys(substitutions).filter((name) => substitutions[name] === "***") : [];
+		const body = inlineDefinitionBody(properties, maskedNames.length === 0 ? void 0 : {
+			...substitutions,
+			...Object.fromEntries(maskedNames.map((name) => [name, MASKED_SUBSTITUTION_SENTINEL]))
+		});
+		if (body === void 0) return properties;
+		let definition;
+		try {
+			definition = JSON.parse(body);
+		} catch {
+			definition = body;
+		}
+		if (maskedNames.length > 0) definition = maskSentinelLeaves(definition);
+		const folded = {
+			...properties,
+			Definition: definition
+		};
+		delete folded["DefinitionString"];
+		delete folded["DefinitionSubstitutions"];
+		return folded;
+	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		return {
+			baseline: this.canonicalizeDriftProperties(resourceType, baseline),
+			aws
+		};
+	}
+	getDriftSecretPathAliases(_resourceType, properties, secretPaths) {
+		const substitutions = properties["DefinitionSubstitutions"];
+		if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return [];
+		const secretNames = Object.keys(substitutions).filter((name) => secretPaths.has("DefinitionSubstitutions") || [...secretPaths].some((p) => p === `DefinitionSubstitutions.${name}` || p.startsWith(`DefinitionSubstitutions.${name}.`)));
+		if (secretNames.length === 0) return [];
+		const definitionString = properties["DefinitionString"];
+		const raw = definitionString !== void 0 ? definitionString : properties["Definition"];
+		let body = raw;
+		if (typeof raw === "string") try {
+			body = JSON.parse(raw);
+		} catch {
+			return ["Definition"];
+		}
+		if (body === void 0 || body === null || typeof body !== "object") return ["Definition"];
+		const tokens = secretNames.map((name) => `\${${name}}`);
+		const carries = (text) => tokens.some((t) => text.includes(t));
+		const aliases = [];
+		const walk = (value, path, arrayPath) => {
+			if (typeof value === "string") {
+				if (carries(value)) aliases.push(arrayPath ?? path);
+				return;
+			}
+			if (Array.isArray(value)) {
+				value.forEach((item, i) => walk(item, `${path}.${i}`, arrayPath ?? path));
+				return;
+			}
+			if (value !== null && typeof value === "object") for (const [key, child] of Object.entries(value)) {
+				if (carries(key)) aliases.push(arrayPath ?? path);
+				walk(child, `${path}.${key}`, arrayPath);
+			}
+		};
+		walk(body, "Definition", void 0);
+		return [...new Set(aliases)];
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let resp;
 		try {
@@ -24708,21 +25157,11 @@ var StepFunctionsProvider = class {
 		}
 	}
 	async buildDefinitionString(properties) {
-		const definitionString = properties["DefinitionString"];
-		const definition = properties["Definition"];
-		if (definitionString !== void 0) {
-			if (typeof definitionString === "string") return definitionString;
-			return JSON.stringify(definitionString);
-		}
-		if (definition !== void 0) {
-			if (typeof definition === "string") return definition;
-			return JSON.stringify(definition);
-		}
+		const inline = inlineDefinitionBody(properties);
+		if (inline !== void 0) return inline;
+		const substitutions = properties["DefinitionSubstitutions"];
 		const s3Location = properties["DefinitionS3Location"];
-		if (s3Location?.Bucket && s3Location.Key) {
-			const body = await this.fetchDefinitionFromS3(s3Location.Bucket, s3Location.Key, s3Location.Version);
-			return this.applyDefinitionSubstitutions(body, properties["DefinitionSubstitutions"]);
-		}
+		if (s3Location?.Bucket && s3Location.Key) return applyDefinitionSubstitutions(await this.fetchDefinitionFromS3(s3Location.Bucket, s3Location.Key, s3Location.Version), substitutions);
 		return "{}";
 	}
 	async fetchDefinitionFromS3(bucket, key, version) {
@@ -24737,16 +25176,36 @@ var StepFunctionsProvider = class {
 		if (body.length === 0) throw new Error(`DefinitionS3Location object s3://${bucket}/${key} returned an empty body`);
 		return body;
 	}
-	applyDefinitionSubstitutions(body, substitutions) {
-		if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return body;
-		let result = body;
-		for (const [name, value] of Object.entries(substitutions)) {
-			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") continue;
-			result = result.split(`\${${name}}`).join(String(value));
-		}
-		return result;
-	}
 };
+function applyDefinitionSubstitutions(body, substitutions) {
+	if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return body;
+	const map = substitutions;
+	return body.replace(/\$\{([^{}]+)\}/g, (token, name) => {
+		if (!Object.hasOwn(map, name)) return token;
+		const value = map[name];
+		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return token;
+		return String(value);
+	});
+}
+function inlineDefinitionBody(properties, substitutionsOverride) {
+	const substitutions = substitutionsOverride ?? properties["DefinitionSubstitutions"];
+	const definitionString = properties["DefinitionString"];
+	const definition = properties["Definition"];
+	const value = definitionString !== void 0 ? definitionString : definition;
+	if (value === void 0) return void 0;
+	return applyDefinitionSubstitutions(typeof value === "string" ? value : JSON.stringify(value), substitutions);
+}
+const MASKED_SUBSTITUTION_SENTINEL = "cdkd-masked-substitution";
+function maskSentinelLeaves(value) {
+	if (typeof value === "string") return value.includes(MASKED_SUBSTITUTION_SENTINEL) ? "***" : value;
+	if (Array.isArray(value)) return value.map((item) => maskSentinelLeaves(item));
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value);
+		if (entries.some(([key]) => key.includes(MASKED_SUBSTITUTION_SENTINEL))) return "***";
+		return Object.fromEntries(entries.map(([key, child]) => [key, maskSentinelLeaves(child)]));
+	}
+	return value;
+}
 function mapEncryptionConfiguration(value) {
 	if (value === null || value === void 0) return void 0;
 	if (typeof value !== "object") return void 0;
@@ -30819,14 +31278,9 @@ function sanitizeDescription(value) {
 	if (typeof value === "string" && value.length === 0) return void 0;
 	return value;
 }
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-const SDK_UNSUPPORTED_RULE_KEYS = [
-	"PreParseTextTransformations",
-	"Monetize",
-	"PriceMultiplier"
-];
 function toSdkByteMatchStatement(byteMatchStatement) {
 	const encoded = byteMatchStatement["SearchStringBase64"];
 	if (typeof encoded !== "string") return byteMatchStatement;
@@ -30843,10 +31297,10 @@ const ARN_REFERENCE_STATEMENT_KEYS = [
 function toSdkStatement(statement) {
 	const converted = { ...statement };
 	const byteMatchStatement = converted["ByteMatchStatement"];
-	if (isPlainObject(byteMatchStatement)) converted["ByteMatchStatement"] = toSdkByteMatchStatement(byteMatchStatement);
+	if (isPlainObject$1(byteMatchStatement)) converted["ByteMatchStatement"] = toSdkByteMatchStatement(byteMatchStatement);
 	for (const key of ARN_REFERENCE_STATEMENT_KEYS) {
 		const reference = converted[key];
-		if (!isPlainObject(reference) || !("Arn" in reference)) continue;
+		if (!isPlainObject$1(reference) || !("Arn" in reference)) continue;
 		const { Arn: arn, ...rest } = reference;
 		converted[key] = {
 			...rest,
@@ -30854,28 +31308,28 @@ function toSdkStatement(statement) {
