@go-to-k/cdkd 0.308.0 → 0.308.1

package/dist/{provider-classes-d9K3vBVh.js → provider-classes-BxfIHcea.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-TFGunWmV.js";
+import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbWaitStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-D94wh05t.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $c as carriesSecretMask, $s as canonicalLambdaFunctionName, A as beginDeleteWait, Ai as tagPlanWarning, An as redactedDeleteAddressFields, B as waitForIndexesSettled, Bl as stringifyValue, Bs as configIntegerRefusal, C as planContributorInsightsOp, Ci as markDeleteStarted, Cs as withoutSilentDropProperties, D as reverseMapTableContributorInsights, Di as readTagList, E as reverseMapIndexContributorInsights, Ei as planTagDiff, En as getCurrentProducerRegions, Er as replacedDeleteFailureVerdict, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fs as toCfnInteger, G as S3_AUTO_DELETE_OBJECTS_TAG, Ga as getAccountInfo, Gl as rewriteTemplateAssetReferences, Gs as requireConfigObject, H as planTimeToLive, Hi as getCurrentResourceSecrets, Hs as readConfigString, I as INDEX_SETTLE_POLL_INTERVAL_MS, Is as toFiniteNumber, J as getPriorAttempts, Jc as recoverMaskedOutput, Ji as slowCcOperationTimeoutMs, Ju as derivePartitionAndUrlSuffix, K as hasCdkAutoDeleteTag, Ks as requireConfigString, L as deleteTableWithIndexBusyRetry, Ll as timePhase, Ls as coerceCfnBoolean, M as deleteBudgetKey, Mi as stringifyIfAssigned, Ms as WARM_THROUGHPUT_MEMBERS, N as resolveDynamoDbDeleteBudgetClock, Ns as coerceWarmThroughput$1, O as stripIndexContributorInsights, Oi as refuseMalformedDesiredTags, On as REDACTED_DELETE_ADDRESS_SKIP_REASON, P as resolveDynamoDbDeleteBudgetMs, Ps as isWarmThroughputDecrease, Pt as revertNestedChildFromJournal, Qs as emrClusterInstancesReplaced, Qt as withApiLimit, R as maskedLogger, Ri as waitForLambdaFunctionActive, Rs as coerceCfnInteger, Rt as getCurrentNestedStackContext, S as indexDeclaresContributorInsights, Sc as snapshotPassProvenance, Si as isRefusedByName, Sr as awaitInFlightSibling, T as readContributorInsightsSpec, Ta as outputReferenceProvenanceOf, Tc as hasMaskableValues, Ti as DBPROXY_TAG_OPTIONS, U as readTtlSpec, Us as replayWarn, V as isTtlAlreadyDisabled, Vc as dynamicReferenceTokens, Vo as refuseMalformedNestedChildOutputs, Vs as configStringRefusal, W as ECR_AUTO_DELETE_IMAGES_TAG, Ws as requireConfigArray, Wu as decodeListingKey, Xc as recordAttributeIdCopy, Xi as unchangedBehindSecretReference, Xs as withRetry, Xt as isAccessDeniedError, Y as markRefusedBeforeApplying, Yc as physicalNameCopiesOf, Yi as onlySecretReferencesDiffer, Yt as chunks, Zs as ecsServiceLaunchTypeSetOrChanged, Zt as lookupEachName, _ as streamMemberRefusals, _a as s3BucketDomainName, ao as passedParameterClassesOf, at as isAbsoluteAssetPath, b as CONTRIBUTOR_INSIGHTS_KEY, ba as s3BucketWebsiteUrl, bc as redactForState, c as DynamoDBGlobalTableProvider, ca as observeThenDisableInstanceApiTermination, cd as displayAssemblyPath, d as declaredStreamPolicyMember, ec as lambdaFunctionNameForMask, f as declaredStreamTagsMember, fo as accountArgs, g as streamDeclaresTags, ga as s3BucketArn, gi as reserveStackCreateToken, h as streamDeclaresPolicy, ha as isSettledInstanceState, ia as markWaitAbandoned, it as findNestedTemplateTreeDefect, j as compensateRemovedDeletionProtection, ji as definedAttributes, jn as redactedDeleteAddressSkip, jt as getNestedRevertRun, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ki as tagMapAsList, kn as isRedactedRecordedValue, l as STREAM_POLICY_KEY, la as reDisableInstanceApiTermination, ld as renderAssemblyPathEscape, m as reverseMapStreamPolicy, mi as earliestDefined, mt as enclosingDeadlineRemainingMs, na as withIndeterminateGuard, no as parseWebACLArn, oa as ec2InstanceProtectionSite, ot as listNestedTemplateRows, p as planStreamMemberOps, pc as passedNoEchoParametersOf, pt as enclosingDeadlineExpired, q as isTruthyCfnBoolean, qu as canonicalizeRegion, ra as isWaitAbandonedError, sa as isTerminationProtectionPropagationError, sd as describeFileReadFailure, ss as refuseMalformedResourcesForDestroy, st as renderNestedTemplateTreeDefect, t as DeployEngine, ta as deleteSkipReason, tc as sameLambdaFunctionAddress, ti as secretNamedAttributeNamesOf, u as STREAM_TAGS_KEY, ua as reEnableInstanceApiTermination, ud as resolveAssemblyPath, v as streamPolicyMatchesDeclared, va as s3BucketDualStackDomainName, vi as acquireIdempotencyToken, w as planIndexContributorInsightsOps, wi as DBPROXY_TAGS_WHAT, wr as getStackRecords, x as contributorInsightsRefusals, xc as recordReferenceProvenanceEntry, xs as findSilentDropProperties, y as streamTagsMatchDeclared, ya as s3BucketRegionalDomainName, yc as markSameGenerationBag, ys as withheldAccountClause, z as relayedIndexBusyDelete, zc as withoutPhysicalNameCopies, zs as configBooleanRefusal, zt as withNestedStackContext } from "./deploy-engine-DSpxEUjC.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider--eWrOXce.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DOPic-aS.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DOJPkECL.js";
-import { RDSProvider } from "./rds-provider-BPs9JSk_.js";
-import { NeptuneProvider } from "./neptune-provider-p59T8CFv.js";
-import { ASGProvider } from "./asg-provider-CsRMe_zh.js";
+import { $c as recordAttributeIdCopy, $s as blockDeviceMappingsDifferOnlyInDeleteOnTermination, $t as lookupEachName, A as beginDeleteWait, Ai as refuseMalformedDesiredTags, An as REDACTED_DELETE_ADDRESS_SKIP_REASON, B as waitForIndexesSettled, Bi as waitForLambdaFunctionActive, Bl as timePhase, Bs as coerceCfnInteger, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cc as redactForState, Cs as findSilentDropProperties, D as reverseMapTableContributorInsights, Da as outputReferenceProvenanceOf, Di as DBPROXY_TAG_OPTIONS, E as reverseMapIndexContributorInsights, Ei as DBPROXY_TAGS_WHAT, Er as getStackRecords, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fs as coerceWarmThroughput$1, G as sendTtlWaitingOutRateLimit, Gs as replayWarn, H as isTtlRateLimited, Hc as withoutPhysicalNameCopies, Hs as configIntegerRefusal, I as INDEX_SETTLE_POLL_INTERVAL_MS, Is as isWarmThroughputDecrease, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Jl as rewriteTemplateAssetReferences, Js as requireConfigString, K as ECR_AUTO_DELETE_IMAGES_TAG, Ks as requireConfigArray, L as deleteTableWithIndexBusyRetry, Ls as toCfnInteger, M as deleteBudgetKey, Mi as tagPlanWarning, Mn as redactedDeleteAddressFields, N as resolveDynamoDbDeleteBudgetClock, Ni as definedAttributes, Nn as redactedDeleteAddressSkip, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oc as hasMaskableValues, Oi as planTagDiff, On as getCurrentProducerRegions, Or as replacedDeleteFailureVerdict, P as resolveDynamoDbDeleteBudgetMs, Pi as stringifyIfAssigned, Ps as WARM_THROUGHPUT_MEMBERS, Qc as physicalNameCopiesOf, Qi as unchangedBehindSecretReference, Qs as withRetry, Qt as isAccessDeniedError, R as maskedLogger, Rs as toFiniteNumber, S as indexDeclaresContributorInsights, Sa as s3BucketWebsiteUrl, Sc as markSameGenerationBag, T as readContributorInsightsSpec, Tc as snapshotPassProvenance, Ti as markDeleteStarted, Ts as withoutSilentDropProperties, U as planTimeToLive, Ul as stringifyValue, Uo as refuseMalformedNestedChildOutputs, Us as configStringRefusal, V as isTtlAlreadyDisabled, Vs as configBooleanRefusal, Vt as withNestedStackContext, W as readTtlSpec, Wc as dynamicReferenceTokens, Wi as getCurrentResourceSecrets, Ws as readConfigString, X as getPriorAttempts, Xi as slowCcOperationTimeoutMs, Xu as canonicalizeRegion, Y as isTruthyCfnBoolean, Z as markRefusedBeforeApplying, Zc as recoverMaskedOutput, Zi as onlySecretReferencesDiffer, Zt as chunks, Zu as derivePartitionAndUrlSuffix, _ as streamMemberRefusals, _a as isSettledInstanceState, aa as isWaitAbandonedError, b as CONTRIBUTOR_INSIGHTS_KEY, ba as s3BucketDualStackDomainName, bi as acquireIdempotencyToken, c as DynamoDBGlobalTableProvider, ca as ec2InstanceProtectionSite, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as reDisableInstanceApiTermination, dd as displayAssemblyPath, ec as