@go-to-k/cdkd 0.308.1 → 0.309.0

package/dist/{provider-classes-BxfIHcea.js → provider-classes-DYke4HKr.js}

@@ -2,13 +2,13 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
 import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbWaitStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-D94wh05t.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $c as recordAttributeIdCopy, $s as blockDeviceMappingsDifferOnlyInDeleteOnTermination, $t as lookupEachName, A as beginDeleteWait, Ai as refuseMalformedDesiredTags, An as REDACTED_DELETE_ADDRESS_SKIP_REASON, B as waitForIndexesSettled, Bi as waitForLambdaFunctionActive, Bl as timePhase, Bs as coerceCfnInteger, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cc as redactForState, Cs as findSilentDropProperties, D as reverseMapTableContributorInsights, Da as outputReferenceProvenanceOf, Di as DBPROXY_TAG_OPTIONS, E as reverseMapIndexContributorInsights, Ei as DBPROXY_TAGS_WHAT, Er as getStackRecords, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fs as coerceWarmThroughput$1, G as sendTtlWaitingOutRateLimit, Gs as replayWarn, H as isTtlRateLimited, Hc as withoutPhysicalNameCopies, Hs as configIntegerRefusal, I as INDEX_SETTLE_POLL_INTERVAL_MS, Is as isWarmThroughputDecrease, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Jl as rewriteTemplateAssetReferences, Js as requireConfigString, K as ECR_AUTO_DELETE_IMAGES_TAG, Ks as requireConfigArray, L as deleteTableWithIndexBusyRetry, Ls as toCfnInteger, M as deleteBudgetKey, Mi as tagPlanWarning, Mn as redactedDeleteAddressFields, N as resolveDynamoDbDeleteBudgetClock, Ni as definedAttributes, Nn as redactedDeleteAddressSkip, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oc as hasMaskableValues, Oi as planTagDiff, On as getCurrentProducerRegions, Or as replacedDeleteFailureVerdict, P as resolveDynamoDbDeleteBudgetMs, Pi as stringifyIfAssigned, Ps as WARM_THROUGHPUT_MEMBERS, Qc as physicalNameCopiesOf, Qi as unchangedBehindSecretReference, Qs as withRetry, Qt as isAccessDeniedError, R as maskedLogger, Rs as toFiniteNumber, S as indexDeclaresContributorInsights, Sa as s3BucketWebsiteUrl, Sc as markSameGenerationBag, T as readContributorInsightsSpec, Tc as snapshotPassProvenance, Ti as markDeleteStarted, Ts as withoutSilentDropProperties, U as planTimeToLive, Ul as stringifyValue, Uo as refuseMalformedNestedChildOutputs, Us as configStringRefusal, V as isTtlAlreadyDisabled, Vs as configBooleanRefusal, Vt as withNestedStackContext, W as readTtlSpec, Wc as dynamicReferenceTokens, Wi as getCurrentResourceSecrets, Ws as readConfigString, X as getPriorAttempts, Xi as slowCcOperationTimeoutMs, Xu as canonicalizeRegion, Y as isTruthyCfnBoolean, Z as markRefusedBeforeApplying, Zc as recoverMaskedOutput, Zi as onlySecretReferencesDiffer, Zt as chunks, Zu as derivePartitionAndUrlSuffix, _ as streamMemberRefusals, _a as isSettledInstanceState, aa as isWaitAbandonedError, b as CONTRIBUTOR_INSIGHTS_KEY, ba as s3BucketDualStackDomainName, bi as acquireIdempotencyToken, c as DynamoDBGlobalTableProvider, ca as ec2InstanceProtectionSite, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as reDisableInstanceApiTermination, dd as displayAssemblyPath, ec as ecsServiceLaunchTypeSetOrChanged, en as withApiLimit, f as declaredStreamTagsMember, fa as reEnableInstanceApiTermination, fd as renderAssemblyPathEscape, g as streamDeclaresTags, gc as passedNoEchoParametersOf, gi as earliestDefined, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ht as enclosingDeadlineExpired, ia as withIndeterminateGuard, ic as sameLambdaFunctionAddress, io as parseWebACLArn, j as compensateRemovedDeletionProtection, ji as tagMapAsList, jn as isRedactedRecordedValue, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ki as readTagList, l as STREAM_POLICY_KEY, la as isTerminationProtectionPropagationError, ls as refuseMalformedResourcesForDestroy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, mo as accountArgs, nc as canonicalLambdaFunctionName, nl as carriesSecretMask, oa as markWaitAbandoned, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pd as resolveAssemblyPath, q as S3_AUTO_DELETE_OBJECTS_TAG, qa as getAccountInfo, qs as requireConfigObject, qu as decodeListingKey, ra as deleteSkipReason, rc as lambdaFunctionNameForMask, ri as secretNamedAttributeNamesOf, so as passedParameterClassesOf, st as isAbsoluteAssetPath, t as DeployEngine, tc as emrClusterInstancesReplaced, u as STREAM_TAGS_KEY, ua as observeThenDisableInstanceApiTermination, ud as describeFileReadFailure, v as streamPolicyMatchesDeclared, va as s3BucketArn, vi as reserveStackCreateToken, w as planIndexContributorInsightsOps, wc as recordReferenceProvenanceEntry, wi as isRefusedByName, wr as awaitInFlightSibling, x as contributorInsightsRefusals, xa as s3BucketRegionalDomainName, xs as withheldAccountClause, y as streamTagsMatchDeclared, ya as s3BucketDomainName, z as relayedIndexBusyDelete, zs as coerceCfnBoolean } from "./deploy-engine-CDjAtIrn.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DbtvFel_.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Ymf7svYk.js";
+import { $l as stringifyValue, $s as readConfigString, $t as lookupEachName, A as beginDeleteWait, Aa as s3BucketRegionalDomainName, Ai as isRefusedByName, Ar as awaitInFlightSibling, As as withheldAccountClause, B as waitForIndexesSettled, Bi as stringifyIfAssigned, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cd as resolveAssemblyPath, Co as accountArgs, D as reverseMapTableContributorInsights, Da as s3BucketArn, E as reverseMapIndexContributorInsights, Ea as isSettledInstanceState, Ec as passedNoEchoParametersOf, Ei as acquireIdempotencyToken, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fc as snapshotPassProvenance, Fi as readTagList, G as sendTtlWaitingOutRateLimit, Gs as isWarmThroughputDecrease, H as isTtlRateLimited, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as outputReferenceProvenanceOf, Ii as refuseMalformedDesiredTags, In as REDACTED_DELETE_ADDRESS_SKIP_REASON, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Js as coerceCfnBoolean, K as ECR_AUTO_DELETE_IMAGES_TAG, Ki as waitForLambdaFunctionActive, Ks as toCfnInteger, L as deleteTableWithIndexBusyRetry, Li as tagMapAsList, Ln as isRedactedRecordedValue, M as deleteBudgetKey, Mc as markSameGenerationBag, Mi as DBPROXY_TAGS_WHAT, Mr as getStackRecords, Ms as findSilentDropProperties, N as resolveDynamoDbDeleteBudgetClock, Nc as redactForState, Ni as DBPROXY_TAG_OPTIONS, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oa as s3BucketDomainName, P as resolveDynamoDbDeleteBudgetMs, Pc as recordReferenceProvenanceEntry, Pi as planTagDiff, Pn as getCurrentProducerRegions, Pr as replacedDeleteFailureVerdict, Ps as withoutSilentDropProperties, Qc as withoutPhysicalNameCopies, Qo as refuseMalformedNestedChildOutputs, Qs as configStringRefusal, Qt as isAccessDeniedError, R as maskedLogger, Rc as hasMaskableValues, Ri as tagPlanWarning, Rn as redactedDeleteAddressFields, S as indexDeclaresContributorInsights, Sd as renderAssemblyPathEscape, Si as earliestDefined, T as readContributorInsightsSpec, U as planTimeToLive, Us as WARM_THROUGHPUT_MEMBERS, V as isTtlAlreadyDisabled, Vt as withNestedStackContext, W as readTtlSpec, Ws as coerceWarmThroughput$1, X as getPriorAttempts, Xi as getCurrentResourceSecrets, Xl as timePhase, Xs as configBooleanRefusal, Y as isTruthyCfnBoolean, Ys as coerceCfnInteger, Z as markRefusedBeforeApplying, Zs as configIntegerRefusal, Zt as chunks, _ as streamMemberRefusals, _a as reDisableInstanceApiTermination, b as CONTRIBUTOR_INSIGHTS_KEY, bd as describeFileReadFailure, c as DynamoDBGlobalTableProvider, cc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, cl as physicalNameCopiesOf, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as isWaitAbandonedError, dc as emrClusterInstancesReplaced, ec as replayWarn, el as dynamicReferenceTokens, en as withApiLimit, f as declaredStreamTagsMember, fa as markWaitAbandoned, fc as canonicalLambdaFunctionName, fl as carriesSecretMask, g as streamDeclaresTags, ga as observeThenDisableInstanceApiTermination, go as passedParameterClassesOf, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ha as isTerminationProtectionPropagationError, ht as enclosingDeadlineExpired, ia as unchangedBehindSecretReference, iu as rewriteTemplateAssetReferences, j as compensateRemovedDeletionProtection, ja as s3BucketWebsiteUrl, ji as markDeleteStarted, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as s3BucketDualStackDomainName, l as STREAM_POLICY_KEY, la as deleteSkipReason, li as secretNamedAttributeNamesOf, ll as recordAttributeIdCopy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as ec2InstanceProtectionSite, mc as sameLambdaFunctionAddress, na as slowCcOperationTimeoutMs, nc as requireConfigObject, no as getAccountInfo, od as canonicalizeRegion, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pc as lambdaFunctionNameForMask, po as parseWebACLArn, q as S3_AUTO_DELETE_OBJECTS_TAG, qs as toFiniteNumber, ra as onlySecretReferencesDiffer, rc as requireConfigString, rd as decodeListingKey, sc as withRetry, sd as derivePartitionAndUrlSuffix, sl as recoverMaskedOutput, st as isAbsoluteAssetPath, t as DeployEngine, tc as requireConfigArray, u as STREAM_TAGS_KEY, ua as withIndeterminateGuard, uc as ecsServiceLaunchTypeSetOrChanged, v as streamPolicyMatchesDeclared, va as reEnableInstanceApiTermination, vs as refuseMalformedResourcesForDestroy, w as planIndexContributorInsightsOps, wi as reserveStackCreateToken, x as contributorInsightsRefusals, xd as displayAssemblyPath, y as streamTagsMatchDeclared, z as relayedIndexBusyDelete, zi as definedAttributes, zn as redactedDeleteAddressSkip } from "./deploy-engine-tQ0aqZMo.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BI8Acvps.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Bnt3Yt0k.js";
 import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-BUG7NMWS.js";
-import { RDSProvider } from "./rds-provider-CZhBLQgJ.js";
-import { NeptuneProvider } from "./neptune-provider-Y3Ii8oYI.js";
-import { ASGProvider } from "./asg-provider-B7pAjRIc.js";
+import { RDSProvider } from "./rds-provider-Qpf09VQv.js";
+import { NeptuneProvider } from "./neptune-provider-DmVmx69p.js";
+import { ASGProvider } from "./asg-provider-DQoKGfKH.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -53,17 +53,17 @@ import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSu
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$22, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$23, UpdatePipeCommand } from "@aws-sdk/client-pipes";
-import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
-import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteFileSystemPolicyCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3vectors";
-import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3vectors";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3-control";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -7924,6 +7924,13 @@ function inlineCodeFileNameForRuntime(runtime) {
 	if (runtime?.startsWith("python")) return "index.py";
 	return "index.js";
 }
+const SEPARATELY_APPLIED_KEYS = /* @__PURE__ */ new Set([
+	"Tags",
+	"ReservedConcurrentExecutions",
+	"RecursiveLoop",
+	"CodeSigningConfigArn",
+	"RuntimeManagementConfig"
+]);
 var LambdaFunctionProvider = class {
 	lambdaClient;
 	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
@@ -8168,6 +8175,7 @@ var LambdaFunctionProvider = class {
 		}));
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const log = lambdaOperationSinks(this.logger, context?.maskSecrets, [[physicalId, physicalId], [previousProperties["FunctionName"], physicalId]], properties);
 		const operationMask = log.mask;
@@ -8195,12 +8203,9 @@ var LambdaFunctionProvider = class {
 				"LoggingConfig",
 				"DurableConfig"
 			];
-			let hasConfigChanges = false;
-			for (const field of configFields) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) {
-				hasConfigChanges = true;
-				break;
-			}
-			if (hasConfigChanges) {
+			const changedConfigFields = [];
+			for (const field of configFields) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) changedConfigFields.push(field);
+			if (changedConfigFields.length > 0) {
 				const configParams = {
 					FunctionName: physicalId,
 					Role: properties["Role"],
@@ -8222,6 +8227,7 @@ var LambdaFunctionProvider = class {
 					LoggingConfig: properties["LoggingConfig"],
 					DurableConfig: properties["DurableConfig"]
 				};
+				for (const field of changedConfigFields) markUnsettled(field);
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand(configParams));
 				log.debug(`Updated configuration for Lambda function ${log.value(physicalId)}`);
 				await this.waitForFunctionUpdated(logicalId, resourceType, physicalId, log);
@@ -8229,6 +8235,7 @@ var LambdaFunctionProvider = class {