 		};
 	}
 	const notStatement = converted["NotStatement"];
-	if (isPlainObject(notStatement)) {
+	if (isPlainObject$1(notStatement)) {
 		const nested = notStatement["Statement"];
-		if (isPlainObject(nested)) converted["NotStatement"] = {
+		if (isPlainObject$1(nested)) converted["NotStatement"] = {
 			...notStatement,
 			Statement: toSdkStatement(nested)
 		};
 	}
 	for (const key of ["AndStatement", "OrStatement"]) {
 		const combined = converted[key];
-		if (!isPlainObject(combined)) continue;
+		if (!isPlainObject$1(combined)) continue;
 		const nested = combined["Statements"];
 		if (!Array.isArray(nested)) continue;
 		converted[key] = {
 			...combined,
-			Statements: nested.map((item) => isPlainObject(item) ? toSdkStatement(item) : item)
+			Statements: nested.map((item) => isPlainObject$1(item) ? toSdkStatement(item) : item)
 		};
 	}
 	for (const key of ["RateBasedStatement", "ManagedRuleGroupStatement"]) {
 		const scoping = converted[key];
-		if (!isPlainObject(scoping)) continue;
+		if (!isPlainObject$1(scoping)) continue;
 		const nested = scoping["ScopeDownStatement"];
-		if (!isPlainObject(nested)) continue;
+		if (!isPlainObject$1(nested)) continue;
 		converted[key] = {
 			...scoping,
 			ScopeDownStatement: toSdkStatement(nested)
@@ -30887,9 +31341,9 @@ function toSdkRules(rules) {
 	if (!rules) return [];
 	if (!Array.isArray(rules)) return rules;
 	return rules.map((rule) => {
-		if (!isPlainObject(rule)) return rule;
+		if (!isPlainObject$1(rule)) return rule;
 		const statement = rule["Statement"];
-		if (!isPlainObject(statement)) return rule;
+		if (!isPlainObject$1(statement)) return rule;
 		return {
 			...rule,
 			Statement: toSdkStatement(statement)
@@ -30901,7 +31355,7 @@ function toCfnByteMatchStatement(byteMatchStatement, baseline) {
 	if (raw === void 0) return byteMatchStatement;
 	const bytes = raw instanceof Uint8Array ? Buffer.from(raw) : typeof raw === "string" ? Buffer.from(raw, "utf8") : void 0;
 	if (!bytes) return byteMatchStatement;
-	const base = isPlainObject(baseline) ? baseline : void 0;
+	const base = isPlainObject$1(baseline) ? baseline : void 0;
 	const baseEncoded = base?.["SearchStringBase64"];
 	const basePlain = base?.["SearchString"];
 	const converted = { ...byteMatchStatement };
@@ -30926,12 +31380,12 @@ function toCfnByteMatchStatement(byteMatchStatement, baseline) {
 }
 function toCfnStatement(statement, baseline) {
 	const converted = { ...statement };
-	const base = isPlainObject(baseline) ? baseline : void 0;
+	const base = isPlainObject$1(baseline) ? baseline : void 0;
 	const byteMatchStatement = converted["ByteMatchStatement"];
-	if (isPlainObject(byteMatchStatement)) converted["ByteMatchStatement"] = toCfnByteMatchStatement(byteMatchStatement, base?.["ByteMatchStatement"]);
+	if (isPlainObject$1(byteMatchStatement)) converted["ByteMatchStatement"] = toCfnByteMatchStatement(byteMatchStatement, base?.["ByteMatchStatement"]);
 	for (const key of ARN_REFERENCE_STATEMENT_KEYS) {
 		const reference = converted[key];
-		if (!isPlainObject(reference) || !("ARN" in reference)) continue;
+		if (!isPlainObject$1(reference) || !("ARN" in reference)) continue;
 		const { ARN: arn, ...rest } = reference;
 		converted[key] = {
 			...rest,
@@ -30939,37 +31393,37 @@ function toCfnStatement(statement, baseline) {
 		};
 	}
 	const notStatement = converted["NotStatement"];
-	if (isPlainObject(notStatement)) {
+	if (isPlainObject$1(notStatement)) {
 		const nested = notStatement["Statement"];
-		if (isPlainObject(nested)) {
+		if (isPlainObject$1(nested)) {
 			const baseNot = base?.["NotStatement"];
 			converted["NotStatement"] = {
 				...notStatement,
-				Statement: toCfnStatement(nested, isPlainObject(baseNot) ? baseNot["Statement"] : void 0)
+				Statement: toCfnStatement(nested, isPlainObject$1(baseNot) ? baseNot["Statement"] : void 0)
 			};
 		}
 	}
 	for (const key of ["AndStatement", "OrStatement"]) {
 		const combined = converted[key];
-		if (!isPlainObject(combined)) continue;
+		if (!isPlainObject$1(combined)) continue;
 		const nested = combined["Statements"];
 		if (!Array.isArray(nested)) continue;
 		const baseCombined = base?.[key];
-		const baseList = isPlainObject(baseCombined) && Array.isArray(baseCombined["Statements"]) ? baseCombined["Statements"] : void 0;
+		const baseList = isPlainObject$1(baseCombined) && Array.isArray(baseCombined["Statements"]) ? baseCombined["Statements"] : void 0;
 		converted[key] = {
 			...combined,
-			Statements: nested.map((item, i) => isPlainObject(item) ? toCfnStatement(item, baseList?.[i]) : item)
+			Statements: nested.map((item, i) => isPlainObject$1(item) ? toCfnStatement(item, baseList?.[i]) : item)
 		};
 	}
 	for (const key of ["RateBasedStatement", "ManagedRuleGroupStatement"]) {
 		const scoping = converted[key];
-		if (!isPlainObject(scoping)) continue;
+		if (!isPlainObject$1(scoping)) continue;
 		const nested = scoping["ScopeDownStatement"];
-		if (!isPlainObject(nested)) continue;
+		if (!isPlainObject$1(nested)) continue;
 		const baseScoping = base?.[key];
 		converted[key] = {
 			...scoping,
-			ScopeDownStatement: toCfnStatement(nested, isPlainObject(baseScoping) ? baseScoping["ScopeDownStatement"] : void 0)
+			ScopeDownStatement: toCfnStatement(nested, isPlainObject$1(baseScoping) ? baseScoping["ScopeDownStatement"] : void 0)
 		};
 	}
 	return converted;
@@ -30978,27 +31432,16 @@ function toCfnRules(rules, baselineRules) {
 	if (!Array.isArray(rules)) return [];
 	const baseList = Array.isArray(baselineRules) ? baselineRules : void 0;
 	return rules.map((rule, i) => {
-		if (!isPlainObject(rule)) return rule;
+		if (!isPlainObject$1(rule)) return rule;
 		const statement = rule["Statement"];
-		if (!isPlainObject(statement)) return rule;
+		if (!isPlainObject$1(statement)) return rule;
 		const baseRule = baseList?.[i];
 		return {
 			...rule,
-			Statement: toCfnStatement(statement, isPlainObject(baseRule) ? baseRule["Statement"] : void 0)
+			Statement: toCfnStatement(statement, isPlainObject$1(baseRule) ? baseRule["Statement"] : void 0)
 		};
 	});
 }
-function collectSdkUnsupportedRuleKeys(value, found) {
-	if (Array.isArray(value)) {
-		for (const item of value) collectSdkUnsupportedRuleKeys(item, found);
-		return;
-	}
-	if (!isPlainObject(value)) return;
-	for (const [key, nested] of Object.entries(value)) {
-		if (SDK_UNSUPPORTED_RULE_KEYS.includes(key)) found.add(key);
-		collectSdkUnsupportedRuleKeys(nested, found);
-	}
-}
 var WAFv2WebACLProvider = class {
 	wafv2Client;
 	createClient;
@@ -31040,7 +31483,6 @@ var WAFv2WebACLProvider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const name = properties["Name"] || generatedNameFor("AWS::WAFv2::WebACL", logicalId);
 		const scope = requireConfigString(properties["Scope"], "REGIONAL", "AWS::WAFv2::WebACL Scope", replayWarn(this.logger, context));
-		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
 			const tags = desiredTags.map((tag) => ({
 				Key: tag.Key,
@@ -31090,7 +31532,6 @@ var WAFv2WebACLProvider = class {
 		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
-		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
 			const { id, name, scope } = parseWebACLArn(physicalId);