ecsServiceLaunchTypeSetOrChanged, en as withApiLimit, f as declaredStreamTagsMember, fa as reEnableInstanceApiTermination, fd as renderAssemblyPathEscape, g as streamDeclaresTags, gc as passedNoEchoParametersOf, gi as earliestDefined, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ht as enclosingDeadlineExpired, ia as withIndeterminateGuard, ic as sameLambdaFunctionAddress, io as parseWebACLArn, j as compensateRemovedDeletionProtection, ji as tagMapAsList, jn as isRedactedRecordedValue, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ki as readTagList, l as STREAM_POLICY_KEY, la as isTerminationProtectionPropagationError, ls as refuseMalformedResourcesForDestroy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, mo as accountArgs, nc as canonicalLambdaFunctionName, nl as carriesSecretMask, oa as markWaitAbandoned, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pd as resolveAssemblyPath, q as S3_AUTO_DELETE_OBJECTS_TAG, qa as getAccountInfo, qs as requireConfigObject, qu as decodeListingKey, ra as deleteSkipReason, rc as lambdaFunctionNameForMask, ri as secretNamedAttributeNamesOf, so as passedParameterClassesOf, st as isAbsoluteAssetPath, t as DeployEngine, tc as emrClusterInstancesReplaced, u as STREAM_TAGS_KEY, ua as observeThenDisableInstanceApiTermination, ud as describeFileReadFailure, v as streamPolicyMatchesDeclared, va as s3BucketArn, vi as reserveStackCreateToken, w as planIndexContributorInsightsOps, wc as recordReferenceProvenanceEntry, wi as isRefusedByName, wr as awaitInFlightSibling, x as contributorInsightsRefusals, xa as s3BucketRegionalDomainName, xs as withheldAccountClause, y as streamTagsMatchDeclared, ya as s3BucketDomainName, z as relayedIndexBusyDelete, zs as coerceCfnBoolean } from "./deploy-engine-CDjAtIrn.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DbtvFel_.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Ymf7svYk.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-BUG7NMWS.js";
+import { RDSProvider } from "./rds-provider-CZhBLQgJ.js";
+import { NeptuneProvider } from "./neptune-provider-Y3Ii8oYI.js";
+import { ASGProvider } from "./asg-provider-B7pAjRIc.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -16,7 +16,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateDeploymentCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -12228,7 +12228,8 @@ var DynamoDBTableProvider = class {
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"], void 0, "create", {
 				logicalId,
-				resourceType
+				resourceType,
+				maskSecrets
 			});
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
@@ -12526,7 +12527,8 @@ var DynamoDBTableProvider = class {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
 				await this.applyTimeToLive(physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"], "update", {
 					logicalId,
-					resourceType
+					resourceType,
+					maskSecrets
 				});
 			}
 			if (JSON.stringify(properties["ResourcePolicy"]) !== JSON.stringify(previousProperties["ResourcePolicy"])) {
@@ -12732,6 +12734,7 @@ var DynamoDBTableProvider = class {
 			const retryLine = `Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`;
 			this.logger.debug(options.maskSecrets ? options.maskSecrets(retryLine) : retryLine);
 			await new Promise((resolve) => setTimeout(resolve, delayMs));
+			if (options.stopAtDeadline && enclosingDeadlineRemainingMs() <= 0) throw error;
 			delayMs = Math.min(delayMs * 2, 3e4);
 		}
 	}
@@ -12746,10 +12749,10 @@ var DynamoDBTableProvider = class {
 		let attributeName;
 		if (plan.kind === "none") return;
 		if (plan.kind === "disable-live") {
-			const live = (await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableName })), `read TTL on ${tableName}`)).TimeToLiveDescription;
+			const live = (await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableName })), `read TTL on ${tableName}`, void 0, { maskSecrets: ids.maskSecrets })).TimeToLiveDescription;
 			const status = live?.TimeToLiveStatus;
 			if (status !== "ENABLED" && status !== "ENABLING" || !live?.AttributeName) {
-				this.logger.debug(`TimeToLive already ${status ?? "DISABLED"} on DynamoDB table ${tableName}; nothing to disable`);
+				this.logger.debug(ids.maskSecrets(`TimeToLive already ${status ?? "DISABLED"} on DynamoDB table ${tableName}; nothing to disable`));
 				return;
 			}
 			enabled = false;
@@ -12759,22 +12762,28 @@ var DynamoDBTableProvider = class {
 			attributeName = plan.attributeName;
 		}
 		try {
-			await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
+			await sendTtlWaitingOutRateLimit(() => this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
 				TableName: tableName,
 				TimeToLiveSpecification: {
 					Enabled: enabled,
 					AttributeName: attributeName
 				}
-			})), `${enabled ? "set" : "disable"} TTL on ${tableName}`);
+			})), `${enabled ? "set" : "disable"} TTL on ${tableName}`, void 0, {
+				maskSecrets: ids.maskSecrets,
+				stopAtDeadline: true
+			}), {
+				what: ids.maskSecrets(`DynamoDB TimeToLive rate-limit wait on ${tableName}`),
+				announce: () => this.logger.info(ids.maskSecrets(`DynamoDB table ${ids.logicalId}: TimeToLive was changed recently, and AWS refuses another change until its rate-limit interval passes (up to about an hour). Retrying every minute, like CloudFormation, within the resource timeout.`))
+			});
 		} catch (error) {
 			if (!enabled && isTtlAlreadyDisabled(describeAwsFailure(error).detail)) {
-				this.logger.debug(`TimeToLive already disabled on DynamoDB table ${tableName}`);
+				this.logger.debug(ids.maskSecrets(`TimeToLive already disabled on DynamoDB table ${tableName}`));
 				return;
 			}
-			if (describeAwsFailure(error).detail.includes("Time to live has been modified multiple times")) throw new ProvisioningError(`DynamoDB table ${ids.logicalId}: AWS refused to ${enabled ? "enable" : "disable"} TimeToLive because it was already modified within DynamoDB's rate-limit interval. Wait for the interval to pass (up to about an hour), then redeploy.`, ids.resourceType, ids.logicalId, tableName, error instanceof Error ? error : void 0);
+			if (isTtlRateLimited(describeAwsFailure(error).detail)) throw new ProvisioningError(`DynamoDB table ${ids.logicalId}: AWS refused to ${enabled ? "enable" : "disable"} TimeToLive because it was already modified within DynamoDB's rate-limit interval, and kept refusing until the resource timeout ran out. Redeploy once the interval has passed (up to about an hour), or raise --resource-timeout.`, ids.resourceType, ids.logicalId, tableName, error instanceof Error ? error : void 0);
 			throw error;
 		}
-		this.logger.debug(`Set TimeToLive Enabled=${enabled} AttributeName=${attributeName} on DynamoDB table ${tableName}`);
+		this.logger.debug(ids.maskSecrets(`Set TimeToLive Enabled=${enabled} AttributeName=${attributeName} on DynamoDB table ${tableName}`));
 	}
 	extractResourcePolicyDocument(spec) {
 		if (spec === void 0 || spec === null) return void 0;
@@ -16131,6 +16140,46 @@ const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
 	segments: ["gatewayId", "vpcId"]
 };
 const VPN_GATEWAY_ATTACHMENT_WAIT_MS = 6e5;
+const INSTANCE_STATE_WAIT_CAP_MS = 9e5;
+const INSTANCE_STATE_POLL_MS = 5e3;
+const STOPPED_AFTER_START_READS = 3;
+const PROFILE_DISASSOCIATING_POLLS = 15;
+const PROFILE_DISASSOCIATING_DELAY_MS = 2e3;
+function refusedBeforeApplying(error) {
+	return markRefusedBeforeApplying(markNonRetryable(error));
+}
+const STOPPABLE_INSTANCE_STATES = /* @__PURE__ */ new Set([
+	"pending",
+	"running",
+	"stopping",
+	"stopped"
+]);
+const instancesLeftStoppedByCdkd = /* @__PURE__ */ new Set();
+const instanceStoppedAfterStart = /* @__PURE__ */ new WeakSet();
+function isRecordedStandIn$1(value) {
+	if (Array.isArray(value)) return value.some(isRecordedStandIn$1);
+	if (value !== null && typeof value === "object") return Object.values(value).some(isRecordedStandIn$1);
+	return typeof value === "string" && (value === "***" || dynamicReferenceTokens(value).length > 0);
+}
+function instanceProfileKey(value) {
+	const fromArn = (arn) => arn.slice(arn.lastIndexOf("/") + 1);
+	if (typeof value === "string") {
+		const v = value.trim();
+		if (v === "") return void 0;