 			const newCodeSigningConfigArn = properties["CodeSigningConfigArn"];
 			const codeSigningChanged = newCodeSigningConfigArn !== previousProperties["CodeSigningConfigArn"];
 			if (codeSigningChanged && newCodeSigningConfigArn === void 0) {
+				markUnsettled("CodeSigningConfigArn");
 				await this.lambdaClient.send(new DeleteFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
 				log.debug(`Detached CodeSigningConfigArn from Lambda function ${log.value(physicalId)} (template removed the property)`);
 			}
@@ -8249,6 +8256,8 @@ var LambdaFunctionProvider = class {
 					ImageUri: builtCode.ImageUri,
 					Architectures: architecturesChanged ? normalizeArchitectures(properties["Architectures"]) : void 0
 				};
+				markUnsettled("Code");
+				if (architecturesChanged) markUnsettled("Architectures");
 				await this.lambdaClient.send(new UpdateFunctionCodeCommand(codeParams));
 				log.debug(`Updated code for Lambda function ${log.value(physicalId)}`);
 				await this.waitForFunctionUpdated(logicalId, resourceType, physicalId, log);
@@ -8256,6 +8265,7 @@ var LambdaFunctionProvider = class {
 			const newRecursiveLoop = properties["RecursiveLoop"];
 			const prevRecursiveLoop = previousProperties["RecursiveLoop"];
 			if (newRecursiveLoop !== void 0 && newRecursiveLoop !== prevRecursiveLoop) {
+				markUnsettled("RecursiveLoop");
 				await this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 					FunctionName: physicalId,
 					RecursiveLoop: newRecursiveLoop
@@ -8264,6 +8274,7 @@ var LambdaFunctionProvider = class {
 			}
 			const newReservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
 			if (newReservedConcurrentExecutions !== previousProperties["ReservedConcurrentExecutions"]) {
+				markUnsettled("ReservedConcurrentExecutions");
 				if (newReservedConcurrentExecutions === void 0) {
 					await this.lambdaClient.send(new DeleteFunctionConcurrencyCommand({ FunctionName: physicalId }));
 					log.debug(`Cleared ReservedConcurrentExecutions for Lambda function ${log.value(physicalId)} (template removed the property)`);
@@ -8276,6 +8287,7 @@ var LambdaFunctionProvider = class {
 				}
 			}
 			if (codeSigningChanged && newCodeSigningConfigArn !== void 0) {
+				markUnsettled("CodeSigningConfigArn");
 				await this.lambdaClient.send(new PutFunctionCodeSigningConfigCommand({
 					FunctionName: physicalId,
 					CodeSigningConfigArn: newCodeSigningConfigArn
@@ -8285,12 +8297,16 @@ var LambdaFunctionProvider = class {
 			const newRuntimeManagementConfig = properties["RuntimeManagementConfig"];
 			const prevRuntimeManagementConfig = previousProperties["RuntimeManagementConfig"];
 			if (newRuntimeManagementConfig?.["UpdateRuntimeOn"] !== prevRuntimeManagementConfig?.["UpdateRuntimeOn"] || newRuntimeManagementConfig?.["RuntimeVersionArn"] !== prevRuntimeManagementConfig?.["RuntimeVersionArn"]) {
+				markUnsettled("RuntimeManagementConfig");
 				await this.putRuntimeManagementConfig(physicalId, newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" });
 				log.debug(`Updated RuntimeManagementConfig for Lambda function ${log.value(physicalId)} to ${JSON.stringify(maskDeep(newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" }, operationMask))}`);
 			}
 			const getResponse = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
 			const functionArn = getResponse.Configuration?.FunctionArn;
-			await this.applyTagDiff(functionArn, physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
+			await this.applyTagDiff(functionArn, physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log, {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -8377,13 +8393,17 @@ var LambdaFunctionProvider = class {
 		const subnets = raw["SubnetIds"];
 		return Array.isArray(subnets) && subnets.length > 0;
 	}
-	async applyTagDiff(functionArn, functionName, resourceType, logicalId, oldTagsRaw, newTagsRaw, log) {
+	async applyTagDiff(functionArn, functionName, resourceType, logicalId, oldTagsRaw, newTagsRaw, log, unsettled = {
+		forceUpsert: false,
+		beforeWrite: () => void 0
+	}) {
 		if (!functionArn) return;
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) log.warn(tagWarning);
-		const tagsToAdd = Object.fromEntries(plan.set);
+		const tagsToAdd = Object.fromEntries(unsettled.forceUpsert ? planTagDiff(void 0, newTagsRaw).set : plan.set);
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || Object.keys(tagsToAdd).length > 0) unsettled.beforeWrite();
 		if (tagsToRemove.length > 0) {
 			await this.lambdaClient.send(new UntagResourceCommand$1({
 				Resource: functionArn,
@@ -8623,6 +8643,43 @@ var LambdaFunctionProvider = class {
 			throw err;
 		}
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, names) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		const strict = async (read) => {
+			try {
+				return await read();
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException) return void 0;
+				throw error;
+			}
+		};
+		const set = (key, value) => {
+			if (value === void 0) delete out[key];
+			else out[key] = value;
+		};
+		if (names.has("ReservedConcurrentExecutions")) set("ReservedConcurrentExecutions", (await strict(() => this.lambdaClient.send(new GetFunctionConcurrencyCommand({ FunctionName: physicalId }))))?.ReservedConcurrentExecutions);
+		if (names.has("RecursiveLoop")) set("RecursiveLoop", (await strict(() => this.lambdaClient.send(new GetFunctionRecursionConfigCommand({ FunctionName: physicalId }))))?.RecursiveLoop);
+		if (names.has("RuntimeManagementConfig")) {
+			const r = await strict(() => this.lambdaClient.send(new GetRuntimeManagementConfigCommand({ FunctionName: physicalId })));
+			set("RuntimeManagementConfig", r?.UpdateRuntimeOn === void 0 ? void 0 : {
+				UpdateRuntimeOn: r.UpdateRuntimeOn,
+				...r.RuntimeVersionArn !== void 0 && { RuntimeVersionArn: r.RuntimeVersionArn }
+			});
+		}
+		if (names.has("CodeSigningConfigArn")) set("CodeSigningConfigArn", (await strict(() => this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }))))?.CodeSigningConfigArn);
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const cfg = (await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }))).Configuration;
+			if (cfg?.State !== "Pending" && cfg?.LastUpdateStatus !== "InProgress") return /* @__PURE__ */ new Set();
+			return new Set([...names].filter((name) => !SEPARATELY_APPLIED_KEYS.has(name)));
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		try {
 			const resp = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
@@ -12267,6 +12324,7 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		const maskSecrets = context?.maskSecrets ?? ((text) => text);
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
@@ -12310,7 +12368,10 @@ var DynamoDBTableProvider = class {
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
 			let latestStreamArn = table?.LatestStreamArn;
-			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
 			const liveBillingMode = table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
@@ -12369,6 +12430,7 @@ var DynamoDBTableProvider = class {
 					warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.map((n) => maskSecrets(n)).join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
 				} else if (removable.length > 0) {
 					debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
+					markUnsettled("GlobalSecondaryIndexes");
 					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0, maskSecrets);
 					for (const name of removable) preFlipDeletedIndexNames.add(name);
 				}
@@ -12415,6 +12477,10 @@ var DynamoDBTableProvider = class {
 					if (indexUpdates.length > 0) updateInput.GlobalSecondaryIndexUpdates = indexUpdates;
 					if (unspecified.length > 0) warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.map((n) => maskSecrets(n)).join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically, so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
 				}
+				if (billingMode !== prevBillingMode) markUnsettled("BillingMode");
+				if (JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"])) markUnsettled("ProvisionedThroughput");
+				if (tableClassChanged) markUnsettled("TableClass");
+				if (updateInput.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
 				else await this.waitForTableActiveAfterUpdate(physicalId, 60);
@@ -12425,6 +12491,7 @@ var DynamoDBTableProvider = class {
 				if (properties["OnDemandThroughput"] || ceilingRemovals.length > 0) {
 					const declaredForSend = properties["OnDemandThroughput"] ? this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets) : {};
 					if (ceilingRemovals.length > 0) debug(`AWS::DynamoDB::Table ${logicalId}: removing the OnDemandThroughput ${ceilingRemovals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET}, DynamoDB's reset sentinel)`);
+					markUnsettled("OnDemandThroughput");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						OnDemandThroughput: withOnDemandCeilingRemovals(declaredForSend, ceilingRemovals)
@@ -12437,6 +12504,7 @@ var DynamoDBTableProvider = class {
 				this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 				const warmThroughputToSend = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 				if (warmThroughputToSend !== void 0 && !this.skipWarmThroughputDecrease(logicalId, physicalId, warmThroughputToSend, table?.WarmThroughput, maskSecrets)) {
+					markUnsettled("WarmThroughput");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						WarmThroughput: warmThroughputToSend
@@ -12452,6 +12520,7 @@ var DynamoDBTableProvider = class {
 				if (liveSseStatus === "UPDATING" || liveSseStatus === "ENABLING" || liveSseStatus === "DISABLING") liveTable = await this.waitForTableSseSettled(physicalId, maskSecrets);
 				const sseUpdate = sseSpecificationToSend(properties["SSESpecification"], previousProperties["SSESpecification"], liveTable?.SSEDescription, liveTable !== void 0);
 				if (sseUpdate !== void 0) {
+					markUnsettled("SSESpecification");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						SSESpecification: sseUpdate
@@ -12465,6 +12534,7 @@ var DynamoDBTableProvider = class {
 				const desiredDeletionProtection = rawDeletionProtection === void 0 ? false : coerceCfnBoolean(rawDeletionProtection);
 				if (desiredDeletionProtection === void 0) warn(`AWS::DynamoDB::Table ${logicalId}: DeletionProtectionEnabled is not a boolean, so it was not applied`);
 				else if (table?.DeletionProtectionEnabled !== desiredDeletionProtection) {
+					markUnsettled("DeletionProtectionEnabled");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						DeletionProtectionEnabled: desiredDeletionProtection
@@ -12474,6 +12544,7 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
+				markUnsettled("StreamSpecification");
 				const newViewType = this.extractStreamViewType(properties["StreamSpecification"]);
 				const prevViewType = this.extractStreamViewType(previousProperties["StreamSpecification"]);
 				const liveStream = table?.StreamSpecification;
@@ -12521,10 +12592,18 @@ var DynamoDBTableProvider = class {
 				}
 				if (newViewType) await this.applyStreamMembers(logicalId, resourceType, physicalId, latestStreamArn, properties["StreamSpecification"], previousProperties["StreamSpecification"], mintedStream, maskSecrets, mintedStream ? preUpdateStreamArn : void 0, contentsUnknown);
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
-			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
+			if (context?.unsettledProperties?.has("GlobalSecondaryIndexes") === true && currentLiveIndexNames !== void 0) this.warnUndeclaredLiveIndexes(physicalId, currentLiveIndexNames, [previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"]], maskSecrets);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) {
+				markUnsettled("GlobalSecondaryIndexes");
+				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
+			}
+			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) {
+				markUnsettled("PointInTimeRecoverySpecification");
+				await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
+			}
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
+				markUnsettled("TimeToLiveSpecification");
 				await this.applyTimeToLive(physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"], "update", {
 					logicalId,
 					resourceType,
@@ -12533,11 +12612,18 @@ var DynamoDBTableProvider = class {
 			}
 			if (JSON.stringify(properties["ResourcePolicy"]) !== JSON.stringify(previousProperties["ResourcePolicy"])) {
 				if (!table?.TableArn) throw new ProvisioningError(`Cannot apply ResourcePolicy change for DynamoDB table ${logicalId}: DescribeTable returned no TableArn`, resourceType, logicalId, physicalId);
+				markUnsettled("ResourcePolicy");
 				await this.applyResourcePolicy(table.TableArn, properties["ResourcePolicy"], previousProperties["ResourcePolicy"]);
 			}
-			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