 			const getResponse = await this.getClient().send(new GetWebACLCommand({
@@ -31169,16 +31610,6 @@ var WAFv2WebACLProvider = class {
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
-	warnOnSdkUnsupportedRuleKeys(logicalId, rules) {
-		const found = /* @__PURE__ */ new Set();
-		collectSdkUnsupportedRuleKeys(rules, found);
-		if (found.size === 0) return;
-		const sorted = [...found].sort();
-		const names = sorted.join(", ");
-		const subject = sorted.length === 1 ? "property" : "properties";
-		const verb = sorted.length === 1 ? "has" : "have";
-		this.logger.warn(`WAFv2 WebACL ${logicalId}: rule ${subject} ${names} ${verb} no member in the installed AWS SDK WAFv2 model and will NOT be sent to AWS. Upgrade cdkd once its @aws-sdk/client-wafv2 dependency carries the ${subject}.`);
-	}
 	async applyTagDiff(arn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
@@ -31355,6 +31786,44 @@ const STANDARD_USER_POOL_ATTRIBUTES = /* @__PURE__ */ new Set([
 	"website",
 	"zoneinfo"
 ]);
+function createTimeOnlyChanges(properties, previousProperties) {
+	return [
+		[
+			"UsernameAttributes",
+			properties["UsernameAttributes"],
+			previousProperties["UsernameAttributes"],
+			"list"
+		],
+		[
+			"AliasAttributes",
+			properties["AliasAttributes"],
+			previousProperties["AliasAttributes"],
+			"list"
+		],
+		[
+			"UsernameConfiguration",
+			properties["UsernameConfiguration"],
+			previousProperties["UsernameConfiguration"],
+			"object"
+		]
+	].filter(([, desired, previous, shape]) => canonicalCreateTimeOnlyValue(shape, desired) !== canonicalCreateTimeOnlyValue(shape, previous)).map(([name]) => name);
+}
+function withPreviousCreateTimeOnly(bag, previousProperties, kept) {
+	if (kept.length === 0) return bag;
+	const out = { ...bag };
+	for (const key of kept) if (previousProperties[key] === void 0) delete out[key];
+	else out[key] = previousProperties[key];
+	return out;
+}
+function canonicalCreateTimeOnlyValue(shape, declared) {
+	const value = declared ?? (shape === "object" ? {} : []);
+	if (Array.isArray(value)) return JSON.stringify(value.map((v) => JSON.stringify(v)).sort());
+	if (typeof value === "object") {
+		const entries = Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, typeof v === "boolean" ? String(v) : v]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+		return JSON.stringify(entries);
+	}
+	return JSON.stringify(value);
+}
 function isEmptyObjectPlaceholder(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
 }
@@ -31837,6 +32306,13 @@ var CognitoUserPoolProvider = class {
 			throw new ProvisioningError(`${describeAwsFailure(error).detail}. Nothing was applied to user pool ${physicalId}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		}
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		const createTimeOnly = createTimeOnlyChanges(properties, previousProperties);
+		const keptCreateTimeOnly = stateBorneDesired ? createTimeOnly : [];
+		if (createTimeOnly.length > 0) {
+			const changed = createTimeOnly.join(", ");
+			if (stateBorneDesired) this.logger.warn(safeMsg`Cognito User Pool ${logicalId} (${physicalId}): ${changed} cannot be changed in place ` + safeMsg`(UpdateUserPool has no such member), so the pool keeps its current value and cdkd ` + safeMsg`records that value.`);
+			else throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${changed} cannot be changed on an existing user pool — UpdateUserPool has no such member, and CloudFormation refuses the same change ("Updates are not allowed for property"). Nothing was applied to user pool ${physicalId}. ` + this.replacementRemedy(physicalId, previousProperties["DeletionProtection"] === "ACTIVE"));
+		}
 		const liveFirstAuthFactors = mfaPreflightNeedsLiveSignInPolicy(properties, mfaConfiguration) ? await this.readLiveAllowedFirstAuthFactors(physicalId) : void 0;
 		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration, liveFirstAuthFactors);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
@@ -31844,6 +32320,7 @@ var CognitoUserPoolProvider = class {
 		const mfaFirstPrior = mfaMayNeedToPrecedeUpdateUserPool(properties, mfaConfiguration) ? await this.readMfaFirstPrior(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
+			if (typeof properties["UserPoolName"] === "string" && properties["UserPoolName"] !== "") updateParams.PoolName = properties["UserPoolName"];
 			if (properties["Policies"]) {
 				const sdkPolicies = this.toSdkUserPoolPolicies(properties["Policies"]);
 				if (sdkPolicies) updateParams.Policies = sdkPolicies;
@@ -31889,7 +32366,7 @@ var CognitoUserPoolProvider = class {
 			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
 			const providerName = `cognito-idp.${region}.${urlSuffix}/${physicalId}`;
 			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${physicalId}`;
-			const effectiveProperties = narrowMfaConfiguration(properties);
+			const effectiveProperties = withPreviousCreateTimeOnly(narrowMfaConfiguration(properties), previousProperties, keptCreateTimeOnly);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -31932,20 +32409,7 @@ var CognitoUserPoolProvider = class {
 			...modified.map((n) => `modified attribute '${n}'`),
 			...addedStandard.map((n) => `added standard attribute '${n}'`)
 		];
-		if (immutableChanges.length > 0) {
-			const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
-			const remedy = deletionProtected ? protectedReplacementAdvice({
-				evidence: "cdkd's properties for this user pool carry DeletionProtection: ACTIVE",
-				replaceFlags,
-				disable: {
-					before: "aws cognito-idp update-user-pool --user-pool-id",
-					identifier: physicalId,
-					after: "--deletion-protection INACTIVE",
-					caveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security and AutoVerifiedAttributes among them), so send your complete pool configuration alongside that flag rather than the flag alone."
-				}
-			}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
-			throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. ${remedy}`);
-		}
+		if (immutableChanges.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. ${this.replacementRemedy(physicalId, deletionProtected)}`);
 		const addedCustom = added.filter((a) => a.Name !== void 0 && !STANDARD_USER_POOL_ATTRIBUTES.has(a.Name));
 		if (addedCustom.length === 0) return;
 		this.logger.debug(`Adding ${addedCustom.length} custom attribute(s) to ${physicalId}: ` + addedCustom.map((a) => a.Name).join(", "));
@@ -31954,6 +32418,19 @@ var CognitoUserPoolProvider = class {
 			CustomAttributes: addedCustom
 		}));
 	}
+	replacementRemedy(physicalId, deletionProtected) {
+		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+		return deletionProtected ? protectedReplacementAdvice({
+			evidence: "cdkd's properties for this user pool carry DeletionProtection: ACTIVE",
+			replaceFlags,
+			disable: {
+				before: "aws cognito-idp update-user-pool --user-pool-id",
+				identifier: physicalId,
+				after: "--deletion-protection INACTIVE",
+				caveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security and AutoVerifiedAttributes among them), so send your complete pool configuration alongside that flag rather than the flag alone."
