@go-to-k/cdkd 0.310.0 → 0.312.0

package/dist/{provider-classes-KsrvwO_r.js → provider-classes-Dz0pYmlJ.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbWaitStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-D94wh05t.js";
+import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-BT2Dfnpt.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $l as stringifyValue, $s as readConfigString, $t as lookupEachName, A as beginDeleteWait, Aa as s3BucketRegionalDomainName, Ai as isRefusedByName, Ar as awaitInFlightSibling, As as withheldAccountClause, B as waitForIndexesSettled, Bi as stringifyIfAssigned, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cd as resolveAssemblyPath, Co as accountArgs, D as reverseMapTableContributorInsights, Da as s3BucketArn, E as reverseMapIndexContributorInsights, Ea as isSettledInstanceState, Ec as passedNoEchoParametersOf, Ei as acquireIdempotencyToken, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fc as snapshotPassProvenance, Fi as readTagList, G as sendTtlWaitingOutRateLimit, Gs as isWarmThroughputDecrease, H as isTtlRateLimited, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as outputReferenceProvenanceOf, Ii as refuseMalformedDesiredTags, In as REDACTED_DELETE_ADDRESS_SKIP_REASON, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Js as coerceCfnBoolean, K as ECR_AUTO_DELETE_IMAGES_TAG, Ki as waitForLambdaFunctionActive, Ks as toCfnInteger, L as deleteTableWithIndexBusyRetry, Li as tagMapAsList, Ln as isRedactedRecordedValue, M as deleteBudgetKey, Mc as markSameGenerationBag, Mi as DBPROXY_TAGS_WHAT, Mr as getStackRecords, Ms as findSilentDropProperties, N as resolveDynamoDbDeleteBudgetClock, Nc as redactForState, Ni as DBPROXY_TAG_OPTIONS, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oa as s3BucketDomainName, P as resolveDynamoDbDeleteBudgetMs, Pc as recordReferenceProvenanceEntry, Pi as planTagDiff, Pn as getCurrentProducerRegions, Pr as replacedDeleteFailureVerdict, Ps as withoutSilentDropProperties, Qc as withoutPhysicalNameCopies, Qo as refuseMalformedNestedChildOutputs, Qs as configStringRefusal, Qt as isAccessDeniedError, R as maskedLogger, Rc as hasMaskableValues, Ri as tagPlanWarning, Rn as redactedDeleteAddressFields, S as indexDeclaresContributorInsights, Sd as renderAssemblyPathEscape, Si as earliestDefined, T as readContributorInsightsSpec, U as planTimeToLive, Us as WARM_THROUGHPUT_MEMBERS, V as isTtlAlreadyDisabled, Vt as withNestedStackContext, W as readTtlSpec, Ws as coerceWarmThroughput$1, X as getPriorAttempts, Xi as getCurrentResourceSecrets, Xl as timePhase, Xs as configBooleanRefusal, Y as isTruthyCfnBoolean, Ys as coerceCfnInteger, Z as markRefusedBeforeApplying, Zs as configIntegerRefusal, Zt as chunks, _ as streamMemberRefusals, _a as reDisableInstanceApiTermination, b as CONTRIBUTOR_INSIGHTS_KEY, bd as describeFileReadFailure, c as DynamoDBGlobalTableProvider, cc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, cl as physicalNameCopiesOf, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as isWaitAbandonedError, dc as emrClusterInstancesReplaced, ec as replayWarn, el as dynamicReferenceTokens, en as withApiLimit, f as declaredStreamTagsMember, fa as markWaitAbandoned, fc as canonicalLambdaFunctionName, fl as carriesSecretMask, g as streamDeclaresTags, ga as observeThenDisableInstanceApiTermination, go as passedParameterClassesOf, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ha as isTerminationProtectionPropagationError, ht as enclosingDeadlineExpired, ia as unchangedBehindSecretReference, iu as rewriteTemplateAssetReferences, j as compensateRemovedDeletionProtection, ja as s3BucketWebsiteUrl, ji as markDeleteStarted, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as