+		return v.startsWith("arn:") ? fromArn(v) : v;
+	}
+	if (value !== null && typeof value === "object") {
+		const obj = value;
+		if (typeof obj["Name"] === "string" && obj["Name"] !== "") return obj["Name"];
+		if (typeof obj["Arn"] === "string" && obj["Arn"] !== "") return fromArn(obj["Arn"]);
+	}
+}
+function sameStringSet(a, b) {
+	if (!Array.isArray(a) || !Array.isArray(b)) return a === b;
+	const sa = new Set(a.map(String));
+	const sb = new Set(b.map(String));
+	return sa.size === sb.size && [...sa].every((x) => sb.has(x));
+}
 const VPN_DETACH_IN_PROGRESS_ERRORS = /* @__PURE__ */ new Set(["IncorrectState"]);
 const EC2_ROUTE_ID_FORMAT = {
 	label: "Route",
@@ -16723,19 +16772,19 @@ var EC2Provider = class {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::InternetGateway": return this.updateInternetGateway(logicalId, physicalId);
+			case "AWS::EC2::InternetGateway": return this.updateTagsOnly(logicalId, physicalId, resourceType, false, properties, previousProperties, context);
 			case "AWS::EC2::EIP": return this.updateEip(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
+			case "AWS::EC2::RouteTable":
+			case "AWS::EC2::NetworkAcl": return this.updateTagsOnly(logicalId, physicalId, resourceType, true, properties, previousProperties, context);
 			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.replayingState === true, context?.recordedAttributes);
 			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NetworkAclEntry": return this.updateNetworkAclEntry(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::NetworkAcl":
-			case "AWS::EC2::SubnetNetworkAclAssociation": throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS provides no in-place Update API for this EC2 sub-resource type; every property change requires Delete + Create. Re-deploy with cdkd deploy --replace, or destroy + redeploy.");
+			case "AWS::EC2::SubnetNetworkAclAssociation": throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS provides no in-place Update API for this EC2 sub-resource type; every property change requires Delete + Create. Re-deploy with cdkd deploy --replace, or destroy + redeploy");
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -16976,6 +17025,10 @@ var EC2Provider = class {
 		this.logger.debug(`Updating VPC ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
+			const tenancyOf = (v) => v == null ? "default" : String(v);
+			const newTenancy = tenancyOf(properties["InstanceTenancy"]);
+			const oldTenancy = tenancyOf(previousProperties["InstanceTenancy"]);
+			if (newTenancy !== oldTenancy && newTenancy !== "default") throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "destroy + redeploy the VPC (and the resources that depend on it). AWS changes InstanceTenancy in place only to default, and CloudFormation creates a new VPC for this change");
 			const asBool = (v) => {
 				if (v === void 0) return void 0;
 				return v === true || v === "true";
@@ -16992,6 +17045,10 @@ var EC2Provider = class {
 				VpcId: physicalId,
 				EnableDnsSupport: { Value: newDnsSupport }
 			}));
+			if (newTenancy !== oldTenancy) await this.ec2Client.send(new ModifyVpcTenancyCommand({
+				VpcId: physicalId,
+				InstanceTenancy: "default"
+			}));
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
 			this.logger.debug(`Successfully updated VPC ${logicalId}`);
 			return {
@@ -17003,6 +17060,7 @@ var EC2Provider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -17272,8 +17330,20 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create InternetGateway ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	updateInternetGateway(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::InternetGateway", logicalId, "destroy + redeploy the InternetGateway. IGW properties are immutable in AWS"));
+	async updateTagsOnly(logicalId, physicalId, resourceType, vpcIdCreateOnly, properties, previousProperties, context) {
+		const label = resourceType.slice(10);
+		this.logger.debug(safeMsg`Updating ${label} ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		if (vpcIdCreateOnly) {
+			const next = properties["VpcId"];
+			const prev = previousProperties["VpcId"];
+			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `destroy + redeploy the ${label} (and the resources that depend on it). VpcId is immutable in AWS`);
+		}
+		await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
+		return {
+			physicalId,
+			wasReplaced: false
+		};
 	}
 	async deleteInternetGateway(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting InternetGateway ${logicalId}: ${physicalId}`);
@@ -18019,9 +18089,6 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create RouteTable ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	updateRouteTable(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::RouteTable", logicalId, "destroy + redeploy the RouteTable (and its associated Routes / SubnetRouteTableAssociations). VpcId is immutable."));
-	}
 	async deleteRouteTable(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting RouteTable ${logicalId}: ${physicalId}`);
 		try {
@@ -18180,7 +18247,7 @@ var EC2Provider = class {
 		}
 	}
 	updateSubnetRouteTableAssociation(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::SubnetRouteTableAssociation", logicalId, "destroy + redeploy the association. (SubnetId, RouteTableId) is immutable."));
+		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::SubnetRouteTableAssociation", logicalId, "destroy + redeploy the association. (SubnetId, RouteTableId) is immutable"));
 	}
 	async deleteSubnetRouteTableAssociation(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting SubnetRouteTableAssociation ${logicalId}: ${physicalId}`);
@@ -18902,9 +18969,12 @@ var EC2Provider = class {
 		this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		this.guardTerminationProtectionRemoval(logicalId, physicalId, resourceType, properties, previousProperties, context);
+		const memberPlan = this.planInstanceMemberUpdates(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		try {
+			await this.prepareInstanceMemberUpdates(logicalId, physicalId, resourceType, memberPlan);
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
 			await this.updateInstanceSecurityProps(physicalId, properties, previousProperties);
+			await this.applyInstanceMemberUpdates(logicalId, physicalId, resourceType, memberPlan);
 			const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
 			return {
 				physicalId,
@@ -18912,6 +18982,7 @@ var EC2Provider = class {
 				attributes: describedInstanceAttributes(physicalId, instance)
 			};
 		} catch (error) {
+			if (error instanceof CdkdError || isInterruptedWaitError(error)) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -18950,6 +19021,286 @@ var EC2Provider = class {
 			CpuCredits: newCpuCredits
 		}] }));
 	}
+	planInstanceMemberUpdates(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const plan = {};
+		const removed = (key) => context?.removedProperties !== void 0 ? context.removedProperties.has(key) : previousProperties[key] !== void 0 && properties[key] === void 0;
+		const changed = (key, same) => {
+			const before = previousProperties[key];
+			const after = properties[key];
+			if (after === void 0 && !removed(key)) return false;
+			if (context?.changedProperties !== void 0 && !context.changedProperties.has(key)) return false;
+			if (isDeepStrictEqual(before, after)) {
+				if (context?.replayingState === true && isRecordedStandIn$1(after)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): both sides of the rollback record ${key} as a stand-in (an unresolved {{resolve:...}} reference or the redaction mask), so cdkd cannot tell whether it changed; the rollback leaves ${key} at its current AWS value.`);
+				return false;
+			}
+			return !(!isRecordedStandIn$1(before) && !isRecordedStandIn$1(after) && same(before, after));
+		};
+		const standInSkips = (key) => {
+			if (!isRecordedStandIn$1(properties[key])) return false;
+			if (context?.replayingState === true) {
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored records ${key} as a stand-in (an unresolved {{resolve:...}} reference or the redaction mask), not a value cdkd can send; the rollback leaves ${key} at its current AWS value.`);