+			}
+		}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		let flipRecord;
 		await deleteWithProtectionCompensation({
@@ -32805,6 +33282,16 @@ function sameAsRecorded(desired, recorded) {
 	}
 	return isDeepStrictEqual(desired, recorded);
 }
+function unappliedDnsConfigMembers(properties, previousProperties, changedProperties) {
+	if (changedProperties !== void 0 && !changedProperties.has("DnsConfig")) return [];
+	const desired = properties["DnsConfig"];
+	const previous = previousProperties["DnsConfig"];
+	if (!isPlainObject(desired) || !isPlainObject(previous)) return [];
+	return ["NamespaceId", "RoutingPolicy"].filter((member) => !sameAsRecorded(desired[member], previous[member]));
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function isRecordedStandIn(value) {
 	return dynamicReferenceTokens(value).length > 0 || value.includes("***");
 }
@@ -33169,14 +33656,13 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Creating service discovery service ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
-		const name = properties["Name"];
+		const name = properties["Name"] || generatedNameFor("AWS::ServiceDiscovery::Service", logicalId);
 		const namespaceId = properties["NamespaceId"];
 		const description = properties["Description"];
 		const dnsConfig = properties["DnsConfig"];
 		const healthCheckCustomConfig = properties["HealthCheckCustomConfig"];
 		const healthCheckConfig = properties["HealthCheckConfig"];
 		const type = properties["Type"];
-		if (!name) throw new ProvisioningError(`Name is required for ServiceDiscovery Service ${logicalId}`, resourceType, logicalId);
 		let leftBehindServiceId;
 		try {
 			const watch = startInterruptWatch(`Cloud Map service ${logicalId}`);
@@ -33274,8 +33760,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const hasTagChange = tagPlan.set.size > 0 || tagPlan.remove.length > 0;
 		const tagWarning = tagPlanWarning(tagPlan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
+		const unapplied = unappliedDnsConfigMembers(properties, previousProperties, changedProperties);
 		if (!hasServiceChange && !hasAttrUpsert && !hasAttrRemove && !hasTagChange) {
 			this.logger.debug(`No mutable diff for ServiceDiscovery Service ${logicalId}, skipping update`);
+			await this.warnUnappliedDnsConfigMembers(logicalId, physicalId, properties, unapplied);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -33336,6 +33824,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}));
 			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
+			await this.warnUnappliedDnsConfigMembers(logicalId, physicalId, properties, unapplied);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -33364,6 +33853,30 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			keepRemovedFromLive: true
 		};
 	}
+	async warnUnappliedDnsConfigMembers(logicalId, physicalId, properties, candidates) {
+		if (candidates.length === 0) return;
+		let members = candidates;
+		try {
+			const live = (await this.getClient().send(new GetServiceCommand({ Id: physicalId }))).Service;
+			const dns = properties["DnsConfig"];
+			const desired = {
+				NamespaceId: dns.NamespaceId ?? properties["NamespaceId"],
+				RoutingPolicy: dns.RoutingPolicy
+			};
+			const held = {
+				NamespaceId: live?.NamespaceId ?? live?.DnsConfig?.NamespaceId,
+				RoutingPolicy: live?.DnsConfig?.RoutingPolicy
+			};
+			members = candidates.filter((m) => desired[m] === void 0 || desired[m] !== held[m]);
+		} catch {
+			this.logger.debug(safeMsg`Could not read service discovery service ${logicalId} back to confirm its DnsConfig; warning unconfirmed`);
+		}
+		if (members.length === 0) return;
+		const paths = members.map((m) => `DnsConfig.${m}`).join(" and ");
+		const [it, value] = members.length > 1 ? ["them", "values"] : ["it", "value"];
+		const remedy = members.includes("NamespaceId") ? "To move the service, declare the namespace in the top-level NamespaceId: a change there replaces the service." : "To change it, replace the service, for example by giving it a new Name.";
+		this.logger.warn(safeMsg`${logicalId} (AWS::ServiceDiscovery::Service): ${paths} changed, but Cloud Map cannot change ${it} on an existing service, so the service keeps its current ${value}, as CloudFormation does. ${remedy}`);
+	}
 	async keepUndeclaredServiceFields(physicalId, serviceChange) {
 		if (serviceChange.Description !== void 0 && serviceChange.HealthCheckConfig !== void 0) return;
 		const live = (await this.getClient().send(new GetServiceCommand({ Id: physicalId }))).Service;
@@ -33915,31 +34428,19 @@ var AppSyncProvider = class {
 	deepEqual(a, b) {
 		return JSON.stringify(a) === JSON.stringify(b);
 	}
-	async graphQLApiNameUnchangedBehindSecret(logicalId, physicalId, resourceType, desired, previous, mask) {
-		if (!isSecretDerivedValue(previous, maskerOrIdentity(void 0))) return false;
+	async unchangedGraphqlApiName(apiId, resourceType, logicalId, desired, recorded, mask) {
+		if (desired === void 0 || desired === recorded) return recorded;
 		let liveName;
 		try {
-			liveName = (await this.getClient().send(new GetGraphqlApiCommand({ apiId: physicalId }))).graphqlApi?.name;
+			liveName = (await this.getClient().send(new GetGraphqlApiCommand({ apiId }))).graphqlApi?.name;
 		} catch (error) {
-			throw this.wrapGraphQLApiNameLookupError(error, logicalId, physicalId, resourceType, mask);
+			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi", mask);
 		}
-		if (liveName === void 0) throw this.wrapGraphQLApiNameLookupError(void 0, logicalId, physicalId, resourceType, mask);
-		return unchangedBehindSecretReference({
-			resourceType,
-			key: "Name",
-			desired,
-			previous,
-			physicalName: liveName
-		});
-	}
-	wrapGraphQLApiNameLookupError(error, logicalId, physicalId, resourceType, mask) {
-		const failureClass = error === void 0 ? "an answer with no name" : error instanceof Error && error.name !== "" ? error.name : "an unreadable failure";
-		const next = failureClass === "NotFoundException" ? `the API ${physicalId} no longer exists; check it with 'cdkd drift' before deploying again` : "re-run once the lookup can succeed";
-		return markRedactedCause(new ProvisioningError(`Name of AWS::AppSync::GraphQLApi ${logicalId} is secret-derived, and whether the value its secret resolves to is still the API's name could not be confirmed (${mask(failureClass)}) — ${next}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
+		if (liveName === void 0 || liveName === "") throw new ProvisioningError(`Could not read the current name of AppSync GraphqlApi ${apiId} to update it without renaming it`, resourceType, logicalId, apiId);
+		return liveName;
 	}
 	async updateGraphQLApi(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
-		if (properties["Name"] !== void 0 && previousProperties["Name"] !== void 0 && properties["Name"] !== previousProperties["Name"] && !await this.graphQLApiNameUnchangedBehindSecret(logicalId, physicalId, resourceType, properties["Name"], previousProperties["Name"], maskerOrIdentity(context?.maskSecrets))) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync GraphqlApi.Name is immutable — destroy + redeploy to rename");
 		for (const immutable of ["ApiType", "Visibility"]) if (properties[immutable] !== void 0 && previousProperties[immutable] !== void 0 && properties[immutable] !== previousProperties[immutable]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync GraphqlApi.${immutable} is immutable — destroy + redeploy to change it`);
 		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) this.refuseChangedMalformedGraphQLApiBlocks(properties, previousProperties, logicalId, physicalId, resourceType);
 		const newAuthType = properties["AuthenticationType"];
@@ -33952,10 +34453,11 @@ var AppSyncProvider = class {
 		const hasAuthDiff = ("AuthenticationType" in properties || "AuthenticationType" in previousProperties) && newAuthType !== oldAuthType;
 		const hasLogDiff = ("LogConfig" in properties || "LogConfig" in previousProperties) && !this.deepEqual(newLog, oldLog);
 		const hasConfigDiff = MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES.some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]));
-		if (hasAuthDiff || hasXrayDiff || hasLogDiff || hasConfigDiff) {
+		const hasNameDiff = properties["Name"] !== void 0 && (context?.changedProperties !== void 0 ? context.changedProperties.has("Name") : properties["Name"] !== previousProperties["Name"]);
+		if (hasNameDiff || hasAuthDiff || hasXrayDiff || hasLogDiff || hasConfigDiff) {
 			const input = {