-			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
-			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets);
+			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) {
+				markUnsettled("KinesisStreamSpecification");
+				await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
+			}
+			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) {
+				markUnsettled("ContributorInsightsSpecification");
+				await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
+			}
+			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets, () => markUnsettled("GlobalSecondaryIndexes"));
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -12675,15 +12761,19 @@ var DynamoDBTableProvider = class {
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
-	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, unsettled = {
+		forceUpsert: false,
+		beforeWrite: () => void 0
+	}) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
-		const tagsToAdd = [...plan.set].map(([k, v]) => ({
+		const tagsToAdd = [...unsettled.forceUpsert ? planTagDiff(void 0, newTagsRaw).set : plan.set].map(([k, v]) => ({
 			Key: k,
 			Value: v
 		}));
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || tagsToAdd.length > 0) unsettled.beforeWrite();
 		if (tagsToRemove.length > 0) {
 			await this.dynamoDBClient.send(new UntagResourceCommand$2({
 				ResourceArn: tableArn,
@@ -12996,12 +13086,15 @@ var DynamoDBTableProvider = class {
 		if (op === void 0) return;
 		await this.sendContributorInsightsOp(tableName, op, maskSecrets);
 	}
-	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets) {
+	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets, beforeSend = () => void 0) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
 		if (ops.length === 0) return;
 		await this.waitForTableAndIndexesActive(tableName);
-		for (const op of ops) await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+		for (const op of ops) {
+			beforeSend();
+			await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+		}
 	}
 	async sendContributorInsightsOp(tableName, op, maskSecrets) {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
@@ -13153,6 +13246,21 @@ var DynamoDBTableProvider = class {
 	indexScope(indexName, logicalId, maskSecrets) {
 		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
 	}
+	warnUndeclaredLiveIndexes(physicalId, liveIndexNames, lists, maskSecrets) {
+		const named = /* @__PURE__ */ new Set();
+		for (const list of lists) {
+			if (!Array.isArray(list)) continue;
+			for (const entry of list) {
+				const name = typeof entry === "object" && entry !== null ? entry["IndexName"] : void 0;
+				if (typeof name === "string") named.add(name);
+			}
+		}
+		for (const name of liveIndexNames) {
+			if (named.has(name)) continue;
+			const secretDerived = maskSecrets(name) !== name || maskSecrets(physicalId) !== physicalId;
+			this.logger.warn(maskSecrets(`${this.indexScopeAt(name, physicalId, maskSecrets)} is live, but neither cdkd's record nor the template declares it, so cdkd left it in place while converging the unsettled GlobalSecondaryIndexes (CloudFormation never deletes an index it did not record). It may belong to another tool, or an earlier failed cdkd update may have created it; cdkd cannot tell which. If it should not exist, delete it ` + (secretDerived ? `with an UpdateTable GlobalSecondaryIndexUpdates Delete for the index.` : `with: aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"${name}"}}]' (in the table's region)`)));
+		}
+	}
 	indexScopeAt(indexName, physicalId, maskSecrets) {
 		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${physicalId}`;
 	}
@@ -13439,6 +13547,62 @@ var DynamoDBTableProvider = class {
 			aws
 		};
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		if (out["BillingMode"] === "PAY_PER_REQUEST") delete out["ProvisionedThroughput"];
+		if (names.has("GlobalSecondaryIndexes")) {
+			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"]);
+			if (out["GlobalSecondaryIndexes"] === void 0) delete out["GlobalSecondaryIndexes"];
+		}
+		const strict = async (key, read) => {
+			if (!names.has(key)) return;
+			const value = await read();
+			if (value === void 0) delete out[key];
+			else out[key] = value;
+		};
+		await strict("PointInTimeRecoverySpecification", () => this.readPointInTimeRecovery(physicalId, true));
+		await strict("TimeToLiveSpecification", () => this.readTimeToLive(physicalId, true));
+		await strict("KinesisStreamSpecification", () => this.readKinesisStreamSpecification(physicalId, true));
+		await strict("ContributorInsightsSpecification", () => this.readTableContributorInsights(physicalId, true));
+		if (names.has("ResourcePolicy")) {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			if (!table?.TableArn) throw new ProvisioningError(`DescribeTable returned no TableArn for the table, which reading its unsettled ResourcePolicy needs`, resourceType, logicalId, physicalId);
+			const tableArn = table.TableArn;
+			await strict("ResourcePolicy", () => this.readTableResourcePolicy(physicalId, tableArn, true));
+		}
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		const SEPARATE = /* @__PURE__ */ new Set([
+			"Tags",
+			"PointInTimeRecoverySpecification",
+			"TimeToLiveSpecification",
+			"ResourcePolicy",
+			"KinesisStreamSpecification",
+			"ContributorInsightsSpecification"
+		]);
+		try {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			const moving = /* @__PURE__ */ new Set();
+			if (table?.TableStatus === "CREATING" || table?.TableStatus === "UPDATING" || table?.TableStatus === "DELETING") {
+				for (const name of names) if (!SEPARATE.has(name)) moving.add(name);
+			}
+			if (names.has("GlobalSecondaryIndexes") && (table?.GlobalSecondaryIndexes ?? []).some((index) => index.IndexStatus === "CREATING" || index.IndexStatus === "UPDATING" || index.IndexStatus === "DELETING")) moving.add("GlobalSecondaryIndexes");
+			const sse = table?.SSEDescription?.Status;
+			if (names.has("SSESpecification") && (sse === "ENABLING" || sse === "DISABLING" || sse === "UPDATING")) moving.add("SSESpecification");
+			if (names.has("TimeToLiveSpecification")) {
+				if ((await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription?.TimeToLiveStatus === "ENABLING") moving.add("TimeToLiveSpecification");
+			}
+			if (names.has("KinesisStreamSpecification")) {
+				if (((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).some((d) => d.DestinationStatus === "ENABLING" || d.DestinationStatus === "DISABLING" || d.DestinationStatus === "UPDATING")) moving.add("KinesisStreamSpecification");
+			}
+			return moving;
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
@@ -13521,7 +13685,7 @@ var DynamoDBTableProvider = class {
 			throw err;
 		}
 	}
-	async readPointInTimeRecovery(physicalId) {
+	async readPointInTimeRecovery(physicalId, strict = false) {
 		try {
 			const pitrDesc = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: physicalId }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
 			const pitrStatus = pitrDesc?.PointInTimeRecoveryStatus;
@@ -13530,11 +13694,12 @@ var DynamoDBTableProvider = class {
 			if (pitrStatus === "ENABLED" && pitrDesc?.RecoveryPeriodInDays !== void 0) pitr["RecoveryPeriodInDays"] = pitrDesc.RecoveryPeriodInDays;
 			return pitr;
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readTimeToLive(physicalId) {
+	async readTimeToLive(physicalId, strict = false) {
 		try {
 			const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
 			if (ttlDesc?.TimeToLiveStatus === "ENABLED" && ttlDesc.AttributeName) return {
@@ -13543,11 +13708,12 @@ var DynamoDBTableProvider = class {
 			};
 			return;
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readTableResourcePolicy(physicalId, tableArn) {
+	async readTableResourcePolicy(physicalId, tableArn, strict = false) {
 		try {
 			const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: tableArn }));
 			if (!rpResp.Policy) return void 0;
@@ -13557,11 +13723,12 @@ var DynamoDBTableProvider = class {
 			} catch {}
 			return { PolicyDocument: doc };
 		} catch (err) {
+			if (strict && !(err instanceof ResourceNotFoundException$1) && !(err instanceof PolicyNotFoundException)) throw err;
 			if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readKinesisStreamSpecification(physicalId) {
+	async readKinesisStreamSpecification(physicalId, strict = false) {
 		try {
 			const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING" || d.DestinationStatus === "UPDATING");
 			if (!active?.StreamArn) return void 0;
@@ -13569,15 +13736,17 @@ var DynamoDBTableProvider = class {
 			if (active.ApproximateCreationDateTimePrecision !== void 0) kspec["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
 			return kspec;
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readTableContributorInsights(physicalId) {
+	async readTableContributorInsights(physicalId, strict = false) {
 		try {
 			const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
 			return reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
@@ -13701,6 +13870,22 @@ var DynamoDBTableProvider = class {
 function isTransientStreamReadFailure(err) {
 	return isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1;
 }
+function projectIndexesOnto(live, recorded, desired) {
+	if (!Array.isArray(live)) return void 0;
+	const named = /* @__PURE__ */ new Set();
+	for (const list of [recorded, desired]) {
+		if (!Array.isArray(list)) continue;
+		for (const entry of list) {
+			const name = typeof entry === "object" && entry !== null ? entry["IndexName"] : void 0;
+			if (typeof name === "string") named.add(name);
+		}
+	}
+	const kept = live.filter((entry) => {
+		const name = typeof entry === "object" && entry !== null ? entry["IndexName"] : void 0;
+		return typeof name === "string" && named.has(name);
+	});
+	return kept.length > 0 ? kept : void 0;
+}
 
 //#endregion
 //#region src/provisioning/providers/logs-loggroup-provider.ts
@@ -18323,7 +18508,7 @@ var EC2Provider = class {
 		if (!Array.isArray(ingressRules) || ingressRules.length === 0) return;
 		await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 			GroupId: groupId,
-			IpPermissions: ingressRules.map((rule) => this.buildIpPermission(rule))
+			IpPermissions: ingressRules.map((rule) => this.buildIpPermission(rule, "ingress", true))
 		}));
 	}
 	async applyInlineEgress(groupId, egressRules) {
@@ -19491,7 +19676,7 @@ var EC2Provider = class {
 		const raw = obj["CPUCredits"] ?? obj["CpuCredits"];
 		return typeof raw === "string" ? raw : void 0;
 	}
-	buildIpPermission(properties, direction = "ingress") {
+	buildIpPermission(properties, direction = "ingress", inline = false) {
 		const ipProtocol = properties["IpProtocol"] ?? "-1";
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
@@ -19512,8 +19697,9 @@ var EC2Provider = class {
 			permission.Ipv6Ranges = [ipv6Range];
 		}
 		const peerGroupId = direction === "egress" ? properties["DestinationSecurityGroupId"] : properties["SourceSecurityGroupId"];
-		if (peerGroupId) {
-			const groupPair = { GroupId: peerGroupId };
+		const peerGroupName = inline && direction === "ingress" ? properties["SourceSecurityGroupName"] : void 0;
+		if (peerGroupId || peerGroupName) {
+			const groupPair = peerGroupId ? { GroupId: peerGroupId } : { GroupName: peerGroupName };
 			if (direction === "ingress") {
 				const peerOwnerId = properties["SourceSecurityGroupOwnerId"];
 				if (peerOwnerId) groupPair.UserId = peerOwnerId;
@@ -19534,6 +19720,7 @@ var EC2Provider = class {
 			const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
 			const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
 			const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
+			const peerName = direction === "ingress" ? rule["SourceSecurityGroupName"] : void 0;
 			return JSON.stringify({
 				p: sgProtocolKey(rule["IpProtocol"]),
 				f: rule["FromPort"] ?? null,
@@ -19541,6 +19728,7 @@ var EC2Provider = class {
 				c4: rule["CidrIp"] ?? null,
 				c6: rule["CidrIpv6"] ?? null,
 				peer: peerKey ?? null,
+				peerName: peerKey ? null : peerName ?? null,
 				peerOwner: peerOwner ?? null,
 				pl: prefixKey ?? null,
 				d: rule["Description"] ?? null
@@ -19569,7 +19757,7 @@ var EC2Provider = class {
 				}));
 				else await this.ec2Client.send(new RevokeSecurityGroupIngressCommand({
 					GroupId: groupId,
-					IpPermissions: [this.buildIpPermission(rule, "ingress")]
+					IpPermissions: [this.buildIpPermission(rule, "ingress", true)]
 				}));
 			} catch (error) {
 				if (!this.isNotFoundError(error)) throw error;
@@ -19582,7 +19770,7 @@ var EC2Provider = class {
 			}));
 			else await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
-				IpPermissions: [this.buildIpPermission(rule, "ingress")]
+				IpPermissions: [this.buildIpPermission(rule, "ingress", true)]
 			}));
 		} catch (error) {