+				return true;
+			}
+			throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): ${key} holds a recorded stand-in (an unresolved {{resolve:...}} reference or the redaction mask), not a value cdkd can send. The instance was not updated; deploy from the template so the value resolves.`, resourceType, logicalId, physicalId));
+		};
+		if (changed("InstanceType", (a, b) => a === b)) {
+			if (properties["InstanceType"] === void 0) {
+				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare InstanceType; the rollback leaves the instance type at its current AWS value.`);
+				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceType was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to the instance's current type to leave it unchanged). The instance was not updated.`, resourceType, logicalId, physicalId));
+			} else if (!standInSkips("InstanceType")) plan.instanceType = requireConfigString(properties["InstanceType"], "", "AWS::EC2::Instance InstanceType");
+		}
+		if (changed("UserData", (a, b) => a === b)) {
+			const userData = properties["UserData"];
+			if (userData === void 0) plan.userData = /* @__PURE__ */ new Uint8Array(0);
+			else if (!standInSkips("UserData")) {
+				if (typeof userData !== "string") throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): UserData must be a base64 string (Fn::Base64), got a ${Array.isArray(userData) ? "list" : typeof userData}. The instance was not updated.`, resourceType, logicalId, physicalId));
+				plan.userData = new Uint8Array(Buffer.from(userData, "base64"));
+			}
+		}
+		if (changed("IamInstanceProfile", (a, b) => instanceProfileKey(a) === instanceProfileKey(b))) {
+			if (properties["IamInstanceProfile"] === void 0) plan.profile = { kind: "remove" };
+			else if (!standInSkips("IamInstanceProfile")) {
+				const desired = this.normalizeIamInstanceProfile(properties["IamInstanceProfile"]);
+				if (desired === void 0) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): IamInstanceProfile is neither a profile name, an ARN, nor an {Arn,Name} object. The instance was not updated.`, resourceType, logicalId, physicalId));
+				plan.profile = {
+					kind: "set",
+					...desired
+				};
+			}
+		}
+		if (changed("SecurityGroupIds", (a, b) => sameStringSet(a, b))) {
+			const groups = properties["SecurityGroupIds"];
+			if (groups === void 0) plan.securityGroups = { kind: "vpc-default" };
+			else {
+				const ids = Array.isArray(groups) ? groups : void 0;
+				if (ids === void 0 || ids.length === 0 || !ids.every((g) => typeof g === "string" && g !== "")) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): SecurityGroupIds must be a non-empty list of security group ids. The instance was not updated.`, resourceType, logicalId, physicalId));
+				if (!standInSkips("SecurityGroupIds")) plan.securityGroups = {
+					kind: "set",
+					ids
+				};
+			}
+		}
+		const beforeBdm = previousProperties["BlockDeviceMappings"];
+		const afterBdm = properties["BlockDeviceMappings"];
+		if (afterBdm !== void 0 && (context?.changedProperties === void 0 || context.changedProperties.has("BlockDeviceMappings")) && blockDeviceMappingsDifferOnlyInDeleteOnTermination(beforeBdm, afterBdm)) {
+			const flips = [];
+			afterBdm.forEach((m, i) => {
+				const before = beforeBdm[i];
+				const read = (x) => {
+					const ebs = x?.["Ebs"];
+					if (ebs === void 0 || ebs === null) return void 0;
+					return this.coerceBool(ebs["DeleteOnTermination"]) ?? true;
+				};
+				const want = read(m);
+				if (want !== void 0 && want !== read(before) && typeof m["DeviceName"] === "string") flips.push({
+					DeviceName: m["DeviceName"],
+					DeleteOnTermination: want
+				});
+			});
+			if (flips.length > 0) plan.deleteOnTermination = flips;
+		}
+		return plan;
+	}
+	async prepareInstanceMemberUpdates(logicalId, physicalId, resourceType, plan) {
+		const needsStop = plan.instanceType !== void 0 || plan.userData !== void 0;
+		const needsDefaultGroup = plan.securityGroups?.kind === "vpc-default";
+		if (!needsStop && !needsDefaultGroup) return;
+		const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+		if (needsStop) {
+			const members = [plan.instanceType !== void 0 ? "InstanceType" : "", plan.userData !== void 0 ? "UserData" : ""].filter(Boolean).join(" and ");
+			if (instance?.RootDeviceType === "instance-store") throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `${members} can change only on a stopped instance, and an instance-store-backed instance cannot be stopped; CloudFormation replaces it. Re-deploy with cdkd deploy --replace.`));
+			const state = instance?.State?.Name;
+			if (!STOPPABLE_INSTANCE_STATES.has(state ?? "")) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} is ${state ?? "not returned by DescribeInstances"}, so its ${members} cannot be changed. The instance was not updated.`, resourceType, logicalId, physicalId));
+		}
+		if (needsDefaultGroup) plan.securityGroups = {
+			kind: "set",
+			ids: [await this.vpcDefaultSecurityGroupId(logicalId, physicalId, resourceType, instance?.VpcId)]
+		};
+	}
+	async applyInstanceMemberUpdates(logicalId, physicalId, resourceType, plan) {
+		const applied = [];
+		if (plan.securityGroups?.kind === "set") {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				Groups: plan.securityGroups.ids
+			}));
+			applied.push("the new SecurityGroupIds");
+		}
+		if (plan.profile !== void 0) {
+			await this.applyInstanceProfileChange(logicalId, physicalId, plan.profile);
+			applied.push(plan.profile.kind === "remove" ? "the IamInstanceProfile removed" : "the new IamInstanceProfile");
+		}
+		if (plan.deleteOnTermination !== void 0) {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				BlockDeviceMappings: plan.deleteOnTermination.map((f) => ({
+					DeviceName: f.DeviceName,
+					Ebs: { DeleteOnTermination: f.DeleteOnTermination }
+				}))
+			}));
+			applied.push("the new DeleteOnTermination");
+		}
+		if (plan.instanceType === void 0 && plan.userData === void 0) {
+			if (instancesLeftStoppedByCdkd.has(physicalId)) {
+				let state = await this.readInstanceState(physicalId);
+				if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
+				if (state === "stopped") await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
+				instancesLeftStoppedByCdkd.delete(physicalId);
+			}
+			return;
+		}
+		let state = await this.readInstanceState(physicalId);
+		if (state === "pending") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "running");
+		else if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
+		if (state !== "stopped" && state !== "running") throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} became ${state ?? "not returned by DescribeInstances"} during the update, so its InstanceType / UserData were not changed`, resourceType, logicalId, physicalId));
+		const startAfter = state === "running" || instancesLeftStoppedByCdkd.has(physicalId);
+		let phase = "stop";
+		let stopIssued = false;
+		try {
+			if (state === "running") {
+				this.logger.info(safeMsg`Stopping EC2 Instance ${logicalId} (${physicalId}) to change its ${plan.instanceType !== void 0 ? "InstanceType" : ""}${plan.instanceType !== void 0 && plan.userData !== void 0 ? " and " : ""}${plan.userData !== void 0 ? "UserData" : ""}; it is started again afterwards`);
+				await this.ec2Client.send(new StopInstancesCommand({ InstanceIds: [physicalId] }));
+				stopIssued = true;
+				await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
+			}
+			phase = "modify";
+			if (plan.instanceType !== void 0) {
+				await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+					InstanceId: physicalId,
+					InstanceType: { Value: plan.instanceType }
+				}));
+				applied.push("the new InstanceType");
+			}
+			if (plan.userData !== void 0) {
+				await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+					InstanceId: physicalId,
+					UserData: { Value: plan.userData }
+				}));
+				applied.push("the new UserData");
+			}
+			if (!startAfter) return;
+			phase = "start";
+			await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
+			instancesLeftStoppedByCdkd.delete(physicalId);