 				apiId: physicalId,
-				name: properties["Name"] ?? previousProperties["Name"],
+				name: hasNameDiff ? properties["Name"] : await this.unchangedGraphqlApiName(physicalId, resourceType, logicalId, properties["Name"], previousProperties["Name"], maskerOrIdentity(context?.maskSecrets)),
 				authenticationType: newAuthType ?? oldAuthType ?? "API_KEY"
 			};
 			if (newXray !== void 0) input.xrayEnabled = newXray;
@@ -33996,6 +34498,14 @@ var AppSyncProvider = class {
 		};
 	}
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties, mask = maskerOrIdentity(void 0)) {
+		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"] && !await unchangedBehindSecretReference({
+			resourceType,
+			key: "ApiId",
+			desired: properties["ApiId"],
+			previous: previousProperties["ApiId"],
+			physicalName: physicalId,
+			maskSecrets: mask
+		})) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync GraphQLSchema.ApiId cannot move a schema to another API in place (CloudFormation fails a template change of it too) — deploy with --replace, or give the schema a new logical ID, to create it on the new API");
 		const newDef = properties["Definition"];
 		const oldDef = previousProperties["Definition"];
 		const newLoc = properties["DefinitionS3Location"];
@@ -34034,11 +34544,7 @@ var AppSyncProvider = class {
 	}
 	async updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
 		const [idApiId, idName] = physicalId.split("|");
-		for (const field of [
-			"ApiId",
-			"Name",
-			"Type"
-		]) {
+		for (const field of ["ApiId", "Name"]) {
 			const next = properties[field];
 			const prev = previousProperties[field];
 			if (next !== void 0 && prev !== void 0 && next !== prev && !await unchangedBehindSecretReference({
@@ -34046,7 +34552,7 @@ var AppSyncProvider = class {
 				key: field,
 				desired: next,
 				previous: prev,
-				physicalName: field === "ApiId" ? idApiId : field === "Name" ? idName : void 0,
+				physicalName: field === "ApiId" ? idApiId : idName,
 				maskSecrets: mask
 			})) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync DataSource.${field} is immutable — destroy + redeploy to change`);
 		}
@@ -34054,6 +34560,7 @@ var AppSyncProvider = class {
 		if (!apiId || !name) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const type = properties["Type"] ?? previousProperties["Type"];
 		if (![
+			"Type",
 			"Description",
 			"ServiceRoleArn",
 			"DynamoDBConfig",
@@ -36580,7 +37087,7 @@ async function fetchGlueTags(client, stsClient, resource, name, accountId, logge
 		const resp = await client.send(new GetTagsCommand({ ResourceArn: arn }));
 		return normalizeAwsTagsToCfn(resp.Tags);
 	} catch (err) {
-		logger.debug(`GetTags failed for ${resource}/${name}: ${describeAwsFailure(err).detail}`);
+		logger.debug(`GetTags failed for a Glue ${resource}: ${describeAwsFailure(err).summary}`);
 		return [];
 	}
 }
@@ -37190,13 +37697,28 @@ function toCfnCrawlerTargets(targets) {
 var GlueConnectionProvider = class {
 	client;
 	createClient;
+	stsClient;
 	providerRegion = ambientRegion();
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueConnectionProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
-	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set([
+		"ConnectionInput",
+		"CatalogId",
+		"Tags"
+	])]]);
+	getStsClient() {
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
+		return this.stsClient;
+	}
+	resourceArn(name, catalogIdValue) {
+		return buildGlueResourceArn(this.getClient(), this.getStsClient(), "connection", name, catalogIdForApi(catalogIdValue));
+	}
 	getClient() {
 		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
@@ -37211,12 +37733,14 @@ var GlueConnectionProvider = class {
 		log.debug(`Creating Glue Connection ${logicalId}`);
 		const connectionInput = properties["ConnectionInput"];
 		if (!connectionInput) throw new ProvisioningError(`ConnectionInput is required for Glue Connection ${logicalId}`, resourceType, logicalId);
+		const tags = desiredGlueTags(properties["Tags"], resourceType, logicalId);
 		const name = connectionInput["Name"] ?? generatedNameFor("AWS::Glue::Connection", logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getCreateClient().send(new CreateConnectionCommand({
 				...catalogId && { CatalogId: catalogId },
-				ConnectionInput: buildConnectionInput(connectionInput, name)
+				ConnectionInput: buildConnectionInput(connectionInput, name),
+				...tags && { Tags: tags }
 			}));
 			log.debug(`Successfully created Glue Connection ${logicalId}: ${v(name)}`);
 			return {
@@ -37259,6 +37783,7 @@ var GlueConnectionProvider = class {
 			debug: log.debug,
 			mask: log.mask
 		});
+		desiredGlueTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const catalogId = updateCatalogId(properties["CatalogId"]);
 		try {
 			await this.getClient().send(new UpdateConnectionCommand({
@@ -37266,6 +37791,7 @@ var GlueConnectionProvider = class {
 				Name: physicalId,
 				ConnectionInput: buildConnectionInput(connectionInput, physicalId)
 			}));
+			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId, properties["CatalogId"]), previousProperties?.["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -37316,7 +37842,7 @@ var GlueConnectionProvider = class {
 			throw err;
 		}
 		if (!conn) return void 0;
-		return withRecordedCatalogId({ ConnectionInput: {
+		const ci = {
 			Name: conn.Name ?? physicalId,
 			ConnectionType: conn.ConnectionType ?? "",
 			Description: conn.Description ?? "",
@@ -37326,7 +37852,12 @@ var GlueConnectionProvider = class {
 			AthenaProperties: conn.AthenaProperties ?? {},
 			PythonProperties: conn.PythonProperties ?? {},
 			PhysicalConnectionRequirements: conn.PhysicalConnectionRequirements ? pickDefined(conn.PhysicalConnectionRequirements) : {}
-		} }, properties);
+		};
+		const name = conn.Name ?? physicalId;
+		return withRecordedCatalogId({
+			ConnectionInput: ci,
+			Tags: await fetchGlueTags(this.getClient(), this.getStsClient(), "connection", name, catalogId, this.logger)
+		}, properties);
 	}
 	async import(input) {
 		const explicitName = input.knownPhysicalId ?? input.properties["ConnectionInput"]?.["Name"];
@@ -37673,9 +38204,9 @@ var KMSProvider = class {
 		const keySpec = properties["KeySpec"];
 		const keyUsage = properties["KeyUsage"];
 		const enableKeyRotation = templateBool(properties["EnableKeyRotation"]);
-		const multiRegion = properties["MultiRegion"];
+		const multiRegion = templateBool(properties["MultiRegion"]);
 		const origin = properties["Origin"];
-		const bypassPolicyLockoutSafetyCheck = properties["BypassPolicyLockoutSafetyCheck"];
+		const bypassPolicyLockoutSafetyCheck = templateBool(properties["BypassPolicyLockoutSafetyCheck"]);
 		const input = {
 			Description: description,
 			KeySpec: keySpec,
@@ -38282,7 +38813,7 @@ function isoDate(value) {
 	else if (typeof value === "string" && /^\d+$/.test(value)) {
 		const n = Number(value);
 		date = new Date(n < 0xe8d4a51000 ? n * 1e3 : n);
-	} else if (typeof value === "string") date = new Date(value);
+	} else if (typeof value === "string") date = parseCfnTimestamp(value);
 	else if (value instanceof Date) date = value;
 	else return void 0;
 	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
@@ -38452,7 +38983,7 @@ var BudgetsBudgetProvider = class {
 		else if (typeof raw === "string" && /^\d+$/.test(raw)) {
 			const num = Number(raw);
 			date = new Date(num < 0xe8d4a51000 ? num * 1e3 : num);
-		} else if (typeof raw === "string") date = new Date(raw);
+		} else if (typeof raw === "string") date = parseCfnTimestamp(raw);
 		else throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: expected a date string or epoch timestamp, got ${JSON.stringify(maskDeep(raw, mask))}`, resourceType, logicalId);
 		if (Number.isNaN(date.getTime())) throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: ${JSON.stringify(maskDeep(raw, mask))} is not a parseable date`, resourceType, logicalId);
 		return date;
@@ -39101,6 +39632,18 @@ function comparableRecordSize(value, mask) {
 	const read = readMaxRecordSize(value, mask);
 	return read.kind === "usable" ? read.size : void 0;
 }
+const DEFAULT_RECORD_DISTRIBUTION_STRATEGY = "USER_PARTITION_KEY";
+function readDistributionStrategy(value, mask) {
+	if (value == null) return { kind: "absent" };
+	if (typeof value === "string" && value.trim() !== "") return {
+		kind: "usable",
+		strategy: value
+	};
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream RecordDistributionStrategy must be a non-empty string, got ${JSON.stringify(maskDeep(value, mask))}`