s3BucketDualStackDomainName, l as STREAM_POLICY_KEY, la as deleteSkipReason, li as secretNamedAttributeNamesOf, ll as recordAttributeIdCopy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as ec2InstanceProtectionSite, mc as sameLambdaFunctionAddress, na as slowCcOperationTimeoutMs, nc as requireConfigObject, no as getAccountInfo, od as canonicalizeRegion, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pc as lambdaFunctionNameForMask, po as parseWebACLArn, q as S3_AUTO_DELETE_OBJECTS_TAG, qs as toFiniteNumber, ra as onlySecretReferencesDiffer, rc as requireConfigString, rd as decodeListingKey, sc as withRetry, sd as derivePartitionAndUrlSuffix, sl as recoverMaskedOutput, st as isAbsoluteAssetPath, t as DeployEngine, tc as requireConfigArray, u as STREAM_TAGS_KEY, ua as withIndeterminateGuard, uc as ecsServiceLaunchTypeSetOrChanged, v as streamPolicyMatchesDeclared, va as reEnableInstanceApiTermination, vs as refuseMalformedResourcesForDestroy, w as planIndexContributorInsightsOps, wi as reserveStackCreateToken, x as contributorInsightsRefusals, xd as displayAssemblyPath, y as streamTagsMatchDeclared, z as relayedIndexBusyDelete, zi as definedAttributes, zn as redactedDeleteAddressSkip } from "./deploy-engine-DZO2SOQJ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BWw7I-SZ.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CS420Kx9.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-BUG7NMWS.js";
-import { RDSProvider } from "./rds-provider-BqwTQeS-.js";
-import { NeptuneProvider } from "./neptune-provider-8kjFmR1l.js";
-import { ASGProvider } from "./asg-provider-I1bFHVsO.js";
+import { $ as getPriorAttempts, $s as isWarmThroughputDecrease, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ad as renderAssemblyPathEscape, Ai as acquireIdempotencyToken, Ao as accountArgs, B as deleteTableWithIndexBusyRetry, Bc as markSameGenerationBag, Bi as refuseMalformedDesiredTags, Bn as isRedactedRecordedValue, Bs as findSilentDropProperties, C as planContributorInsightsOp, Co as passedParameterClassesOf, D as reverseMapTableContributorInsights, E as reverseMapIndexContributorInsights, Ei as earliestDefined, F as resolveDynamoDbDeleteBudgetClock, Fa as s3BucketDomainName, Fi as markDeleteStarted, Fr as getStackRecords, G as isTtlRateLimited, H as relayedIndexBusyDelete, Hc as recordReferenceProvenanceEntry, Hi as tagPlanWarning, Hn as redactedDeleteAddressSkip, Hs as withoutSilentDropProperties, I as resolveDynamoDbDeleteBudgetMs, Ia as s3BucketDualStackDomainName, Ii as DBPROXY_TAGS_WHAT, It as getNestedRevertRun, J as sendTtlWaitingOutRateLimit, K as planTimeToLive, Kc as hasMaskableValues, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as s3BucketRegionalDomainName, Li as DBPROXY_TAG_OPTIONS, Ln as getCurrentProducerRegions, Lr as replacedDeleteFailureVerdict, Ls as withheldAccountClause, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Na as isSettledInstanceState, Nr as awaitInFlightSibling, O as stripIndexContributorInsights, Od as describeFileReadFailure, Oi as reserveStackCreateToken, P as deleteBudgetKey, Pa as s3BucketArn, Pc as passedNoEchoParametersOf, Pi as isRefusedByName, Q as isTruthyCfnBoolean, Qs as coerceWarmThroughput$1, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketWebsiteUrl, Ri as planTagDiff, S as indexDeclaresContributorInsights, Sa as reEnableInstanceApiTermination, Sc as sameLambdaFunctionAddress, T as readContributorInsightsSpec, Ta as isUsableAttemptedName, Ts as refuseMalformedResourcesForDestroy, U as waitForIndexesSettled, Ua as outputReferenceProvenanceOf, Uc as snapshotPassProvenance, Ui as definedAttributes, Ut as getCurrentNestedStackContext, V as maskedLogger, Vc as redactForState, Vi as tagMapAsList, Vn as