+			if (process.env["CDKD_NO_WAIT"] === "true") {
+				this.logger.debug(safeMsg`Instance ${physicalId} started (skipping running-state wait per --no-wait)`);
+				return;
+			}
+			phase = "wait";
+			await this.waitForInstanceState(logicalId, physicalId, resourceType, "running", { stoppedIsTerminal: true });
+		} catch (error) {
+			const carries = applied.length === 0 ? "its previous settings" : `${applied.join(" and ")} already applied`;
+			const startCommand = `aws ec2 start-instances --instance-ids ${physicalId}`;
+			if (phase === "stop" && !stopIssued) throw error;
+			if (phase === "wait") {
+				if (instanceStoppedAfterStart.has(error)) {
+					instancesLeftStoppedByCdkd.add(physicalId);
+					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} stopped again right after cdkd started it, with ${carries}. Start it with: ${startCommand}`);
+				}
+				throw error;
+			}
+			if (!stopIssued && !startAfter) throw error;
+			if (phase !== "start" && !isInterruptedWaitError(error) && !enclosingDeadlineExpired()) {
+				let startFailure;
+				try {
+					await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
+				} catch (e) {
+					startFailure = e ?? /* @__PURE__ */ new Error("StartInstances failed");
+				}
+				if (startFailure === void 0) {
+					instancesLeftStoppedByCdkd.delete(physicalId);
+					this.logger.warn(safeMsg`${logicalId}: the InstanceType / UserData change failed after instance ${physicalId} was stopped; cdkd started it again, with ${carries}.`);
+				} else {
+					instancesLeftStoppedByCdkd.add(physicalId);
+					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} was stopped for an InstanceType / UserData change that failed, and starting it again failed too (${describeAwsFailure(startFailure).summary}); it is stopped, with ${carries}. Start it with: ${startCommand}`);
+				}
+				throw error;
+			}
+			instancesLeftStoppedByCdkd.add(physicalId);
+			this.logger.warn(phase === "stop" ? safeMsg`${logicalId}: instance ${physicalId} was being stopped for an InstanceType / UserData change that did not finish. Once it is stopped, start it with: ${startCommand}` : safeMsg`${logicalId}: instance ${physicalId} is stopped, with ${carries}; cdkd did not start it again. Start it with: ${startCommand}`);
+			throw error;
+		}
+	}
+	async readInstanceState(physicalId) {
+		return (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0]?.State?.Name;
+	}
+	async waitForInstanceState(logicalId, physicalId, resourceType, target, opts = {}) {
+		const watch = startInterruptWatch(`EC2 Instance ${logicalId} ${target} wait`);
+		const capAt = Date.now() + INSTANCE_STATE_WAIT_CAP_MS;
+		let last;
+		let stoppedReads = 0;
+		try {
+			for (;;) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				if (Math.min(enclosingDeadlineRemainingMs(), capAt - Date.now()) <= 0) throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): timed out waiting for instance ${physicalId} to be ${target} (last state: ${last ?? "none reported"})`, resourceType, logicalId, physicalId));
+				const previous = last;
+				last = await this.readInstanceState(physicalId);
+				if (last === target) return last;
+				stoppedReads = last === "stopped" ? stoppedReads + 1 : 0;
+				if (opts.stoppedIsTerminal === true && last === "stopped" && (previous === "pending" || stoppedReads >= STOPPED_AFTER_START_READS)) {
+					const stopped = markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} stopped again right after it was started; run \`aws ec2 describe-instances --instance-ids ${physicalId}\` and read StateReason for AWS's cause`, resourceType, logicalId, physicalId));
+					instanceStoppedAfterStart.add(stopped);
+					throw stopped;
+				}
+				if (last === "terminated" || last === "shutting-down" || last === void 0) throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} is ${last ?? "no longer returned by DescribeInstances"} while cdkd waited for it to be ${target}`, resourceType, logicalId, physicalId));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await this.sleep(Math.max(0, Math.min(INSTANCE_STATE_POLL_MS, enclosingDeadlineRemainingMs())));
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
+	async vpcDefaultSecurityGroupId(logicalId, physicalId, resourceType, vpcId) {
+		const id = (vpcId === void 0 ? void 0 : await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [{
+			Name: "vpc-id",
+			Values: [vpcId]
+		}, {
+			Name: "group-name",
+			Values: ["default"]
+		}] })))?.SecurityGroups?.[0]?.GroupId;
+		if (id === void 0) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): SecurityGroupIds was removed, and the default security group of instance ${physicalId}'s VPC (${vpcId ?? "unknown"}) could not be found to put in its place. The instance was not updated.`, resourceType, logicalId, physicalId));
+		return id;
+	}
+	async applyInstanceProfileChange(logicalId, physicalId, change) {
+		let assoc = await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+			Name: "instance-id",
+			Values: [physicalId]
+		}] }));
+		for (let poll = 1; poll <= PROFILE_DISASSOCIATING_POLLS && (assoc.IamInstanceProfileAssociations ?? []).some((a) => a.State === "disassociating"); poll++) {
+			await this.sleep(PROFILE_DISASSOCIATING_DELAY_MS);
+			assoc = await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+				Name: "instance-id",
+				Values: [physicalId]
+			}] }));
+		}
+		const current = assoc.IamInstanceProfileAssociations?.find((a) => a.State === "associated" || a.State === "associating");
+		if (change.kind === "remove") {
+			if (current?.AssociationId === void 0) return;
+			await this.ec2Client.send(new DisassociateIamInstanceProfileCommand({ AssociationId: current.AssociationId }));
+			return;
+		}
+		const spec = change.arn !== void 0 ? { Arn: change.arn } : { Name: change.name };
+		const maxAttempts = 10;
+		for (let attempt = 1;; attempt++) try {
+			if (current?.AssociationId !== void 0) await this.ec2Client.send(new ReplaceIamInstanceProfileAssociationCommand({
+				AssociationId: current.AssociationId,
+				IamInstanceProfile: spec
+			}));
+			else await this.ec2Client.send(new AssociateIamInstanceProfileCommand({
+				InstanceId: physicalId,
+				IamInstanceProfile: spec
+			}));
+			return;
+		} catch (error) {
+			const msg = describeAwsFailure(error).detail;
+			if (this.isInstanceProfilePropagationError(msg) && attempt < maxAttempts) {
+				this.logger.debug(safeMsg`IAM instance profile not yet propagated for ${logicalId} (${physicalId}) (attempt ${attempt}/${maxAttempts}: ${msg}), retrying in ${attempt}s...`);
+				await this.sleep(attempt * 1e3);
+				continue;
+			}
+			throw error;
+		}
+	}
 	shallowEqual(a, b) {
 		if (b === void 0) return false;
 		const ra = a;
@@ -19364,7 +19715,7 @@ var EC2Provider = class {
 		const egress = properties["Egress"] ?? false;
 		const parts = physicalId.split("|");
 		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
-		if (typeof networkAclId !== "string" || ruleNumber === void 0 || parts[0] !== networkAclId || parts[1] !== String(ruleNumber) || parts[2] !== String(egress)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "NetworkAclId, RuleNumber and Egress identify the entry and are createOnly; a change to any of them requires a new entry. Re-deploy with cdkd deploy --replace, or destroy + redeploy.");
+		if (typeof networkAclId !== "string" || ruleNumber === void 0 || parts[0] !== networkAclId || parts[1] !== String(ruleNumber) || parts[2] !== String(egress)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "NetworkAclId, RuleNumber and Egress identify the entry and are createOnly; a change to any of them requires a new entry. Re-deploy with cdkd deploy --replace, or destroy + redeploy");
 		if (properties["Protocol"] == null || !properties["RuleAction"]) throw new ProvisioningError(`Protocol and RuleAction are required for NetworkAclEntry ${logicalId}`, resourceType, logicalId, physicalId);
 		const ruleParams = networkAclEntryRuleParams(properties, properties["Icmp"] !== void 0 && properties["IcmpTypeCode"] !== void 0 && JSON.stringify(properties["Icmp"]) === JSON.stringify(previousProperties["Icmp"]) && JSON.stringify(properties["IcmpTypeCode"]) !== JSON.stringify(previousProperties["IcmpTypeCode"]));