+	};
+}
 const KINESIS_DELETE_POLL_INTERVAL_MS = 2e3;
 const KINESIS_DELETE_MAX_WAIT_MS = 3e5;
 function isStreamName(id) {
@@ -39119,8 +39662,10 @@ var KinesisStreamProvider = class {
 		"RetentionPeriodHours",
 		"StreamEncryption",
 		"DesiredShardLevelMetrics",
-		"MaxRecordSizeInKiB"
+		"MaxRecordSizeInKiB",
+		"RecordDistributionStrategy"
 	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Kinesis::Stream", /* @__PURE__ */ new Map([["WarmThroughputMiBps", "AWS accepts it only on an account enrolled in the Kinesis minimum throughput billing commitment, so the SDK path is not wired (go-to-k/cdkd#1695); Cloud Control forwards it."]])]]);
 	getClient() {
 		if (!this.client) this.client = new KinesisClient({
 			...ambientClientDefaults(),
@@ -39158,6 +39703,11 @@ var KinesisStreamProvider = class {
 		}
 		const encryptionRead = readEncryptionKeyId(properties["StreamEncryption"], mask);
 		if (encryptionRead.kind === "unusable") throw new ProvisioningError(encryptionRead.reason, resourceType, logicalId, streamName);
+		const strategyRead = readDistributionStrategy(properties["RecordDistributionStrategy"], mask);
+		if (strategyRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(strategyRead.reason, resourceType, logicalId, streamName);
+			warn(`${strategyRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default record distribution strategy rather than refusing the restore`);
+		}
 		let streamCreated = false;
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -39171,6 +39721,7 @@ var KinesisStreamProvider = class {
 				...shardCount !== void 0 && { ShardCount: shardCount },
 				StreamModeDetails: { StreamMode: streamMode },
 				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB },
+				...strategyRead.kind === "usable" && { RecordDistributionStrategy: strategyRead.strategy },
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			streamCreated = true;
@@ -39310,6 +39861,7 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
+			await this.reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn);
 			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 			let desiredMetrics;
 			if (desiredRead.kind === "unusable") warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
@@ -39430,6 +39982,30 @@ var KinesisStreamProvider = class {
 			throw error;
 		}
 	}
+	async reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn) {
+		const desired = readDistributionStrategy(properties["RecordDistributionStrategy"], mask);
+		if (desired.kind === "unusable") {
+			warn(`${desired.reason}. Leaving the record distribution strategy on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
+			return;
+		}
+		const previous = readDistributionStrategy(previousProperties["RecordDistributionStrategy"], mask);
+		const recorded = previous.kind === "usable" ? previous.strategy : void 0;
+		let target;
+		if (desired.kind === "usable") {
+			if (desired.strategy === recorded) return;
+			target = desired.strategy;
+		} else {
+			if (recorded === void 0 || recorded === DEFAULT_RECORD_DISTRIBUTION_STRATEGY) return;
+			if (streamMode !== "ON_DEMAND") return;
+			target = DEFAULT_RECORD_DISTRIBUTION_STRATEGY;
+		}
+		this.logger.debug(mask(safeMsg`Updating record distribution strategy for ${physicalId}: from ${recorded ?? "no value"} to ${target}`));
+		await this.getClient().send(new UpdateStreamRecordDistributionStrategyCommand({
+			StreamARN: await this.resolveStreamArn(physicalId),
+			RecordDistributionStrategy: target
+		}));
+		await this.waitForStreamActive(physicalId);
+	}
 	effectiveMetricsProperties(properties, expanded) {
 		if (expanded === void 0) return {};
 		if (expanded === properties["DesiredShardLevelMetrics"]) return {};
@@ -39496,8 +40072,11 @@ var KinesisStreamProvider = class {
 		}
 		result["DesiredShardLevelMetrics"] = (stream.EnhancedMonitoring ?? []).flatMap((entry) => entry.ShardLevelMetrics ?? []);
 		try {
-			const maxRecordSize = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.MaxRecordSizeInKiB;
+			const summaryResp = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }));
+			const maxRecordSize = summaryResp.StreamDescriptionSummary?.MaxRecordSizeInKiB;
 			if (maxRecordSize !== void 0) result["MaxRecordSizeInKiB"] = maxRecordSize;
+			const strategy = summaryResp.StreamDescriptionSummary?.RecordDistributionStrategy;
+			if (strategy !== void 0) result["RecordDistributionStrategy"] = strategy;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
 			throw err;
@@ -39843,8 +40422,8 @@ var SchedulerScheduleProvider = class {
 			Target: this.toSdkTarget(properties["Target"]),
 			...properties["Description"] !== void 0 && { Description: properties["Description"] },
 			...properties["ScheduleExpressionTimezone"] !== void 0 && { ScheduleExpressionTimezone: properties["ScheduleExpressionTimezone"] },
-			...properties["StartDate"] !== void 0 && { StartDate: new Date(properties["StartDate"]) },
-			...properties["EndDate"] !== void 0 && { EndDate: new Date(properties["EndDate"]) },
+			...properties["StartDate"] !== void 0 && { StartDate: parseCfnTimestamp(properties["StartDate"]) },
+			...properties["EndDate"] !== void 0 && { EndDate: parseCfnTimestamp(properties["EndDate"]) },
 			...properties["State"] !== void 0 && { State: properties["State"] },
 			...properties["KmsKeyArn"] !== void 0 && { KmsKeyArn: properties["KmsKeyArn"] }
 		};
@@ -40357,7 +40936,7 @@ function toSdkSourceParameters(value) {
 		...source,
 		KinesisStreamParameters: {
 			...kinesis,
-			StartingPositionTimestamp: new Date(kinesis["StartingPositionTimestamp"])
+			StartingPositionTimestamp: parseCfnTimestamp(kinesis["StartingPositionTimestamp"])
 		}
 	};
 }
@@ -44188,6 +44767,46 @@ var EMRInstanceFleetConfigProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/firehose-provider.ts
+const ENCRYPTION_KEY = "DeliveryStreamEncryptionConfigurationInput";
+function readEncryptionInput(value, emptyIsAbsent) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (typeof value !== "object" || Array.isArray(value)) return { kind: "unusable" };
+	const block = value;
+	if (emptyIsAbsent && Object.keys(block).length === 0) return { kind: "absent" };
+	const keyType = block["KeyType"];
+	const keyArn = block["KeyArn"] || block["KeyARN"];
+	if (typeof keyType !== "string" || keyType.length === 0) return { kind: "unusable" };
+	if (keyArn !== void 0 && keyArn !== null && keyArn !== "" && typeof keyArn !== "string") return { kind: "unusable" };
+	return typeof keyArn === "string" && keyArn.length > 0 ? {
+		kind: "usable",
+		keyType,
+		keyArn
+	} : {
+		kind: "usable",
+		keyType
+	};
+}
+function sameEncryptionInput(next, nextRead, prev) {
+	const b = readEncryptionInput(prev, true);
+	if (nextRead.kind === "unusable" || b.kind === "unusable") return JSON.stringify(next) === JSON.stringify(prev);
+	if (nextRead.kind === "absent" || b.kind === "absent") return nextRead.kind === b.kind;
+	return nextRead.keyType === b.keyType && nextRead.keyArn === b.keyArn;
+}
+function encryptionMatches(live, desired) {
+	if (live?.Status !== "ENABLED" || live.KeyType !== desired.keyType) return false;
+	return desired.keyType !== "CUSTOMER_MANAGED_CMK" || live.KeyARN === desired.keyArn;
+}
+function liveEncryptionAsCfn(live) {
+	const status = live?.Status;
+	if (status !== "ENABLED" && status !== "ENABLING" && status !== "DISABLING_FAILED") return {};
+	return {
+		...live?.KeyARN !== void 0 && { KeyARN: live.KeyARN },
+		...live?.KeyType !== void 0 && { KeyType: live.KeyType }
+	};
+}
+const ENCRYPTION_POLL_INTERVAL_MS = 5e3;
+const ENCRYPTION_POLL_MAX_ATTEMPTS = 120;
+const terminalEncryptionFailures = /* @__PURE__ */ new WeakSet();
 function isReadableTagList(value) {
 	if (value === void 0 || value === null) return true;
 	return Array.isArray(value) && value.every((t) => typeof t === "object" && t !== null && !Array.isArray(t) && typeof t.Key === "string" && t.Key.length > 0 && !holdsSecretDerivedEntry(t.Key));
@@ -44412,15 +45031,24 @@ var FirehoseProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update Firehose delivery stream ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Firehose delivery stream ${logicalId}: ${physicalId}`);
+		const desiredEncryption = readEncryptionInput(properties[ENCRYPTION_KEY], context?.desiredFromAwsReadback === true);
+		const encryptionChanged = !sameEncryptionInput(properties[ENCRYPTION_KEY], desiredEncryption, previousProperties[ENCRYPTION_KEY]);
+		let encryptionSkipped = false;