redactedDeleteAddressFields, W as isTtlAlreadyDisabled, Wi as stringifyIfAssigned, Wt as withNestedStackContext, X as S3_AUTO_DELETE_OBJECTS_TAG, Xi as waitForLambdaFunctionActive, Y as ECR_AUTO_DELETE_IMAGES_TAG, Z as hasCdkAutoDeleteTag, Zs as WARM_THROUGHPUT_MEMBERS, _ as streamMemberRefusals, _l as recordAttributeIdCopy, ac as configIntegerRefusal, as as refuseMalformedNestedChildOutputs, b as CONTRIBUTOR_INSIGHTS_KEY, ba as observeThenDisableInstanceApiTermination, bc as canonicalLambdaFunctionName, bl as carriesSecretMask, bo as parseWebACLArn, c as DynamoDBGlobalTableProvider, ca as unchangedBehindSecretReference, cc as replayWarn, cl as dynamicReferenceTokens, d as declaredStreamPolicyMember, dc as requireConfigString, dd as decodeListingKey, dt as listNestedTemplateRows, ea as getCurrentResourceSecrets, ec as toCfnInteger, en as chunks, et as markRefusedBeforeApplying, f as declaredStreamTagsMember, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, g as streamDeclaresTags, ga as markWaitAbandoned, gc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, gl as physicalNameCopiesOf, h as streamDeclaresPolicy, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hl as recoverMaskedOutput, ic as configBooleanRefusal, iu as timePhase, j as DYNAMODB_DELETE_POLL_COST_MS, jd as resolveAssemblyPath, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, kd as displayAssemblyPath, l as STREAM_POLICY_KEY, lc as requireConfigArray, lo as getAccountInfo, lt as findNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as withIndeterminateGuard, md as canonicalizeRegion, nc as coerceCfnBoolean, nn as lookupEachName, oa as slowCcOperationTimeoutMs, oc as configStringRefusal, ol as withoutPhysicalNameCopies, p as planStreamMemberOps, pa as deleteSkipReason, pi as secretNamedAttributeNamesOf, q as readTtlSpec, rc as coerceCfnInteger, rn as withApiLimit, sa as onlySecretReferencesDiffer, sc as readConfigString, su as stringifyValue, t as DeployEngine, tc as toFiniteNumber, tn as isAccessDeniedError, u as STREAM_TAGS_KEY, uc as requireConfigObject, ut as isAbsoluteAssetPath, v as streamPolicyMatchesDeclared, va as ec2InstanceProtectionSite, vc as ecsServiceLaunchTypeSetOrChanged, vt as enclosingDeadlineExpired, w as planIndexContributorInsightsOps, x as contributorInsightsRefusals, xa as reDisableInstanceApiTermination, xc as lambdaFunctionNameForMask, y as streamTagsMatchDeclared, ya as isTerminationProtectionPropagationError, yc as emrClusterInstancesReplaced, yt as enclosingDeadlineRemainingMs, z as TABLE_INDEX_NOUN, zi as readTagList, zn as REDACTED_DELETE_ADDRESS_SKIP_REASON, zt as revertNestedChildFromJournal } from "./deploy-engine-CVNzK__j.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DM7bN9m1.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Nk_95KKk.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D7wXWxVo.js";
+import { RDSProvider } from "./rds-provider-CXSZq1c8.js";
+import { NeptuneProvider } from "./neptune-provider-qdoLunCh.js";
+import { ASGProvider } from "./asg-provider-CVLTQtQr.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -63,7 +63,7 @@ import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as Creat
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableBucketMetricsConfigurationCommand, DeleteTableBucketReplicationCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableBucketEncryptionCommand, GetTableBucketMaintenanceConfigurationCommand, GetTableBucketMetricsConfigurationCommand, GetTableBucketReplicationCommand, GetTableBucketStorageClassCommand, GetTableCommand as GetTableCommand$1, GetTableMaintenanceConfigurationCommand, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, PutTableBucketEncryptionCommand, PutTableBucketMaintenanceConfigurationCommand, PutTableBucketMetricsConfigurationCommand, PutTableBucketReplicationCommand, PutTableBucketStorageClassCommand, PutTableMaintenanceConfigurationCommand, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -656,6 +656,7 @@ var IAMManagedPolicyProvider = class {