 		if (context?.desiredFromAwsReadback === true && ruleParams.CidrBlock !== void 0 && ruleParams.Ipv6CidrBlock !== void 0) {
@@ -24558,6 +24909,8 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 
 //#endregion
 //#region src/provisioning/providers/agentcore-runtime-provider.ts
+const CFN_MAP_KEYS = /* @__PURE__ */ new Set(["Tags", "AdvertisedScopeMapping"]);
+const SDK_MAP_KEYS = /* @__PURE__ */ new Set(["tags", "advertisedScopeMapping"]);
 var AgentCoreRuntimeProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreRuntimeProvider");
@@ -24595,16 +24948,16 @@ var AgentCoreRuntimeProvider = class {
 				agentRuntimeName,
 				roleArn
 			};
-			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"]);
-			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"]);
+			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"], CFN_MAP_KEYS);
+			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"], CFN_MAP_KEYS);
 			if (properties["Description"] !== void 0) input["description"] = properties["Description"];
-			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"]);
+			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"], CFN_MAP_KEYS);
 			if (properties["ProtocolConfiguration"] !== void 0) {
 				const proto = properties["ProtocolConfiguration"];
 				if (typeof proto === "string") input["protocolConfiguration"] = { serverProtocol: proto };
-				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto);
+				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto, CFN_MAP_KEYS);
 			}
-			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"]);
+			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
 			const response = await this.client.send(new CreateAgentRuntimeCommand(input));
@@ -24630,16 +24983,16 @@ var AgentCoreRuntimeProvider = class {
 				agentRuntimeId: physicalId,
 				roleArn
 			};
-			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"]);
-			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"]);
+			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"], CFN_MAP_KEYS);
+			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"], CFN_MAP_KEYS);
 			if (properties["Description"] !== void 0) input["description"] = properties["Description"];
-			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"]);
+			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"], CFN_MAP_KEYS);
 			if (properties["ProtocolConfiguration"] !== void 0) {
 				const proto = properties["ProtocolConfiguration"];
 				if (typeof proto === "string") input["protocolConfiguration"] = { serverProtocol: proto };
-				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto);
+				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto, CFN_MAP_KEYS);
 			}
-			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"]);
+			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
 			const response = await this.client.send(new UpdateAgentRuntimeCommand(input));
@@ -24681,7 +25034,7 @@ var AgentCoreRuntimeProvider = class {
 		if (response.agentRuntimeVersion !== void 0) attributes["AgentRuntimeVersion"] = response.agentRuntimeVersion;
 		if (response.status !== void 0) attributes["Status"] = response.status;
 		if (response.createdAt !== void 0) attributes["CreatedAt"] = response.createdAt.toISOString();
-		if (response.workloadIdentityDetails !== void 0) attributes["WorkloadIdentityDetails"] = camelToPascalCaseKeys(response.workloadIdentityDetails);
+		if (response.workloadIdentityDetails !== void 0) attributes["WorkloadIdentityDetails"] = camelToPascalCaseKeys(response.workloadIdentityDetails, SDK_MAP_KEYS);
 		return attributes;
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -24710,17 +25063,17 @@ var AgentCoreRuntimeProvider = class {
 		const result = {};
 		if (resp.agentRuntimeName !== void 0) result["AgentRuntimeName"] = resp.agentRuntimeName;
 		if (resp.roleArn !== void 0) result["RoleArn"] = resp.roleArn;
-		if (resp.agentRuntimeArtifact !== void 0) result["AgentRuntimeArtifact"] = camelToPascalCaseKeys(resp.agentRuntimeArtifact);
-		if (resp.networkConfiguration !== void 0) result["NetworkConfiguration"] = camelToPascalCaseKeys(resp.networkConfiguration);
+		if (resp.agentRuntimeArtifact !== void 0) result["AgentRuntimeArtifact"] = camelToPascalCaseKeys(resp.agentRuntimeArtifact, SDK_MAP_KEYS);
+		if (resp.networkConfiguration !== void 0) result["NetworkConfiguration"] = camelToPascalCaseKeys(resp.networkConfiguration, SDK_MAP_KEYS);
 		result["Description"] = resp.description ?? "";
-		if (resp.authorizerConfiguration !== void 0) result["AuthorizerConfiguration"] = camelToPascalCaseKeys(resp.authorizerConfiguration);
+		if (resp.authorizerConfiguration !== void 0) result["AuthorizerConfiguration"] = camelToPascalCaseKeys(resp.authorizerConfiguration, SDK_MAP_KEYS);
 		if (resp.protocolConfiguration !== void 0) {
 			const proto = resp.protocolConfiguration;
 			const keys = Object.keys(proto);
 			if (keys.length === 1 && keys[0] === "serverProtocol" && typeof proto["serverProtocol"] === "string") result["ProtocolConfiguration"] = proto["serverProtocol"];
-			else result["ProtocolConfiguration"] = camelToPascalCaseKeys(resp.protocolConfiguration);
+			else result["ProtocolConfiguration"] = camelToPascalCaseKeys(resp.protocolConfiguration, SDK_MAP_KEYS);
 		}
-		if (resp.lifecycleConfiguration !== void 0) result["LifecycleConfiguration"] = camelToPascalCaseKeys(resp.lifecycleConfiguration);
+		if (resp.lifecycleConfiguration !== void 0) result["LifecycleConfiguration"] = camelToPascalCaseKeys(resp.lifecycleConfiguration, SDK_MAP_KEYS);
 		if (resp.environmentVariables !== void 0) result["EnvironmentVariables"] = resp.environmentVariables;
 		return result;
 	}
@@ -29871,7 +30224,7 @@ var DocDBProvider = class {
 			createdResourceId = response.DBCluster?.DbClusterResourceId;
 			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
-			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
+			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
 				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
@@ -30026,7 +30379,7 @@ var DocDBProvider = class {
 			createdResourceId = response.DBInstance?.DbiResourceId;
 			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
-			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
+			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(logicalId, dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
 				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
@@ -30161,7 +30514,7 @@ var DocDBProvider = class {
 	}
 	requireClusterWhileWaiting(cluster, logicalId, change) {
 		if (cluster === void 0) throw new Error(safeMsg`DescribeDBClusters returned no cluster for DocDB DBCluster ${logicalId} while waiting for its new ${change}`);
-		if (isTerminalDbStatus(cluster.Status)) throw new Error(safeMsg`DocDB DBCluster ${logicalId} entered status ${cluster.Status ?? ""} while applying its new ${change}`);
+		if (isTerminalDbWaitStatus(cluster.Status)) throw new Error(safeMsg`DocDB DBCluster ${logicalId} entered status ${cluster.Status ?? ""} while applying its new ${change}`);
 		return cluster;
 	}
 	async waitForClusterPortApplied(dbClusterIdentifier, logicalId, port, maxWaitMs = 18e5) {
@@ -30210,13 +30563,14 @@ var DocDBProvider = class {
 			remainingMs: enclosingDeadlineRemainingMs()
 		});
 	}
-	async waitForClusterAvailable(dbClusterIdentifier, maxWaitMs = 18e5) {
+	async waitForClusterAvailable(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 5e3;
 		while (Date.now() - startTime < maxWaitMs) {
 			const status = (await this.describeDBCluster(dbClusterIdentifier))?.Status;
 			this.logger.debug(`DocDB DBCluster ${dbClusterIdentifier} status: ${status}`);
 			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`DocDB DBCluster ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -30240,13 +30594,14 @@ var DocDBProvider = class {
 		}
 		throw new Error(`Timed out waiting for DocDB DBCluster ${logicalId} to be deleted`);
 	}
-	async waitForInstanceAvailable(dbInstanceIdentifier, maxWaitMs = 18e5) {
+	async waitForInstanceAvailable(logicalId, dbInstanceIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 1e4;