 			if (!(error instanceof Error && error.message.includes("already exists"))) throw error;
@@ -30866,6 +31054,18 @@ var DocDBSubnetGroupProvider = class {
 function isZoneDisabledForMutationError(error) {
 	return error instanceof Error && error.message.includes("is marked disabled for mutation");
 }
+function declaresAcceleratedRecovery(properties, acceptReadSideKey = false) {
+	const features = properties["HostedZoneFeatures"];
+	if (isTruthyCfnBoolean(features?.["EnableAcceleratedRecovery"])) return true;
+	const legacyStatus = features?.["AcceleratedRecoveryStatus"];
+	return acceptReadSideKey && features?.["EnableAcceleratedRecovery"] === void 0 && typeof legacyStatus === "string" && ACCELERATED_RECOVERY_ON_STATUSES.has(legacyStatus);
+}
+const ACCELERATED_RECOVERY_ON_STATUSES = /* @__PURE__ */ new Set([
+	"ENABLED",
+	"ENABLING",
+	"ENABLING_HOSTED_ZONE_LOCKED",
+	"DISABLE_FAILED"
+]);
 var HostedZoneNameNotFoundError = class HostedZoneNameNotFoundError extends ProvisioningError {
 	constructor(message, resourceType, logicalId, physicalId, cause) {
 		super(message, resourceType, logicalId, physicalId, cause);
@@ -31081,26 +31281,29 @@ var Route53Provider = class {
 			}
 			await this.applyHostedZoneTags(zoneId, properties, logicalId, void 0, mask);
 			await this.applyQueryLoggingConfig(zoneId, properties, logicalId);
-			if (properties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED") try {
-				await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
-					HostedZoneId: zoneId,
-					EnableAcceleratedRecovery: true
-				}));
-			} catch (uhfError) {
-				this.logger.error(`UpdateHostedZoneFeatures failed for ${zoneId} after CreateHostedZone — rolling back the hosted zone to keep deploy retry idempotent`);
+			if (declaresAcceleratedRecovery(properties)) {
 				try {
-					await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
-					await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
-					zoneRolledBack = true;
-					callerReferenceToken.release();
-				} catch (deleteError) {
-					const head = `Best-effort rollback DeleteHostedZone for ${zoneId} also failed: `;
-					const m = maskerOrIdentity(mask);
-					this.logger.warn(m(`${head}${this.warnFailureText(head, deleteError, mask)} The operator may need to clean up the orphan zone.`));
+					await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
+						HostedZoneId: zoneId,
+						EnableAcceleratedRecovery: true
+					}));
+				} catch (uhfError) {
+					this.logger.error(`UpdateHostedZoneFeatures failed for ${zoneId} after CreateHostedZone — rolling back the hosted zone to keep deploy retry idempotent`);
+					try {
+						await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
+						await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
+						zoneRolledBack = true;
+						callerReferenceToken.release();
+					} catch (deleteError) {
+						const head = `Best-effort rollback DeleteHostedZone for ${zoneId} also failed: `;
+						const m = maskerOrIdentity(mask);
+						this.logger.warn(m(`${head}${this.warnFailureText(head, deleteError, mask)} The operator may need to clean up the orphan zone.`));
+					}
+					const cause = uhfError instanceof Error ? uhfError : void 0;
+					markAuxiliaryFailure(uhfError, logicalId);
+					throw this.wrapCaughtError(mask, uhfError, (text) => new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${text}`, resourceType, logicalId, zoneId, cause));
 				}
-				const cause = uhfError instanceof Error ? uhfError : void 0;
-				markAuxiliaryFailure(uhfError, logicalId);
-				throw this.wrapCaughtError(mask, uhfError, (text) => new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${text}`, resourceType, logicalId, zoneId, cause));
+				await this.waitForAcceleratedRecoveryFeatureSettled(zoneId, logicalId, resourceType, true, true);
 			}
 			const nameServers = response.DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully created hosted zone ${logicalId}: ${zoneId}`);
@@ -31178,12 +31381,15 @@ var Route53Provider = class {
 			await this.applyHostedZoneTags(physicalId, properties, logicalId, previousProperties, mask);
 			await this.applyQueryLoggingConfig(physicalId, properties, logicalId, previousProperties);
 			await this.syncVPCAssociations(physicalId, properties, logicalId);
-			const prevEnabled = previousProperties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
-			const nextEnabled = properties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
-			if (prevEnabled !== nextEnabled) await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
-				HostedZoneId: physicalId,
-				EnableAcceleratedRecovery: nextEnabled
-			}));
+			const prevEnabled = declaresAcceleratedRecovery(previousProperties, true);
+			const nextEnabled = declaresAcceleratedRecovery(properties, context?.desiredFromAwsReadback === true);
+			if (prevEnabled !== nextEnabled) {
+				await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
+					HostedZoneId: physicalId,
+					EnableAcceleratedRecovery: nextEnabled
+				}));
+				await this.waitForAcceleratedRecoveryFeatureSettled(physicalId, logicalId, resourceType, nextEnabled);
+			}
 			const nameServers = (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully updated hosted zone ${logicalId}`);
 			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
@@ -31438,25 +31644,43 @@ var Route53Provider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete record set ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType) {
+	async waitForAcceleratedRecoveryFeatureSettled(zoneId, logicalId, resourceType, enabled, freshZone = false) {
+		const verb = enabled ? "enable" : "disable";
+		await this.waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType, {
+			blocked: `the hosted zone ${logicalId} can be deployed`,
+			retry: `after the ${verb} of Accelerated Recovery (hosted zone ${logicalId}); re-run the deploy once the transition settles`,
+			settledAt: enabled ? "ENABLED" : "DISABLED",
+			freshZone
+		});
+	}
+	async waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType, purpose = {
+		blocked: `the record set ${logicalId} can be deleted`,
+		retry: `(record set ${logicalId}); re-run the destroy once the transition settles`
+	}) {
 		const client = this.getClient();
 		const parsedInterval = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_INTERVAL_MS"] ?? "15000", 10);
 		const pollIntervalMs = Number.isFinite(parsedInterval) && parsedInterval > 0 ? parsedInterval : 15e3;
 		const parsedTimeout = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_TIMEOUT_MS"] ?? "600000", 10);
 		const timeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? parsedTimeout : 6e5;
 		const deadline = Date.now() + timeoutMs;
-		const TERMINAL_FAILED = /* @__PURE__ */ new Set(["ENABLE_FAILED", "DISABLE_FAILED"]);
-		const MUTABLE = /* @__PURE__ */ new Set(["ENABLED", "DISABLED"]);
+		const TERMINAL_FAILED = new Set(purpose.settledAt === "ENABLED" ? ["ENABLE_FAILED"] : purpose.settledAt === "DISABLED" ? ["DISABLE_FAILED"] : ["ENABLE_FAILED", "DISABLE_FAILED"]);
+		const MUTABLE = new Set(purpose.settledAt !== void 0 ? [purpose.settledAt] : ["ENABLED", "DISABLED"]);
+		let sawTransition = purpose.settledAt === void 0 || purpose.freshZone === true;
+		let lastStatus;
 		while (Date.now() < deadline) {
 			let status;
 			try {
 				status = (await client.send(new GetHostedZoneCommand({ Id: zoneId }))).HostedZone?.Features?.AcceleratedRecoveryStatus;
 			} catch (err) {
-				if (err instanceof Error && err.name === "NoSuchHostedZone") return;
+				if (err instanceof Error && err.name === "NoSuchHostedZone" && purpose.settledAt === void 0) return;
 				throw err;
 			}
-			if (status === void 0 || MUTABLE.has(status)) return;
-			if (TERMINAL_FAILED.has(status)) throw new ProvisioningError(`Cannot mutate hosted zone ${zoneId}: AcceleratedRecoveryStatus is '${status}' — operator must resolve before the record set ${logicalId} can be deleted`, resourceType, logicalId, zoneId);
+			if (status === void 0) {
+				if (purpose.settledAt !== "ENABLED") return;
+			} else if (MUTABLE.has(status)) return;
+			lastStatus = status;
+			if (status?.includes("ING") === true) sawTransition = true;
+			if (status !== void 0 && sawTransition && TERMINAL_FAILED.has(status)) throw new ProvisioningError(`Cannot mutate hosted zone ${zoneId}: AcceleratedRecoveryStatus is '${status}' — operator must resolve before ${purpose.blocked}`, resourceType, logicalId, zoneId);
 			this.logger.debug(`Polling AcceleratedRecoveryStatus for ${zoneId}: ${status} (waiting for a mutable state, will re-poll in ~${pollIntervalMs}ms)`);
 			const sliceEnd = Math.min(Date.now() + pollIntervalMs, deadline);
 			while (Date.now() < sliceEnd) {
@@ -31465,7 +31689,7 @@ var Route53Provider = class {
 				await new Promise((resolve) => setTimeout(resolve, tick));
 			}
 		}
-		throw new ProvisioningError(`Timed out after ${timeoutMs}ms waiting for AcceleratedRecoveryStatus to reach a mutable state on hosted zone ${zoneId} (record set ${logicalId}); re-run the destroy once the transition settles`, resourceType, logicalId, zoneId);
+		throw new ProvisioningError(`Timed out after ${timeoutMs}ms waiting for AcceleratedRecoveryStatus to reach a mutable state on hosted zone ${zoneId} ${purpose.retry}${purpose.settledAt !== void 0 ? ` (last status: ${lastStatus ?? "none"})` : ""}`, resourceType, logicalId, zoneId);
 	}
 	buildResourceRecordSet(properties) {
 		const name = properties["Name"];
@@ -31773,7 +31997,8 @@ var Route53Provider = class {
 			const bare = resp.DelegationSet.Id.replace(/^\/delegationset\//, "");
 			result["DelegationSetId"] = properties?.["DelegationSetId"] === `/delegationset/${bare}` ? `/delegationset/${bare}` : bare;
 		}
-		if (resp.HostedZone.Features?.AcceleratedRecoveryStatus !== void 0) result["HostedZoneFeatures"] = { AcceleratedRecoveryStatus: resp.HostedZone.Features.AcceleratedRecoveryStatus };
+		const acceleratedRecoveryStatus = resp.HostedZone.Features?.AcceleratedRecoveryStatus;
+		if (acceleratedRecoveryStatus !== void 0) result["HostedZoneFeatures"] = { EnableAcceleratedRecovery: ACCELERATED_RECOVERY_ON_STATUSES.has(acceleratedRecoveryStatus) };
 		if (resp.HostedZone.Config?.PrivateZone === true) result["VPCs"] = (resp.VPCs ?? []).map((v) => {
 			const out = {};
 			if (v.VPCId !== void 0) out["VPCId"] = v.VPCId;
@@ -33893,11 +34118,7 @@ var ElastiCacheProvider = class {
 		if (templateLowered && desiredCount !== void 0 && desiredCount < liveNodes.length) {
 			if (liveNodes.length !== previousCount) throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: the template lowers NumCacheNodes from ${String(previousCount)} ` + safeMsg`to ${String(desiredCount)}, but the cluster has ${String(liveNodes.length)} nodes, so ` + "the removal would delete nodes the template change does not account for. Deploy NumCacheNodes set to the live count first, then lower it.", resourceType, logicalId, physicalId);
 			const plan = nodesToRemove(liveNodes, desiredCount, zones);
-			if (plan === void 0) {
-				const liveZones = liveNodes.map((n) => n.zone);
-				const disjoint = zones !== void 0 && !zones.some((z) => liveZones.includes(z));
-				throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: lowering NumCacheNodes to ${String(desiredCount)} ` + "with this PreferredAvailabilityZones list needs a node removed and a node added in a zone no live node occupies, in one update, which ModifyCacheCluster cannot do. " + (disjoint ? `CloudFormation replaces the cluster for a move to disjoint zones; cdkd does not yet (issue #5458). ` : "") + `Replace the cluster (for example by changing its logical ID), or list only zones the kept nodes occupy.`, resourceType, logicalId, physicalId);
-			}
+			if (plan === void 0) throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: lowering NumCacheNodes to ${String(desiredCount)} ` + "with this PreferredAvailabilityZones list needs a node removed and a node added in a zone no live node occupies, in one update, which ModifyCacheCluster cannot do. Replace the cluster (for example by changing its logical ID), or list only zones the kept nodes occupy.", resourceType, logicalId, physicalId);
 			removeIds = plan;
 			this.logger.info(safeMsg`CacheCluster ${logicalId}: NumCacheNodes ${String(previousProperties["NumCacheNodes"])} -> ${String(desiredCount)}, removing cache nodes ${removeIds.join(", ")}`);
 		}
@@ -38237,15 +38458,20 @@ function desiredGlueTags(raw, resourceType, logicalId, physicalId) {
 	const tags = refuseMalformedDesiredTags(tagMapAsList(raw), resourceType, logicalId, physicalId, "Tags", GLUE_TAGS_WHAT);
 	return tags.length > 0 ? Object.fromEntries(tags.map((t) => [t.Key, t.Value])) : void 0;
 }
-async function applyGlueTagDiff(client, resourceArn, recorded, desired, resourceType, logicalId, warn) {
