@go-to-k/cdkd 0.309.0 → 0.311.0

package/dist/{provider-classes-DYke4HKr.js → provider-classes-DktsDsTf.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbWaitStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-D94wh05t.js";
+import { $ as observeThenDisableProtection, A as RESOURCE_NOT_FOUND, An as ProvisioningError, Ar as wrapMaskedAwsError, At as isSecretDerivedValue, B as refusalTypeShown, Bt as isAuxiliaryFailure, C as ambiguousAttemptLead, Cr as isTransientServerError, Ct as logicalIdShown, D as replayedSendWindow, Dr as isThrottlingError, Dt as stateOrphanRecordRemedy, E as replayFollowedAmbiguousAttempt, Er as isMarkedNonRetryable, Et as segmentAfterAnchor, F as isPlainImportJson, H as resolveExplicitPhysicalId, Ht as markAuxiliaryFailure, I as isPlainImportValue, It as clearCreatedBeforeFailure, Jn as isInertUnquoted, K as deleteAfterProtectionFlipWithFinalSnapshot, Kn as commandHole, L as isQuotableImportValue, M as markNotGone, Mn as ResourceUpdateNotSupportedError, Mt as maskerOrIdentity, N as assertRegionMatch, Nt as withDerivedNameMasks, O as setBounded, Or as markNonRetryable, Ot as createMaskedLogSinks, P as VALUE_NOT_SHOWN, Q as logGroupProtectionSite, R as normalizeAwsTagsToCfn, S as RecentIdSet, Sr as isRetryableTransientError, St as compositeIdSkipResult, T as isInsideWindow, Tr as THROTTLING_ERROR_NAMES, Ut as markCreatedBeforeFailure, V as remedyLogicalId, W as ProtectionFlipRegistry, Wt as markSupersedesEarlierCreate, X as isTerminalDbWaitStatus, Yn as pasteableCommand, Z as isTerminalDeleteFailure, Zn as plainOrDescribed, _t as isInterruptedWaitError, a as retractCreatedResource, b as AMBIGUOUS_LATCH_TTL_MS, br as isExplicitDenyError, bt as compositeIdFormatMessage, c as SECRET_DERIVED_READ_LIVE, cn as withPasteableAwsProfile, ct as isAwsCliLiteral, d as readPrincipalLists, dn as clientDefaultsFor, dr as markReplayMayCollide, dt as renderDisableCommand, er as shellQuote, et as protectionFlipKey, fn as credentialFingerprint, fr as relayedNameCollision, ft as ElapsedBudgetRegistry, gr as explicitDenyPolicyKind, h as clearOnUpdateRemoval, hn as CdkdError, i as reportCreatedResource, in as injectiveKeyPrefix, it as userPoolProtectionSite, jt as maskDeep, k as withoutServerErrorRetries, kr as markRedactedCause, kt as createMaskedRetryLogger, l as holdsSecretDerivedEntry, ln as ambientClientDefaults, lt as pasteableAwsCommand, ot as UNNAMEABLE_ID_CLAUSE, p as recordedPrincipalsRepair, pn as AccountIdUnavailableError, q as deleteWithProtectionCompensation, qn as hasClauseBreak, rn as injectiveKey, st as WITHHELD_AWS_COMMAND, tr as withheldTargetClause, tt as rdsFamilyProtectionSite, u as onlySecretDerived, un as ambientCredentialConfig, ur as markNameCollision, ut as protectedReplacementAdvice, v as withRemovalDefaults, vt as startInterruptWatch, w as createAttemptKey, wt as packCompositeId, x as AmbiguousCreateLatch, xt as compositeIdSeparatorRefusal, yr as isAmbiguousOutcomeError, yt as canonicalizeRoute53QueryName, z as quotedRemedyLogicalId } from "./created-resource-sink-DlzoIY-1.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $l as stringifyValue, $s as readConfigString, $t as lookupEachName, A as beginDeleteWait, Aa as s3BucketRegionalDomainName, Ai as isRefusedByName, Ar as awaitInFlightSibling, As as withheldAccountClause, B as waitForIndexesSettled, Bi as stringifyIfAssigned, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cd as resolveAssemblyPath, Co as accountArgs, D as reverseMapTableContributorInsights, Da as s3BucketArn, E as reverseMapIndexContributorInsights, Ea as isSettledInstanceState, Ec as passedNoEchoParametersOf, Ei as acquireIdempotencyToken, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fc as snapshotPassProvenance, Fi as readTagList, G as sendTtlWaitingOutRateLimit, Gs as isWarmThroughputDecrease, H as isTtlRateLimited, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as outputReferenceProvenanceOf, Ii as refuseMalformedDesiredTags, In as REDACTED_DELETE_ADDRESS_SKIP_REASON, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Js as coerceCfnBoolean, K as ECR_AUTO_DELETE_IMAGES_TAG, Ki as waitForLambdaFunctionActive, Ks as toCfnInteger, L as deleteTableWithIndexBusyRetry, Li as tagMapAsList, Ln as isRedactedRecordedValue, M as deleteBudgetKey, Mc as markSameGenerationBag, Mi as DBPROXY_TAGS_WHAT, Mr as getStackRecords, Ms as findSilentDropProperties, N as resolveDynamoDbDeleteBudgetClock, Nc as redactForState, Ni as DBPROXY_TAG_OPTIONS, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oa as s3BucketDomainName, P as resolveDynamoDbDeleteBudgetMs, Pc as recordReferenceProvenanceEntry, Pi as planTagDiff, Pn as getCurrentProducerRegions, Pr as replacedDeleteFailureVerdict, Ps as withoutSilentDropProperties, Qc as withoutPhysicalNameCopies, Qo as refuseMalformedNestedChildOutputs, Qs as configStringRefusal, Qt as isAccessDeniedError, R as maskedLogger, Rc as hasMaskableValues, Ri as tagPlanWarning, Rn as redactedDeleteAddressFields, S as indexDeclaresContributorInsights, Sd as renderAssemblyPathEscape, Si as earliestDefined, T as readContributorInsightsSpec, U as planTimeToLive, Us as WARM_THROUGHPUT_MEMBERS, V as isTtlAlreadyDisabled, Vt as withNestedStackContext, W as readTtlSpec, Ws as coerceWarmThroughput$1, X as getPriorAttempts, Xi as getCurrentResourceSecrets, Xl as timePhase, Xs as configBooleanRefusal, Y as isTruthyCfnBoolean, Ys as coerceCfnInteger, Z as markRefusedBeforeApplying, Zs as configIntegerRefusal, Zt as chunks, _ as streamMemberRefusals, _a as reDisableInstanceApiTermination, b as CONTRIBUTOR_INSIGHTS_KEY, bd as describeFileReadFailure, c as DynamoDBGlobalTableProvider, cc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, cl as physicalNameCopiesOf, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as isWaitAbandonedError, dc as emrClusterInstancesReplaced, ec as replayWarn, el as dynamicReferenceTokens, en as withApiLimit, f as declaredStreamTagsMember, fa as markWaitAbandoned, fc as canonicalLambdaFunctionName, fl as carriesSecretMask, g as streamDeclaresTags, ga as observeThenDisableInstanceApiTermination, go as passedParameterClassesOf, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ha as isTerminationProtectionPropagationError, ht as enclosingDeadlineExpired, ia as unchangedBehindSecretReference, iu as rewriteTemplateAssetReferences, j as compensateRemovedDeletionProtection, ja as s3BucketWebsiteUrl, ji as markDeleteStarted, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as s3BucketDualStackDomainName, l as STREAM_POLICY_KEY, la as deleteSkipReason, li as secretNamedAttributeNamesOf, ll as recordAttributeIdCopy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as ec2InstanceProtectionSite, mc as sameLambdaFunctionAddress, na as slowCcOperationTimeoutMs, nc as requireConfigObject, no as getAccountInfo, od as canonicalizeRegion, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pc as lambdaFunctionNameForMask, po as parseWebACLArn, q as S3_AUTO_DELETE_OBJECTS_TAG, qs as toFiniteNumber, ra as onlySecretReferencesDiffer, rc as requireConfigString, rd as decodeListingKey, sc as withRetry, sd as derivePartitionAndUrlSuffix, sl as recoverMaskedOutput, st as isAbsoluteAssetPath, t as DeployEngine, tc as requireConfigArray, u as STREAM_TAGS_KEY, ua as withIndeterminateGuard, uc as ecsServiceLaunchTypeSetOrChanged, v as streamPolicyMatchesDeclared, va as reEnableInstanceApiTermination, vs as refuseMalformedResourcesForDestroy, w as planIndexContributorInsightsOps, wi as reserveStackCreateToken, x as contributorInsightsRefusals, xd as displayAssemblyPath, y as streamTagsMatchDeclared, z as relayedIndexBusyDelete, zi as definedAttributes, zn as redactedDeleteAddressSkip } from "./deploy-engine-tQ0aqZMo.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BI8Acvps.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Bnt3Yt0k.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-BUG7NMWS.js";
-import { RDSProvider } from "./rds-provider-Qpf09VQv.js";
-import { NeptuneProvider } from "./neptune-provider-DmVmx69p.js";
-import { ASGProvider } from "./asg-provider-DQoKGfKH.js";
+import { $s as coerceCfnBoolean, $t as isAccessDeniedError, A as DYNAMODB_DELETE_POLL_COST_MS, B as relayedIndexBusyDelete, Bc as snapshotPassProvenance, Bi as tagPlanWarning, Bn as redactedDeleteAddressSkip, C as planContributorInsightsOp, Ca as isUsableAttemptedName, Cs as refuseMalformedResourcesForDestroy, D as reverseMapTableContributorInsights, Dd as renderAssemblyPathEscape, E as reverseMapIndexContributorInsights, Ed as displayAssemblyPath, Ei as reserveStackCreateToken, F as resolveDynamoDbDeleteBudgetMs, Fa as s3BucketRegionalDomainName, Fi as DBPROXY_TAG_OPTIONS, Fn as getCurrentProducerRegions, Fr as replacedDeleteFailureVerdict, Fs as withheldAccountClause, G as readTtlSpec, H as isTtlAlreadyDisabled, Hi as stringifyIfAssigned, Ht as withNestedStackContext, I as DELETE_INDEX_WAIT_PROCEED_NOTE, Ia as s3BucketWebsiteUrl, Ii as planTagDiff, J as S3_AUTO_DELETE_OBJECTS_TAG, Ji as waitForLambdaFunctionActive, Js as WARM_THROUGHPUT_MEMBERS, K as sendTtlWaitingOutRateLimit, L as INDEX_SETTLE_POLL_INTERVAL_MS, Lc as markSameGenerationBag, Li as readTagList, Ln as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ls as findSilentDropProperties, Lt as revertNestedChildFromJournal, M as compensateRemovedDeletionProtection, Ma as s3BucketArn, Mi as isRefusedByName, N as deleteBudgetKey, Na as s3BucketDomainName, Ni as markDeleteStarted, Nr as getStackRecords, O as stripIndexContributorInsights, Od as resolveAssemblyPath, Oi as acquireIdempotencyToken, Oo as accountArgs, P as resolveDynamoDbDeleteBudgetClock, Pa as s3BucketDualStackDomainName, Pi as DBPROXY_TAGS_WHAT, Pt as getNestedRevertRun, Q as markRefusedBeforeApplying, Qi as getCurrentResourceSecrets, Qs as toFiniteNumber, Qt as chunks, R as deleteTableWithIndexBusyRetry, Rc as redactForState, Ri as refuseMalformedDesiredTags, Rn as isRedactedRecordedValue, S as indexDeclaresContributorInsights, T as readContributorInsightsSpec, Td as describeFileReadFailure, U as isTtlRateLimited, Uc as hasMaskableValues, V as waitForIndexesSettled, Va as outputReferenceProvenanceOf, Vi as definedAttributes, Vt as getCurrentNestedStackContext, W as planTimeToLive, X as isTruthyCfnBoolean, Xs as isWarmThroughputDecrease, Y as hasCdkAutoDeleteTag, Ys as coerceWarmThroughput$1, Z as getPriorAttempts, Zs as toCfnInteger, _ as streamMemberRefusals, _a as isTerminationProtectionPropagationError, _c as canonicalLambdaFunctionName, _l as carriesSecretMask, _t as enclosingDeadlineRemainingMs, aa as onlySecretReferencesDiffer, ac as replayWarn, al as dynamicReferenceTokens, b as CONTRIBUTOR_INSIGHTS_KEY, ba as reEnableInstanceApiTermination, c as DynamoDBGlobalTableProvider, cc as requireConfigString, cd as decodeListingKey, ct as isAbsoluteAssetPath, d as declaredStreamPolicyMember, da as deleteSkipReason, dd as canonicalizeRegion, di as secretNamedAttributeNamesOf, ec as coerceCfnInteger, en as lookupEachName, f as declaredStreamTagsMember, fa as withIndeterminateGuard, fc as withRetry, fd as derivePartitionAndUrlSuffix, fl as recoverMaskedOutput, g as streamDeclaresTags, ga as ec2InstanceProtectionSite, gc as emrClusterInstancesReplaced, gt as enclosingDeadlineExpired, h as streamDeclaresPolicy, hc as ecsServiceLaunchTypeSetOrChanged, ia as slowCcOperationTimeoutMs, ic as readConfigString, iu as stringifyValue, j as beginDeleteWait, ja as isSettledInstanceState, jc as passedNoEchoParametersOf, jr as awaitInFlightSibling, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, l as STREAM_POLICY_KEY, lt as listNestedTemplateRows, lu as rewriteTemplateAssetReferences, m as reverseMapStreamPolicy, ma as markWaitAbandoned, ml as recordAttributeIdCopy, nc as configIntegerRefusal, oa as unchangedBehindSecretReference, oc as requireConfigArray, p as planStreamMemberOps, pa as isWaitAbandonedError, pc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, pl as physicalNameCopiesOf, q as ECR_AUTO_DELETE_IMAGES_TAG, rc as configStringRefusal, rl as withoutPhysicalNameCopies, rs as refuseMalformedNestedChildOutputs, sc as requireConfigObject, so as getAccountInfo, st as findNestedTemplateTreeDefect, t as DeployEngine, tc as configBooleanRefusal, tn as withApiLimit, tu as timePhase, u as STREAM_TAGS_KEY, ut as renderNestedTemplateTreeDefect, v as streamPolicyMatchesDeclared, va as observeThenDisableInstanceApiTermination, vc as lambdaFunctionNameForMask, vo as parseWebACLArn, w as planIndexContributorInsightsOps, wi as earliestDefined, x as contributorInsightsRefusals, xo as passedParameterClassesOf, y as streamTagsMatchDeclared, ya as reDisableInstanceApiTermination, yc as sameLambdaFunctionAddress, z as maskedLogger, zc as recordReferenceProvenanceEntry, zi as tagMapAsList, zn as redactedDeleteAddressFields, zs as withoutSilentDropProperties } from "./deploy-engine-BF5exXUb.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-qvhlVnrn.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DbnTHlwR.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-1y0kIPCO.js";
+import { RDSProvider } from "./rds-provider-0LUsn9Wl.js";
+import { NeptuneProvider } from "./neptune-provider-D9ac71Ca.js";
+import { ASGProvider } from "./asg-provider-CIg_guZ-.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -57,7 +57,7 @@ import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand
 import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventConfigurationCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventConfigurationCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
@@ -656,6 +656,7 @@ var IAMManagedPolicyProvider = class {
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
 			createdPolicyIdentity = policyIdentityToken(response.Policy?.PolicyId);
+			reportCreatedResource(logicalId, resourceType, policyArn, createdPolicyIdentity);
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
 			try {
 				await this.attachToPrincipals(policyArn, principals.lists.Groups, principals.lists.Roles, principals.lists.Users, log);
@@ -664,6 +665,7 @@ var IAMManagedPolicyProvider = class {
 					await this.detachAllPrincipals(policyArn);
 					await this.deleteAllNonDefaultVersions(policyArn);
 					await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: policyArn }));
+					retractCreatedResource(logicalId, resourceType, policyArn);
 					leftBehindArn = void 0;
 					log.debug(`Cleaned up partially-created managed policy ${logicalId} (${v(policyArn)}) after attachment failure`);
 				} catch (cleanupError) {
@@ -1263,6 +1265,7 @@ var IAMInstanceProfileProvider = class {
 			}));
 			leftBehind = true;
 			createdProfileIdentity = instanceProfileIdentityToken(response.InstanceProfile?.InstanceProfileId);
+			reportCreatedResource(logicalId, resourceType, instanceProfileName, createdProfileIdentity);
 			log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
 			const attachedRoles = [];
 			try {
@@ -1285,6 +1288,7 @@ var IAMInstanceProfileProvider = class {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
 					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
+					retractCreatedResource(logicalId, resourceType, instanceProfileName);
 					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${v(instanceProfileName)}) after wiring failure`);
 				} catch (cleanupError) {
@@ -1534,12 +1538,14 @@ var IAMAccessKeyProvider = class {
 			const accessKeyId = response.AccessKey?.AccessKeyId;
 			const secretAccessKey = response.AccessKey?.SecretAccessKey;
 			leftBehindKeyId = accessKeyId;
+			reportCreatedResource(logicalId, resourceType, accessKeyId ?? "");
 			if (!accessKeyId || !secretAccessKey) {
 				if (accessKeyId) try {
 					await this.iamClient.send(new DeleteAccessKeyCommand({
 						UserName: userName,
 						AccessKeyId: accessKeyId
 					}));
+					retractCreatedResource(logicalId, resourceType, accessKeyId);
 					leftBehindKeyId = void 0;
 				} catch (cleanupError) {
 					const lead = `Failed to clean up IAM access key ${logicalId} (${v(accessKeyId)}) minted by a partial CreateAccessKey response`;
@@ -1559,6 +1565,7 @@ var IAMAccessKeyProvider = class {
 						UserName: userName,
 						AccessKeyId: accessKeyId
 					}));
+					retractCreatedResource(logicalId, resourceType, accessKeyId);
 					leftBehindKeyId = void 0;
 					log.debug(`Cleaned up partially-created IAM access key ${logicalId} (${v(accessKeyId)}) after status wiring failure`);
 				} catch (cleanupError) {
@@ -1584,7 +1591,10 @@ var IAMAccessKeyProvider = class {
 			};
 		} catch (error) {
 			const reconciled = await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log);
-			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
+			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) {
+				retractCreatedResource(logicalId, resourceType, leftBehindKeyId);
+				leftBehindKeyId = void 0;
+			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindKeyId !== void 0) {
@@ -1935,6 +1945,7 @@ var IAMUserGroupProvider = class {
 			const response = await (await this.createClient.get()).send(new CreateUserCommand(createParams));
 			leftBehind = true;
 			createdUserIdentity = userOrGroupIdentityToken(response.User?.UserId);
+			reportCreatedResource(logicalId, resourceType, userName, createdUserIdentity);
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
 				if (permissionsBoundary) {
@@ -1995,6 +2006,7 @@ var IAMUserGroupProvider = class {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
 					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
+					retractCreatedResource(logicalId, resourceType, userName);
 					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM user ${logicalId} (${v(userName)}) after wiring failure`);
 				} catch (cleanupError) {
@@ -2337,6 +2349,7 @@ var IAMUserGroupProvider = class {
 			const response = await (await this.createClient.get()).send(new CreateGroupCommand(createParams));
 			leftBehind = true;
 			createdGroupIdentity = userOrGroupIdentityToken(response.Group?.GroupId);
+			reportCreatedResource(logicalId, resourceType, groupName, createdGroupIdentity);
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