+		if (encryptionChanged && desiredEncryption.kind === "unusable") {
+			const message = `${ENCRYPTION_KEY} of Firehose delivery stream ${logicalId} is not an object with a string KeyType (and a string KeyARN, if any)`;
+			if (context?.replayingState !== true) throw markNonRetryable(new ProvisioningError(`${message} — nothing was updated`, resourceType, logicalId, physicalId));
+			this.logger.warn(safeMsg`${message}; its encryption is left unchanged`);
+			encryptionSkipped = true;
+		}
 		const destKey = this.findDestinationKey(properties);
 		const prevDestKey = this.findDestinationKey(previousProperties);
 		if (destKey && prevDestKey && destKey !== prevDestKey) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `Switching Firehose destination type from '${prevDestKey}' to '${destKey}' is not supported in-place — AWS UpdateDestination requires the same destination type as the original CreateDeliveryStream. Re-deploy with cdkd deploy --replace.`);
@@ -44482,11 +45110,21 @@ var FirehoseProvider = class {
 			const prevDest = previousProperties[activeDest] ?? {};
 			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applySnowflakeDestinationUpdate(logicalId, physicalId, nextDest);
 		}
+		if (encryptionChanged && desiredEncryption.kind !== "unusable") await this.applyEncryptionUpdate(logicalId, physicalId, resourceType, desiredEncryption, maskerOrIdentity(context?.maskSecrets));
 		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		return {
 			physicalId,
 			wasReplaced: false,
-			attributes: { ...desc?.DeliveryStreamARN !== void 0 && { Arn: desc.DeliveryStreamARN } }
+			attributes: { ...desc?.DeliveryStreamARN !== void 0 && { Arn: desc.DeliveryStreamARN } },
+			...encryptionSkipped && { effectiveProperties: this.withRecordedEncryption(properties, previousProperties[ENCRYPTION_KEY], desc?.DeliveryStreamEncryptionConfiguration) }
+		};
+	}
+	withRecordedEncryption(properties, previous, live) {
+		const { [ENCRYPTION_KEY]: _skipped, ...rest } = properties;
+		if (previous === void 0 || previous === null) return rest;
+		return {
+			...rest,
+			[ENCRYPTION_KEY]: liveEncryptionAsCfn(live)
 		};
 	}
 	async applyExtendedS3DestinationUpdate(logicalId, physicalId, nextConfig) {
@@ -44529,6 +45167,87 @@ var FirehoseProvider = class {
 			}))
 		}));
 	}
+	async applyEncryptionUpdate(logicalId, physicalId, resourceType, desired, mask) {
+		const settled = await this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+			what: "settle",
+			done: (enc) => enc?.Status !== "ENABLING" && enc?.Status !== "DISABLING"
+		});
+		if (desired.kind === "absent") {
+			if (settled?.Status !== "ENABLED" && settled?.Status !== "DISABLING_FAILED") return;
+			this.refuseToStartTransition(logicalId, physicalId, resourceType, "disable");
+			await this.getClient().send(new StopDeliveryStreamEncryptionCommand({ DeliveryStreamName: physicalId }));
+			await this.warnIfUnfinished(logicalId, "StopDeliveryStreamEncryption", () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+				what: "disable",
+				done: (enc) => enc === void 0 || enc.Status === "DISABLED",
+				inProgress: "DISABLING",
+				failed: "DISABLING_FAILED",
+				staleFailure: settled.Status === "DISABLING_FAILED"
+			}));
+			return;
+		}
+		if (encryptionMatches(settled, desired)) return;
+		this.refuseToStartTransition(logicalId, physicalId, resourceType, "enable");
+		await this.getClient().send(new StartDeliveryStreamEncryptionCommand({
+			DeliveryStreamName: physicalId,
+			DeliveryStreamEncryptionConfigurationInput: {
+				KeyType: desired.keyType,
+				...desired.keyArn !== void 0 && { KeyARN: desired.keyArn }
+			}
+		}));
+		await this.warnIfUnfinished(logicalId, "StartDeliveryStreamEncryption", () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+			what: "enable",
+			done: (enc) => encryptionMatches(enc, desired),
+			inProgress: "ENABLING",
+			failed: "ENABLING_FAILED",
+			staleFailure: settled?.Status === "ENABLING_FAILED"
+		}));
+	}
+	async warnIfUnfinished(logicalId, call, wait) {
+		try {
+			return await wait();
+		} catch (error) {
+			const outcome = typeof error === "object" && error !== null && terminalEncryptionFailures.has(error) ? "AWS reported the change failed, so the stream may no longer match" : "the stream may still finish the change, so it may no longer match";
+			this.logger.warn(safeMsg`Firehose delivery stream ${logicalId}: ${call} was sent but the encryption change did not finish; ${outcome} the previous setting cdkd keeps recorded. Run 'cdkd drift' to compare, then 'cdkd drift --revert' to apply the recorded setting or 'cdkd drift --accept' to record the stream's.`);
+			throw error;
+		}
+	}
+	refuseToStartTransition(logicalId, physicalId, resourceType, what) {
+		const watch = startInterruptWatch(`Firehose ${logicalId} encryption ${what}`);
+		try {
+			if (watch.isInterrupted()) throw watch.onInterrupted();
+		} finally {
+			watch.dispose();
+		}
+		if (!enclosingDeadlineExpired() && enclosingDeadlineRemainingMs() > 0) return;
+		throw markNonRetryable(new ProvisioningError(`The resource timeout expired before encryption could be ${what}d on Firehose delivery stream ${logicalId}; no encryption call was sent`, resourceType, logicalId, physicalId));
+	}
+	async waitForEncryption(logicalId, physicalId, resourceType, mask, opts) {
+		const { what, done, inProgress, failed } = opts;
+		const watch = startInterruptWatch(`Firehose ${logicalId} encryption ${what}`);
+		try {
+			let last;
+			let sawInProgress = false;
+			for (let attempt = 1; attempt <= ENCRYPTION_POLL_MAX_ATTEMPTS; attempt++) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				if (enclosingDeadlineRemainingMs() <= 0) throw markNonRetryable(new ProvisioningError(`The resource timeout expired while waiting to ${what} encryption on Firehose delivery stream ${logicalId} (last status: ${last ?? "none reported"})`, resourceType, logicalId, physicalId));
+				const enc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription?.DeliveryStreamEncryptionConfiguration;
+				if (done(enc)) return enc;
+				last = enc?.Status;
+				if (last !== void 0 && last === inProgress) sawInProgress = true;
+				if (failed !== void 0 && last === failed && (sawInProgress || !opts.staleFailure)) {
+					const failure = enc?.FailureDescription;
+					const terminal = markNonRetryable(new ProvisioningError(`Failed to ${what} encryption on Firehose delivery stream ${logicalId}: AWS reports ${failed}` + (failure ? ` (${mask(`${failure.Type ?? ""}: ${failure.Details ?? ""}`)})` : ""), resourceType, logicalId, physicalId));
+					terminalEncryptionFailures.add(terminal);
+					throw terminal;
+				}
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(ENCRYPTION_POLL_INTERVAL_MS, enclosingDeadlineRemainingMs()))));
+			}
+			throw markNonRetryable(new ProvisioningError(`Timed out waiting to ${what} encryption on Firehose delivery stream ${logicalId} (last status: ${last ?? "none reported"})`, resourceType, logicalId, physicalId));
+		} finally {
+			watch.dispose();
+		}
+	}
 	findDestinationKey(properties) {
 		for (const key of [
 			"ExtendedS3DestinationConfiguration",
@@ -44934,11 +45653,7 @@ var FirehoseProvider = class {
 		else if (dest?.AmazonOpenSearchServerlessDestinationDescription) result["AmazonOpenSearchServerlessDestinationConfiguration"] = mapNonS3DestinationToCfn(dest.AmazonOpenSearchServerlessDestinationDescription);
 		else if (dest?.SplunkDestinationDescription) result["SplunkDestinationConfiguration"] = mapNonS3DestinationToCfn(dest.SplunkDestinationDescription);
 		else if (dest?.HttpEndpointDestinationDescription) result["HttpEndpointDestinationConfiguration"] = mapHttpEndpointDescriptionToCfn(dest.HttpEndpointDestinationDescription);
-		const enc = desc.DeliveryStreamEncryptionConfiguration;
-		const encOut = {};
-		if (enc?.KeyARN !== void 0) encOut["KeyARN"] = enc.KeyARN;
-		if (enc?.KeyType !== void 0) encOut["KeyType"] = enc.KeyType;
-		result["DeliveryStreamEncryptionConfigurationInput"] = encOut;
+		result["DeliveryStreamEncryptionConfigurationInput"] = liveEncryptionAsCfn(desc.DeliveryStreamEncryptionConfiguration);
 		try {
 			const tagsResp = await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
@@ -45456,6 +46171,22 @@ var CloudTrailProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/codebuild-provider.ts
+const DEFAULT_PROJECT_VISIBILITY = "PRIVATE";
+function readVisibility(properties, mask) {
+	const visibility = properties["Visibility"];
+	const role = properties["ResourceAccessRole"];