+async function applyGlueTagDiff(client, resourceArn, recorded, desired, resourceType, logicalId, warn, unsettled = {
+	forceUpsert: false,
+	beforeWrite: () => void 0
+}) {
 	const plan = planTagDiff(tagMapAsList(recorded), tagMapAsList(desired));
 	const warning = tagPlanWarning(plan, resourceType, logicalId);
 	if (warning !== void 0) warn(warning);
-	if (plan.set.size === 0 && plan.remove.length === 0) return;
+	const toSet = unsettled.forceUpsert ? planTagDiff([], tagMapAsList(desired)).set : plan.set;
+	if (toSet.size === 0 && plan.remove.length === 0) return;
+	unsettled.beforeWrite();
 	const arn = await resourceArn();
-	if (plan.set.size > 0) await client.send(new TagResourceCommand$19({
+	if (toSet.size > 0) await client.send(new TagResourceCommand$19({
 		ResourceArn: arn,
-		TagsToAdd: Object.fromEntries(plan.set)
+		TagsToAdd: Object.fromEntries(toSet)
 	}));
 	if (plan.remove.length > 0) await client.send(new UntagResourceCommand$20({
 		ResourceArn: arn,
@@ -38280,6 +38506,28 @@ const crawlerLeftInPlaceWarning = (logicalId, names, caller) => {
 	const cfnKeeps = names.includes("LineageConfiguration") ? "" : `, as CloudFormation leaves ${one ? "it" : "them"}`;
 	return caller === "rollback" ? safeMsg`${logicalId} (AWS::Glue::Crawler): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateCrawler keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::Glue::Crawler): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value${cfnKeeps}; UpdateCrawler keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
+const CRAWLER_UPDATE_KEYS = [
+	"Role",
+	"Targets",
+	"Classifiers",
+	"Configuration",
+	"CrawlerSecurityConfiguration",
+	"DatabaseName",
+	"Description",
+	"LakeFormationConfiguration",
+	"LineageConfiguration",
+	"RecrawlPolicy",
+	"Schedule",
+	"SchemaChangePolicy",
+	"TablePrefix"
+];
+const TRIGGER_UPDATE_KEYS = [
+	"Description",
+	"Schedule",
+	"Actions",
+	"Predicate",
+	"EventBatchingCondition"
+];
 var GlueCrawlerProvider = class {
 	client;
 	createClient;
@@ -38362,6 +38610,7 @@ var GlueCrawlerProvider = class {
 		const { value: v } = log;
 		log.debug(`Updating Glue Crawler ${logicalId}: ${v(physicalId)}`);
 		desiredGlueTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		try {
 			const updateInput = {
 				Name: physicalId,
@@ -38369,6 +38618,7 @@ var GlueCrawlerProvider = class {
 				...properties["Targets"] !== void 0 && { Targets: toSdkCrawlerTargets(properties["Targets"]) },
 				...buildCrawlerCommonFields(properties)
 			};
+			for (const key of CRAWLER_UPDATE_KEYS) if (JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key])) markUnsettled(key);
 			try {
 				await this.getClient().send(new UpdateCrawlerCommand(updateInput));
 			} catch (err) {
@@ -38378,7 +38628,10 @@ var GlueCrawlerProvider = class {
 					await this.getClient().send(new UpdateCrawlerCommand(updateInput));
 				} else throw err;
 			}
-			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
+			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn, {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			if (!context?.desiredFromAwsReadback) {
 				const removed = context?.removedProperties;
 				const leftInPlace = [];
@@ -38854,6 +39107,7 @@ var GlueTriggerProvider = class {
 		const { value: v } = log;
 		log.debug(`Updating Glue Trigger ${logicalId}: ${v(physicalId)}`);
 		desiredGlueTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		try {
 			let restart = false;
 			try {
@@ -38873,6 +39127,7 @@ var GlueTriggerProvider = class {
 				...properties["EventBatchingCondition"] !== void 0 && { EventBatchingCondition: properties["EventBatchingCondition"] }
 			};
 			let updateError;
+			for (const key of TRIGGER_UPDATE_KEYS) if (JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key])) markUnsettled(key);
 			try {
 				await this.getClient().send(new UpdateTriggerCommand({
 					Name: physicalId,
@@ -38890,7 +39145,10 @@ var GlueTriggerProvider = class {
 				if (restartFailure.redacted) log.debug(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${restartFailure.detail}`);
 			}
 			if (updateError !== void 0) throw updateError;
-			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
+			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn, {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			return {
 				physicalId,
 				wasReplaced: false
@@ -38900,6 +39158,14 @@ var GlueTriggerProvider = class {
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update Glue Trigger ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const state = (await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State;
+			return state === "ACTIVATING" || state === "DEACTIVATING" || state === "CREATING" || state === "UPDATING" ? new Set([...names].filter((name) => name !== "Tags")) : /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
 	async waitForTriggerDeactivated(physicalId) {
 		for (let attempt = 0; attempt < TRIGGER_DEACTIVATE_MAX_ATTEMPTS; attempt++) {
 			try {
@@ -40655,6 +40921,7 @@ var KinesisStreamProvider = class {
 		const desiredRetention = readRetentionHours(properties["RetentionPeriodHours"], mask);
 		if (desiredRetention.kind === "unusable" && context?.replayingState !== true) throw new ProvisioningError(desiredRetention.reason, resourceType, logicalId, physicalId);
 		if (desiredRetention.kind === "unusable") warn(`${desiredRetention.reason}. Replaying a state record, so the retention period of ${physicalId} is left as it is rather than refusing the restore`);
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		const previousRetention = readRetentionHours(previousProperties["RetentionPeriodHours"], mask);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -40664,6 +40931,7 @@ var KinesisStreamProvider = class {
 			if (modeChanged) {
 				const streamArn = await this.resolveStreamArn(physicalId);
 				this.logger.debug(`Switching stream mode for ${physicalId}: from ${oldStreamMode} to ${streamMode}`);
+				markUnsettled("StreamModeDetails");
 				await this.getClient().send(new UpdateStreamModeCommand({
 					StreamARN: streamArn,
 					StreamModeDetails: { StreamMode: streamMode }
@@ -40672,9 +40940,10 @@ var KinesisStreamProvider = class {
 			}
 			if (streamMode === "PROVISIONED") {
 				const newShardCount = Number(properties["ShardCount"] ?? 1);
-				const oldShardCount = modeChanged ? await this.getOpenShardCount(physicalId) : Number(previousProperties["ShardCount"] ?? 1);
+				const oldShardCount = modeChanged || context?.unsettledProperties?.has("StreamModeDetails") === true ? await this.getOpenShardCount(physicalId) : Number(previousProperties["ShardCount"] ?? 1);
 				if (newShardCount !== oldShardCount) {
 					this.logger.debug(`Updating shard count for ${physicalId}: from ${oldShardCount} to ${newShardCount}`);
+					markUnsettled("ShardCount");
 					await this.getClient().send(new UpdateShardCountCommand({
 						StreamName: physicalId,
 						TargetShardCount: newShardCount,
@@ -40687,6 +40956,7 @@ var KinesisStreamProvider = class {
 			const effectiveOldRetention = previousRetention.kind === "usable" ? previousRetention.hours ?? 24 : 24;
 			if (desiredRetention.kind !== "unusable" && effectiveNewRetention !== effectiveOldRetention) {
 				this.logger.debug(`Updating retention period for ${physicalId}: from ${effectiveOldRetention} to ${effectiveNewRetention}`);
+				markUnsettled("RetentionPeriodHours");
 				if (effectiveNewRetention > effectiveOldRetention) await this.getClient().send(new IncreaseStreamRetentionPeriodCommand({
 					StreamName: physicalId,
 					RetentionPeriodHours: effectiveNewRetention
@@ -40697,7 +40967,10 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
-			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			const newEncryption = properties["StreamEncryption"];
 			const oldEncryption = previousProperties["StreamEncryption"];
 			const oldIsKms = isKmsEncryption(oldEncryption);
@@ -40705,6 +40978,7 @@ var KinesisStreamProvider = class {
 			const oldKeyId = oldIsKms ? oldEncryption["KeyId"] : void 0;
 			const newKeyId = newIsKms ? newEncryption["KeyId"] : void 0;
 			if (oldIsKms !== newIsKms || oldIsKms && newIsKms && oldKeyId !== newKeyId) {
+				markUnsettled("StreamEncryption");
 				if (oldIsKms) {
 					await this.getClient().send(new StopStreamEncryptionCommand({
 						StreamName: physicalId,
@@ -40728,13 +41002,14 @@ var KinesisStreamProvider = class {
 			const recordedMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"], mask);
 			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== (recordedMaxRecordSize ?? DEFAULT_MAX_RECORD_SIZE_KIB)) {
 				this.logger.debug(`Updating max record size for ${physicalId}: from ${recordedMaxRecordSize ?? "no value"} to ${newMaxRecordSize}`);
+				markUnsettled("MaxRecordSizeInKiB");
 				await this.getClient().send(new UpdateMaxRecordSizeCommand({
 					StreamARN: await this.resolveStreamArn(physicalId),
 					MaxRecordSizeInKiB: newMaxRecordSize
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
-			await this.reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn);
+			await this.reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn, markUnsettled);
 			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 			let desiredMetrics;
 			if (desiredRead.kind === "unusable") warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
@@ -40743,7 +41018,9 @@ var KinesisStreamProvider = class {
 				const desiredSet = desiredRead.kind === "usable" ? desiredRead.metrics : [];
 				const previousSet = previousMetricNames(previousProperties["DesiredShardLevelMetrics"]);
 				const toDisable = previousSet.filter((m) => !desiredSet.includes(m));
+				if (context?.unsettledProperties?.has("DesiredShardLevelMetrics") === true) await this.warnUndeclaredLiveMetrics(physicalId, [...previousSet, ...desiredSet], warn, mask);
 				const toEnable = desiredSet.filter((m) => !previousSet.includes(m));
+				if (toDisable.length > 0 || toEnable.length > 0) markUnsettled("DesiredShardLevelMetrics");
 				if (toDisable.length > 0) {
 					this.logger.debug(`Disabling ${toDisable.length} shard-level metric(s) on ${physicalId}`);
 					await this.getClient().send(new DisableEnhancedMonitoringCommand({
@@ -40855,7 +41132,7 @@ var KinesisStreamProvider = class {
 			throw error;
 		}
 	}
-	async reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn) {
+	async reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn, markUnsettled) {
 		const desired = readDistributionStrategy(properties["RecordDistributionStrategy"], mask);
 		if (desired.kind === "unusable") {
 			warn(`${desired.reason}. Leaving the record distribution strategy on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
@@ -40873,6 +41150,7 @@ var KinesisStreamProvider = class {
 			target = DEFAULT_RECORD_DISTRIBUTION_STRATEGY;
 		}
 		this.logger.debug(mask(safeMsg`Updating record distribution strategy for ${physicalId}: from ${recorded ?? "no value"} to ${target}`));
+		markUnsettled("RecordDistributionStrategy");
 		await this.getClient().send(new UpdateStreamRecordDistributionStrategyCommand({
 			StreamARN: await this.resolveStreamArn(physicalId),
 			RecordDistributionStrategy: target
@@ -40901,12 +41179,16 @@ var KinesisStreamProvider = class {
 		if (resourceType !== "AWS::Kinesis::Stream") return [];
 		return ["DesiredShardLevelMetrics"];
 	}
-	async applyTagDiff(streamName, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(streamName, resourceType, logicalId, oldTagsRaw, newTagsRaw, unsettled = {
+		forceUpsert: false,
+		beforeWrite: () => void 0
+	}) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
-		const tagsToAdd = Object.fromEntries(plan.set);
+		const tagsToAdd = Object.fromEntries(unsettled.forceUpsert ? planTagDiff(void 0, newTagsRaw).set : plan.set);
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || Object.keys(tagsToAdd).length > 0) unsettled.beforeWrite();
 		if (tagsToRemove.length > 0) {
 			await this.getClient().send(new RemoveTagsFromStreamCommand({
 				StreamName: streamName,
@@ -40922,6 +41204,46 @@ var KinesisStreamProvider = class {
 			this.logger.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream ${streamName}`);
 		}
 	}
+	async warnUndeclaredLiveMetrics(physicalId, named, warn, mask) {
+		let live;
+		try {
+			live = ((await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.EnhancedMonitoring ?? []).flatMap((entry) => entry.ShardLevelMetrics ?? []);
+		} catch {
+			return;
+		}
+		const expandedLive = expandShardLevelMetrics(live);
+		const undeclared = (Array.isArray(expandedLive) ? expandedLive : live).filter((metric) => metric !== "ALL" && !named.includes(metric));
+		if (undeclared.length === 0) return;
+		const secretDerived = mask(physicalId) !== physicalId;