 				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
@@ -2361,6 +2374,7 @@ var IAMUserGroupProvider = class {
 					await this.detachAllGroupPolicies(groupName, log);
 					await this.deleteAllGroupInlinePolicies(groupName, log);
 					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
+					retractCreatedResource(logicalId, resourceType, groupName);
 					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM group ${logicalId} (${v(groupName)}) after wiring failure`);
 				} catch (cleanupError) {
@@ -4803,6 +4817,7 @@ var S3BucketProvider = class S3BucketProvider {
 				}
 				createdNewBucket = adoptedOwnLeftover || preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
+				if (createdNewBucket) reportCreatedResource(logicalId, resourceType, bucketName);
 				if (createdNewBucket) windowSpent = true;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
 				if (preflight.kind === "region" && !adoptedOwnLeftover) this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
@@ -4832,6 +4847,7 @@ var S3BucketProvider = class S3BucketProvider {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
 					bucketLeftBehind = false;
+					retractCreatedResource(logicalId, resourceType, bucketName);
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) after wiring failure`);
 				} catch (cleanupError) {
 					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}): ${describeAwsFailure(cleanupError).detail}`);
@@ -6263,7 +6279,7 @@ function normalizeStatement(statement) {
 	for (const key of PRINCIPAL_KEYS) if (Object.prototype.hasOwnProperty.call(out, key)) out[key] = normalizePrincipal(out[key]);
 	return out;
 }
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -6287,7 +6303,7 @@ function policyContentKey(document) {
 		if (Object.prototype.hasOwnProperty.call(doc, "Statement")) doc["Statement"] = (Array.isArray(doc["Statement"]) ? doc["Statement"] : [doc["Statement"]]).map(normalizeStatement);
 		value = doc;
 	}
-	return canonicalJson$2(value);
+	return canonicalJson$3(value);
 }
 
 //#endregion
@@ -6565,7 +6581,7 @@ function listedQueues(bag) {
 function isListedQueueUrl(value) {
 	return isSqsQueueUrl(value) && !value.includes(",") && !value.includes("*");
 }
-function canonicalJson$1(value) {
+function canonicalJson$2(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -6580,14 +6596,14 @@ function canonicalJson$1(value) {
 }
 function canonicalPolicy$1(text) {
 	try {
-		return canonicalJson$1(JSON.parse(text));
+		return canonicalJson$2(JSON.parse(text));
 	} catch {
 		return `raw:${text}`;
 	}
 }
 function policyReference(document) {
 	if (typeof document === "string" && document.length > 0) return canonicalPolicy$1(document);
-	if (document !== null && typeof document === "object") return canonicalJson$1(document);
+	if (document !== null && typeof document === "object") return canonicalJson$2(document);
 }
 function splitQueueUrls(physicalId) {
 	return physicalId.split(",").filter((url) => url.length > 0);
@@ -6683,7 +6699,8 @@ var SNSTopicProvider = class {
 			if (properties["MaximumMessageSize"] != null) topicAttributes["MaximumMessageSize"] = stringifyValue(properties["MaximumMessageSize"]);
 			let tags;
 			if (properties["Tags"] != null) tags = desiredTags;
-			const heldBefore = Boolean(properties["ArchivePolicy"]) || Boolean(properties["DataProtectionPolicy"]) || properties["DeliveryStatusLogging"] != null || Array.isArray(properties["Subscription"]) ? await this.topicHeldBefore(topicName) : "free";
+			const wiringDeclared = Boolean(properties["ArchivePolicy"]) || Boolean(properties["DataProtectionPolicy"]) || properties["DeliveryStatusLogging"] != null || Array.isArray(properties["Subscription"]);
+			const heldBefore = wiringDeclared ? await this.topicHeldBefore(topicName) : "free";
 			const createParams = {
 				Name: topicName,
 				...Object.keys(topicAttributes).length > 0 && { Attributes: topicAttributes },
@@ -6691,6 +6708,7 @@ var SNSTopicProvider = class {
 			};
 			const topicArn = (await this.snsClient.send(new CreateTopicCommand(createParams))).TopicArn;
 			if (!topicArn) throw new Error("CreateTopic did not return TopicArn");
+			if (wiringDeclared && heldBefore === "free") reportCreatedResource(logicalId, resourceType, topicArn);
 			try {
 				if (properties["ArchivePolicy"]) {
 					const archivePolicy = typeof properties["ArchivePolicy"] === "string" ? properties["ArchivePolicy"] : JSON.stringify(properties["ArchivePolicy"]);
@@ -6722,6 +6740,7 @@ var SNSTopicProvider = class {
 				if (heldBefore !== "free") warn(skippedCleanupText(heldBefore, `SNS topic ${logicalId} (${topicArn})`, pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()));
 				else try {
 					await this.snsClient.send(new DeleteTopicCommand({ TopicArn: topicArn }));
+					retractCreatedResource(logicalId, resourceType, topicArn);
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = topicArn;
@@ -7609,7 +7628,7 @@ var SNSTopicPolicyProvider = class {
 		if (candidates.length === 0) return [];
 		let reference;
 		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy(document);
-		else if (document !== null && typeof document === "object") reference = canonicalJson(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$1(document);
 		if (reference === void 0) {
 			this.logger.warn(mask(safeMsg`The topics ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`));
 			return [];
@@ -7726,7 +7745,7 @@ function defaultTopicPolicy(topicArn) {
 		}]
 	});
 }
-function canonicalJson(value) {
+function canonicalJson$1(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -7740,7 +7759,7 @@ function canonicalJson(value) {
 }
 function canonicalPolicy(text) {
 	try {
-		return canonicalJson(JSON.parse(text));
+		return canonicalJson$1(JSON.parse(text));
 	} catch {
 		return `raw:${text}`;
 	}
@@ -8059,6 +8078,7 @@ var LambdaFunctionProvider = class {
 			functionCreated = true;
 			createdFunctionName = response.FunctionName || functionName;
 			createdFunctionIdentity = functionIdentityToken(response.FunctionArn, response.LastModified);
+			reportCreatedResource(logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
 			const recursiveLoop = properties["RecursiveLoop"];
 			if (recursiveLoop !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 				FunctionName: functionName,
@@ -8093,6 +8113,7 @@ var LambdaFunctionProvider = class {
 					minDelay: 1,
 					maxDelay: 5
 				}, { FunctionName: functionName });
+				reportCreatedResource(logicalId, resourceType, createdFunctionName);
 				await this.putRuntimeManagementConfig(functionName, runtimeManagementConfig);
 				createdFunctionIdentity = void 0;
 			}, {
@@ -8117,6 +8138,7 @@ var LambdaFunctionProvider = class {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(safeStringify(error))));
 			if (createdFunctionName !== void 0 && !postCreateCleanup.deleted) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
+			else if (createdFunctionName !== void 0) retractCreatedResource(logicalId, resourceType, createdFunctionName);
 			throw thrown;
 		}
 	}
@@ -10398,6 +10420,7 @@ var LambdaMicrovmImageProvider = class {
 			const imageArn = response.imageArn;
 			createdArn = imageArn;
 			if (!imageArn) throw new ProvisioningError(`CreateMicrovmImage succeeded but no imageArn returned for ${logicalId}`, resourceType, logicalId);
+			reportCreatedResource(logicalId, resourceType, imageArn);
 			this.logger.debug(`Created MicroVM image ${logicalId}: ${imageArn} (state=${response.state})`);
 			const noWait = process.env["CDKD_NO_WAIT"] === "true";
 			let latest = {
@@ -10656,15 +10679,15 @@ function buildCommonImageInput(properties) {
 	return input;
 }
 function mapCodeArtifact(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	const uri = value["Uri"];
 	return typeof uri === "string" ? { uri } : void 0;
 }
 function mapLogging(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	if (value["Disabled"] === true) return { disabled: {} };
 	const cloudWatch = value["CloudWatch"];
-	if (isRecord$1(cloudWatch)) {
+	if (isRecord$2(cloudWatch)) {
 		const cw = {};
 		if (typeof cloudWatch["LogGroup"] === "string") cw.logGroup = cloudWatch["LogGroup"];
 		if (typeof cloudWatch["LogStream"] === "string") cw.logStream = cloudWatch["LogStream"];
@@ -10673,32 +10696,32 @@ function mapLogging(value) {
 }
 function mapCpuConfigurations(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$1).map((c) => ({ architecture: c["Architecture"] }));
+	return value.filter(isRecord$2).map((c) => ({ architecture: c["Architecture"] }));
 }
 function mapResources(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$1).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
+	return value.filter(isRecord$2).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
 }
 function mapHooks(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	return lowerFirstKeysDeep(value);
 }
 function mapKeyValueListToRecord(value) {
 	if (!Array.isArray(value)) return void 0;
 	const out = {};
-	for (const entry of value) if (isRecord$1(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
+	for (const entry of value) if (isRecord$2(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
 	return Object.keys(out).length > 0 ? out : void 0;
 }
 function lowerFirstKeysDeep(value) {
 	if (Array.isArray(value)) return value.map(lowerFirstKeysDeep);
-	if (isRecord$1(value)) {
+	if (isRecord$2(value)) {
 		const out = {};
 		for (const [k, v] of Object.entries(value)) out[k.charAt(0).toLowerCase() + k.slice(1)] = lowerFirstKeysDeep(v);
 		return out;
 	}
 	return value;
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -10784,7 +10807,10 @@ var LambdaWebFunctionRevisionProvider = class {
 				throw error;
 			}
 			createdArn = response.revisionArn;
-			if (createdArn) revisionsCreatedByThisProcess.add(createdArn);
+			if (createdArn) {
+				revisionsCreatedByThisProcess.add(createdArn);
+				reportCreatedResource(logicalId, resourceType, createdArn);
+			}
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, replayWindow, log, input.functionName);
 			if (!createdArn || !response.revisionId) throw new ProvisioningError(`CreateWebFunctionRevision succeeded but returned no revision ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
@@ -10798,6 +10824,7 @@ var LambdaWebFunctionRevisionProvider = class {
 			let leftBehindArn = createdArn;
 			if (leftBehindArn) try {
 				await this.delete(logicalId, leftBehindArn, resourceType, void 0, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
+				retractCreatedResource(logicalId, resourceType, leftBehindArn);
 				leftBehindArn = void 0;
 			} catch (cleanupError) {
 				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
@@ -11167,6 +11194,7 @@ var LambdaWebFunctionEndpointProvider = class {
 		try {
 			createdArn = (await this.client.send(new CreateWebFunctionEndpointCommand(input))).endpointArn;
 			if (!createdArn) throw new ProvisioningError(`CreateWebFunctionEndpoint succeeded but returned no endpoint ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			reportCreatedResource(logicalId, resourceType, createdArn);
 			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, resourceType, "create", void 0, context?.maskSecrets);
 			return {
 				physicalId: createdArn,
@@ -11510,6 +11538,7 @@ var LambdaNetworkConnectorProvider = class {
 		try {
 			createdArn = (await this.client.send(new CreateNetworkConnectorCommand(input))).Arn;
 			if (!createdArn) throw new ProvisioningError(`CreateNetworkConnector succeeded but returned no ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			reportCreatedResource(logicalId, resourceType, createdArn);
 			const settled = await this.waitForSettled(createdArn, logicalId, "create");
 			createToken.release();
 			return {
@@ -11739,6 +11768,58 @@ function versionOfArn(arn) {
 	return match ? Number(match[1]) : void 0;
 }
 
+//#endregion
+//#region src/provisioning/delete-gone-wait.ts
+async function waitForGoneAfterDelete(opts) {
+	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+	const now = opts.now ?? Date.now;
+	const userTimeoutMs = resolvedResourceTimeoutMs(opts.resourceType);
+	const maxWaitMs = userTimeoutMs === void 0 ? opts.maxWaitMs : Math.min(opts.maxWaitMs, userTimeoutMs / 2);
+	const startedAt = now();
+	const stopped = `${opts.what}: the delete was ACCEPTED by AWS, but cdkd stopped waiting for it to disappear`;
+	const consequence = "AWS finishes the delete on its side; until it does, a create of the same name is refused with \"already exists\".";
+	const watch = startInterruptWatch(`${opts.what} deletion wait`);
+	try {
+		let lastStatus;
+		let sawNonFailedStatus = false;
+		for (;;) {
+			if (watch.isInterrupted()) {
+				opts.logger.warn(safeMsg`${stopped} (interrupted). ${consequence}`);
+				return;
+			}
+			try {
+				const status = await opts.describe();
+				if (status === void 0) {
+					opts.logger.debug(safeMsg`${opts.what} is gone`);
+					return;
+				}
+				const failure = opts.failedStatus?.(status);
+				if (failure !== void 0) {
+					if (sawNonFailedStatus || now() - startedAt >= opts.pollIntervalMs) throw markWaitAbandoned(failure);
+				} else sawNonFailedStatus = true;
+				lastStatus = status;
+				opts.logger.debug(safeMsg`${opts.what} status: ${status}, waiting for it to disappear`);
+			} catch (error) {
+				if (isWaitAbandonedError(error)) throw error;
+				if (!isThrottlingError(error) && !isTransientServerError(error)) {
+					opts.logger.debug(safeMsg`${opts.what}: status read failed: ${describeAwsFailure(error).detail}`);
+					opts.logger.warn(safeMsg`${stopped}: its status could not be read (${describeAwsFailure(error).summary}). ${consequence}`);
+					return;
+				}
+				opts.logger.debug(safeMsg`${opts.what}: status read throttled or failed transiently, re-polling`);
+			}
+			const remainingMs = maxWaitMs - (now() - startedAt);
+			if (remainingMs <= 0) {
+				opts.logger.warn(safeMsg`${stopped} after ${Math.round(maxWaitMs / 1e3)}s` + safeMsg`${lastStatus !== void 0 ? ` (last status: ${lastStatus})` : ""}. ${consequence}`);
+				return;
+			}
+			await sleep(Math.min(opts.pollIntervalMs, remainingMs));
+		}
+	} finally {
+		watch.dispose();
+	}
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
@@ -12150,6 +12231,10 @@ const tableNameReleaseWait = {
 	maxPolls: 600,
 	intervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
 };
+const tableDeleteGoneWait = {
+	maxWaitMs: 600 * DYNAMODB_DELETE_POLL_COST_MS,
+	pollIntervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
+};
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	createClient;
@@ -12280,6 +12365,7 @@ var DynamoDBTableProvider = class {
 			const createOut = await (await this.getCreateClient()).send(new CreateTableCommand(createParams));
 			tableCreated = true;
 			createdTableId = createOut?.TableDescription?.TableId;
+			reportCreatedResource(logicalId, resourceType, tableName, createdTableId);
 			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
 			const tableInfo = await timePhase("provider waits", "DynamoDB table: wait for ACTIVE", () => this.waitForTableActive(tableName), logicalId);
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
@@ -12307,6 +12393,7 @@ var DynamoDBTableProvider = class {
 			if (tableCreated) {
 				try {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+					retractCreatedResource(logicalId, resourceType, tableName);
 					debug(`Rolled back partially-created DynamoDB table ${tableName}`);
 				} catch (cleanupError) {
 					tableLeftBehind = true;
@@ -12370,7 +12457,10 @@ var DynamoDBTableProvider = class {
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
 				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
-				beforeWrite: () => markUnsettled("Tags")
+				beforeWrite: () => markUnsettled("Tags"),
+				afterAdded: (keys) => {
+					if (keys.length > 0) context?.markAttempted?.("Tags", keys);
+				}
 			});
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
@@ -12595,7 +12685,7 @@ var DynamoDBTableProvider = class {
 			if (context?.unsettledProperties?.has("GlobalSecondaryIndexes") === true && currentLiveIndexNames !== void 0) this.warnUndeclaredLiveIndexes(physicalId, currentLiveIndexNames, [previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"]], maskSecrets);
 			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) {
 				markUnsettled("GlobalSecondaryIndexes");
-				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
+				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets, (indexName) => context?.markAttempted?.("GlobalSecondaryIndexes", [indexName]));
 			}
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) {
 				markUnsettled("PointInTimeRecoverySpecification");
@@ -12743,6 +12833,22 @@ var DynamoDBTableProvider = class {
 				},
 				sleepSeam: deleteTableRetryDelays
 			});
+			const mask = maskerOrIdentity(context?.maskSecrets);
+			await waitForGoneAfterDelete({
+				what: mask(`DynamoDB table ${physicalId}`),
+				resourceType,
+				describe: async () => {
+					try {
+						return (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.TableStatus ?? "UNKNOWN";
+					} catch (describeError) {
+						if (describeError instanceof ResourceNotFoundException$1) return void 0;
+						throw describeError;
+					}
+				},
+				logger: loopLogger,
+				pollIntervalMs: tableDeleteGoneWait.pollIntervalMs,
+				maxWaitMs: Math.min(tableDeleteGoneWait.maxWaitMs, budget.remainingMs())
+			});
 			this.logger.debug(`Successfully deleted DynamoDB table ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -12786,6 +12892,13 @@ var DynamoDBTableProvider = class {
 				ResourceArn: tableArn,
 				Tags: tagsToAdd
 			}));
+			let recordedKeys;
+			try {
+				recordedKeys = /* @__PURE__ */ new Set([...planTagDiff(void 0, oldTagsRaw).set.keys()]);
+			} catch {
+				recordedKeys = void 0;
+			}
+			unsettled.afterAdded?.(tagsToAdd.map((t) => t.Key).filter((key) => recordedKeys !== void 0 && !recordedKeys.has(key)));
 			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB table ${tableArn}`);
 		}
 	}
@@ -13159,7 +13272,7 @@ var DynamoDBTableProvider = class {
 		}