 		while (Date.now() - startTime < maxWaitMs) {
 			const status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
 			this.logger.debug(`DocDB DBInstance ${dbInstanceIdentifier} status: ${status}`);
 			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`DocDB DBInstance ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -33179,7 +33534,7 @@ var CognitoUserPoolProvider = class {
 //#region src/provisioning/providers/elasticache-provider.ts
 const CACHE_DELETE_WAIT_MS = Math.max(6e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "DELETE"));
 const NODE_TYPE_MODIFY_WAIT_MS = Math.max(36e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "UPDATE"));
-const NODE_TYPE_DROPPED_AFTER_MS = 12e4;
+const MODIFY_DROPPED_AFTER_MS = 12e4;
 function availabilityZonesNotCovered(a, b) {
 	const remaining = [...b];
 	const out = [];
@@ -33190,6 +33545,27 @@ function availabilityZonesNotCovered(a, b) {
 	}
 	return out;
 }
+function nodesToRemove(nodes, desiredCount, desiredZones) {
+	const remainingZones = desiredZones === void 0 ? void 0 : [...desiredZones];
+	const named = nodes.filter((n) => n.id !== void 0);
+	const keep = /* @__PURE__ */ new Set();
+	const unnamed = nodes.length - named.length;
+	const byIdDesc = [...named].sort((a, b) => a.id < b.id ? 1 : a.id > b.id ? -1 : 0);
+	for (const node of byIdDesc) {
+		if (keep.size + unnamed >= desiredCount) break;
+		if (remainingZones === void 0) {
+			keep.add(node.id);
+			continue;
+		}
+		const i = node.zone === void 0 ? -1 : remainingZones.indexOf(node.zone);
+		if (i >= 0) {
+			remainingZones.splice(i, 1);
+			keep.add(node.id);
+		}
+	}
+	if (keep.size + unnamed < desiredCount) return void 0;
+	return named.map((n) => n.id).filter((id) => !keep.has(id)).sort();
+}
 var ElastiCacheProvider = class {
 	client;
 	createClient;
@@ -33407,7 +33783,8 @@ var ElastiCacheProvider = class {
 			const sgIds = rawSgIds && rawSgIds.length > 0 ? rawSgIds : void 0;
 			const notificationTopicArn = properties["NotificationTopicArn"];
 			const desiredNodeType = properties["CacheNodeType"];
-			const placement = await this.newNodePlacement(physicalId, properties, previousProperties);
+			const nodeChanges = await this.planNodeChanges(logicalId, physicalId, resourceType, properties, previousProperties);
+			const placement = nodeChanges.placement;
 			this.warnNotAppliedInPlace(logicalId, properties, previousProperties, placement);
 			await this.getClient().send(new ModifyCacheClusterCommand({
 				CacheClusterId: physicalId,
@@ -33417,6 +33794,7 @@ var ElastiCacheProvider = class {
 					NewAvailabilityZones: placement.newAvailabilityZones,
 					...placement.azMode !== void 0 && { AZMode: placement.azMode }
 				},
+				...nodeChanges.removeIds.length > 0 && { CacheNodeIdsToRemove: nodeChanges.removeIds },
 				SecurityGroupIds: sgIds,
 				CacheParameterGroupName: properties["CacheParameterGroupName"],
 				EngineVersion: properties["EngineVersion"],
@@ -33431,7 +33809,7 @@ var ElastiCacheProvider = class {
 				ApplyImmediately: true
 			}));
 			this.logger.debug(`Successfully updated CacheCluster ${logicalId}`);
-			if (desiredNodeType !== void 0) await this.waitForClusterAvailable(physicalId, NODE_TYPE_MODIFY_WAIT_MS, desiredNodeType);
+			if (desiredNodeType !== void 0 || nodeChanges.removeIds.length > 0) await this.waitForClusterAvailable(physicalId, NODE_TYPE_MODIFY_WAIT_MS, desiredNodeType, nodeChanges.removeIds);
 			else await this.waitForClusterAvailable(physicalId);
 			const described = await this.describeCacheCluster(physicalId);
 			this.warnTransitEncryptionNotApplied(logicalId, properties, previousProperties, described?.TransitEncryptionEnabled);
@@ -33495,15 +33873,41 @@ var ElastiCacheProvider = class {
 		const state = current === true ? "ENABLED" : "DISABLED";
 		this.logger.warn(safeMsg`CacheCluster ${logicalId}: the cluster still has encryption in transit ${state} ` + safeMsg`(the template now says TransitEncryptionEnabled: ${String(next)}). ` + "ModifyCacheCluster cannot change it, and CloudFormation leaves it unchanged too; to change it, replace the cluster, for example by changing its logical ID.");
 	}
-	async newNodePlacement(physicalId, properties, previousProperties) {
-		const desired = properties["PreferredAvailabilityZones"];
-		if (!Array.isArray(desired) || desired.length === 0) return void 0;
-		if (isDeepStrictEqual(desired, previousProperties["PreferredAvailabilityZones"]) && String(properties["NumCacheNodes"]) === String(previousProperties["NumCacheNodes"])) return;
-		const newAvailabilityZones = availabilityZonesNotCovered(desired, ((await this.describeCacheCluster(physicalId))?.CacheNodes ?? []).map((n) => n.CustomerAvailabilityZone).filter((az) => typeof az === "string"));
-		if (newAvailabilityZones.length === 0) return void 0;
+	async planNodeChanges(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const none = {
+			placement: void 0,
+			removeIds: []
+		};
+		const desiredZones = properties["PreferredAvailabilityZones"];
+		const zones = Array.isArray(desiredZones) && desiredZones.length > 0 ? desiredZones : void 0;
+		if (!(String(properties["NumCacheNodes"]) !== String(previousProperties["NumCacheNodes"])) && (zones === void 0 || isDeepStrictEqual(zones, previousProperties["PreferredAvailabilityZones"]))) return none;
+		if (zones === void 0 && !(Number(properties["NumCacheNodes"]) < Number(previousProperties["NumCacheNodes"]))) return none;
+		const liveNodes = ((await this.describeCacheCluster(physicalId))?.CacheNodes ?? []).map((n) => ({
+			id: n.CacheNodeId,
+			zone: n.CustomerAvailabilityZone
+		}));
+		const desiredCount = properties["NumCacheNodes"] != null ? Number(properties["NumCacheNodes"]) : void 0;
+		const previousCount = Number(previousProperties["NumCacheNodes"]);
+		const templateLowered = Number(properties["NumCacheNodes"]) < previousCount;
+		let removeIds = [];
+		if (templateLowered && desiredCount !== void 0 && desiredCount < liveNodes.length) {
+			if (liveNodes.length !== previousCount) throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: the template lowers NumCacheNodes from ${String(previousCount)} ` + safeMsg`to ${String(desiredCount)}, but the cluster has ${String(liveNodes.length)} nodes, so ` + "the removal would delete nodes the template change does not account for. Deploy NumCacheNodes set to the live count first, then lower it.", resourceType, logicalId, physicalId);
+			const plan = nodesToRemove(liveNodes, desiredCount, zones);
+			if (plan === void 0) {
+				const liveZones = liveNodes.map((n) => n.zone);
+				const disjoint = zones !== void 0 && !zones.some((z) => liveZones.includes(z));
+				throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: lowering NumCacheNodes to ${String(desiredCount)} ` + "with this PreferredAvailabilityZones list needs a node removed and a node added in a zone no live node occupies, in one update, which ModifyCacheCluster cannot do. " + (disjoint ? `CloudFormation replaces the cluster for a move to disjoint zones; cdkd does not yet (issue #5458). ` : "") + `Replace the cluster (for example by changing its logical ID), or list only zones the kept nodes occupy.`, resourceType, logicalId, physicalId);
+			}
+			removeIds = plan;
+			this.logger.info(safeMsg`CacheCluster ${logicalId}: NumCacheNodes ${String(previousProperties["NumCacheNodes"])} -> ${String(desiredCount)}, removing cache nodes ${removeIds.join(", ")}`);
+		}
+		const newAvailabilityZones = zones === void 0 || removeIds.length > 0 ? [] : availabilityZonesNotCovered(zones, liveNodes.filter((n) => n.id === void 0 || !removeIds.includes(n.id)).map((n) => n.zone).filter((z) => typeof z === "string"));
 		return {
-			newAvailabilityZones,
-			azMode: properties["AZMode"]
+			placement: newAvailabilityZones.length > 0 ? {
+				newAvailabilityZones,
+				azMode: properties["AZMode"]
+			} : void 0,
+			removeIds
 		};
 	}
 	warnNotAppliedInPlace(logicalId, properties, previousProperties, placement) {
@@ -33577,7 +33981,7 @@ var ElastiCacheProvider = class {
 			ShowCacheNodeInfo: true
 		}))).CacheClusters?.[0];
 	}
-	async waitForClusterAvailable(cacheClusterId, maxWaitMs = 6e5, expectedNodeType) {