+		warn(`Kinesis stream ${physicalId} has shard-level metrics enabled that neither cdkd's record nor the template declares (${undeclared.join(", ")}), so cdkd left them enabled while converging the unsettled DesiredShardLevelMetrics (CloudFormation never disables a metric it did not record). Another tool may have enabled them, or an earlier failed cdkd update may have; cdkd cannot tell which. If they should be off, disable them ` + (secretDerived ? `with DisableEnhancedMonitoring for those metrics.` : `with: aws kinesis disable-enhanced-monitoring --stream-name ${physicalId} --shard-level-metrics ${undeclared.join(" ")} (in the stream's region)`));
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		if (names.has("DesiredShardLevelMetrics") && Array.isArray(out["DesiredShardLevelMetrics"])) {
+			const named = new Set([recordedProperties, desiredProperties].flatMap((bag) => {
+				const expanded = expandShardLevelMetrics(bag?.["DesiredShardLevelMetrics"]);
+				return isUsableMetricsList(expanded) ? expanded : [];
+			}));
+			const liveMetrics = expandShardLevelMetrics(out["DesiredShardLevelMetrics"]);
+			out["DesiredShardLevelMetrics"] = (Array.isArray(liveMetrics) ? liveMetrics : []).filter((metric) => typeof metric === "string" && named.has(metric));
+		}
+		if (!names.has("ShardCount")) return out;
+		return {
+			...out,
+			ShardCount: await this.getOpenShardCount(physicalId)
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const status = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.StreamStatus;
+			if (status !== "UPDATING" && status !== "CREATING") return /* @__PURE__ */ new Set();
+			return new Set([...names].filter((name) => name !== "Tags"));
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
 		if (resourceType !== "AWS::Kinesis::Stream") return void 0;
 		let stream;
@@ -41687,6 +42009,13 @@ function pipeIdentityToken(name, arn, creationTime) {
 	return `${arn}@${Math.floor(ms / 1e3)}`;
 }
 const SETTLED_STATES = /* @__PURE__ */ new Set(["RUNNING", "STOPPED"]);
+const MOVING_STATES = /* @__PURE__ */ new Set([
+	"CREATING",
+	"UPDATING",
+	"STARTING",
+	"STOPPING",
+	"DELETING"
+]);
 const PIPE_POLL_INTERVAL_MS = 5e3;
 const PIPE_SETTLE_MAX_WAIT_MS = 9e5;
 const PIPE_DELETE_MAX_WAIT_MS = 6e5;
@@ -41980,13 +42309,19 @@ var PipesPipeProvider = class {
 				};
 				const sourceParameters = toUpdateSourceParameters(desired["SourceParameters"], previousProperties["SourceParameters"]);
 				if (sourceParameters !== void 0) input.SourceParameters = sourceParameters;
+				for (const key of this.changedPipeFields(desired, previousProperties)) context?.markUnsettled?.(key);
 				const accepted = await this.getClient().send(new UpdatePipeCommand(input));
 				settled = await this.waitForSettled(physicalId, logicalId, resourceType, "update", mask, accepted.LastModifiedTime);
 			}
-			const plan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(desiredTags));
+			const recordedPlan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(desiredTags));
+			const plan = context?.unsettledProperties?.has("Tags") === true ? {
+				...recordedPlan,
+				set: planTagDiff([], tagMapAsList(desiredTags)).set
+			} : recordedPlan;
 			const warning = tagPlanWarning(plan, resourceType, logicalId);
 			if (warning) this.logger.warn(warning);
 			if (plan.set.size > 0 || plan.remove.length > 0) {
+				context?.markUnsettled?.("Tags");
 				settled ??= await this.describe(physicalId);
 				const arn = settled.Arn;
 				if (!arn) throw new Error("DescribePipe returned no Arn, which tagging needs");
@@ -42146,10 +42481,30 @@ var PipesPipeProvider = class {
 		return value;
 	}
 	pipeFieldsChanged(desired, previous) {
+		return this.changedPipeFields(desired, previous).length > 0;
+	}
+	changedPipeFields(desired, previous) {
 		const keys = /* @__PURE__ */ new Set([...Object.keys(desired), ...Object.keys(previous)]);
 		keys.delete("Tags");
-		for (const key of keys) if (JSON.stringify(desired[key]) !== JSON.stringify(previous[key])) return true;
-		return false;
+		return [...keys].filter((key) => JSON.stringify(desired[key]) !== JSON.stringify(previous[key]));
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const state = (await this.describe(physicalId)).CurrentState;
+			if (state === void 0 || !MOVING_STATES.has(state)) return /* @__PURE__ */ new Set();
+			return new Set([...names].filter((name) => name !== "Tags"));
+		} catch {
+			return names;
+		}
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (typeof live !== "object" || live === null) return live;
+		const state = (await this.describe(physicalId)).CurrentState;
+		if (state === void 0 || !state.endsWith("_FAILED")) return live;
+		const out = { ...live };
+		for (const name of names) delete out[name];
+		return out;
 	}
 	async readStateForDelete(name) {
 		try {
@@ -42312,6 +42667,7 @@ var EFSProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("EFSProvider");
 	unconfirmedCreationTokens = /* @__PURE__ */ new Map();
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["BackupPolicy", { Status: "DISABLED" }], ["FileSystemProtection", { ReplicationOverwriteProtection: "ENABLED" }]])]]);
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::EFS::FileSystem", /* @__PURE__ */ new Set([
 			"FileSystemTags",
@@ -42383,13 +42739,56 @@ var EFSProvider = class {
 	}
 	update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		switch (resourceType) {
 			case "AWS::EFS::FileSystem": return this.updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::EFS::MountTarget": return this.updateMountTarget(logicalId, physicalId, resourceType, properties, log);
-			case "AWS::EFS::AccessPoint": return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS EFS AccessPoint has no in-place update API — there is no UpdateAccessPoint command; every property change requires DeleteAccessPoint + CreateAccessPoint. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack."));
+			case "AWS::EFS::AccessPoint": return this.updateAccessPoint(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
+	async applyTagDiff(resourceId, resourceType, logicalId, recorded, desired, log) {
+		const plan = planTagDiff(recorded, desired);
+		const warning = tagPlanWarning(plan, resourceType, logicalId);
+		if (warning !== void 0) log.warn(warning);
+		if (plan.remove.length > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new UntagResourceCommand$24({
+			ResourceId: resourceId,
+			TagKeys: plan.remove
+		})), `UntagResource ${resourceId}`, log);
+		if (plan.set.size > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new TagResourceCommand$23({
+			ResourceId: resourceId,
+			Tags: [...plan.set].map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		})), `TagResource ${resourceId}`, log);
+	}
+	async updateAccessPoint(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+		const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+		const sameExceptSecretLeaves = (desired, recorded) => {
+			if (desired !== void 0 && typeof recorded === "string" && holdsSecretDerivedEntry(recorded)) return true;
+			if (Array.isArray(desired) && Array.isArray(recorded)) return desired.length === recorded.length && desired.every((d, i) => sameExceptSecretLeaves(d, recorded[i]));
+			if (isPlainObject(desired) && isPlainObject(recorded)) return [.../* @__PURE__ */ new Set([...Object.keys(desired), ...Object.keys(recorded)])].every((k) => sameExceptSecretLeaves(desired[k], recorded[k]));
+			return isDeepStrictEqual(desired, recorded);
+		};
+		const keys = /* @__PURE__ */ new Set([...Object.keys(properties), ...Object.keys(previousProperties)]);
+		for (const key of keys) {
+			if (key === "AccessPointTags") continue;
+			if (!sameExceptSecretLeaves(properties[key], previousProperties[key])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EFS AccessPoint ${key} changed or was removed, and it is immutable on AWS — there is no UpdateAccessPoint command, and only AccessPointTags can change in place; any other property change requires DeleteAccessPoint + CreateAccessPoint. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		refuseMalformedDesiredTags(properties["AccessPointTags"], resourceType, logicalId, physicalId, "AccessPointTags");
+		try {
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["AccessPointTags"], properties["AccessPointTags"], log);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
 	async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log) {
 		for (const key of [
 			"Encrypted",
@@ -42413,7 +42812,9 @@ var EFSProvider = class {
 		const backupChanged = changed("BackupPolicy");
 		const policyChanged = changed("FileSystemPolicy") || changed("BypassPolicyLockoutSafetyCheck");
 		const protectionChanged = changed("FileSystemProtection");
-		if (!throughputModeChanged && !provisionedChanged && !lifecycleChanged && !backupChanged && !policyChanged && !protectionChanged) {
+		const tagsChanged = changed("FileSystemTags");
+		if (tagsChanged) refuseMalformedDesiredTags(properties["FileSystemTags"], resourceType, logicalId, physicalId, "FileSystemTags");
+		if (!throughputModeChanged && !provisionedChanged && !lifecycleChanged && !backupChanged && !policyChanged && !protectionChanged && !tagsChanged) {
 			log.debug(`No mutable diff for EFS FileSystem ${logicalId}, skipping update`);
 			return {
 				physicalId,
@@ -42432,8 +42833,12 @@ var EFSProvider = class {
 			}
 			if (lifecycleChanged) await this.applyLifecyclePolicies(physicalId, properties["LifecyclePolicies"], log, previousProperties["LifecyclePolicies"]);
 			if (backupChanged) await this.applyBackupPolicy(physicalId, properties["BackupPolicy"], log);
-			if (policyChanged) await this.applyFileSystemPolicy(physicalId, properties["FileSystemPolicy"], properties["BypassPolicyLockoutSafetyCheck"], log);
+			if (policyChanged) {
+				if (properties["FileSystemPolicy"] === void 0 && previousProperties["FileSystemPolicy"] !== void 0) await this.deleteFileSystemPolicy(physicalId, log);
+				else await this.applyFileSystemPolicy(physicalId, properties["FileSystemPolicy"], properties["BypassPolicyLockoutSafetyCheck"], log);
+			}
 			if (protectionChanged) await this.applyFileSystemProtection(physicalId, properties["FileSystemProtection"], log);
+			if (tagsChanged) await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["FileSystemTags"], properties["FileSystemTags"], log);
 			log.debug(`Successfully updated EFS FileSystem ${logicalId}`);
 			return {
 				physicalId,
@@ -42641,6 +43046,10 @@ var EFSProvider = class {
 		})), `set FileSystemPolicy on ${fileSystemId}`, log);
 		log.debug(`Set FileSystemPolicy on EFS FileSystem ${fileSystemId}`);
 	}
+	async deleteFileSystemPolicy(fileSystemId, log) {
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new DeleteFileSystemPolicyCommand({ FileSystemId: fileSystemId })), `delete FileSystemPolicy on ${fileSystemId}`, log);
+		log.debug(`Deleted FileSystemPolicy on EFS FileSystem ${fileSystemId}`);
+	}
 	async applyFileSystemProtection(fileSystemId, spec, log) {
 		if (spec === void 0 || spec === null) return;
 		const protection = spec.ReplicationOverwriteProtection;
@@ -43149,6 +43558,23 @@ const routeTableDelta = (next, prev) => {
 		...remove.length > 0 && { remove }
 	};
 };
+const STALE_FAILED_READS = 3;
+const ALIAS_NON_BLOCKING_ACTIONS = /* @__PURE__ */ new Set(["STORAGE_OPTIMIZATION", "IOPS_OPTIMIZATION"]);
+const runningAliasBlockingActions = (fs) => (fs.AdministrativeActions ?? []).filter((a) => (a.Status === "PENDING" || a.Status === "IN_PROGRESS") && !ALIAS_NON_BLOCKING_ACTIONS.has(a.AdministrativeActionType ?? "")).map((a) => a.AdministrativeActionType ?? "unknown");
+const isAdministrativeActionInProgress = (error) => error instanceof Error && error.name === "BadRequest" && /in progress/i.test(describeAwsFailure(error).detail);
+const isTransientFsxError = (error) => {
+	const name = error instanceof Error ? error.name : "";
+	return name === "ThrottlingException" || name === "ServiceLimitExceeded" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(describeAwsFailure(error).detail);
+};
+const aliasDelta = (next, prev) => {
+	const names = (value) => new Set((Array.isArray(value) ? value : []).filter((v) => typeof v === "string").map((v) => v.toLowerCase()));
+	const nextNames = names(next);
+	const prevNames = names(prev);
+	return {
+		add: [...nextNames].filter((n) => !prevNames.has(n)),
+		remove: [...prevNames].filter((n) => !nextNames.has(n))
+	};
+};
 const TOP_LEVEL_IMMUTABLE_PROPS = [
 	"FileSystemType",
 	"SubnetIds",
@@ -43551,11 +43977,16 @@ var FSxFileSystemProvider = class {
 			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 		}
 		const variantConfigKey = this.detectVariantConfigKey(properties, previousProperties);
-		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff, leftInPlace } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
+		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff, leftInPlace, aliases } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
 			diff: {},