 		throw new Error(`Table ${tableName} and its global secondary indexes did not reach ACTIVE within ${maxAttempts} seconds after UpdateTable`);
 	}
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets, onCreated = () => void 0) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const prev = previousGsis ?? [];
@@ -13234,7 +13347,7 @@ var DynamoDBTableProvider = class {
 			}
 			if (updateHasMember) ops.push({ Update: update });
 		}
-		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets);
+		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets, onCreated);
 	}
 	coerceWarmThroughputForSend(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -13398,7 +13511,7 @@ var DynamoDBTableProvider = class {
 		}
 		return sendable;
 	}
-	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets) {
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets, onCreated = () => void 0) {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		for (const op of ops) {
 			const input = {
@@ -13407,6 +13520,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			if (op.Create?.IndexName !== void 0) onCreated(op.Create.IndexName);
 			await this.waitForTableAndIndexesActive(physicalId);
 			debug(`${op.Create ? "created" : op.Delete ? "deleted" : "updated"} ${this.indexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName, physicalId, maskSecrets)}`);
 		}
@@ -13547,13 +13661,13 @@ var DynamoDBTableProvider = class {
 			aws
 		};
 	}
-	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
 		const live = await this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
 		if (typeof live !== "object" || live === null) return live;
 		const out = { ...live };
 		if (out["BillingMode"] === "PAY_PER_REQUEST") delete out["ProvisionedThroughput"];
 		if (names.has("GlobalSecondaryIndexes")) {
-			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"]);
+			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"], attemptedItems?.get("GlobalSecondaryIndexes"));
 			if (out["GlobalSecondaryIndexes"] === void 0) delete out["GlobalSecondaryIndexes"];
 		}
 		const strict = async (key, read) => {
@@ -13870,9 +13984,9 @@ var DynamoDBTableProvider = class {
 function isTransientStreamReadFailure(err) {
 	return isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1;
 }
-function projectIndexesOnto(live, recorded, desired) {
+function projectIndexesOnto(live, recorded, desired, attempted = /* @__PURE__ */ new Set()) {
 	if (!Array.isArray(live)) return void 0;
-	const named = /* @__PURE__ */ new Set();
+	const named = new Set([...attempted].filter(isUsableAttemptedName));
 	for (const list of [recorded, desired]) {
 		if (!Array.isArray(list)) continue;
 		for (const entry of list) {
@@ -13928,7 +14042,7 @@ var LogsLogGroupProvider = class {
 		"DeletionProtectionEnabled",
 		"BearerTokenAuthenticationEnabled"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["ResourcePolicyDocument", "covered by the separate account-wide AWS::Logs::ResourcePolicy resource type; logs:PutResourcePolicy is account-scoped, not per-log-group, so it has no CreateLogGroup / PutRetentionPolicy counterpart — routed via Cloud Control instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["ResourcePolicyDocument", "not driven by this provider by decision (issue #1412): no CreateLogGroup / PutRetentionPolicy member carries it, and both policy lifecycles — the account-scoped AWS::Logs::ResourcePolicy type and the log-group-scoped logs:PutResourcePolicy (resourceArn + policyScope RESOURCE) — are ones this provider does not take on — routed via Cloud Control, whose handler applies it"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.logsClient = awsClients.cloudWatchLogs;
@@ -13991,6 +14105,7 @@ var LogsLogGroupProvider = class {
 				await this.logsClient.send(new CreateLogGroupCommand(createParams));
 				createdNewLogGroup = true;
 				leftBehind = true;
+				reportCreatedResource(logicalId, resourceType, logGroupName);
 			} catch (createError) {
 				if (createError instanceof ResourceAlreadyExistsException) this.logger.debug(`Log group ${logGroupName} already exists, using existing`);
 				else throw createError;
@@ -14037,6 +14152,7 @@ var LogsLogGroupProvider = class {
 				if (createdNewLogGroup) try {
 					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
 					leftBehind = false;
+					retractCreatedResource(logicalId, resourceType, logGroupName);
 					this.logger.debug(`Cleaned up partially-created log group ${displaySafe(logicalId)} (${displaySafe(logGroupName)}) after wiring failure`);
 				} catch (cleanupError) {
 					const mask = maskerOrIdentity(context?.maskSecrets);
@@ -14387,6 +14503,29 @@ var LogsLogGroupProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/cloudwatch-alarm-provider.ts
+function isDefaultEvaluationWindow(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || keys[0] !== "SlidingWindow") return false;
+	const sliding = value["SlidingWindow"];
+	return sliding !== null && typeof sliding === "object" && !Array.isArray(sliding) && Object.keys(sliding).length === 0;
+}
+const PROMQL_EXCLUDED_MEMBERS = [
+	"Namespace",
+	"MetricName",
+	"Dimensions",
+	"Period",
+	"Unit",
+	"Statistic",
+	"ExtendedStatistic",
+	"Metrics",
+	"Threshold",
+	"ComparisonOperator",
+	"ThresholdMetricId",
+	"EvaluationPeriods",
+	"DatapointsToAlarm",
+	"EvaluationWindow"
+];
 function isAlarmWriteThrottle(error) {
 	return isThrottlingError(error) || error instanceof Error && error.message.includes("Rate exceeded");
 }
@@ -14422,9 +14561,13 @@ var CloudWatchAlarmProvider = class {
 		"Tags",
 		"ExtendedStatistic",
 		"EvaluateLowSampleCountPercentile",
-		"ThresholdMetricId"
+		"ThresholdMetricId",
+		"ActionConfiguration",
+		"WarmUpConfiguration",
+		"EvaluationWindow",
+		"EvaluationCriteria",
+		"EvaluationInterval"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudWatchClient = awsClients.cloudWatch;
@@ -14573,7 +14716,12 @@ var CloudWatchAlarmProvider = class {
 			Unit: emptyToUndefined(properties["Unit"]),
 			ExtendedStatistic: emptyToUndefined(properties["ExtendedStatistic"]),
 			EvaluateLowSampleCountPercentile: emptyToUndefined(properties["EvaluateLowSampleCountPercentile"]),
-			ThresholdMetricId: emptyToUndefined(properties["ThresholdMetricId"])
+			ThresholdMetricId: emptyToUndefined(properties["ThresholdMetricId"]),
+			ActionConfiguration: properties["ActionConfiguration"],
+			WarmUpConfiguration: properties["WarmUpConfiguration"],
+			EvaluationWindow: properties["EvaluationWindow"],
+			EvaluationCriteria: properties["EvaluationCriteria"],
+			EvaluationInterval: properties["EvaluationInterval"]
 		};
 		const metricsValue = properties["Metrics"];
 		if (Array.isArray(metricsValue) && metricsValue.length > 0) params["Metrics"] = metricsValue.map((m) => {
@@ -14605,6 +14753,7 @@ var CloudWatchAlarmProvider = class {
 			params["Period"] = properties["Period"];
 			params["Statistic"] = emptyToUndefined(properties["Statistic"]);
 			params["Dimensions"] = properties["Dimensions"];
+			if (properties["EvaluationCriteria"] !== void 0 && Array.isArray(params["Dimensions"]) && params["Dimensions"].length === 0) delete params["Dimensions"];
 		}
 		return params;
 	}
@@ -14615,30 +14764,40 @@ var CloudWatchAlarmProvider = class {
 		}))).MetricAlarms?.[0];
 		if (!alarm) return RESOURCE_NOT_FOUND;
 		const result = {};
+		const promql = alarm.EvaluationCriteria !== void 0;
 		if (alarm.AlarmName !== void 0) result["AlarmName"] = alarm.AlarmName;
 		result["AlarmDescription"] = alarm.AlarmDescription ?? "";
-		result["MetricName"] = alarm.MetricName ?? "";
-		result["Namespace"] = alarm.Namespace ?? "";
-		result["Statistic"] = alarm.Statistic ?? "";
-		if (alarm.ComparisonOperator !== void 0) result["ComparisonOperator"] = alarm.ComparisonOperator;
-		if (alarm.Threshold !== void 0) result["Threshold"] = alarm.Threshold;
-		if (alarm.EvaluationPeriods !== void 0) result["EvaluationPeriods"] = alarm.EvaluationPeriods;
-		if (alarm.Period !== void 0) result["Period"] = alarm.Period;
-		if (alarm.DatapointsToAlarm !== void 0) result["DatapointsToAlarm"] = alarm.DatapointsToAlarm;
+		if (!promql) {
+			result["MetricName"] = alarm.MetricName ?? "";
+			result["Namespace"] = alarm.Namespace ?? "";
+			result["Statistic"] = alarm.Statistic ?? "";
+			if (alarm.ComparisonOperator !== void 0) result["ComparisonOperator"] = alarm.ComparisonOperator;
+			if (alarm.Threshold !== void 0) result["Threshold"] = alarm.Threshold;
+			if (alarm.EvaluationPeriods !== void 0) result["EvaluationPeriods"] = alarm.EvaluationPeriods;
+			if (alarm.Period !== void 0) result["Period"] = alarm.Period;
+			if (alarm.DatapointsToAlarm !== void 0) result["DatapointsToAlarm"] = alarm.DatapointsToAlarm;
+		}
 		result["ActionsEnabled"] = alarm.ActionsEnabled ?? true;
 		result["AlarmActions"] = alarm.AlarmActions ? [...alarm.AlarmActions] : [];
 		result["OKActions"] = alarm.OKActions ? [...alarm.OKActions] : [];
 		result["InsufficientDataActions"] = alarm.InsufficientDataActions ? [...alarm.InsufficientDataActions] : [];
 		result["TreatMissingData"] = alarm.TreatMissingData ?? "";
-		result["Unit"] = alarm.Unit ?? "";
-		result["Dimensions"] = (alarm.Dimensions ?? []).map((d) => ({
-			...d.Name !== void 0 ? { Name: d.Name } : {},
-			...d.Value !== void 0 ? { Value: d.Value } : {}
-		}));
-		result["Metrics"] = (alarm.Metrics ?? []).map((m) => m);
-		if (alarm.ExtendedStatistic !== void 0) result["ExtendedStatistic"] = alarm.ExtendedStatistic;
+		if (!promql) {
+			result["Unit"] = alarm.Unit ?? "";
+			result["Dimensions"] = (alarm.Dimensions ?? []).map((d) => ({
+				...d.Name !== void 0 ? { Name: d.Name } : {},
+				...d.Value !== void 0 ? { Value: d.Value } : {}
+			}));
+			result["Metrics"] = (alarm.Metrics ?? []).map((m) => m);
+		}
+		if (!promql && alarm.ExtendedStatistic !== void 0) result["ExtendedStatistic"] = alarm.ExtendedStatistic;
 		if (alarm.EvaluateLowSampleCountPercentile !== void 0) result["EvaluateLowSampleCountPercentile"] = alarm.EvaluateLowSampleCountPercentile;
-		if (alarm.ThresholdMetricId !== void 0) result["ThresholdMetricId"] = alarm.ThresholdMetricId;
+		if (!promql && alarm.ThresholdMetricId !== void 0) result["ThresholdMetricId"] = alarm.ThresholdMetricId;
+		if (alarm.ActionConfiguration !== void 0) result["ActionConfiguration"] = alarm.ActionConfiguration;
+		if (alarm.WarmUpConfiguration !== void 0) result["WarmUpConfiguration"] = alarm.WarmUpConfiguration;
+		if (!promql && alarm.EvaluationWindow !== void 0 && !isDefaultEvaluationWindow(alarm.EvaluationWindow)) result["EvaluationWindow"] = alarm.EvaluationWindow;
+		if (alarm.EvaluationCriteria !== void 0) result["EvaluationCriteria"] = alarm.EvaluationCriteria;
+		if (promql && alarm.EvaluationInterval !== void 0) result["EvaluationInterval"] = alarm.EvaluationInterval;
 		if (alarm.AlarmArn) try {
 			const tagsResp = await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
@@ -14647,6 +14806,26 @@ var CloudWatchAlarmProvider = class {
 		}
 		return result;
 	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		if (resourceType !== "AWS::CloudWatch::Alarm" || !isDefaultEvaluationWindow(baseline["EvaluationWindow"]) || aws["EvaluationWindow"] !== void 0) return {
+			baseline,
+			aws
+		};
+		const trimmed = { ...baseline };
+		delete trimmed["EvaluationWindow"];
+		return {
+			baseline: trimmed,
+			aws
+		};
+	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		if (resourceType !== "AWS::CloudWatch::Alarm") return [];
+		if (properties["EvaluationCriteria"] !== void 0) return [...PROMQL_EXCLUDED_MEMBERS].filter((key) => properties[key] === void 0);
+		const keys = ["EvaluationCriteria", "EvaluationInterval"];
+		const declared = properties["EvaluationWindow"];
+		if (declared === void 0 || isDefaultEvaluationWindow(declared)) keys.push("EvaluationWindow");
+		return keys;
+	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["AlarmName"]) return void 0;
 		return generatedNameFor("AWS::CloudWatch::Alarm", logicalId);
@@ -15721,6 +15900,7 @@ var EventBridgeRuleProvider = class {
 			if (properties["Tags"]) putRuleParams["Tags"] = desiredTags;
 			const ruleArn = (await this.eventBridgeClient.send(new PutRuleCommand(putRuleParams))).RuleArn;
 			this.logger.debug(`Created EventBridge rule: ${ruleName} (${ruleArn})`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, ruleArn);
 			const eventBusName = properties["EventBusName"];
 			try {
 				if (targets && targets.length > 0) {
@@ -15750,6 +15930,7 @@ var EventBridgeRuleProvider = class {
 						Name: ruleName,
 						EventBusName: eventBusName
 					}));
+					retractCreatedResource(logicalId, resourceType, ruleArn);
 					this.logger.debug(`Cleaned up partially-created EventBridge rule ${logicalId} (${ruleName}) after wiring failure`);
 				} catch (cleanupError) {
 					leftLiveArn = ruleArn;
@@ -16122,6 +16303,7 @@ var EventBridgeBusProvider = class {
 			if (properties["LogConfig"] !== void 0) createParams.LogConfig = properties["LogConfig"];
 			const response = await (await this.getCreateClient()).send(new CreateEventBusCommand(createParams));
 			busCreated = true;
+			reportCreatedResource(logicalId, resourceType, name);
 			const policy = policyDocument(properties["Policy"]);
 			if (policy !== void 0) await this.eventBridgeClient.send(new PutPermissionCommand({
 				EventBusName: name,
@@ -17151,6 +17333,7 @@ var EC2Provider = class {
 			}
 			const vpcId = response.Vpc.VpcId;
 			ec2IdsCreatedByThisProcess.add(vpcId);
+			reportCreatedResource(logicalId, resourceType, vpcId);
 			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
 			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, vpcReplayWindow, context);
 			let defaultSgId;
@@ -17179,6 +17362,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteVpcCommand({ VpcId: vpcId }));
+					retractCreatedResource(logicalId, resourceType, vpcId);
 					this.logger.debug(`Cleaned up partially-created VPC ${logicalId} (${vpcId}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindId = vpcId;
@@ -17334,6 +17518,7 @@ var EC2Provider = class {
 			}
 			const subnetId = response.Subnet.SubnetId;
 			ec2IdsCreatedByThisProcess.add(subnetId);
+			reportCreatedResource(logicalId, resourceType, subnetId);
 			const subnetReplayWindow = replayedSendWindow(response, attemptStartMs);
 			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, desiredTags, subnetReplayWindow, context);
 			const availabilityZone = response.Subnet.AvailabilityZone;
@@ -17350,6 +17535,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSubnetCommand({ SubnetId: subnetId }));
+					retractCreatedResource(logicalId, resourceType, subnetId);
 					this.logger.debug(`Cleaned up partially-created Subnet ${logicalId} (${subnetId}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindId = subnetId;
@@ -17604,6 +17790,7 @@ var EC2Provider = class {
 			} catch {
 				createdId = allocationId;
 			}
+			reportCreatedResource(logicalId, resourceType, createdId);
 			ec2IdsCreatedByThisProcess.add(allocationId);
 			const eipReplayWindow = replayedSendWindow(response, attemptStartMs);
 			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, desiredTags, eipReplayWindow, context);
@@ -17636,6 +17823,7 @@ var EC2Provider = class {
 				} finally {
 					watch.dispose();
 				}
+				retractCreatedResource(logicalId, resourceType, createdId);
 				createdId = void 0;
 				this.logger.debug(safeMsg`Released partially-created EIP ${logicalId} (${allocatedId})`);
 			} catch (cleanupError) {
@@ -17772,6 +17960,7 @@ var EC2Provider = class {
 					VpnGatewayId: gatewayId
 				}));
 				attachSent = true;
+				reportCreatedResource(logicalId, resourceType, physicalId);
 				await this.waitForVpnGatewayAttachment(gatewayId, vpcId, "attached", logicalId);
 			}
 			this.logger.debug(`Successfully created VPCGatewayAttachment ${logicalId}: ${physicalId}`);
@@ -18068,6 +18257,7 @@ var EC2Provider = class {
 			})));
 			const natGatewayId = response.NatGateway.NatGatewayId;
 			createdId = natGatewayId;
+			reportCreatedResource(logicalId, resourceType, natGatewayId);
 			if (!tagsApplied) await this.applyTags(natGatewayId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
 			let described;
 			if (process.env["CDKD_NO_WAIT"] !== "true") {
@@ -18465,6 +18655,7 @@ var EC2Provider = class {
 				...TagSpecifications && { TagSpecifications }
 			})));
 			const groupId = response.GroupId;
+			reportCreatedResource(logicalId, resourceType, groupId);
 			try {
 				const ingressRules = properties["SecurityGroupIngress"];
 				const egressRules = properties["SecurityGroupEgress"];
@@ -18481,6 +18672,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
+					retractCreatedResource(logicalId, resourceType, groupId);
 					this.logger.debug(`Cleaned up partially-created SecurityGroup ${logicalId} (${groupId}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindId = groupId;
@@ -19027,6 +19219,7 @@ var EC2Provider = class {
 			const instance = response.Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
 			const instanceId = instance.InstanceId;
+			reportCreatedResource(logicalId, resourceType, instanceId);
 			try {
 				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
 				if (process.env["CDKD_NO_WAIT"] !== "true") {
@@ -19056,6 +19249,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new TerminateInstancesCommand({ InstanceIds: [instanceId] }));
+					retractCreatedResource(logicalId, resourceType, instanceId);
 					runInstancesToken.release();
 					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
 				} catch (cleanupError) {
@@ -21655,6 +21849,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				documentationVersion: properties["DocumentationVersion"],
 				canarySettings: toSdkCanarySettings(properties["CanarySetting"])
 			}));
+			reportCreatedResource(logicalId, resourceType, stageName);
 			const methodSettings = properties["MethodSettings"];
 			const postCreateOps = buildMethodSettingsPatchOps(void 0, methodSettings);
 			const accessLogSetting = properties["AccessLogSetting"];
@@ -21688,6 +21883,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						restApiId,
 						stageName
 					}));