+	async waitForClusterAvailable(cacheClusterId, maxWaitMs = 6e5, expectedNodeType, removedNodeIds = []) {
 		const startTime = Date.now();
 		let delay = 1e4;
 		while (Date.now() - startTime < maxWaitMs) {
@@ -33585,12 +33989,14 @@ var ElastiCacheProvider = class {
 			const status = cluster?.CacheClusterStatus;
 			this.logger.debug(`CacheCluster ${cacheClusterId} status: ${status}`);
 			const liveNodeType = cluster?.CacheNodeType;
-			if (status === "available" && (expectedNodeType === void 0 || liveNodeType === expectedNodeType)) return;
-			if (expectedNodeType !== void 0 && status === "available" && cluster?.PendingModifiedValues?.CacheNodeType === void 0 && Date.now() - startTime > NODE_TYPE_DROPPED_AFTER_MS) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is available with node type ${liveNodeType} and no node-type change pending; the change to ${expectedNodeType} was not applied. Check the cluster's events (aws elasticache describe-events) for the reason, then deploy again.`);
+			const removalDone = removedNodeIds.length === 0 || cluster?.CacheNodes !== void 0 && !cluster.CacheNodes.some((n) => n.CacheNodeId !== void 0 && removedNodeIds.includes(n.CacheNodeId));
+			if (status === "available" && removalDone && (expectedNodeType === void 0 || liveNodeType === expectedNodeType)) return;
+			if (!removalDone && status === "available" && (cluster?.PendingModifiedValues?.CacheNodeIdsToRemove ?? []).length === 0 && Date.now() - startTime > MODIFY_DROPPED_AFTER_MS) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is available and still lists cache nodes ${removedNodeIds.join(", ")} with no removal pending; the removal was not applied. Check the cluster's events (aws elasticache describe-events) for the reason, then deploy again.`);
+			if (expectedNodeType !== void 0 && liveNodeType !== expectedNodeType && status === "available" && cluster?.PendingModifiedValues?.CacheNodeType === void 0 && Date.now() - startTime > MODIFY_DROPPED_AFTER_MS) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is available with node type ${liveNodeType} and no node-type change pending; the change to ${expectedNodeType} was not applied. Check the cluster's events (aws elasticache describe-events) for the reason, then deploy again.`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
-		throw new Error(expectedNodeType === void 0 ? `Timed out waiting for CacheCluster ${cacheClusterId} to become available` : safeMsg`Timed out waiting for CacheCluster ${cacheClusterId} to become available with node type ${expectedNodeType}`);
+		throw new Error(expectedNodeType === void 0 && removedNodeIds.length === 0 ? `Timed out waiting for CacheCluster ${cacheClusterId} to become available` : safeMsg`Timed out waiting for CacheCluster ${cacheClusterId} to become available` + (expectedNodeType === void 0 ? "" : safeMsg` with node type ${expectedNodeType}`) + (removedNodeIds.length === 0 ? "" : safeMsg` without cache nodes ${removedNodeIds.join(", ")}`));
 	}
 	async waitForClusterDeleted(logicalId, cacheClusterId, maxWaitMs = 6e5) {
 		const startTime = Date.now();
@@ -40052,6 +40458,7 @@ function previousMetricNames(value) {
 	const expanded = expandShardLevelMetrics(value);
 	return isUsableMetricsList(expanded) ? expanded : [];
 }
+const DEFAULT_MAX_RECORD_SIZE_KIB = 1024;
 function readMaxRecordSize(value, mask) {
 	if (value == null) return { kind: "absent" };
 	if (typeof value === "number" && Number.isFinite(value)) return {
@@ -40317,10 +40724,10 @@ var KinesisStreamProvider = class {
 			}
 			const desiredSizeRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"], mask);
 			if (desiredSizeRead.kind === "unusable") warn(`${desiredSizeRead.reason}. Leaving the maximum record size on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
-			const newMaxRecordSize = comparableRecordSize(properties["MaxRecordSizeInKiB"], mask);
-			const oldMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"], mask);
-			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== oldMaxRecordSize) {
-				this.logger.debug(`Updating max record size for ${physicalId}: from ${oldMaxRecordSize ?? "no value"} to ${newMaxRecordSize}`);
+			const newMaxRecordSize = desiredSizeRead.kind === "absent" ? DEFAULT_MAX_RECORD_SIZE_KIB : comparableRecordSize(properties["MaxRecordSizeInKiB"], mask);
+			const recordedMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"], mask);
+			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== (recordedMaxRecordSize ?? DEFAULT_MAX_RECORD_SIZE_KIB)) {
+				this.logger.debug(`Updating max record size for ${physicalId}: from ${recordedMaxRecordSize ?? "no value"} to ${newMaxRecordSize}`);
 				await this.getClient().send(new UpdateMaxRecordSizeCommand({
 					StreamARN: await this.resolveStreamArn(physicalId),
 					MaxRecordSizeInKiB: newMaxRecordSize
@@ -43227,6 +43634,7 @@ var FSxFileSystemProvider = class {
 			const nextVal = next[key];
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
+			if (configKey === "OpenZFSConfiguration" && key === "Options") continue;
 			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 			if (nextVal === void 0 && key !== "RouteTableIds") {
 				leftInPlace.push(key);
@@ -43394,10 +43802,14 @@ var FSxFileSystemProvider = class {
 			TagKeys: toRemove
 		}));
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting FSx FileSystem ${logicalId}: ${physicalId}`);
 		try {
-			await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: physicalId }));
+			const openZfsOptions = this.toDeleteOpenZFSOptions(properties);
+			await this.getClient().send(new DeleteFileSystemCommand$1({
+				FileSystemId: physicalId,
+				...openZfsOptions && { OpenZFSConfiguration: { Options: openZfsOptions } }
+			}));
 		} catch (error) {
 			if (error instanceof FileSystemNotFound$1) {
 				const clientRegion = await this.getClient().config.region();
@@ -43413,6 +43825,14 @@ var FSxFileSystemProvider = class {
 		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType, context?.maskSecrets);
 		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
 	}
+	toDeleteOpenZFSOptions(properties) {
+		if (properties?.["FileSystemType"] !== "OPENZFS") return void 0;
+		const config = properties["OpenZFSConfiguration"];
+		if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
+		const options = config["Options"];
+		if (!Array.isArray(options) || options.length === 0) return void 0;
+		return options.map((o) => String(o));
+	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
 		if (resourceType !== "AWS::FSx::FileSystem") return "unknown";
 		if (!FILE_SYSTEM_ID_PATTERN.test(journaledPhysicalId) || !FILE_SYSTEM_ID_PATTERN.test(record.physicalId)) return "unknown";
@@ -43675,7 +44095,8 @@ var FSxFileSystemProvider = class {
 			"BackupId",
 			"WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password",
 			"OntapConfiguration.FsxAdminPassword",
-			"OpenZFSConfiguration.RootVolumeConfiguration"
+			"OpenZFSConfiguration.RootVolumeConfiguration",
+			"OpenZFSConfiguration.Options"
 		];
 	}
 	getDriftUnorderedPaths(resourceType) {
@@ -46916,6 +47337,7 @@ var CloudTrailProvider = class {
 //#endregion
 //#region src/provisioning/providers/codebuild-provider.ts
 const DEFAULT_PROJECT_VISIBILITY = "PRIVATE";
+const DEFAULT_ENCRYPTION_KEY = "alias/aws/s3";
 function readVisibility(properties, mask) {
 	const visibility = properties["Visibility"];
 	const role = properties["ResourceAccessRole"];
@@ -47194,6 +47616,9 @@ var CodeBuildProvider = class {
 			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
+			const declaredKey = (value) => value != null && value !== "";
+			if (!declaredKey(properties["EncryptionKey"]) && declaredKey(previousProperties["EncryptionKey"])) input.encryptionKey = DEFAULT_ENCRYPTION_KEY;
+			if (properties["Tags"] == null && previousProperties["Tags"] != null) input.tags = [];
 			const updated = await this.getClient().send(new UpdateProjectCommand(input));
 			const desiredVisibility = readVisibility(properties, mask);
 			const recorded = readVisibility(previousProperties, mask);
@@ -50595,4 +51020,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-d9K3vBVh.js.map
+//# sourceMappingURL=provider-classes-BxfIHcea.js.map