 			hasMutableDiff: false,
-			leftInPlace: []
+			leftInPlace: [],
+			aliases: {
+				add: [],
+				remove: []
+			}
 		};
+		const aliasesChanged = aliases.add.length > 0 || aliases.remove.length > 0;
 		const leftInPlaceNames = [...TOP_LEVEL_LEFT_IN_PLACE_PROPS.filter((key) => properties[key] === void 0 && previousProperties[key] !== void 0), ...leftInPlace.map((key) => `${variantConfigKey}.${key}`)];
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
@@ -43576,7 +44007,7 @@ var FSxFileSystemProvider = class {
 		const typeVersionChanged = sendsChange("FileSystemTypeVersion");
 		const networkTypeChanged = sendsChange("NetworkType");
 		const tagsChanged = changed("Tags");
-		if (!variantHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !tagsChanged) {
+		if (!variantHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !aliasesChanged && !tagsChanged) {
 			this.logger.debug(`No mutable diff for FSx FileSystem ${logicalId}, skipping update`);
 			warnLeftInPlace();
 			return {
@@ -43586,6 +44017,7 @@ var FSxFileSystemProvider = class {
 		}
 		this.logger.debug(`Updating FSx FileSystem ${logicalId}: ${physicalId}`);
 		try {
+			const deadline = Date.now() + this.maxWaitMs;
 			const needsUpdateCall = variantHasMutableDiff || storageCapacityChanged || storageTypeChanged || typeVersionChanged || networkTypeChanged;
 			let updatedFs;
 			if (needsUpdateCall) {
@@ -43600,8 +44032,9 @@ var FSxFileSystemProvider = class {
 				}))).FileSystem?.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.Status === "PENDING" || a.Status === "IN_PROGRESS"));
 				const requestTimes = respPendingActions.map((a) => a.RequestTime?.getTime()).filter((t) => t !== void 0);
 				const actionThresholdMs = requestTimes.length > 0 ? Math.min(...requestTimes) : callTimeMs - 6e4;
-				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0, context?.maskSecrets);
+				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0, deadline, context?.maskSecrets);
 			}
+			if (aliasesChanged) await this.applyAliasDelta(physicalId, logicalId, resourceType, aliases, deadline);
 			if (tagsChanged) await this.applyTagDiff(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"]);
 			if (!updatedFs) try {
 				updatedFs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0];
@@ -43629,12 +44062,20 @@ var FSxFileSystemProvider = class {
 		const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(prev)]);
 		const diff = {};
 		const leftInPlace = [];
+		let aliases = {
+			add: [],
+			remove: []
+		};
 		let hasMutableDiff = false;
 		for (const key of keys) {
 			const nextVal = next[key];
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
 			if (configKey === "OpenZFSConfiguration" && key === "Options") continue;
+			if (configKey === "WindowsConfiguration" && key === "Aliases") {
+				aliases = aliasDelta(nextVal, prevVal);
+				continue;
+			}
 			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 			if (nextVal === void 0 && key !== "RouteTableIds") {
 				leftInPlace.push(key);
@@ -43650,7 +44091,8 @@ var FSxFileSystemProvider = class {
 		return {
 			diff,
 			hasMutableDiff,
-			leftInPlace
+			leftInPlace,
+			aliases
 		};
 	}
 	unmappedMutableSubprop(ctx, key) {
@@ -43782,6 +44224,104 @@ var FSxFileSystemProvider = class {
 		}
 		return true;
 	}
+	async applyAliasDelta(physicalId, logicalId, resourceType, delta, deadline) {
+		await this.waitForNoAdministrativeAction(physicalId, logicalId, resourceType, deadline);
+		const live = new Map((await this.describeAliases(physicalId)).map((a) => [a.Name?.toLowerCase(), a.Lifecycle]));
+		const retryAdd = delta.add.filter((n) => {
+			const lifecycle = live.get(n);
+			return lifecycle === "CREATE_FAILED" || lifecycle === "DELETING" || lifecycle === "DELETE_FAILED";
+		});
+		const awaitGone = [...delta.remove, ...retryAdd];
+		const sendRemove = awaitGone.filter((n) => live.has(n) && live.get(n) !== "DELETING");
+		const sendAdd = delta.add.filter((n) => live.get(n) !== "AVAILABLE" && live.get(n) !== "CREATING");
+		if (sendRemove.length > 0) await this.sendAliasCall(physicalId, logicalId, resourceType, () => new DisassociateFileSystemAliasesCommand({
+			FileSystemId: physicalId,
+			Aliases: sendRemove
+		}), deadline);
+		if (awaitGone.length > 0) await this.waitForAliases(physicalId, logicalId, resourceType, awaitGone, "gone", deadline);
+		if (sendAdd.length > 0) await this.sendAliasCall(physicalId, logicalId, resourceType, () => new AssociateFileSystemAliasesCommand({
+			FileSystemId: physicalId,
+			Aliases: sendAdd
+		}), deadline);
+		if (delta.add.length > 0) await this.waitForAliases(physicalId, logicalId, resourceType, delta.add, "AVAILABLE", deadline);
+	}
+	async describeAliases(physicalId) {
+		const aliases = [];
+		let nextToken;
+		do {
+			const resp = await this.getClient().send(new DescribeFileSystemAliasesCommand({
+				FileSystemId: physicalId,
+				NextToken: nextToken
+			}));
+			aliases.push(...resp.Aliases ?? []);
+			nextToken = resp.NextToken;
+		} while (nextToken);
+		return aliases;
+	}
+	async waitForNoAdministrativeAction(physicalId, logicalId, resourceType, deadline) {
+		const transientState = { count: 0 };
+		let running = [];
+		while (Date.now() < deadline) {
+			const fs = await this.describeForPoll(physicalId, transientState);
+			if (fs) {
+				running = runningAliasBlockingActions(fs);
+				if (running.length === 0) return;
+				this.logger.debug(safeMsg`FSx FileSystem ${physicalId}: waiting for ${running.join(", ")} to finish before changing DNS aliases...`);
+			}
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(safeMsg`Timed out waiting for FSx FileSystem ${physicalId} administrative actions (${running.join(", ") || "unknown"}) to finish before changing its DNS aliases (${Math.round(this.maxWaitMs / 6e4)} min). Re-deploy once they complete.`, resourceType, logicalId, physicalId);
+	}
+	async sendAliasCall(physicalId, logicalId, resourceType, command, deadline) {
+		for (;;) try {
+			const call = command();
+			if (call instanceof AssociateFileSystemAliasesCommand) await this.getClient().send(call);
+			else await this.getClient().send(call);
+			return;
+		} catch (error) {
+			if (!isAdministrativeActionInProgress(error)) throw error;
+			if (Date.now() >= deadline) {
+				let running = [];
+				try {
+					running = ((await this.describeForPoll(physicalId, { count: 0 }))?.AdministrativeActions ?? []).filter((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS").map((a) => a.AdministrativeActionType ?? "unknown");
+				} catch {}
+				throw new ProvisioningError(safeMsg`Timed out changing FSx FileSystem ${physicalId} DNS aliases: FSx kept refusing the call while an administrative action (${running.join(", ") || "unknown"}) is in progress (${Math.round(this.maxWaitMs / 6e4)} min). Re-deploy once it completes.`, resourceType, logicalId, physicalId, error);
+			}
+			this.logger.debug(safeMsg`FSx FileSystem ${physicalId}: DNS alias call refused while an administrative action is in progress, re-sending...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+	}
+	async waitForAliases(physicalId, logicalId, resourceType, names, target, deadline) {
+		const failedLifecycle = target === "AVAILABLE" ? "CREATE_FAILED" : "DELETE_FAILED";
+		const transitionLifecycle = target === "AVAILABLE" ? "CREATING" : "DELETING";
+		const seenTransition = /* @__PURE__ */ new Set();
+		const failedReads = /* @__PURE__ */ new Map();
+		let transient = 0;
+		while (Date.now() < deadline) {
+			let aliases;
+			try {
+				aliases = await this.describeAliases(physicalId);
+				transient = 0;
+			} catch (error) {
+				if (!isTransientFsxError(error) || transient >= 5) throw error;
+				transient += 1;
+				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+				continue;
+			}
+			const byName = new Map(aliases.map((a) => [a.Name?.toLowerCase(), a.Lifecycle]));
+			for (const n of names) {
+				const lifecycle = byName.get(n);
+				if (lifecycle === transitionLifecycle) seenTransition.add(n);
+				failedReads.set(n, lifecycle === failedLifecycle ? (failedReads.get(n) ?? 0) + 1 : 0);
+			}
+			const failed = names.filter((n) => byName.get(n) === failedLifecycle && (seenTransition.has(n) || (failedReads.get(n) ?? 0) >= STALE_FAILED_READS));
+			if (failed.length > 0) throw new ProvisioningError(safeMsg`FSx FileSystem ${physicalId}: DNS alias ${failed.join(", ")} entered ${failedLifecycle}. Check the alias name and the file system's Active Directory, then re-deploy.`, resourceType, logicalId, physicalId);
+			if (names.every((n) => target === "AVAILABLE" ? byName.get(n) === "AVAILABLE" : !byName.has(n))) return;
+			this.logger.debug(safeMsg`FSx FileSystem ${physicalId}: waiting for DNS aliases ${names.join(", ")} to be ${target}...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(safeMsg`Timed out waiting for FSx FileSystem ${physicalId} DNS aliases ${names.join(", ")} to be ${target} (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, physicalId);
+	}
 	async applyTagDiff(physicalId, resourceType, logicalId, nextTags, prevTags) {
 		const plan = planTagDiff(prevTags, nextTags);
 		const arn = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0]?.ResourceARN;
@@ -43793,11 +44333,11 @@ var FSxFileSystemProvider = class {
 			Value
 		}));
 		const toRemove = plan.remove;
-		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$23({
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$24({
 			ResourceARN: arn,
 			Tags: toSet
 		}));
-		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$24({
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$25({
 			ResourceARN: arn,
 			TagKeys: toRemove
 		}));
@@ -43863,9 +44403,8 @@ var FSxFileSystemProvider = class {
 			transientState.count = 0;
 			return response.FileSystems?.[0];
 		} catch (error) {
-			const name = error instanceof Error ? error.name : "";
 			const msg = describeAwsFailure(error).detail;
-			if ((name === "ThrottlingException" || name === "ServiceLimitExceeded" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+			if (isTransientFsxError(error) && transientState.count < maxConsecutiveTransient) {
 				transientState.count += 1;
 				this.logger.debug(`Transient DescribeFileSystems error while polling ${fileSystemId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
 				return;
@@ -43886,11 +44425,10 @@ var FSxFileSystemProvider = class {
 		}
 		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} to become AVAILABLE (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
 	}
-	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation, mask) {
-		const startTime = Date.now();
+	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation, deadline, mask) {
 		const transientState = { count: 0 };
 		let seenTrackedAction = false;
-		while (Date.now() - startTime < this.maxWaitMs) {
+		while (Date.now() < deadline) {
 			const fs = await this.describeForPoll(fileSystemId, transientState);
 			if (fs) {
 				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
@@ -44079,13 +44617,26 @@ var FSxFileSystemProvider = class {
 	canonicalizeDriftProperties(resourceType, properties) {
 		if (resourceType !== "AWS::FSx::FileSystem") return properties;
 		const lustre = properties["LustreConfiguration"];
-		if (typeof lustre !== "object" || lustre === null || Array.isArray(lustre)) return properties;
+		if (typeof lustre !== "object" || lustre === null || Array.isArray(lustre)) return this.canonicalizeWindowsAliases(properties);
 		const log = lustre["LogConfiguration"];
-		if (typeof log !== "object" || log === null || Array.isArray(log) || JSON.stringify(log) !== JSON.stringify({ Level: "DISABLED" })) return properties;
+		if (typeof log !== "object" || log === null || Array.isArray(log) || JSON.stringify(log) !== JSON.stringify({ Level: "DISABLED" })) return this.canonicalizeWindowsAliases(properties);
 		const { LogConfiguration: _disabled, ...rest } = lustre;
-		return {
+		return this.canonicalizeWindowsAliases({
 			...properties,
 			LustreConfiguration: rest
+		});
+	}
+	canonicalizeWindowsAliases(properties) {
+		const windows = properties["WindowsConfiguration"];
+		if (typeof windows !== "object" || windows === null || Array.isArray(windows)) return properties;
+		const aliases = windows["Aliases"];
+		if (!Array.isArray(aliases) || aliases.every((a) => typeof a !== "string" || a === a.toLowerCase())) return properties;
+		return {
+			...properties,
+			WindowsConfiguration: {
+				...windows,
+				Aliases: aliases.map((a) => typeof a === "string" ? a.toLowerCase() : a)
+			}
 		};
 	}
 	getDriftUnknownPaths(resourceType) {
@@ -44226,6 +44777,12 @@ const toNumber$2 = (v) => {
 const jsonEqual$2 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const addInstanceGroupsLatch = new AmbiguousCreateLatch("emr:AddInstanceGroups");
 const groupsCreatedByThisProcess = new RecentIdSet();