+					retractCreatedResource(logicalId, resourceType, stageName);
 				} catch (cleanupError) {
 					stageLeftBehind = true;
 					const cleanupFailure = describeAwsFailure(cleanupError);
@@ -21945,6 +22141,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				}
 				await putMethod();
 			}
+			reportCreatedResource(logicalId, resourceType, physicalId);
 			try {
 				const integration = properties["Integration"];
 				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand(putIntegrationInput({
@@ -21973,6 +22170,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						resourceId,
 						httpMethod
 					}));
+					retractCreatedResource(logicalId, resourceType, physicalId);
 					log.debug(`Cleaned up partially-created API Gateway Method ${logicalId} (${methodPath}) after wiring failure`);
 				} catch (cleanupError) {
 					methodLeftBehind = true;
@@ -25099,14 +25297,57 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 //#region src/provisioning/providers/agentcore-runtime-provider.ts
 const CFN_MAP_KEYS = /* @__PURE__ */ new Set(["Tags", "AdvertisedScopeMapping"]);
 const SDK_MAP_KEYS = /* @__PURE__ */ new Set(["tags", "advertisedScopeMapping"]);
+const RUNTIME_TAGS_WHAT = "a map of tag keys to scalar values or a list of tags with a non-empty string Key and a scalar Value";
+function isUserTagKey(key) {
+	return !key.startsWith("aws:");
+}
+function desiredRuntimeTags(raw, resourceType, logicalId, physicalId) {
+	const tags = refuseMalformedDesiredTags(tagMapAsList(raw), resourceType, logicalId, physicalId, "Tags", RUNTIME_TAGS_WHAT);
+	if (!tags.every((t) => isUserTagKey(t.Key))) throw markNonRetryable(new ProvisioningError(`${physicalId !== void 0 ? "desired " : ""}Tags of ${resourceType} ${logicalId} holds a reserved aws: key, which AWS does not let a user set — the resource was not ${physicalId !== void 0 ? "updated" : "created"}`, resourceType, logicalId, physicalId));
+	return tags;
+}
+const CREATE_TAG_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	2e3,
+	4e3
+];
+function isTransientTagFailure(error) {
+	return isThrottlingError(error) || error instanceof ResourceNotFoundException$6 || error instanceof Error && error.name === "ResourceNotFoundException";
+}
+function isNonEmptyObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+}
+function writeSharedRuntimeMembers(input, properties) {
+	const requestHeaders = properties["RequestHeaderConfiguration"];
+	if (isNonEmptyObject(requestHeaders)) input["requestHeaderConfiguration"] = pascalToCamelCaseKeys(requestHeaders, CFN_MAP_KEYS);
+	const filesystems = properties["FilesystemConfigurations"];
+	if (Array.isArray(filesystems) && filesystems.length > 0) input["filesystemConfigurations"] = pascalToCamelCaseKeys(filesystems, CFN_MAP_KEYS);
+	const capacityProvider = properties["CapacityProviderConfiguration"];
+	if (isNonEmptyObject(capacityProvider)) input["capacityProviderConfiguration"] = pascalToCamelCaseKeys(capacityProvider, CFN_MAP_KEYS);
+	const platformVersion = properties["PlatformVersion"];
+	if (platformVersion !== void 0 && platformVersion !== null && platformVersion !== "") input["platformVersion"] = platformVersion;
+}
 var AgentCoreRuntimeProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreRuntimeProvider");
+	sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+	async sendCreateTagCall(send) {
+		for (let attempt = 0;; attempt++) try {
+			return await send();
+		} catch (error) {
+			const delay = CREATE_TAG_RETRY_DELAYS_MS[attempt];
+			if (delay === void 0 || !isTransientTagFailure(error)) throw error;
+			this.logger.debug(safeMsg`Post-create tag call failed transiently (${describeAwsFailure(error).summary}); retrying in ${delay}ms`);
+			await this.sleep(delay);
+		}
+	}
 	wrapCaughtError(mask, error, build) {
 		const failure = describeAwsFailure(error);
 		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
 		this.logger.debug(mask(build(mask(failure.detail)).message));
-		const wrapped = build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
+		const wrapped = build(`${mask(failure.summary)}${relay}`);
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Runtime", /* @__PURE__ */ new Set([
@@ -25119,7 +25360,12 @@ var AgentCoreRuntimeProvider = class {
 		"ProtocolConfiguration",
 		"LifecycleConfiguration",
 		"EnvironmentVariables",
-		"ClientToken"
+		"ClientToken",
+		"RequestHeaderConfiguration",
+		"FilesystemConfigurations",
+		"CapacityProviderConfiguration",
+		"PlatformVersion",
+		"Tags"
 	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -25131,6 +25377,8 @@ var AgentCoreRuntimeProvider = class {
 		if (!agentRuntimeName) throw new ProvisioningError(`AgentRuntimeName is required for ${logicalId}`, resourceType, logicalId);
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for ${logicalId}`, resourceType, logicalId);
+		const desiredTags = desiredRuntimeTags(properties["Tags"], resourceType, logicalId);
+		let createdRuntimeId;
 		try {
 			const input = {
 				agentRuntimeName,
@@ -25148,24 +25396,34 @@ var AgentCoreRuntimeProvider = class {
 			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
+			writeSharedRuntimeMembers(input, properties);
+			if (desiredTags.length > 0) input["tags"] = Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value]));
 			const response = await this.client.send(new CreateAgentRuntimeCommand(input));
 			const agentRuntimeId = response.agentRuntimeId;
 			const agentRuntimeArn = response.agentRuntimeArn;
+			createdRuntimeId = agentRuntimeId;
+			reportCreatedResource(logicalId, resourceType, agentRuntimeId);
 			this.logger.debug(`Created BedrockAgentCore Runtime: ${agentRuntimeId} (${agentRuntimeArn})`);
+			if (desiredTags.length > 0) await this.ensureCreateTags(agentRuntimeId, agentRuntimeArn, desiredTags);
 			return {
 				physicalId: agentRuntimeId,
 				attributes: this.buildAttributes(response, agentRuntimeName)
 			};
 		} catch (error) {
+			if (createdRuntimeId !== void 0) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdRuntimeId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdRuntimeId);
+			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating BedrockAgentCore Runtime ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for ${logicalId}`, resourceType, logicalId, physicalId);
+		desiredRuntimeTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		try {
 			const input = {
 				agentRuntimeId: physicalId,
@@ -25183,8 +25441,10 @@ var AgentCoreRuntimeProvider = class {
 			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
+			writeSharedRuntimeMembers(input, properties);
 			const response = await this.client.send(new UpdateAgentRuntimeCommand(input));
 			const agentRuntimeId = response.agentRuntimeId;
+			await this.syncTags(logicalId, resourceType, physicalId, response.agentRuntimeArn, previousProperties["Tags"], properties["Tags"], mask);
 			this.logger.debug(`Successfully updated BedrockAgentCore Runtime ${logicalId}`);
 			return {
 				physicalId: agentRuntimeId,
@@ -25192,10 +25452,44 @@ var AgentCoreRuntimeProvider = class {
 				attributes: this.buildAttributes(response, properties["AgentRuntimeName"])
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async ensureCreateTags(agentRuntimeId, resourceArn, desired) {
+		let live;
+		try {
+			live = (await this.sendCreateTagCall(() => this.client.send(new ListTagsForResourceCommand$6({ resourceArn })))).tags ?? {};
+		} catch (err) {
+			this.logger.debug(safeMsg`Could not read the tags of new runtime ${agentRuntimeId} (${describeAwsFailure(err).detail}); setting every declared tag`);
+		}
+		const missing = Object.fromEntries(desired.filter((t) => live?.[t.Key] !== t.Value).map((t) => [t.Key, t.Value]));
+		if (Object.keys(missing).length === 0) return;
+		if (live !== void 0) this.logger.debug(safeMsg`New runtime ${agentRuntimeId} lacks ${Object.keys(missing).length} of the tag(s) CreateAgentRuntime was sent; setting them with TagResource`);
+		await this.sendCreateTagCall(() => this.client.send(new TagResourceCommand$9({
+			resourceArn,
+			tags: missing
+		})));
+	}
+	async syncTags(logicalId, resourceType, physicalId, responseArn, previousTagsRaw, nextTagsRaw, mask) {
+		const plan = planTagDiff(tagMapAsList(previousTagsRaw), tagMapAsList(nextTagsRaw));
+		const warning = tagPlanWarning(plan, resourceType, logicalId);
+		if (warning !== void 0) this.logger.warn(mask(warning));
+		const remove = plan.remove.filter(isUserTagKey);
+		const set = Object.fromEntries([...plan.set].filter(([k]) => isUserTagKey(k)));
+		if (remove.length === 0 && Object.keys(set).length === 0) return;
+		const resourceArn = responseArn ?? (await this.client.send(new GetAgentRuntimeCommand({ agentRuntimeId: physicalId }))).agentRuntimeArn;
+		if (!resourceArn) throw new ProvisioningError(`Cannot apply the Tags change to ${logicalId}: AWS returned no runtime ARN`, resourceType, logicalId, physicalId);
+		if (remove.length > 0) await this.client.send(new UntagResourceCommand$9({
+			resourceArn,
+			tagKeys: remove
+		}));
+		if (Object.keys(set).length > 0) await this.client.send(new TagResourceCommand$9({
+			resourceArn,
+			tags: set
+		}));
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting BedrockAgentCore Runtime ${logicalId}: ${physicalId}`);
 		try {
@@ -25263,6 +25557,16 @@ var AgentCoreRuntimeProvider = class {
 		}
 		if (resp.lifecycleConfiguration !== void 0) result["LifecycleConfiguration"] = camelToPascalCaseKeys(resp.lifecycleConfiguration, SDK_MAP_KEYS);
 		if (resp.environmentVariables !== void 0) result["EnvironmentVariables"] = resp.environmentVariables;
+		result["RequestHeaderConfiguration"] = resp.requestHeaderConfiguration !== void 0 ? camelToPascalCaseKeys(resp.requestHeaderConfiguration, SDK_MAP_KEYS) : {};
+		result["FilesystemConfigurations"] = resp.filesystemConfigurations !== void 0 ? camelToPascalCaseKeys(resp.filesystemConfigurations, SDK_MAP_KEYS) : [];
+		result["CapacityProviderConfiguration"] = resp.capacityProviderConfiguration !== void 0 ? camelToPascalCaseKeys(resp.capacityProviderConfiguration, SDK_MAP_KEYS) : {};
+		result["PlatformVersion"] = resp.platformVersion ?? "";
+		if (resp.agentRuntimeArn) try {
+			const tagsResp = await this.client.send(new ListTagsForResourceCommand$6({ resourceArn: resp.agentRuntimeArn }));
+			result["Tags"] = Object.fromEntries(Object.entries(tagsResp.tags ?? {}).filter(([k]) => isUserTagKey(k)));
+		} catch (err) {
+			this.logger.debug(safeMsg`Failed to read tags for runtime ${physicalId}: ${describeAwsFailure(err).detail}`);
+		}
 		return result;
 	}
 	async import(input) {
@@ -26532,6 +26836,7 @@ var ECSProvider = class {
 			}))).service;
 			if (!service || !service.serviceArn) throw new Error("CreateService did not return service ARN");
 			log.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, service.serviceArn);
 			try {
 				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"], log);
 			} catch (waitError) {
@@ -26547,6 +26852,7 @@ var ECSProvider = class {
 						service: service.serviceArn,
 						force: true
 					}));
+					retractCreatedResource(logicalId, resourceType, service.serviceArn);
 					log.warn(`Deleted partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed, so the next deploy's CreateService does not collide on the name. Its stopped tasks remain inspectable for about an hour: ${listStopped.render()}`);
 				} catch (cleanupError) {
 					survivorArn = service.serviceArn;
@@ -27982,6 +28288,7 @@ var ELBv2Provider = class {
 			if (!lb || !lb.LoadBalancerArn) throw new Error("CreateLoadBalancer did not return LoadBalancer ARN");
 			const lbArn = lb.LoadBalancerArn;
 			this.logger.debug(`Successfully created LoadBalancer ${logicalId}: ${lbArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, lbArn);
 			try {
 				if (waitForActive) {
 					this.logger.debug(`Waiting for LoadBalancer ${logicalId} to reach active state...`);
@@ -28020,6 +28327,7 @@ var ELBv2Provider = class {
 				if (heldBefore !== "free") this.logger.warn(maskerOrIdentity(maskSecrets)(skippedCleanupText(heldBefore, `LoadBalancer ${logicalId} (${lbArn})`, pasteableAwsCommand(maskSecrets)`aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`.render())));
 				else try {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
+					retractCreatedResource(logicalId, resourceType, lbArn);
 					this.logger.debug(`Cleaned up partially-created LoadBalancer ${logicalId} (${lbArn}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = lbArn;
@@ -28288,6 +28596,7 @@ var ELBv2Provider = class {
 			if (!tg || !tg.TargetGroupArn) throw new Error("CreateTargetGroup did not return TargetGroup ARN");
 			const tgArn = tg.TargetGroupArn;
 			this.logger.debug(`Successfully created TargetGroup ${logicalId}: ${tgArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, tgArn);
 			try {
 				if (tgAttributes.length > 0) {
 					await this.getClient().send(new ModifyTargetGroupAttributesCommand({
@@ -28310,6 +28619,7 @@ var ELBv2Provider = class {
 					if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating TargetGroup ${logicalId} (${tgArn}) but before its targets were registered. Nothing in cdkd state refers to it, so cdkd is deleting it now. If that delete fails, remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render()}`));
 					try {
 						await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
+						retractCreatedResource(logicalId, resourceType, tgArn);
 						this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
 					} catch (cleanupError) {
 						leftBehindArn = tgArn;
@@ -28483,6 +28793,7 @@ var ELBv2Provider = class {
 			if (!listener || !listener.ListenerArn) throw new Error("CreateListener did not return Listener ARN");
 			const listenerArn = listener.ListenerArn;
 			this.logger.debug(`Successfully created Listener ${logicalId}: ${listenerArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, listenerArn);
 			try {
 				if (listenerAttributes.length > 0) {
 					const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
@@ -28508,6 +28819,7 @@ var ELBv2Provider = class {
 				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
+					retractCreatedResource(logicalId, resourceType, listenerArn);
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = listenerArn;
@@ -29128,6 +29440,7 @@ var RDSDBProxyProvider = class {
 		} catch (error) {
 			throw this.wrapCaughtError(error, "CREATE", resourceType, logicalId, void 0, mask);
 		}
+		reportCreatedResource(logicalId, resourceType, dbProxyName);
 		let endpoint;
 		let dbProxyArn;
 		let vpcId;
@@ -29457,6 +29770,7 @@ var RDSDBProxyEndpointProvider = class {
 		} catch (error) {
 			throw this.wrapCaughtError(error, "CREATE", resourceType, logicalId, void 0, mask);
 		}
+		reportCreatedResource(logicalId, resourceType, dbProxyEndpointName);
 		let endpoint;
 		let arn;
 		let isDefault;
@@ -29816,6 +30130,7 @@ var RDSDBProxyTargetGroupProvider = class {
 			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0, mask), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
 		}
 		if (!targetGroupArn) throw await this.retireRegistrationAfterFailedCreate(new ProvisioningError(`Failed to recover TargetGroupArn for ${dbProxyName}/${targetGroupName} after create`, resourceType, logicalId), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
+		if (dbClusterIdentifiers.length > 0 || dbInstanceIdentifiers.length > 0) reportCreatedResource(logicalId, resourceType, targetGroupArn);
 		if (tags.length > 0) try {
 			await client.send(new AddTagsToResourceCommand$2({
 				ResourceName: targetGroupArn,
@@ -30135,6 +30450,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				DBClusterIdentifiers: clusters,
 				DBInstanceIdentifiers: instances
 			}));
+			if (leftBehind) retractCreatedResource(leftBehind.logicalId, leftBehind.resourceType, leftBehind.physicalId);
 			return original;
 		} catch (cleanupError) {
 			const aws = pasteableAwsCommand(maskSecrets);
@@ -30410,6 +30726,7 @@ var DocDBProvider = class {
 			}));
 			clusterCreated = true;
 			createdResourceId = response.DBCluster?.DbClusterResourceId;
+			reportCreatedResource(logicalId, resourceType, dbClusterIdentifier, createdResourceId);
 			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
@@ -30565,6 +30882,7 @@ var DocDBProvider = class {
 			}));
 			instanceCreated = true;
 			createdResourceId = response.DBInstance?.DbiResourceId;
+			reportCreatedResource(logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
 			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(logicalId, dbInstanceIdentifier);
@@ -31268,6 +31586,7 @@ var Route53Provider = class {
 			if (!hostedZone?.Id) throw new Error("CreateHostedZone did not return HostedZone.Id");
 			const zoneId = hostedZone.Id.replace("/hostedzone/", "");
 			createdZoneId = zoneId;
+			reportCreatedResource(logicalId, resourceType, zoneId);
 			if (vpcs && vpcs.length > 1) for (let i = 1; i < vpcs.length; i++) {
 				const additionalVpc = vpcs[i];
 				this.logger.debug(`Associating additional VPC ${String(additionalVpc["VPCId"])} with hosted zone ${zoneId}`);
@@ -31293,6 +31612,7 @@ var Route53Provider = class {
 						await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 						await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
 						zoneRolledBack = true;
+						retractCreatedResource(logicalId, resourceType, zoneId);
 						callerReferenceToken.release();
 					} catch (deleteError) {
 						const head = `Best-effort rollback DeleteHostedZone for ${zoneId} also failed: `;
@@ -32213,6 +32533,27 @@ function sanitizeDescription(value) {
 function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+const DATA_PROTECTION_FALSE_DEFAULTS = ["ExcludeRuleMatchDetails", "ExcludeRateBasedDetails"];
+function toCfnDataProtectionConfig(config, baseline) {
+	const entries = config["DataProtections"];
+	if (!Array.isArray(entries)) return config;
+	const baseEntries = isPlainObject$2(baseline) && Array.isArray(baseline["DataProtections"]) ? baseline["DataProtections"] : [];
+	return {
+		...config,
+		DataProtections: entries.map((entry, i) => {
+			if (!isPlainObject$2(entry)) return entry;
+			const base = baseEntries[i];