+	const refuse = (key, value) => ({
+		kind: "unusable",
+		reason: `AWS::CodeBuild::Project ${key} must be a non-empty string, got ${JSON.stringify(maskDeep(value, mask))}`
+	});
+	if (visibility != null && (typeof visibility !== "string" || visibility.trim() === "")) return refuse("Visibility", visibility);
+	if (role != null && (typeof role !== "string" || role !== "" && role.trim() === "")) return refuse("ResourceAccessRole", role);
+	return {
+		kind: "usable",
+		visibility: visibility ?? DEFAULT_PROJECT_VISIBILITY,
+		...typeof role === "string" && role !== "" && { resourceAccessRole: role }
+	};
+}
 var CodeBuildProvider = class {
 	client;
 	createClient;
@@ -45484,7 +46215,9 @@ var CodeBuildProvider = class {
 		"BuildBatchConfig",
 		"BadgeEnabled",
 		"SourceVersion",
-		"AutoRetryLimit"
+		"AutoRetryLimit",
+		"Visibility",
+		"ResourceAccessRole"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -45675,29 +46408,59 @@ var CodeBuildProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating CodeBuild Project ${logicalId}`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const visibilityRead = readVisibility(properties, mask);
+		if (visibilityRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(visibilityRead.reason, resourceType, logicalId);
+			this.logger.warn(mask(`${visibilityRead.reason}. Replaying a state record, so CodeBuild Project ${logicalId} is left ${DEFAULT_PROJECT_VISIBILITY} with no resource access role rather than refusing the restore`));
+		}
+		let createdName;
 		try {
 			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
 			const result = await this.getCreateClient().send(new CreateProjectCommand(input));
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
+			createdName = projectName;
+			if (visibilityRead.kind === "usable" && (visibilityRead.visibility !== DEFAULT_PROJECT_VISIBILITY || visibilityRead.resourceAccessRole !== void 0)) await this.applyVisibility(projectArn, visibilityRead);
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
 			return {
 				physicalId: projectName,
 				attributes: { Arn: projectArn }
 			};
 		} catch (error) {
+			if (createdName !== void 0) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdName);
+			throw thrown;
 		}
 	}
+	async applyVisibility(projectArn, read) {
+		await this.getClient().send(new UpdateProjectVisibilityCommand({
+			projectArn,
+			projectVisibility: read.visibility,
+			...read.resourceAccessRole !== void 0 && { resourceAccessRole: read.resourceAccessRole }
+		}));
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
 			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
-			await this.getClient().send(new UpdateProjectCommand(input));
+			const updated = await this.getClient().send(new UpdateProjectCommand(input));
+			const desiredVisibility = readVisibility(properties, mask);
+			const recorded = readVisibility(previousProperties, mask);
+			if (desiredVisibility.kind === "unusable") {
+				const kept = recorded.kind === "usable" ? ` (recorded ${recorded.visibility})` : "";
+				this.logger.warn(mask(`${desiredVisibility.reason}. Leaving the visibility of CodeBuild Project ${physicalId} unchanged${kept}; the same value is REFUSED on a template-path create`));
+			} else if (recorded.kind !== "usable" || recorded.visibility !== desiredVisibility.visibility || recorded.resourceAccessRole !== desiredVisibility.resourceAccessRole) {
+				const projectArn = updated.project?.arn;
+				if (projectArn === void 0) throw new Error("UpdateProject returned no project ARN for the visibility update");
+				await this.applyVisibility(projectArn, desiredVisibility);
+			}
 			this.logger.debug(`Successfully updated CodeBuild Project ${logicalId}`);
 			return {
 				physicalId,
@@ -45705,7 +46468,7 @@ var CodeBuildProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	wrapCaughtError(mask, error, build) {
@@ -45902,6 +46665,7 @@ var CodeBuildProvider = class {
 			result["BuildBatchConfig"] = bbc;
 		} else result["BuildBatchConfig"] = {};
 		result["ResourceAccessRole"] = project.resourceAccessRole ?? "";
+		if (project.projectVisibility !== void 0) result["Visibility"] = project.projectVisibility;
 		result["Tags"] = normalizeAwsTagsToCfn(project.tags);
 		return result;
 	}
@@ -47310,16 +48074,32 @@ var S3TablesProvider = class {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		if (resourceType === "AWS::S3Tables::Table" || resourceType === "AWS::S3Tables::TableBucket") refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.recordedAttributes);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
-		if (resourceType === "AWS::S3Tables::Table") await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
-		else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask, recordedAttributes) {
+		if (resourceType === "AWS::S3Tables::Table") {
+			const rename = await this.planTableRename(logicalId, physicalId, resourceType, properties, mask);
+			await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+			if (rename === void 0) return {
+				physicalId,
+				wasReplaced: false
+			};
+			try {
+				await this.getClient().send(rename.command);
+			} catch (error) {
+				if (!(error instanceof NotFoundException$7) || !await this.renameAlreadyApplied(rename.target, recordedAttributes)) throw error;
+			}
+			this.logger.debug(safeMsg`Renamed S3 Tables Table ${logicalId}: ${physicalId} -> ${rename.physicalId}`);
+			return {
+				physicalId: rename.physicalId,
+				wasReplaced: false
+			};
+		} else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
 		else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
 		return {
 			physicalId,
@@ -47822,6 +48602,59 @@ var S3TablesProvider = class {
 		for (const t of tags) map[t.Key] = t.Value;
 		return map;
 	}
+	async planTableRename(logicalId, physicalId, resourceType, properties, mask) {
+		const desiredString = (key, value) => {
+			if (value === void 0) return void 0;
+			if (typeof value === "string" && value.length > 0) return value;
+			throw new ProvisioningError(safeMsg`${key} for S3 Tables Table ${logicalId} must be a non-empty string; refusing the update`, resourceType, logicalId, physicalId);
+		};
+		const desiredNamespace = desiredString("Namespace", properties["Namespace"]);
+		const desiredName = desiredString("TableName", properties["TableName"] ?? properties["Name"]);
+		if (desiredNamespace === void 0 && desiredName === void 0) return void 0;
+		const current = await this.resolveTableParts(physicalId);
+		if (current === "not-found" || current === "unparseable") throw new ProvisioningError(current === "not-found" ? safeMsg`S3 Tables Table '${physicalId}' no longer exists (state is out of sync); ` + `refusing to record a rename that did not happen` : compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+		const newNamespace = desiredNamespace ?? current.namespace;
+		const newName = desiredName ?? current.name;
+		if (newNamespace === current.namespace && newName === current.name) return void 0;
+		return {
+			physicalId: physicalId.includes("|") ? packCompositeId(resourceType, logicalId, [
+				{
+					name: "tableBucketARN",
+					value: current.tableBucketARN
+				},
+				{
+					name: "namespace",
+					value: newNamespace
+				},
+				{
+					name: "name",
+					value: newName
+				}
+			], { maskSecrets: mask }) : physicalId,
+			target: {
+				tableBucketARN: current.tableBucketARN,
+				namespace: newNamespace,
+				name: newName
+			},
+			command: new RenameTableCommand({
+				tableBucketARN: current.tableBucketARN,
+				namespace: current.namespace,
+				name: current.name,
+				...newNamespace !== current.namespace && { newNamespaceName: newNamespace },
+				...newName !== current.name && { newName }
+			})
+		};
+	}
+	async renameAlreadyApplied(target, recordedAttributes) {
+		const recordedArn = recordedAttributes?.["TableARN"];
+		if (typeof recordedArn !== "string" || recordedArn.length === 0) return false;
+		try {
+			return await this.lookupTableArn(target.tableBucketARN, target.namespace, target.name) === recordedArn;
+		} catch (lookupError) {
+			this.logger.debug(safeMsg`Could not check whether the rename of ${target.name} was already applied: ${describeAwsFailure(lookupError).summary}`);
+			return false;
+		}
+	}
 	async lookupTableArn(tableBucketARN, namespace, name) {
 		try {
 			return (await this.getClient().send(new GetTableCommand$1({
@@ -49018,4 +49851,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-L1a3Wl0g.js.map
+//# sourceMappingURL=provider-classes-CPMW_2-R.js.map