+const MOVING_GROUP_STATES = /* @__PURE__ */ new Set([
+	"PROVISIONING",
+	"BOOTSTRAPPING",
+	"RESIZING",
+	"RECONFIGURING"
+]);
 var EMRInstanceGroupConfigProvider = class {
 	disableCcApiFallback = true;
 	client;
@@ -44426,6 +44983,7 @@ var EMRInstanceGroupConfigProvider = class {
 		this.logger.debug(`Updating EMR instance group ${logicalId}: ${physicalId}`);
 		try {
 			if (instanceCountChanged) {
+				context?.markUnsettled?.("InstanceCount");
 				await this.getClient().send(new ModifyInstanceGroupsCommand({
 					...jobFlowId && { ClusterId: jobFlowId },
 					InstanceGroups: [{
@@ -44438,6 +44996,7 @@ var EMRInstanceGroupConfigProvider = class {
 			if (autoScalingChanged) {
 				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
 				const policy = properties["AutoScalingPolicy"];
+				context?.markUnsettled?.("AutoScalingPolicy");
 				if (policy) await this.getClient().send(new PutAutoScalingPolicyCommand({
 					ClusterId: jobFlowId,
 					InstanceGroupId: physicalId,
@@ -44521,6 +45080,27 @@ var EMRInstanceGroupConfigProvider = class {
 		}
 		throw new ProvisioningError(`Timed out waiting for EMR instance group ${groupId} to reach RUNNING with ${expectedCount} instance(s) (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, groupId);
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, _names, recordedProperties) {
+		const jobFlowId = recordedProperties?.["JobFlowId"];
+		if (typeof jobFlowId !== "string" || jobFlowId === "") throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} has no JobFlowId (the cluster id) recorded, so cdkd cannot read the group to converge what an earlier failed update left unsettled`, resourceType, logicalId, physicalId);
+		const group = await this.findGroupForPoll(jobFlowId, physicalId, { count: 0 }, 0);
+		if (group === void 0) return void 0;
+		return {
+			...group.RunningInstanceCount !== void 0 && { InstanceCount: group.RunningInstanceCount },
+			...group.AutoScalingPolicy !== void 0 && { AutoScalingPolicy: group.AutoScalingPolicy }
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names, recordedProperties) {
+		if (!names.has("InstanceCount")) return /* @__PURE__ */ new Set();
+		const jobFlowId = recordedProperties?.["JobFlowId"];
+		if (typeof jobFlowId !== "string" || jobFlowId === "") return /* @__PURE__ */ new Set();
+		try {
+			const state = (await this.findGroupForPoll(jobFlowId, physicalId, { count: 0 }, 0))?.Status?.State;
+			return state !== void 0 && MOVING_GROUP_STATES.has(state) ? /* @__PURE__ */ new Set(["InstanceCount"]) : /* @__PURE__ */ new Set();
+		} catch {
+			return /* @__PURE__ */ new Set(["InstanceCount"]);
+		}
+	}
 	async findGroupForPoll(clusterId, groupId, transientState, maxConsecutiveTransient = 5) {
 		try {
 			let marker;
@@ -46182,7 +46762,7 @@ var FirehoseProvider = class {
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Firehose delivery stream ${logicalId}: ${physicalId}`);
 		const desiredEncryption = readEncryptionInput(properties[ENCRYPTION_KEY], context?.desiredFromAwsReadback === true);
-		const encryptionChanged = !sameEncryptionInput(properties[ENCRYPTION_KEY], desiredEncryption, previousProperties[ENCRYPTION_KEY]);
+		const encryptionChanged = !sameEncryptionInput(properties[ENCRYPTION_KEY], desiredEncryption, previousProperties[ENCRYPTION_KEY]) || context?.unsettledProperties?.has(ENCRYPTION_KEY) === true && desiredEncryption.kind !== "unusable";
 		let encryptionSkipped = false;
 		if (encryptionChanged && desiredEncryption.kind === "unusable") {
 			const message = `${ENCRYPTION_KEY} of Firehose delivery stream ${logicalId} is not an object with a string KeyType (and a string KeyARN, if any)`;
@@ -46251,7 +46831,7 @@ var FirehoseProvider = class {
 			const prevDest = previousProperties[activeDest] ?? {};
 			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applySnowflakeDestinationUpdate(logicalId, physicalId, nextDest);
 		}
-		if (encryptionChanged && desiredEncryption.kind !== "unusable") await this.applyEncryptionUpdate(logicalId, physicalId, resourceType, desiredEncryption, maskerOrIdentity(context?.maskSecrets));
+		if (encryptionChanged && desiredEncryption.kind !== "unusable") await this.applyEncryptionUpdate(logicalId, physicalId, resourceType, desiredEncryption, maskerOrIdentity(context?.maskSecrets), context?.markUnsettled);
 		const description = await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 		this.warnUnappliedS3BackupMode(logicalId, properties, unappliedS3BackupModeDestination(properties, previousProperties, destKey, context?.changedProperties), description.DeliveryStreamDescription);
 		const desc = description.DeliveryStreamDescription;
@@ -46332,7 +46912,7 @@ var FirehoseProvider = class {
 			}))
 		}));
 	}
-	async applyEncryptionUpdate(logicalId, physicalId, resourceType, desired, mask) {
+	async applyEncryptionUpdate(logicalId, physicalId, resourceType, desired, mask, markUnsettled) {
 		const settled = await this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
 			what: "settle",
 			done: (enc) => enc?.Status !== "ENABLING" && enc?.Status !== "DISABLING"
@@ -46340,8 +46920,9 @@ var FirehoseProvider = class {
 		if (desired.kind === "absent") {
 			if (settled?.Status !== "ENABLED" && settled?.Status !== "DISABLING_FAILED") return;
 			this.refuseToStartTransition(logicalId, physicalId, resourceType, "disable");
+			markUnsettled?.(ENCRYPTION_KEY);
 			await this.getClient().send(new StopDeliveryStreamEncryptionCommand({ DeliveryStreamName: physicalId }));
-			await this.warnIfUnfinished(logicalId, "StopDeliveryStreamEncryption", () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+			await this.warnIfUnfinished(logicalId, "StopDeliveryStreamEncryption", markUnsettled, () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
 				what: "disable",
 				done: (enc) => enc === void 0 || enc.Status === "DISABLED",
 				inProgress: "DISABLING",
@@ -46352,6 +46933,7 @@ var FirehoseProvider = class {
 		}
 		if (encryptionMatches(settled, desired)) return;
 		this.refuseToStartTransition(logicalId, physicalId, resourceType, "enable");
+		markUnsettled?.(ENCRYPTION_KEY);
 		await this.getClient().send(new StartDeliveryStreamEncryptionCommand({
 			DeliveryStreamName: physicalId,
 			DeliveryStreamEncryptionConfigurationInput: {
@@ -46359,7 +46941,7 @@ var FirehoseProvider = class {
 				...desired.keyArn !== void 0 && { KeyARN: desired.keyArn }
 			}
 		}));
-		await this.warnIfUnfinished(logicalId, "StartDeliveryStreamEncryption", () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+		await this.warnIfUnfinished(logicalId, "StartDeliveryStreamEncryption", markUnsettled, () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
 			what: "enable",
 			done: (enc) => encryptionMatches(enc, desired),
 			inProgress: "ENABLING",
@@ -46367,12 +46949,12 @@ var FirehoseProvider = class {
 			staleFailure: settled?.Status === "ENABLING_FAILED"
 		}));
 	}
-	async warnIfUnfinished(logicalId, call, wait) {
+	async warnIfUnfinished(logicalId, call, markUnsettled, wait) {
 		try {
 			return await wait();
 		} catch (error) {
 			const outcome = typeof error === "object" && error !== null && terminalEncryptionFailures.has(error) ? "AWS reported the change failed, so the stream may no longer match" : "the stream may still finish the change, so it may no longer match";
-			this.logger.warn(safeMsg`Firehose delivery stream ${logicalId}: ${call} was sent but the encryption change did not finish; ${outcome} the previous setting cdkd keeps recorded. Run 'cdkd drift' to compare, then 'cdkd drift --revert' to apply the recorded setting or 'cdkd drift --accept' to record the stream's.`);
+			this.logger.warn(safeMsg`Firehose delivery stream ${logicalId}: ${call} was sent but the encryption change did not finish; ${outcome} the previous setting cdkd keeps recorded. `.concat(markUnsettled === void 0 ? "Run 'cdkd drift' to compare, then 'cdkd drift --revert' to apply the recorded setting or 'cdkd drift --accept' to record the stream's." : `cdkd records ${ENCRYPTION_KEY} as unsettled, so the next 'cdkd deploy' reads the stream and applies the template's setting. To keep the stream as it ends up instead, run 'cdkd drift --accept' once the stream no longer reads ENABLING or DISABLING (an accept during the transition keeps the key unsettled).`));
 			throw error;
 		}
 	}
@@ -46790,6 +47372,15 @@ var FirehoseProvider = class {
 		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
 		return result;
 	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		if (!names.has(ENCRYPTION_KEY)) return /* @__PURE__ */ new Set();
+		try {
+			const status = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription?.DeliveryStreamEncryptionConfiguration?.Status;
+			return status === "ENABLING" || status === "DISABLING" ? /* @__PURE__ */ new Set([ENCRYPTION_KEY]) : /* @__PURE__ */ new Set();
+		} catch {
+			return /* @__PURE__ */ new Set([ENCRYPTION_KEY]);
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let desc;
 		try {
@@ -48105,11 +48696,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !Object.hasOwn(newTagMap, k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$25({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$26({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$24({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$25({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -48552,7 +49143,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = plan.remove;
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$26({
+					await this.getClient().send(new UntagResourceCommand$27({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -48560,7 +49151,7 @@ var DLMLifecyclePolicyProvider = class {
 				}
 				const tagsToAdd = Object.fromEntries(plan.set);
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$25({
+					await this.getClient().send(new TagResourceCommand$26({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -48724,11 +49315,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${mask(physicalId)}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$26({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$27({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$27({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$28({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -49011,12 +49602,12 @@ var S3DirectoryBucketProvider = class {
 			if (removedKeys.length > 0 || tagsToApply.length > 0) {
 				const accountId = await this.getAccountId();
 				const resourceArn = await this.buildBucketArn(physicalId, accountId);
-				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$28({
+				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$29({
 					AccountId: accountId,
 					ResourceArn: resourceArn,
 					TagKeys: removedKeys
 				}));
-				if (tagsToApply.length > 0) await this.getS3ControlClient().send(new TagResourceCommand$27({
+				if (tagsToApply.length > 0) await this.getS3ControlClient().send(new TagResourceCommand$28({
 					AccountId: accountId,
 					ResourceArn: resourceArn,
 					Tags: tagsToApply
@@ -49864,7 +50455,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(safeMsg`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone ` + `or state is out-of-sync. Refusing to silently drop the tag update. If the table was deleted out-of-band, drop just this resource's record with the command below, filling in the construct path the CDK app gave this resource — its aws:cdk:path Metadata entry in the synthesized template.\nClean up with: cdkd orphan ${commandHole("constructPath")}`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$29({
+			await this.getClient().send(new UntagResourceCommand$30({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -49873,7 +50464,7 @@ var S3TablesProvider = class {
 			throw this.wrapCaughtError(mask, err, (text) => new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${sentence(text)} State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause));
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$28({
+			await this.getClient().send(new TagResourceCommand$29({
 				resourceArn,
 				tags: upserts
 			}));
@@ -49891,7 +50482,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$29({
+			await this.getClient().send(new UntagResourceCommand$30({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -49900,7 +50491,7 @@ var S3TablesProvider = class {
 			throw this.wrapCaughtError(mask, err, (text) => new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${sentence(text)} State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause));
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$28({
+			await this.getClient().send(new TagResourceCommand$29({
 				resourceArn,
 				tags: upserts
 			}));
@@ -51020,4 +51611,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-BxfIHcea.js.map
+//# sourceMappingURL=provider-classes-DYke4HKr.js.map