+			const converted = { ...entry };
+			for (const key of DATA_PROTECTION_FALSE_DEFAULTS) if (converted[key] === false && !(isPlainObject$2(base) && key in base)) delete converted[key];
+			return converted;
+		})
+	};
+}
+function applicationConfigForUpdate(next, previous) {
+	if (next === void 0 || next === null) return void 0;
+	if (isDeepStrictEqual(next, previous)) return void 0;
+	return next;
+}
 function toSdkByteMatchStatement(byteMatchStatement) {
 	const encoded = byteMatchStatement["SearchStringBase64"];
 	if (typeof encoded !== "string") return byteMatchStatement;
@@ -32391,7 +32732,11 @@ var WAFv2WebACLProvider = class {
 		"CaptchaConfig",
 		"ChallengeConfig",
 		"TokenDomains",
-		"AssociationConfig"
+		"AssociationConfig",
+		"DataProtectionConfig",
+		"OnSourceDDoSProtectionConfig",
+		"ApplicationConfig",
+		"MonetizationConfig"
 	])]]);
 	getClient() {
 		if (!this.wafv2Client) {
@@ -32432,7 +32777,11 @@ var WAFv2WebACLProvider = class {
 				CaptchaConfig: properties["CaptchaConfig"],
 				ChallengeConfig: properties["ChallengeConfig"],
 				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
+				AssociationConfig: properties["AssociationConfig"],
+				DataProtectionConfig: properties["DataProtectionConfig"],
+				OnSourceDDoSProtectionConfig: properties["OnSourceDDoSProtectionConfig"],
+				ApplicationConfig: properties["ApplicationConfig"],
+				MonetizationConfig: properties["MonetizationConfig"]
 			}))).Summary;
 			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
 			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
@@ -32486,7 +32835,11 @@ var WAFv2WebACLProvider = class {
 				CaptchaConfig: properties["CaptchaConfig"],
 				ChallengeConfig: properties["ChallengeConfig"],
 				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
+				AssociationConfig: properties["AssociationConfig"],
+				DataProtectionConfig: properties["DataProtectionConfig"],
+				OnSourceDDoSProtectionConfig: properties["OnSourceDDoSProtectionConfig"],
+				ApplicationConfig: applicationConfigForUpdate(properties["ApplicationConfig"], previousProperties["ApplicationConfig"]),
+				MonetizationConfig: properties["MonetizationConfig"]
 			}));
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
@@ -32593,6 +32946,10 @@ var WAFv2WebACLProvider = class {
 		if (webACL.ChallengeConfig) result["ChallengeConfig"] = webACL.ChallengeConfig;
 		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
 		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
+		if (webACL.DataProtectionConfig) result["DataProtectionConfig"] = toCfnDataProtectionConfig(webACL.DataProtectionConfig, properties?.["DataProtectionConfig"]);
+		if (webACL.OnSourceDDoSProtectionConfig) result["OnSourceDDoSProtectionConfig"] = webACL.OnSourceDDoSProtectionConfig;
+		if (webACL.ApplicationConfig) result["ApplicationConfig"] = webACL.ApplicationConfig;
+		if (webACL.MonetizationConfig) result["MonetizationConfig"] = webACL.MonetizationConfig;
 		try {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
@@ -33068,6 +33425,7 @@ var CognitoUserPoolProvider = class {
 			if (!userPool?.Id) throw new Error("CreateUserPool did not return UserPool.Id");
 			const userPoolId = userPool.Id;
 			createdUserPoolId = userPoolId;
+			reportCreatedResource(logicalId, resourceType, userPoolId);
 			const replayWindow = replayedSendWindow(created, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleOrphanPools(logicalId, poolName, replayWindow, createMaskedLogSinks(this.logger, context?.maskSecrets), userPoolId);
 			const userPoolArn = userPool.Arn;
@@ -33095,6 +33453,7 @@ var CognitoUserPoolProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				try {
 					await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: createdUserPoolId }));
+					retractCreatedResource(logicalId, resourceType, createdUserPoolId);
 					this.logger.debug(`Rolled back partially-created Cognito User Pool ${createdUserPoolId}`);
 				} catch (rollbackError) {
 					poolLeftBehind = true;
@@ -33976,6 +34335,7 @@ var ElastiCacheProvider = class {
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
+			reportCreatedResource(logicalId, resourceType, cacheClusterId);
 			this.logger.debug(`Successfully created CacheCluster ${logicalId}: ${cacheClusterId}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(cacheClusterId);
 			const described = await this.describeCacheCluster(cacheClusterId);
@@ -34786,6 +35146,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			if (!service || !service.Id) throw new Error("CreateService did not return Service ID");
 			const serviceId = service.Id;
 			leftBehindServiceId = serviceId;
+			reportCreatedResource(logicalId, resourceType, serviceId);
 			this.logger.debug(`Successfully created service discovery service ${logicalId}: ${serviceId}`);
 			try {
 				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
@@ -34810,6 +35171,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					leftBehindServiceId = void 0;
+					retractCreatedResource(logicalId, resourceType, serviceId);
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
 					const cleanupFailure = describeAwsFailure(cleanupError);
@@ -36234,6 +36596,7 @@ var AppSyncProvider = class {
 				throw error;
 			}
 			createdApiId = response.graphqlApi?.apiId;
+			if (createdApiId) reportCreatedResource(logicalId, resourceType, createdApiId);
 			const apiId = response.graphqlApi.apiId;
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleOrphanApis(logicalId, input, replayWindow, maskerOrIdentity(context?.maskSecrets), apiId);
@@ -36257,6 +36620,7 @@ var AppSyncProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				try {
 					await this.getClient().send(new DeleteGraphqlApiCommand({ apiId: createdApiId }));
+					retractCreatedResource(logicalId, resourceType, createdApiId);
 					this.logger.debug(`Rolled back partially-created GraphQL API ${createdApiId}`);
 				} catch (rollbackError) {
 					apiLeftBehind = true;
@@ -39391,6 +39755,7 @@ var KMSProvider = class {
 					heldAtMs: Date.now()
 				});
 				createdKeyId = keyId;
+				reportCreatedResource(logicalId, resourceType, keyId);
 				const declinedAtMs = supersededAttempts.get(attemptKey);
 				supersededAttempts.delete(attemptKey);
 				supersededPending = declinedAtMs !== void 0 && Date.now() - declinedAtMs <= 18e5;
@@ -39398,6 +39763,7 @@ var KMSProvider = class {
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
 			createdKeyId = keyId;
+			reportCreatedResource(logicalId, resourceType, keyId);
 			if (enableKeyRotation === true) {
 				const rotationPeriodInDays = properties["RotationPeriodInDays"];
 				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
@@ -40623,58 +40989,6 @@ var BudgetsBudgetProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/delete-gone-wait.ts
-async function waitForGoneAfterDelete(opts) {
-	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-	const now = opts.now ?? Date.now;
-	const userTimeoutMs = resolvedResourceTimeoutMs(opts.resourceType);
-	const maxWaitMs = userTimeoutMs === void 0 ? opts.maxWaitMs : Math.min(opts.maxWaitMs, userTimeoutMs / 2);
-	const startedAt = now();
-	const stopped = `${opts.what}: the delete was ACCEPTED by AWS, but cdkd stopped waiting for it to disappear`;
-	const consequence = "AWS finishes the delete on its side; until it does, a create of the same name is refused with \"already exists\".";
-	const watch = startInterruptWatch(`${opts.what} deletion wait`);
-	try {
-		let lastStatus;
-		let sawNonFailedStatus = false;
-		for (;;) {
-			if (watch.isInterrupted()) {
-				opts.logger.warn(safeMsg`${stopped} (interrupted). ${consequence}`);
-				return;
-			}
-			try {
-				const status = await opts.describe();
-				if (status === void 0) {
-					opts.logger.debug(safeMsg`${opts.what} is gone`);
-					return;
-				}
-				const failure = opts.failedStatus?.(status);
-				if (failure !== void 0) {
-					if (sawNonFailedStatus || now() - startedAt >= opts.pollIntervalMs) throw markWaitAbandoned(failure);
-				} else sawNonFailedStatus = true;
-				lastStatus = status;
-				opts.logger.debug(safeMsg`${opts.what} status: ${status}, waiting for it to disappear`);
-			} catch (error) {
-				if (isWaitAbandonedError(error)) throw error;
-				if (!isThrottlingError(error) && !isTransientServerError(error)) {
-					opts.logger.debug(safeMsg`${opts.what}: status read failed: ${describeAwsFailure(error).detail}`);
-					opts.logger.warn(safeMsg`${stopped}: its status could not be read (${describeAwsFailure(error).summary}). ${consequence}`);
-					return;
-				}
-				opts.logger.debug(safeMsg`${opts.what}: status read throttled or failed transiently, re-polling`);
-			}
-			const remainingMs = maxWaitMs - (now() - startedAt);
-			if (remainingMs <= 0) {
-				opts.logger.warn(safeMsg`${stopped} after ${Math.round(maxWaitMs / 1e3)}s` + safeMsg`${lastStatus !== void 0 ? ` (last status: ${lastStatus})` : ""}. ${consequence}`);
-				return;
-			}
-			await sleep(Math.min(opts.pollIntervalMs, remainingMs));
-		}
-	} finally {
-		watch.dispose();
-	}
-}
-
 //#endregion
 //#region src/provisioning/providers/kinesis-provider.ts
 function isKmsEncryption(value) {
@@ -40864,6 +41178,7 @@ var KinesisStreamProvider = class {
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			streamCreated = true;
+			reportCreatedResource(logicalId, resourceType, streamName);
 			this.logger.debug(`CreateStream initiated for ${streamName}, waiting for ACTIVE status`);
 			const streamInfo = await this.waitForStreamActive(streamName);
 			const retentionPeriodHours = retentionRead.kind === "usable" ? retentionRead.hours : void 0;
@@ -40969,7 +41284,10 @@ var KinesisStreamProvider = class {
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
 				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
-				beforeWrite: () => markUnsettled("Tags")
+				beforeWrite: () => markUnsettled("Tags"),
+				afterAdded: (keys) => {
+					if (keys.length > 0) context?.markAttempted?.("Tags", keys);
+				}
 			});
 			const newEncryption = properties["StreamEncryption"];
 			const oldEncryption = previousProperties["StreamEncryption"];
@@ -41031,10 +41349,13 @@ var KinesisStreamProvider = class {
 				}
 				if (toEnable.length > 0) {
 					this.logger.debug(`Enabling ${toEnable.length} shard-level metric(s) on ${physicalId}`);
-					await this.getClient().send(new EnableEnhancedMonitoringCommand({
+					const current = expandShardLevelMetrics((await this.getClient().send(new EnableEnhancedMonitoringCommand({
 						StreamName: physicalId,
 						ShardLevelMetrics: toEnable
-					}));
+					})))?.CurrentShardLevelMetrics ?? []);
+					const before = new Set(Array.isArray(current) ? current : []);
+					const added = toEnable.filter((metric) => !before.has(metric));
+					if (added.length > 0) context?.markAttempted?.("DesiredShardLevelMetrics", added);
 					await this.waitForStreamActive(physicalId);
 				}
 			}
@@ -41201,6 +41522,13 @@ var KinesisStreamProvider = class {
 				StreamName: streamName,
 				Tags: tagsToAdd
 			}));
+			let recordedKeys;
+			try {
+				recordedKeys = /* @__PURE__ */ new Set([...planTagDiff(void 0, oldTagsRaw).set.keys()]);
+			} catch {
+				recordedKeys = void 0;
+			}
+			unsettled.afterAdded?.(Object.keys(tagsToAdd).filter((key) => recordedKeys !== void 0 && !recordedKeys.has(key)));
 			this.logger.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream ${streamName}`);
 		}
 	}
@@ -41217,7 +41545,7 @@ var KinesisStreamProvider = class {
 		const secretDerived = mask(physicalId) !== physicalId;
 		warn(`Kinesis stream ${physicalId} has shard-level metrics enabled that neither cdkd's record nor the template declares (${undeclared.join(", ")}), so cdkd left them enabled while converging the unsettled DesiredShardLevelMetrics (CloudFormation never disables a metric it did not record). Another tool may have enabled them, or an earlier failed cdkd update may have; cdkd cannot tell which. If they should be off, disable them ` + (secretDerived ? `with DisableEnhancedMonitoring for those metrics.` : `with: aws kinesis disable-enhanced-monitoring --stream-name ${physicalId} --shard-level-metrics ${undeclared.join(" ")} (in the stream's region)`));
 	}
-	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
 		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
 		if (typeof live !== "object" || live === null) return live;
 		const out = { ...live };
@@ -41226,6 +41554,7 @@ var KinesisStreamProvider = class {
 				const expanded = expandShardLevelMetrics(bag?.["DesiredShardLevelMetrics"]);
 				return isUsableMetricsList(expanded) ? expanded : [];
 			}));
+			for (const metric of attemptedItems?.get("DesiredShardLevelMetrics") ?? []) if (metric !== "ALL" && isUsableAttemptedName(metric)) named.add(metric);
 			const liveMetrics = expandShardLevelMetrics(out["DesiredShardLevelMetrics"]);
 			out["DesiredShardLevelMetrics"] = (Array.isArray(liveMetrics) ? liveMetrics : []).filter((metric) => typeof metric === "string" && named.has(metric));
 		}
@@ -41386,6 +41715,7 @@ var KinesisStreamConsumerProvider = class {
 			if (!consumer?.ConsumerARN || !consumer.ConsumerName) throw new ProvisioningError("RegisterStreamConsumer did not return ConsumerARN/ConsumerName", resourceType, logicalId);
 			const consumerArn = consumer.ConsumerARN;
 			createdArn = consumerArn;
+			reportCreatedResource(logicalId, resourceType, consumerArn);
 			await this.waitForConsumerActive(consumerArn);
 			this.logger.debug(`Successfully registered Kinesis stream consumer ${logicalId}`);
 			return {
@@ -42259,6 +42589,7 @@ var PipesPipeProvider = class {
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			createdIdentity = pipeIdentityToken(name, created?.Arn, created?.CreationTime);
+			reportCreatedResource(logicalId, resourceType, name, createdIdentity);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Pipe ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
@@ -42566,7 +42897,10 @@ var PipesPipeProvider = class {
 		try {
 			await this.getClient().send(new DeletePipeCommand({ Name: name }));
 		} catch (cleanupError) {
-			if (cleanupError instanceof NotFoundException$6) return original;
+			if (cleanupError instanceof NotFoundException$6) {
+				retractCreatedResource(logicalId, resourceType, name);
+				return original;
+			}
 			return orphaned(describeAwsFailure(cleanupError).summary);
 		}
 		let gone = false;
@@ -42592,10 +42926,12 @@ var PipesPipeProvider = class {
 			return orphaned("its delete did not complete (AWS reports a failed or rolled-back delete)");
 		}
 		if (gone) {
+			retractCreatedResource(logicalId, resourceType, name);
 			original.message += " (cdkd deleted the pipe it had created, so nothing is left behind)";
 			return original;
 		}
 		if (sawDeleting) {
+			retractCreatedResource(logicalId, resourceType, name);
 			original.message += " (cdkd started deleting the pipe it had created; a re-deploy may report the name in use until AWS finishes)";
 			return original;
 		}
@@ -42926,6 +43262,7 @@ var EFSProvider = class {
 				}))
 			});
 			fileSystemId = created.fileSystemId;
+			reportCreatedResource(logicalId, resourceType, fileSystemId);
 			const available = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, log);
 			const arn = created.arn ?? available.FileSystemArn;
 			await this.applyLifecyclePolicies(fileSystemId, properties["LifecyclePolicies"], log);
@@ -42947,6 +43284,7 @@ var EFSProvider = class {
 				try {
 					await this.getClient().send(new DeleteFileSystemCommand({ FileSystemId: fileSystemId }));
 					this.unconfirmedCreationTokens.delete(creationToken);
+					retractCreatedResource(logicalId, resourceType, fileSystemId);
 					log.debug(`Rolled back partially-created EFS FileSystem ${fileSystemId}`);
 				} catch (cleanupError) {
 					fileSystemLeftBehind = true;
@@ -43124,6 +43462,7 @@ var EFSProvider = class {
 			}));
 			const mountTargetId = response.MountTargetId;
 			createdMountTargetId = mountTargetId;
+			reportCreatedResource(logicalId, resourceType, mountTargetId);
 			log.debug(`Created EFS MountTarget ${logicalId}: ${mountTargetId}, waiting for available state`);
 			await this.waitForMountTargetAvailable(mountTargetId, logicalId, resourceType, log);
 			log.debug(`Successfully created EFS MountTarget ${logicalId}: ${mountTargetId}`);
@@ -43775,6 +44114,7 @@ var FSxFileSystemProvider = class {
 				throw markNonRetryable(new ProvisioningError(safeMsg`FSx answered the create of ${logicalId} with file system ${returnedId}, which ${createdAt === void 0 ? "carries no creation time" : "predates this create"}: the create token cdkd derives for this stack's file system is held by it, and it is NOT recorded in cdkd state. It is not one this deploy, or an interrupted earlier deploy of this stack, made: it was created under this token by an earlier cdkd version, or a completed deploy recorded it and cdkd later let go of it, and it may hold data, so cdkd neither records nor deletes it. Inspect it with: ${inspect} --file-system-ids ${returnedId} -- then import it into this stack, or delete it once you are sure its data is not needed, and deploy again.`, resourceType, logicalId));
 			}
 			fileSystemId = returnedId;
+			reportCreatedResource(logicalId, resourceType, returnedId);
 			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, context?.maskSecrets);
 			this.logger.debug(`Successfully created FSx FileSystem ${logicalId}: ${fileSystemId}`);
 			this.createTokenFirstSentAt.delete(clientRequestToken);
@@ -43786,6 +44126,7 @@ var FSxFileSystemProvider = class {
 			let survivorId;
 			if (fileSystemId !== void 0) try {
 				await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: fileSystemId }));
+				retractCreatedResource(logicalId, resourceType, fileSystemId);
 				this.createTokenFirstSentAt.delete(clientRequestToken);
 				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
@@ -44712,11 +45053,11 @@ var FSxFileSystemProvider = class {
 
 //#endregion
 //#region src/provisioning/emr-configuration.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toSdkConfiguration(raw) {
-	if (!isRecord(raw)) return raw;
+	if (!isRecord$1(raw)) return raw;
 	const { ConfigurationProperties, Configurations, ...rest } = raw;
 	return {
 		...rest,
@@ -44733,9 +45074,9 @@ function toSdkStepConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((step) => {
-		if (!isRecord(step)) return step;
+		if (!isRecord$1(step)) return step;
 		const hadoopJarStep = step["HadoopJarStep"];
-		if (!isRecord(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
+		if (!isRecord$1(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
 		const { StepProperties, ...restHadoopJarStep } = hadoopJarStep;
 		return {
 			...step,
@@ -44750,7 +45091,7 @@ function toSdkInstanceTypeConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((instanceTypeConfig) => {
-		if (!isRecord(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
+		if (!isRecord$1(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
 		return {
 			...instanceTypeConfig,
 			Configurations: toSdkConfigurations(instanceTypeConfig["Configurations"])
@@ -44897,6 +45238,7 @@ var EMRInstanceGroupConfigProvider = class {
 			const groupId = response.InstanceGroupIds?.[0];
 			if (groupId) groupsCreatedByThisProcess.add(groupId);
 			createdGroupId = groupId;
+			reportCreatedResource(logicalId, resourceType, groupId ?? "");
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0 && group.InstanceRole === "TASK") await reportOrphans(replayWindow);
 			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
@@ -44923,6 +45265,7 @@ var EMRInstanceGroupConfigProvider = class {
 						}]
 					}));
 					log.warn(safeMsg`Scaled partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0; EMR has no delete API, so the empty group stays on cluster ${log.value(jobFlowId)} until it terminates`);
+					retractCreatedResource(logicalId, resourceType, leftBehindGroupId);
 					leftBehindGroupId = void 0;
 				} catch (cleanupError) {
 					const cleanupHead = safeMsg`Failed to scale partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0: `;
@@ -45272,6 +45615,7 @@ var EMRInstanceFleetConfigProvider = class {
 			const fleetId = response.InstanceFleetId;
 			if (fleetId) fleetsCreatedByThisProcess.add(fleetId);
 			createdFleetId = fleetId;
+			reportCreatedResource(logicalId, resourceType, fleetId ?? "");
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0 && fleet.InstanceFleetType === "TASK") await reportOrphans(replayWindow);
 			if (!fleetId) throw new ProvisioningError(`EMR AddInstanceFleet for ${logicalId} returned no instance fleet id`, resourceType, logicalId);
@@ -45763,6 +46107,7 @@ var EMRClusterProvider = class {
 			}
 			clusterId = response.JobFlowId;
 			if (clusterId) clustersCreatedByThisProcess.add(clusterId);
+			reportCreatedResource(logicalId, resourceType, clusterId ?? "");
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			if (!clusterId) throw new ProvisioningError(`EMR RunJobFlow for ${logicalId} returned no JobFlowId`, resourceType, logicalId);
@@ -45780,6 +46125,7 @@ var EMRClusterProvider = class {
 					TerminationProtected: false
 				}));
 				await this.getClient().send(new TerminateJobFlowsCommand({ JobFlowIds: [clusterId] }));
+				retractCreatedResource(logicalId, resourceType, clusterId);
 				this.logger.warn(`Rolled back partially-created EMR Cluster ${clusterId}`);
 			} catch (cleanupError) {
 				survivorId = clusterId;
@@ -46521,6 +46867,9 @@ function liveEncryptionAsCfn(live) {
 }
 const ENCRYPTION_POLL_INTERVAL_MS = 5e3;
 const ENCRYPTION_POLL_MAX_ATTEMPTS = 120;
+const ACTIVE_POLL_INTERVAL_MS = 5e3;
+const ACTIVE_POLL_MAX_ATTEMPTS = 360;
+const ACTIVE_DEADLINE_MARGIN_MS = 2e3;
 const terminalEncryptionFailures = /* @__PURE__ */ new WeakSet();
 function isReadableTagList(value) {
 	if (value === void 0 || value === null) return true;
@@ -46736,9 +47085,10 @@ var FirehoseProvider = class {
 			const response = await this.getCreateClient().send(new CreateDeliveryStreamCommand(input));
 			const physicalId = deliveryStreamName || input.DeliveryStreamName || response.DeliveryStreamARN?.split("/").pop() || "";
 			createdStreamName = physicalId;
+			reportCreatedResource(logicalId, resourceType, physicalId);
 			const arn = response.DeliveryStreamARN;
 			this.logger.debug(`Successfully created Firehose delivery stream ${logicalId}: ${physicalId}`);
-			await this.waitForActive(physicalId, logicalId);
+			await this.waitForActive(physicalId, logicalId, resourceType, maskerOrIdentity(context?.maskSecrets));
 			return {
 				physicalId,
 				attributes: { Arn: arn }
@@ -47437,18 +47787,59 @@ var FirehoseProvider = class {
 		}
 		return null;
 	}
-	async waitForActive(streamName, logicalId) {
-		const maxAttempts = 30;
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-			const status = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: streamName }))).DeliveryStreamDescription?.DeliveryStreamStatus;
-			if (status === "ACTIVE") {
-				this.logger.debug(`Firehose ${logicalId} is ACTIVE`);
-				return;
+	async waitForActive(streamName, logicalId, resourceType, mask) {
+		const watch = startInterruptWatch(`Firehose ${logicalId} create`);
+		try {
+			let last;
+			let deadlineNear = false;
+			for (let attempt = 1; attempt <= ACTIVE_POLL_MAX_ATTEMPTS; attempt++) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				if (enclosingDeadlineRemainingMs() <= ACTIVE_DEADLINE_MARGIN_MS) {
+					deadlineNear = true;
+					break;
+				}
+				const resp = await this.describeBeforeDeadline(streamName);
+				if (resp === "deadline") {
+					deadlineNear = true;
+					break;
+				}
+				const description = resp.DeliveryStreamDescription;
+				last = description?.DeliveryStreamStatus;
+				if (last === "ACTIVE") {
+					this.logger.debug(`Firehose ${logicalId} is ACTIVE`);
+					return;
+				}
+				if (last !== void 0 && last.endsWith("_FAILED")) {
+					const failure = description?.FailureDescription;
+					throw markNonRetryable(new ProvisioningError(`Firehose delivery stream ${logicalId} did not become ACTIVE: AWS reports ${last}` + (failure ? ` (${mask(`${failure.Type ?? ""}: ${failure.Details ?? ""}`)})` : ""), resourceType, logicalId, streamName));
+				}
+				this.logger.debug(`Firehose ${logicalId} status: ${last} (attempt ${attempt}/${ACTIVE_POLL_MAX_ATTEMPTS})`);
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				if (enclosingDeadlineRemainingMs() <= 7e3) {
+					deadlineNear = true;
+					break;
+				}
+				await new Promise((resolve) => setTimeout(resolve, ACTIVE_POLL_INTERVAL_MS));
 			}
-			this.logger.debug(`Firehose ${logicalId} status: ${status} (attempt ${attempt}/${maxAttempts})`);
-			await new Promise((resolve) => setTimeout(resolve, 2e3));
+			throw markNonRetryable(new ProvisioningError((deadlineNear ? `The resource timeout would expire while waiting for Firehose delivery stream ${logicalId} to become ACTIVE ` : `Timed out waiting for Firehose delivery stream ${logicalId} to become ACTIVE `) + `(last status: ${last ?? "none reported"})`, resourceType, logicalId, streamName));
+		} finally {
+			watch.dispose();
+		}
+	}
+	async describeBeforeDeadline(streamName) {
+		const command = new DescribeDeliveryStreamCommand({ DeliveryStreamName: streamName });
+		const remaining = enclosingDeadlineRemainingMs();
+		if (!Number.isFinite(remaining)) return this.getClient().send(command);
+		const abort = new AbortController();
+		const timer = setTimeout(() => abort.abort(), Math.max(0, remaining - ACTIVE_DEADLINE_MARGIN_MS));
+		try {
+			return await this.getClient().send(command, { abortSignal: abort.signal });
+		} catch (error) {
+			if (abort.signal.aborted) return "deadline";
+			throw error;
+		} finally {
+			clearTimeout(timer);
 		}
-		this.logger.warn(`Firehose ${logicalId} did not reach ACTIVE after ${maxAttempts} attempts`);
 	}
 };
 function pickDefinedDeep(input) {
@@ -47576,6 +47967,77 @@ function resolveCloudWatchLogsPair(properties) {
 		roleArn: desiredRole
 	};
 }
+function readListBlock(raw, path) {
+	if (raw == null) return { kind: "absent" };
+	try {
+		return {
+			kind: "list",
+			value: requireConfigArray(raw, path)
+		};
+	} catch (error) {
+		return {
+			kind: "unusable",
+			detail: describeAwsFailure(error).detail
+		};
+	}
+}
+function listOf$1(read) {
+	return read.kind === "list" ? read.value : void 0;
+}
+function retainPreviousLists(desired, previous, keys, live) {
+	const out = Object.fromEntries(Object.entries(desired).filter(([key]) => !keys.includes(key)));
+	for (const key of keys) {
+		const prev = previous[key];
+		if (Array.isArray(prev)) out[key] = structuredClone(prev);
+		else if (prev != null && Array.isArray(live?.[key])) out[key] = structuredClone(live[key]);
+	}
+	return out;
+}
+const UNORDERED_LIST_BLOCKS = ["AdvancedEventSelectors", "AggregationConfigurations"];
+function setKey(value) {
+	if (value === void 0) return "undefined";
+	if (Array.isArray(value)) return [
+		"[",
+		value.map(setKey).sort().join(","),
+		"]"
+	].join("");
+	if (value !== null && typeof value === "object") {
+		const bag = value;
+		return [
+			"{",
+			Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => [JSON.stringify(k), setKey(bag[k])].join(":")).join(","),
+			"}"
+		].join("");
+	}
+	return JSON.stringify(value) ?? "null";
+}
+function nonEmptyListOf(read) {
+	return read.kind === "list" && read.value.length > 0 ? read.value : void 0;
+}
+function eventSelectorRequest(basic, advanced) {
+	const hasBasic = basic !== void 0 && basic.length > 0;
+	if (advanced !== void 0 && advanced.length > 0) return {
+		members: {
+			AdvancedEventSelectors: advanced,
+			...hasBasic ? { EventSelectors: basic } : {}
+		},
+		isReset: false
+	};
+	if (hasBasic) return {
+		members: { EventSelectors: basic },
+		isReset: false
+	};
+	return {
+		members: { EventSelectors: [...DEFAULT_EVENT_SELECTORS] },
+		isReset: true
+	};
+}
+function advancedSelectorsToCfn(selectors) {
+	return selectors.map((s) => ({
+		...s.Name !== void 0 && { Name: s.Name },
+		FieldSelectors: (s.FieldSelectors ?? []).map((f) => Object.fromEntries(Object.entries(f).filter(([, v]) => v !== void 0)))
+	}));
+}
 function describeValue(value) {
 	if (value === null) return "null";
 	if (value === void 0) return "nothing";
@@ -47625,7 +48087,9 @@ var CloudTrailProvider = class {
 		"SnsTopicName",
 		"EventSelectors",
 		"InsightSelectors",
-		"IsOrganizationTrail"
+		"IsOrganizationTrail",
+		"AdvancedEventSelectors",
+		"AggregationConfigurations"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -47662,6 +48126,9 @@ var CloudTrailProvider = class {
 		const isOrganizationTrail = properties["IsOrganizationTrail"];
 		const eventSelectors = properties["EventSelectors"];
 		const insightSelectors = properties["InsightSelectors"];
+		const advancedEventSelectors = properties["AdvancedEventSelectors"] == null ? void 0 : requireConfigArray(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors", replayWarn(this.logger, context));
+		const aggregationConfigurations = properties["AggregationConfigurations"] == null ? void 0 : requireConfigArray(properties["AggregationConfigurations"], "AWS::CloudTrail::Trail AggregationConfigurations", replayWarn(this.logger, context));
+		const skippedOnReplay = [...properties["AdvancedEventSelectors"] != null && advancedEventSelectors === void 0 ? ["AdvancedEventSelectors"] : [], ...properties["AggregationConfigurations"] != null && aggregationConfigurations === void 0 ? ["AggregationConfigurations"] : []];
 		let trailCreated = false;
 		let createdTrailArn;
 		try {
@@ -47685,11 +48152,20 @@ var CloudTrailProvider = class {
 			trailCreated = true;
 			const trailArn = result.TrailARN;
 			createdTrailArn = result.TrailARN;
-			if (eventSelectors && eventSelectors.length > 0) {
+			if (createdTrailArn) reportCreatedResource(logicalId, resourceType, createdTrailArn);
+			const basicForCreate = eventSelectors && eventSelectors.length > 0 ? eventSelectors : void 0;
+			if (basicForCreate || advancedEventSelectors && advancedEventSelectors.length > 0) {
 				this.logger.debug(`Setting event selectors for CloudTrail Trail ${logicalId}`);
 				await this.getClient().send(new PutEventSelectorsCommand({
 					TrailName: trailArn,
-					EventSelectors: eventSelectors
+					...eventSelectorRequest(basicForCreate, advancedEventSelectors).members
+				}));
+			}
+			if (aggregationConfigurations && aggregationConfigurations.length > 0) {
+				this.logger.debug(safeMsg`Setting aggregation configurations for CloudTrail Trail ${logicalId}`);
+				await this.getClient().send(new PutEventConfigurationCommand({
+					TrailName: trailArn,
+					AggregationConfigurations: aggregationConfigurations
 				}));
 			}
 			if (insightSelectors && insightSelectors.length > 0) {
@@ -47706,7 +48182,8 @@ var CloudTrailProvider = class {
 			this.logger.debug(`Successfully created CloudTrail Trail ${logicalId}: ${trailArn}`);
 			return {
 				physicalId: trailArn,
-				attributes: { Arn: trailArn }
+				attributes: { Arn: trailArn },
+				...skippedOnReplay.length > 0 && { effectiveProperties: retainPreviousLists(properties, {}, skippedOnReplay) }
 			};
 		} catch (error) {
 			if (trailCreated) markAuxiliaryFailure(error, logicalId);
@@ -47717,6 +48194,7 @@ var CloudTrailProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const desiredProperties = properties;
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		this.logger.debug(`Updating CloudTrail Trail ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
@@ -47733,6 +48211,7 @@ var CloudTrailProvider = class {
 		const kmsKeyId = clearOnUpdateRemoval(emptyToUndefined(properties["KMSKeyId"]), emptyToUndefined(previousProperties["KMSKeyId"]), "");
 		const snsTopicName = clearOnUpdateRemoval(emptyToUndefined(properties["SnsTopicName"]), emptyToUndefined(previousProperties["SnsTopicName"]), "");
 		const isOrganizationTrail = properties["IsOrganizationTrail"];
+		const appliedBeforeFailure = [];
 		try {
 			await this.getClient().send(new UpdateTrailCommand({
 				Name: physicalId,
@@ -47747,36 +48226,61 @@ var CloudTrailProvider = class {
 				SnsTopicName: snsTopicName,
 				IsOrganizationTrail: isOrganizationTrail
 			}));
-			const rawEventSelectors = properties["EventSelectors"];
-			let eventSelectorsUnusable = false;
-			let newEventSelectors;
-			if (rawEventSelectors != null) try {
-				newEventSelectors = requireConfigArray(rawEventSelectors, "AWS::CloudTrail::Trail EventSelectors");
-			} catch (error) {
-				eventSelectorsUnusable = true;
-				this.logger.warn(`${describeAwsFailure(error).detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
-			}
+			const basicRead = readListBlock(properties["EventSelectors"], "AWS::CloudTrail::Trail EventSelectors");
+			const advancedRead = readListBlock(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors");
+			for (const read of [basicRead, advancedRead]) if (read.kind === "unusable") this.logger.warn(safeMsg`${read.detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
+			const selectorsUnusable = basicRead.kind === "unusable" || advancedRead.kind === "unusable";
+			const newEventSelectors = listOf$1(basicRead);
+			const newAdvancedSelectors = listOf$1(advancedRead);
 			const oldEventSelectors = previousProperties["EventSelectors"];
-			if (!eventSelectorsUnusable && JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
-				const isRemoval = newEventSelectors === void 0 || newEventSelectors.length === 0;
-				const eventSelectorsToSend = newEventSelectors === void 0 || newEventSelectors.length === 0 ? DEFAULT_EVENT_SELECTORS : newEventSelectors;
+			const oldAdvancedSelectors = previousProperties["AdvancedEventSelectors"];
+			const hadAdvancedSelectors = Array.isArray(oldAdvancedSelectors) && oldAdvancedSelectors.length > 0;
+			const aggregationRead = readListBlock(properties["AggregationConfigurations"], "AWS::CloudTrail::Trail AggregationConfigurations");
+			if (aggregationRead.kind === "unusable") this.logger.warn(safeMsg`${aggregationRead.detail} The trail's existing aggregation configurations are left untouched for this update rather than cleared.`);
+			const newAggregation = listOf$1(aggregationRead);
+			const aggregationChanged = aggregationRead.kind !== "unusable" && setKey(newAggregation) !== setKey(previousProperties["AggregationConfigurations"]);
+			const aggregationCleared = aggregationChanged && nonEmptyListOf(aggregationRead) === void 0;
+			const putAggregation = async () => {
+				this.logger.debug(safeMsg`Updating aggregation configurations for CloudTrail Trail ${logicalId}`);
+				await this.getClient().send(new PutEventConfigurationCommand({
+					TrailName: physicalId,
+					AggregationConfigurations: newAggregation ?? []
+				}));
+			};
+			if (aggregationCleared) {
+				await putAggregation();
+				appliedBeforeFailure.push("AggregationConfigurations was cleared");
+			}
+			if (!selectorsUnusable && (JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors) || setKey(newAdvancedSelectors) !== setKey(oldAdvancedSelectors))) {
+				let basicToSend = newEventSelectors;
+				let advancedToSend = newAdvancedSelectors;
+				if (context?.desiredFromAwsReadback === true && nonEmptyListOf(basicRead) !== void 0 && nonEmptyListOf(advancedRead) !== void 0) {
+					if (JSON.stringify(newEventSelectors) === JSON.stringify(oldEventSelectors)) basicToSend = void 0;
+					else if (setKey(newAdvancedSelectors) === setKey(oldAdvancedSelectors)) advancedToSend = void 0;
+				}
+				const { members, isReset: isRemoval } = eventSelectorRequest(basicToSend, advancedToSend);
 				this.logger.debug(isRemoval ? `Resetting event selectors to the AWS default for CloudTrail Trail ${logicalId}` : `Updating event selectors for CloudTrail Trail ${logicalId}`);
 				try {
 					await this.getClient().send(new PutEventSelectorsCommand({
 						TrailName: physicalId,
-						EventSelectors: [...eventSelectorsToSend]
+						...members
 					}));
+					appliedBeforeFailure.push("the event selectors were updated");
 				} catch (error) {
 					const failure = describeAwsFailure(error);
 					const message = withoutTrailIdentifiers(failure.detail, physicalId);
 					const errorClass = error instanceof Error ? error.name : "";
-					if (!isRemoval || ACCESS_DENIAL_CLASS.test(errorClass) || !ADVANCED_SELECTOR_PHRASE.test(message)) throw error;
+					if (!isRemoval || hadAdvancedSelectors || ACCESS_DENIAL_CLASS.test(errorClass) || !ADVANCED_SELECTOR_PHRASE.test(message)) throw error;
 					const m = maskerOrIdentity(context?.maskSecrets);
 					const head = `CloudTrail Trail ${logicalId}: skipping the EventSelectors reset — the trail is using AdvancedEventSelectors, which AWS manages through a separate API, so there are no basic event selectors to clear (`;
 					if (failure.redacted) this.logger.debug(m(`${head}${m(failure.detail)})`));
 					this.logger.warn(m(`${head}${failure.redacted ? failure.summary : failure.detail})`));
 				}
 			}
+			if (aggregationChanged && !aggregationCleared) {
+				await putAggregation();
+				appliedBeforeFailure.push("AggregationConfigurations was updated");
+			}
 			const newInsightSelectors = properties["InsightSelectors"];
 			const oldInsightSelectors = previousProperties["InsightSelectors"];
 			if (JSON.stringify(newInsightSelectors) !== JSON.stringify(oldInsightSelectors)) {
@@ -47798,13 +48302,19 @@ var CloudTrailProvider = class {
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated CloudTrail Trail ${logicalId}`);
-			return {
+			const skipped = [...selectorsUnusable ? ["EventSelectors", "AdvancedEventSelectors"] : [], ...aggregationRead.kind === "unusable" ? ["AggregationConfigurations"] : []];
+			if (skipped.length === 0) return {
 				physicalId,
 				wasReplaced: false
 			};
+			return {
+				physicalId,
+				wasReplaced: false,
+				effectiveProperties: retainPreviousLists(desiredProperties, previousProperties, skipped, skipped.some((key) => previousProperties[key] != null && !Array.isArray(previousProperties[key])) ? await this.readLiveForRecord(physicalId, resourceType) : void 0)
+			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${text}` + (appliedBeforeFailure.length > 0 ? ` (selector/aggregation writes already applied before this failure: ${appliedBeforeFailure.join("; ")})` : ""), resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -47834,6 +48344,19 @@ var CloudTrailProvider = class {
 			throw stripped ? markDeleteStarted(notGone) : notGone;
 		}
 	}
+	async readLiveForRecord(physicalId, resourceType) {
+		try {
+			const live = await this.readCurrentState(physicalId, "", resourceType);
+			return live !== void 0 && live !== RESOURCE_NOT_FOUND ? live : void 0;
+		} catch (error) {
+			this.logger.debug(safeMsg`CloudTrail read-back for the record failed: ${describeAwsFailure(error).detail}`);
+			return;
+		}
+	}
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::CloudTrail::Trail") return [];
+		return [...UNORDERED_LIST_BLOCKS];
+	}
 	getAttribute(_physicalId, _resourceType, attributeName) {
 		return Promise.resolve(attributeName);
 	}
@@ -47892,7 +48415,9 @@ var CloudTrailProvider = class {
 		} catch {}
 		try {
 			const sel = await this.getClient().send(new GetEventSelectorsCommand({ TrailName: physicalId }));
-			if (!(Array.isArray(sel.AdvancedEventSelectors) && sel.AdvancedEventSelectors.length > 0)) result["EventSelectors"] = (sel.EventSelectors ?? []).map((es) => es);
+			const hasAdvanced = Array.isArray(sel.AdvancedEventSelectors) && sel.AdvancedEventSelectors.length > 0;
+			if (!hasAdvanced) result["EventSelectors"] = (sel.EventSelectors ?? []).map((es) => es);
+			result["AdvancedEventSelectors"] = hasAdvanced ? advancedSelectorsToCfn(sel.AdvancedEventSelectors ?? []) : [];
 		} catch {}
 		let insightSelectors = [];
 		try {
@@ -47907,6 +48432,14 @@ var CloudTrailProvider = class {
 			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		result["Tags"] = tags;
+		try {
+			result["AggregationConfigurations"] = ((await this.getClient().send(new GetEventConfigurationCommand({ TrailName: physicalId }))).AggregationConfigurations ?? []).map((a) => ({
+				...a.EventCategory !== void 0 && { EventCategory: a.EventCategory },
+				...a.Templates !== void 0 && { Templates: a.Templates }
+			}));
+		} catch (err) {
+			this.logger.debug(safeMsg`CloudTrail GetEventConfiguration(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
+		}
 		return result;
 	}
 	async import(input) {
@@ -48178,6 +48711,7 @@ var CodeBuildProvider = class {
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
 			createdName = projectName;
+			reportCreatedResource(logicalId, resourceType, createdName);
 			if (visibilityRead.kind === "usable" && (visibilityRead.visibility !== DEFAULT_PROJECT_VISIBILITY || visibilityRead.resourceAccessRole !== void 0)) await this.applyVisibility(projectArn, visibilityRead);
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
 			return {
@@ -48599,6 +49133,7 @@ var CodeCommitRepositoryProvider = class {
 			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
 			const createdName = metadata.repositoryName;
 			leftLiveName = createdName;
+			reportCreatedResource(logicalId, resourceType, createdName);
 			try {
 				const code = properties["Code"];
 				if (code) await this.seedInitialCommit(createdName, code);
@@ -48612,7 +49147,10 @@ var CodeCommitRepositoryProvider = class {
 				}
 			} catch (postCreateError) {
 				this.logger.warn(`Post-create step failed for CodeCommit Repository ${logicalId}; deleting the just-created repository ${createdName} to avoid an orphan`);
-				if (await this.bestEffortDelete(createdName, maskerOrIdentity(context?.maskSecrets))) leftLiveName = void 0;
+				if (await this.bestEffortDelete(createdName, maskerOrIdentity(context?.maskSecrets))) {
+					retractCreatedResource(logicalId, resourceType, leftLiveName);
+					leftLiveName = void 0;
+				}
 				throw markAuxiliaryFailure(postCreateError, logicalId);
 			}
 			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${createdName}`);
@@ -49472,6 +50010,370 @@ function notEmptyRefusalMessage(bucketName, maskSecrets) {
 	const remedy = command ? `Delete all objects first (e.g. ${command}) and destroy again.` : secretDerived ? "Delete all objects first, via the console, and destroy again: the bucket name is derived from a secret, so cdkd does not print it." : "Delete all objects first, via the console, and destroy again: the bucket name cdkd recorded cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.";
 	return mask(`bucket ${displayIdent(mask(bucketName))} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. ${remedy}`);
 }
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function itemId(item) {
+	if (!isRecord(item)) return void 0;
+	const id = item["Id"];
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
+function canonicalJson(value) {
+	const sorted = (v) => {
+		if (Array.isArray(v)) return v.map(sorted);
+		if (isRecord(v)) return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sorted(v[k])]));
+		return v;
+	};
+	return JSON.stringify(sorted(value)) ?? "undefined";
+}
+function sameJson(a, b) {
+	return canonicalJson(a) === canonicalJson(b);
+}
+function optionalString(value, path, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "string") refuse(path, "a string");
+	return value;
+}
+function optionalBoolean(value, path, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "boolean") return value;
+	if (value === "true") return true;
+	if (value === "false") return false;
+	return refuse(path, "a boolean");
+}
+function optionalInteger(value, path, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return value;
+	if (typeof value === "string" && /^[0-9]{1,15}$/.test(value)) return Number(value);
+	return refuse(path, "a non-negative integer");
+}
+function listOf(value, path, refuse) {
+	if (!Array.isArray(value)) refuse(path, "a list");
+	return value;
+}
+function encryptionToSdk(value, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (!isRecord(value)) refuse("BucketEncryption", "an object");
+	const rules = listOf(value["ServerSideEncryptionConfiguration"], "BucketEncryption.ServerSideEncryptionConfiguration", refuse);
+	if (rules.length === 0) return void 0;
+	return { Rules: rules.map((rule, i) => {
+		const path = `BucketEncryption.ServerSideEncryptionConfiguration[${i}]`;
+		if (!isRecord(rule)) refuse(path, "an object");
+		const out = {};
+		const byDefault = rule["ServerSideEncryptionByDefault"];
+		if (byDefault !== void 0 && byDefault !== null) {
+			if (!isRecord(byDefault)) refuse(`${path}.ServerSideEncryptionByDefault`, "an object");
+			const algorithm = optionalString(byDefault["SSEAlgorithm"], `${path}.ServerSideEncryptionByDefault.SSEAlgorithm`, refuse);
+			const keyId = optionalString(byDefault["KMSMasterKeyID"], `${path}.ServerSideEncryptionByDefault.KMSMasterKeyID`, refuse);
+			out.ApplyServerSideEncryptionByDefault = {
+				SSEAlgorithm: algorithm,
+				...keyId !== void 0 ? { KMSMasterKeyID: keyId } : {}
+			};
+		}
+		const bucketKey = optionalBoolean(rule["BucketKeyEnabled"], `${path}.BucketKeyEnabled`, refuse);
+		if (bucketKey !== void 0) out.BucketKeyEnabled = bucketKey;
+		return out;
+	}) };
+}
+function lifecycleFilterToSdk(rule, path, refuse) {
+	const prefix = optionalString(rule["Prefix"], `${path}.Prefix`, refuse);
+	const greater = optionalInteger(rule["ObjectSizeGreaterThan"], `${path}.ObjectSizeGreaterThan`, refuse);
+	const less = optionalInteger(rule["ObjectSizeLessThan"], `${path}.ObjectSizeLessThan`, refuse);
+	const members = {
+		...prefix !== void 0 ? { Prefix: prefix } : {},
+		...greater !== void 0 ? { ObjectSizeGreaterThan: greater } : {},
+		...less !== void 0 ? { ObjectSizeLessThan: less } : {}
+	};
+	const count = Object.keys(members).length;
+	if (count === 0) return { Prefix: "" };
+	if (count === 1) return members;
+	return { And: members };
+}
+function lifecycleToSdk(value, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (!isRecord(value)) refuse("LifecycleConfiguration", "an object");
+	const rules = listOf(value["Rules"], "LifecycleConfiguration.Rules", refuse);
+	if (rules.length === 0) return void 0;
+	return { Rules: rules.map((rule, i) => {
+		const path = `LifecycleConfiguration.Rules[${i}]`;
+		if (!isRecord(rule)) refuse(path, "an object");
+		const id = optionalString(rule["Id"], `${path}.Id`, refuse);
+		const status = optionalString(rule["Status"], `${path}.Status`, refuse);
+		const days = optionalInteger(rule["ExpirationInDays"], `${path}.ExpirationInDays`, refuse);
+		const out = {
+			...id !== void 0 ? { ID: id } : {},
+			Status: status,
+			Filter: lifecycleFilterToSdk(rule, path, refuse)
+		};
+		if (days !== void 0) out.Expiration = { Days: days };
+		const abort = rule["AbortIncompleteMultipartUpload"];
+		if (abort !== void 0 && abort !== null) {
+			if (!isRecord(abort)) refuse(`${path}.AbortIncompleteMultipartUpload`, "an object");
+			const after = optionalInteger(abort["DaysAfterInitiation"], `${path}.AbortIncompleteMultipartUpload.DaysAfterInitiation`, refuse);
+			out.AbortIncompleteMultipartUpload = after !== void 0 ? { DaysAfterInitiation: after } : {};
+		}
+		return out;
+	}) };
+}
+function keyedItems(value, property, refuse) {
+	const out = /* @__PURE__ */ new Map();
+	if (value === void 0 || value === null) return out;
+	listOf(value, property, refuse).forEach((item, i) => {
+		if (!isRecord(item)) refuse(`${property}[${i}]`, "an object");
+		const id = itemId(item);
+		if (id === void 0) refuse(`${property}[${i}].Id`, "a non-empty string");
+		if (out.has(id)) refuse(`${property}[${i}].Id`, "an Id no other item of the list carries");
+		out.set(id, item);
+	});
+	return out;
+}
+function recordedItems(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const item of value) {
+		const id = itemId(item);
+		if (id !== void 0 && !out.has(id)) out.set(id, item);
+	}
+	return out;
+}
+function metricsItemToSdk(id, item, path, refuse) {
+	const prefix = optionalString(item["Prefix"], `${path}.Prefix`, refuse);
+	const accessPoint = optionalString(item["AccessPointArn"], `${path}.AccessPointArn`, refuse);
+	if (prefix !== void 0 && accessPoint !== void 0) return {
+		Id: id,
+		Filter: { And: {
+			Prefix: prefix,
+			AccessPointArn: accessPoint
+		} }
+	};
+	if (prefix !== void 0) return {
+		Id: id,
+		Filter: { Prefix: prefix }
+	};
+	if (accessPoint !== void 0) return {
+		Id: id,
+		Filter: { AccessPointArn: accessPoint }
+	};
+	return { Id: id };
+}
+function inventoryItemToSdk(id, item, path, refuse) {
+	const destination = item["Destination"];
+	if (!isRecord(destination)) refuse(`${path}.Destination`, "an object");
+	const bucketArn = optionalString(destination["BucketArn"], `${path}.Destination.BucketArn`, refuse);
+	const accountId = optionalString(destination["BucketAccountId"], `${path}.Destination.BucketAccountId`, refuse);
+	const format = optionalString(destination["Format"], `${path}.Destination.Format`, refuse);
+	const destPrefix = optionalString(destination["Prefix"], `${path}.Destination.Prefix`, refuse);
+	const enabled = optionalBoolean(item["Enabled"], `${path}.Enabled`, refuse);
+	const versions = optionalString(item["IncludedObjectVersions"], `${path}.IncludedObjectVersions`, refuse);
+	const prefix = optionalString(item["Prefix"], `${path}.Prefix`, refuse);
+	const frequency = optionalString(item["ScheduleFrequency"], `${path}.ScheduleFrequency`, refuse);
+	const fields = item["OptionalFields"];
+	let optionalFields;
+	if (fields !== void 0 && fields !== null) optionalFields = listOf(fields, `${path}.OptionalFields`, refuse).map((f, j) => {
+		if (typeof f !== "string") refuse(`${path}.OptionalFields[${j}]`, "a string");
+		return f;
+	});
+	return {
+		Id: id,
+		Destination: { S3BucketDestination: {
+			Bucket: bucketArn,
+			Format: format,
+			...accountId !== void 0 ? { AccountId: accountId } : {},
+			...destPrefix !== void 0 ? { Prefix: destPrefix } : {}
+		} },
+		IsEnabled: enabled,
+		IncludedObjectVersions: versions,
+		Schedule: { Frequency: frequency },
+		...prefix !== void 0 ? { Filter: { Prefix: prefix } } : {},
+		...optionalFields !== void 0 ? { OptionalFields: optionalFields } : {}
+	};
+}
+function desiredConfigurations(properties, refuse, onUnusable) {
+	const warnOut = (error, what) => onUnusable?.(`${error.message.replace(/ — the resource was not created$/, "")}; replaying a recorded state, so the bucket is created without ${what}`);
+	const build = (fallback, what, run) => {
+		if (!onUnusable) return run();
+		try {
+			return run();
+		} catch (error) {
+			if (!(error instanceof ProvisioningError)) throw error;
+			warnOut(error, what);
+			return fallback;
+		}
+	};
+	const buildList = (property, toSdk) => {
+		if (!onUnusable) {
+			const out = /* @__PURE__ */ new Map();
+			let i = 0;
+			for (const [id, item] of keyedItems(properties[property], property, refuse)) out.set(id, toSdk(id, item, `${property}[${i++}]`));
+			return out;
+		}
+		const out = /* @__PURE__ */ new Map();
+		const value = properties[property];
+		if (value === void 0 || value === null) return out;
+		build(void 0, `any ${property} item`, () => listOf(value, property, refuse))?.forEach((item, i) => {
+			const path = `${property}[${i}]`;
+			build(void 0, `${path}`, () => {
+				if (!isRecord(item)) refuse(path, "an object");
+				const id = itemId(item);
+				if (id === void 0) refuse(`${path}.Id`, "a non-empty string");
+				if (out.has(id)) refuse(`${path}.Id`, "an Id no other item of the list carries");
+				out.set(id, toSdk(id, item, path));
+			});
+		});
+		return out;
+	};
+	const metrics = buildList("MetricsConfigurations", (id, item, path) => metricsItemToSdk(id, item, path, refuse));
+	const inventory = buildList("InventoryConfigurations", (id, item, path) => inventoryItemToSdk(id, item, path, refuse));
+	return {
+		encryption: build(void 0, "its BucketEncryption", () => encryptionToSdk(properties["BucketEncryption"], refuse)),
+		lifecycle: build(void 0, "its LifecycleConfiguration", () => lifecycleToSdk(properties["LifecycleConfiguration"], refuse)),
+		metrics,
+		inventory
+	};
+}
+function configurationRefuser(resourceType, logicalId, physicalId) {
+	const updating = physicalId !== void 0;
+	return (path, expected) => {
+		throw markNonRetryable(new ProvisioningError(`${updating ? "desired " : ""}${path} of ${resourceType} ${logicalId} is not ${expected} — the resource was not ${updating ? "updated" : "created"}`, resourceType, logicalId, physicalId));
+	};
+}
+function encryptionFromSdk(rules) {
+	return { ServerSideEncryptionConfiguration: rules.map((rule) => {
+		const out = {};
+		const byDefault = rule.ApplyServerSideEncryptionByDefault;
+		if (byDefault) out["ServerSideEncryptionByDefault"] = {
+			...byDefault.SSEAlgorithm !== void 0 ? { SSEAlgorithm: byDefault.SSEAlgorithm } : {},
+			...byDefault.KMSMasterKeyID !== void 0 ? { KMSMasterKeyID: byDefault.KMSMasterKeyID } : {}
+		};
+		if (rule.BucketKeyEnabled !== void 0) out["BucketKeyEnabled"] = rule.BucketKeyEnabled;
+		return out;
+	}) };
+}
+function lifecycleFromSdk(rules) {
+	return { Rules: rules.map((rule) => {
+		const out = {};
+		if (rule.ID !== void 0) out["Id"] = rule.ID;
+		if (rule.Status !== void 0) out["Status"] = rule.Status;
+		const scope = {
+			...rule.Filter?.And ?? {},
+			...rule.Filter ?? {}
+		};
+		const prefix = scope["Prefix"] ?? rule.Prefix;
+		if (prefix !== void 0 && prefix !== "") out["Prefix"] = prefix;
+		if (typeof scope["ObjectSizeGreaterThan"] === "number") out["ObjectSizeGreaterThan"] = String(scope["ObjectSizeGreaterThan"]);
+		if (typeof scope["ObjectSizeLessThan"] === "number") out["ObjectSizeLessThan"] = String(scope["ObjectSizeLessThan"]);
+		if (rule.Expiration?.Days !== void 0) out["ExpirationInDays"] = rule.Expiration.Days;
+		if (rule.AbortIncompleteMultipartUpload) {
+			const after = rule.AbortIncompleteMultipartUpload.DaysAfterInitiation;
+			out["AbortIncompleteMultipartUpload"] = after !== void 0 ? { DaysAfterInitiation: after } : {};
+		}
+		return out;
+	}) };
+}
+function metricsFromSdk(item) {
+	const filter = item.Filter;
+	const scope = filter?.And ?? filter ?? {};
+	return {
+		Id: item.Id,
+		...scope.Prefix !== void 0 ? { Prefix: scope.Prefix } : {},
+		...scope.AccessPointArn !== void 0 ? { AccessPointArn: scope.AccessPointArn } : {}
+	};
+}
+function inventoryFromSdk(item) {
+	const dest = item.Destination?.S3BucketDestination;
+	return {
+		Id: item.Id,
+		Destination: {
+			...dest?.Bucket !== void 0 ? { BucketArn: dest.Bucket } : {},
+			...dest?.AccountId !== void 0 ? { BucketAccountId: dest.AccountId } : {},
+			...dest?.Format !== void 0 ? { Format: dest.Format } : {},
+			...dest?.Prefix !== void 0 ? { Prefix: dest.Prefix } : {}
+		},
+		...item.IsEnabled !== void 0 ? { Enabled: item.IsEnabled } : {},
+		...item.IncludedObjectVersions !== void 0 ? { IncludedObjectVersions: item.IncludedObjectVersions } : {},
+		...item.Filter?.Prefix !== void 0 ? { Prefix: item.Filter.Prefix } : {},
+		...item.Schedule?.Frequency !== void 0 ? { ScheduleFrequency: item.Schedule.Frequency } : {},
+		...item.OptionalFields !== void 0 && item.OptionalFields.length > 0 ? { OptionalFields: [...item.OptionalFields] } : {}
+	};
+}
+function impliedBucketKey(algorithm) {
+	if (algorithm === "AES256") return false;
+	if (algorithm === "aws:kms") return true;
+}
+function canonicalizeConfigurationsForDrift(properties) {
+	let out = properties;
+	const encryption = properties["BucketEncryption"];
+	if (isRecord(encryption) && Array.isArray(encryption["ServerSideEncryptionConfiguration"])) {
+		let changed = false;
+		const rules = encryption["ServerSideEncryptionConfiguration"].map((rule) => {
+			if (!isRecord(rule) || !("BucketKeyEnabled" in rule)) return rule;
+			const byDefault = rule["ServerSideEncryptionByDefault"];
+			const implied = impliedBucketKey(isRecord(byDefault) ? byDefault["SSEAlgorithm"] : void 0);
+			const declared = rule["BucketKeyEnabled"];
+			if (implied === void 0 || (declared === "true" ? true : declared === "false" ? false : declared) !== implied) return rule;
+			changed = true;
+			const { BucketKeyEnabled: _dropped, ...rest } = rule;
+			return rest;
+		});
+		if (changed) out = {
+			...out,
+			BucketEncryption: {
+				...encryption,
+				ServerSideEncryptionConfiguration: rules
+			}
+		};
+	}
+	const lifecycle = properties["LifecycleConfiguration"];
+	if (isRecord(lifecycle) && Array.isArray(lifecycle["Rules"])) {
+		let changed = false;
+		const rules = lifecycle["Rules"].map((rule) => {
+			if (!isRecord(rule) || rule["Prefix"] !== "") return rule;
+			changed = true;
+			const { Prefix: _dropped, ...rest } = rule;
+			return rest;
+		});
+		if (changed) out = {
+			...out,
+			LifecycleConfiguration: {
+				...lifecycle,
+				Rules: rules
+			}
+		};
+	}
+	return out;
+}
+function liveMatchesDesired(name, desired, live) {
+	const d = canonicalizeConfigurationsForDrift({ [name]: desired[name] })[name];
+	let l = canonicalizeConfigurationsForDrift({ [name]: live[name] })[name];
+	if (name === "LifecycleConfiguration" && isRecord(d) && isRecord(l)) {
+		const dRules = Array.isArray(d["Rules"]) ? d["Rules"] : [];
+		const lRules = Array.isArray(l["Rules"]) ? l["Rules"] : [];
+		l = {
+			...l,
+			Rules: lRules.map((rule, i) => {
+				const declared = dRules[i];
+				if (!isRecord(rule) || !isRecord(declared) || "Id" in declared) return rule;
+				const { Id: _assigned, ...rest } = rule;
+				return rest;
+			})
+		};
+	}
+	if (name === "MetricsConfigurations" || name === "InventoryConfigurations") {
+		const withSortedFields = (item) => isRecord(item) && Array.isArray(item["OptionalFields"]) ? {
+			...item,
+			OptionalFields: [...item["OptionalFields"]].map(String).sort()
+		} : item;
+		const asSet = (v) => Array.isArray(v) ? v.map((item) => canonicalJson(withSortedFields(item))).sort() : [canonicalJson(v)];
+		return sameJson(asSet(d), asSet(l));
+	}
+	return sameJson(d, l);
+}
+const CONFIGURATION_READ_ACTIONS = {
+	BucketEncryption: "s3express:GetEncryptionConfiguration",
+	LifecycleConfiguration: "s3express:GetLifecycleConfiguration",
+	MetricsConfigurations: "s3express:GetMetricsConfiguration",
+	InventoryConfigurations: "s3express:GetInventoryConfiguration"
+};
 var S3DirectoryBucketProvider = class {
 	s3Client;
 	createClient;
@@ -49489,8 +50391,44 @@ var S3DirectoryBucketProvider = class {
 		"DataRedundancy",
 		"LocationName",
 		"BucketName",
-		"Tags"
+		"Tags",
+		"BucketEncryption",
+		"LifecycleConfiguration",
+		"MetricsConfigurations",
+		"InventoryConfigurations"
 	])]]);
+	async readUnsettled(physicalId, _logicalId, _resourceType, names, recordedProperties, desiredProperties) {
+		const live = await this.readState(physicalId);
+		if (live === RESOURCE_NOT_FOUND) return live;
+		const desired = desiredProperties ?? recordedProperties ?? {};
+		const out = {};
+		for (const name of names) {
+			if (!Object.hasOwn(live, name)) continue;
+			if (desired[name] !== void 0 && liveMatchesDesired(name, desired, live)) {
+				out[name] = desired[name];
+				continue;
+			}
+			if (name === "MetricsConfigurations" || name === "InventoryConfigurations") {
+				const named = /* @__PURE__ */ new Set([...recordedItems(recordedProperties?.[name]).keys(), ...recordedItems(desiredProperties?.[name]).keys()]);
+				const items = live[name];
+				out[name] = Array.isArray(items) ? items.filter((item) => {
+					const id = itemId(item);
+					return id !== void 0 && named.has(id);
+				}) : items;
+				continue;
+			}
+			out[name] = live[name];
+		}
+		return out;
+	}
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::S3Express::DirectoryBucket") return [];
+		return ["MetricsConfigurations", "InventoryConfigurations"];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::S3Express::DirectoryBucket") return properties;
+		return canonicalizeConfigurationsForDrift(properties);
+	}
 	ec2Client;
 	s3ControlClient;
 	providerRegion = ambientRegion();
@@ -49554,6 +50492,7 @@ var S3DirectoryBucketProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 Express Directory Bucket ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const configs = desiredConfigurations(properties, configurationRefuser(resourceType, logicalId), replayWarn(this.logger, context).onUnusable);
 		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy", replayWarn(this.logger, context));
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
@@ -49561,6 +50500,7 @@ var S3DirectoryBucketProvider = class {
 		if (!bucketName) bucketName = generatedNameFor("AWS::S3Express::DirectoryBucket", logicalId, { zoneId: azId });
 		const tags = desiredTags;
 		const includeTags = tags.length > 0;
+		let bucketCreated = false;
 		try {
 			const attributes = await this.buildAttributes(bucketName);
 			await (await this.getCreateClient()).send(new CreateBucketCommand({
@@ -49577,19 +50517,112 @@ var S3DirectoryBucketProvider = class {
 					...includeTags ? { Tags: tags } : {}
 				}
 			}));
+			bucketCreated = true;
 			this.logger.debug(`Created S3 Express Directory Bucket: ${bucketName}`);
+			await this.applyConfigurations(bucketName, configs, properties, {}, true);
 			return {
 				physicalId: bucketName,
 				attributes
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${text}`, resourceType, logicalId, bucketName, cause));
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${text}`, resourceType, logicalId, bucketName, cause));
+			if (bucketCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, bucketName);
+			throw thrown;
+		}
+	}
+	async applyConfigurations(bucketName, desired, desiredRaw, previousRaw, creating, markUnsettled = () => {}) {
+		const changed = (desiredValue, previousValue) => creating || !sameJson(desiredValue, previousValue);
+		const holds = (value, toSdk) => {
+			try {
+				return toSdk(value, () => {
+					throw new Error("malformed");
+				}) !== void 0;
+			} catch {
+				return true;
+			}
+		};
+		if (changed(desiredRaw["BucketEncryption"], previousRaw["BucketEncryption"])) {
+			if (desired.encryption) {
+				markUnsettled("BucketEncryption");
+				await this.s3Client.send(new PutBucketEncryptionCommand({
+					Bucket: bucketName,
+					ServerSideEncryptionConfiguration: desired.encryption
+				}));
+			} else if (!creating && holds(previousRaw["BucketEncryption"], encryptionToSdk)) {
+				markUnsettled("BucketEncryption");
+				await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
+				this.logger.debug("Sent DeleteBucketEncryption: the default encryption is back to SSE-S3");
+			}
+		}
+		if (changed(desiredRaw["LifecycleConfiguration"], previousRaw["LifecycleConfiguration"])) {
+			if (desired.lifecycle) {
+				markUnsettled("LifecycleConfiguration");
+				await this.s3Client.send(new PutBucketLifecycleConfigurationCommand({
+					Bucket: bucketName,
+					LifecycleConfiguration: desired.lifecycle
+				}));
+			} else if (!creating && holds(previousRaw["LifecycleConfiguration"], lifecycleToSdk)) {
+				markUnsettled("LifecycleConfiguration");
+				await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
+				this.logger.debug("Sent DeleteBucketLifecycle: every lifecycle rule is removed");
+			}
+		}
+		const desiredMetrics = recordedItems(desiredRaw["MetricsConfigurations"]);
+		const previousMetrics = creating ? /* @__PURE__ */ new Map() : recordedItems(previousRaw["MetricsConfigurations"]);
+		for (const [id, config] of desired.metrics) {
+			if (previousMetrics.has(id) && sameJson(previousMetrics.get(id), desiredMetrics.get(id))) continue;
+			markUnsettled("MetricsConfigurations");
+			await this.s3Client.send(new PutBucketMetricsConfigurationCommand({
+				Bucket: bucketName,
+				Id: id,
+				MetricsConfiguration: config
+			}));
+		}
+		for (const id of previousMetrics.keys()) {
+			if (desired.metrics.has(id)) continue;
+			markUnsettled("MetricsConfigurations");
+			await this.deleteItemIdempotently(new DeleteBucketMetricsConfigurationCommand({
+				Bucket: bucketName,
+				Id: id
+			}));
+		}
+		const desiredInventory = recordedItems(desiredRaw["InventoryConfigurations"]);
+		const previousInventory = creating ? /* @__PURE__ */ new Map() : recordedItems(previousRaw["InventoryConfigurations"]);
+		for (const [id, config] of desired.inventory) {
+			if (previousInventory.has(id) && sameJson(previousInventory.get(id), desiredInventory.get(id))) continue;
+			markUnsettled("InventoryConfigurations");
+			await this.s3Client.send(new PutBucketInventoryConfigurationCommand({
+				Bucket: bucketName,
+				Id: id,
+				InventoryConfiguration: config
+			}));
+		}
+		for (const id of previousInventory.keys()) {
+			if (desired.inventory.has(id)) continue;
+			markUnsettled("InventoryConfigurations");
+			await this.deleteItemIdempotently(new DeleteBucketInventoryConfigurationCommand({
+				Bucket: bucketName,
+				Id: id
+			}));
+		}
+	}
+	async deleteItemIdempotently(command) {
+		try {
+			if (command instanceof DeleteBucketMetricsConfigurationCommand) await this.s3Client.send(command);
+			else await this.s3Client.send(command);
+		} catch (error) {
+			if (error instanceof Error && error.name === "NoSuchConfiguration") {
+				this.logger.debug("A configuration this update deletes is already gone");
+				return;
+			}
+			throw error;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		if (context?.expectedRegion) for (const clientRegion of [await this.s3Client.config.region(), await this.getS3ControlClient().config.region()]) assertRegionMatch(clientRegion, context.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const configs = desiredConfigurations(properties, configurationRefuser(resourceType, logicalId, physicalId));
 		try {
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
@@ -49602,18 +50635,25 @@ var S3DirectoryBucketProvider = class {
 			if (removedKeys.length > 0 || tagsToApply.length > 0) {
 				const accountId = await this.getAccountId();
 				const resourceArn = await this.buildBucketArn(physicalId, accountId);
-				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$29({
-					AccountId: accountId,
-					ResourceArn: resourceArn,
-					TagKeys: removedKeys
-				}));
-				if (tagsToApply.length > 0) await this.getS3ControlClient().send(new TagResourceCommand$28({
-					AccountId: accountId,
-					ResourceArn: resourceArn,
-					Tags: tagsToApply
-				}));
+				if (removedKeys.length > 0) {
+					context?.markUnsettled?.("Tags");
+					await this.getS3ControlClient().send(new UntagResourceCommand$29({
+						AccountId: accountId,
+						ResourceArn: resourceArn,
+						TagKeys: removedKeys
+					}));
+				}
+				if (tagsToApply.length > 0) {
+					context?.markUnsettled?.("Tags");
+					await this.getS3ControlClient().send(new TagResourceCommand$28({
+						AccountId: accountId,
+						ResourceArn: resourceArn,
+						Tags: tagsToApply
+					}));
+				}
 				this.logger.debug(`Updated tags for S3 Express Directory Bucket ${physicalId}`);
-			} else this.logger.debug(`Update for S3 Express Directory Bucket ${logicalId} is a no-op (no tag changes; other properties are immutable)`);
+			}
+			await this.applyConfigurations(physicalId, configs, properties, previousProperties, false, (key) => context?.markUnsettled?.(key));
 			return {
 				physicalId,
 				wasReplaced: false
@@ -49686,6 +50726,9 @@ var S3DirectoryBucketProvider = class {
 		} while (continuationToken);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		return this.readState(physicalId);
+	}
+	async readState(physicalId) {
 		let locationType;
 		try {
 			locationType = (await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId })))?.BucketLocationType;
@@ -49697,8 +50740,63 @@ var S3DirectoryBucketProvider = class {
 		const result = { BucketName: physicalId };
 		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = locationType === "LocalZone" ? "SingleLocalZone" : "SingleAvailabilityZone";
 		result["Tags"] = await this.readTags(physicalId);
+		const reads = [
+			["BucketEncryption", () => this.readEncryption(physicalId)],
+			["LifecycleConfiguration", () => this.readLifecycle(physicalId)],
+			["MetricsConfigurations", () => this.readMetrics(physicalId)],
+			["InventoryConfigurations", () => this.readInventory(physicalId)]
+		];
+		(await Promise.all(reads.map(([key, read]) => read().catch((error) => {
+			const name = error?.name;
+			if (name === "AccessDenied" || name === "AccessDeniedException") throw new Error(`Reading ${key} of an S3 Express directory bucket needs ${CONFIGURATION_READ_ACTIONS[key]}: grant it to read the bucket back`, { cause: error });
+			throw error;
+		})))).forEach((value, i) => {
+			result[reads[i][0]] = value;
+		});
 		return result;
 	}
+	async readEncryption(bucket) {
+		try {
+			return encryptionFromSdk((await this.s3Client.send(new GetBucketEncryptionCommand({ Bucket: bucket }))).ServerSideEncryptionConfiguration?.Rules ?? []);
+		} catch (err) {
+			if (err.name === "ServerSideEncryptionConfigurationNotFoundError") return { ServerSideEncryptionConfiguration: [] };
+			throw err;
+		}
+	}
+	async readLifecycle(bucket) {
+		try {
+			return lifecycleFromSdk((await this.s3Client.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules ?? []);
+		} catch (err) {
+			if (err.name === "NoSuchLifecycleConfiguration") return { Rules: [] };
+			throw err;
+		}
+	}
+	async readMetrics(bucket) {
+		const out = [];
+		let token;
+		do {
+			const resp = await this.s3Client.send(new ListBucketMetricsConfigurationsCommand({
+				Bucket: bucket,
+				ContinuationToken: token
+			}));
+			for (const item of resp.MetricsConfigurationList ?? []) out.push(metricsFromSdk(item));
+			token = resp.IsTruncated ? resp.NextContinuationToken : void 0;
+		} while (token);
+		return out;
+	}
+	async readInventory(bucket) {
+		const out = [];
+		let token;
+		do {
+			const resp = await this.s3Client.send(new ListBucketInventoryConfigurationsCommand({
+				Bucket: bucket,
+				ContinuationToken: token
+			}));
+			for (const item of resp.InventoryConfigurationList ?? []) out.push(inventoryFromSdk(item));
+			token = resp.IsTruncated ? resp.NextContinuationToken : void 0;
+		} while (token);
+		return out;
+	}
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
@@ -50055,6 +51153,7 @@ var S3TablesProvider = class {
 				...tags !== void 0 && { tags }
 			}));
 			tableCreated = true;
+			reportCreatedResource(logicalId, resourceType, physicalId);
 			if (!response.tableARN) throw new ProvisioningError(`CreateTable did not return a tableARN for ${logicalId} (${physicalId}) — refusing to record an empty TableARN attribute`, resourceType, logicalId, physicalId);
 			const tableARN = response.tableARN;
 			this.logger.debug(`Successfully created S3 Tables Table ${logicalId}: ${physicalId}`);
@@ -50582,6 +51681,7 @@ var ECRProvider = class {
 				...tags ? { tags } : {}
 			}));
 			repositoryCreated = true;
+			reportCreatedResource(logicalId, resourceType, repositoryName);
 			const repo = response.repository;
 			if (!repo?.repositoryName) throw new Error("CreateRepository did not return repository name");
 			const lifecyclePolicy = properties["LifecyclePolicy"];
@@ -51310,6 +52410,7 @@ var ACMCertificateProvider = class {
 			const certificateArn = (await this.acmClient.send(new RequestCertificateCommand(input))).CertificateArn;
 			if (!certificateArn) throw new ProvisioningError(`RequestCertificate succeeded but no CertificateArn returned for ${logicalId}`, resourceType, logicalId);
 			requestedArn = certificateArn;
+			reportCreatedResource(logicalId, resourceType, certificateArn);
 			this.logger.debug(`Requested ACM certificate: ${certificateArn}`);
 			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId, resourceType, dnsValidationZones(properties));
 			else this.logger.warn(`Skipping wait for ACM certificate ${logicalId} (CDKD_NO_WAIT=true). Downstream consumers (CloudFront / ALB) will fail until the cert reaches ISSUED.`);
@@ -51323,6 +52424,7 @@ var ACMCertificateProvider = class {
 			};
 		} catch (error) {
 			const survivorNote = requestedArn ? await this.cleanupRequestedCertificate(requestedArn, logicalId, idempotencyToken, context?.maskSecrets) : void 0;
+			if (requestedArn && survivorNote === void 0) retractCreatedResource(logicalId, resourceType, requestedArn);
 			if (error instanceof CdkdError) {
 				if (survivorNote === void 0) throw error;
 				const thrown = new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
@@ -51611,4 +52713,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DYke4HKr.js.map
+//# sourceMappingURL=provider-classes-DktsDsTf.js.map