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
 			createdPolicyIdentity = policyIdentityToken(response.Policy?.PolicyId);
+			reportCreatedResource(logicalId, resourceType, policyArn, createdPolicyIdentity);
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
 			try {
 				await this.attachToPrincipals(policyArn, principals.lists.Groups, principals.lists.Roles, principals.lists.Users, log);
@@ -664,6 +665,7 @@ var IAMManagedPolicyProvider = class {
 					await this.detachAllPrincipals(policyArn);
 					await this.deleteAllNonDefaultVersions(policyArn);
 					await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: policyArn }));
+					retractCreatedResource(logicalId, resourceType, policyArn);
 					leftBehindArn = void 0;
 					log.debug(`Cleaned up partially-created managed policy ${logicalId} (${v(policyArn)}) after attachment failure`);
 				} catch (cleanupError) {
@@ -1263,6 +1265,7 @@ var IAMInstanceProfileProvider = class {
 			}));
 			leftBehind = true;
 			createdProfileIdentity = instanceProfileIdentityToken(response.InstanceProfile?.InstanceProfileId);
+			reportCreatedResource(logicalId, resourceType, instanceProfileName, createdProfileIdentity);
 			log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
 			const attachedRoles = [];
 			try {
@@ -1285,6 +1288,7 @@ var IAMInstanceProfileProvider = class {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
 					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
+					retractCreatedResource(logicalId, resourceType, instanceProfileName);
 					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${v(instanceProfileName)}) after wiring failure`);
 				} catch (cleanupError) {
@@ -1534,12 +1538,14 @@ var IAMAccessKeyProvider = class {
 			const accessKeyId = response.AccessKey?.AccessKeyId;
 			const secretAccessKey = response.AccessKey?.SecretAccessKey;
 			leftBehindKeyId = accessKeyId;
+			reportCreatedResource(logicalId, resourceType, accessKeyId ?? "");
 			if (!accessKeyId || !secretAccessKey) {
 				if (accessKeyId) try {
 					await this.iamClient.send(new DeleteAccessKeyCommand({
 						UserName: userName,
 						AccessKeyId: accessKeyId
 					}));
+					retractCreatedResource(logicalId, resourceType, accessKeyId);
 					leftBehindKeyId = void 0;
 				} catch (cleanupError) {
 					const lead = `Failed to clean up IAM access key ${logicalId} (${v(accessKeyId)}) minted by a partial CreateAccessKey response`;
@@ -1559,6 +1565,7 @@ var IAMAccessKeyProvider = class {
 						UserName: userName,
 						AccessKeyId: accessKeyId
 					}));
+					retractCreatedResource(logicalId, resourceType, accessKeyId);
 					leftBehindKeyId = void 0;
 					log.debug(`Cleaned up partially-created IAM access key ${logicalId} (${v(accessKeyId)}) after status wiring failure`);
 				} catch (cleanupError) {
@@ -1584,7 +1591,10 @@ var IAMAccessKeyProvider = class {
 			};
 		} catch (error) {
 			const reconciled = await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log);
-			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
+			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) {
+				retractCreatedResource(logicalId, resourceType, leftBehindKeyId);
+				leftBehindKeyId = void 0;
+			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindKeyId !== void 0) {
@@ -1935,6 +1945,7 @@ var IAMUserGroupProvider = class {
 			const response = await (await this.createClient.get()).send(new CreateUserCommand(createParams));
 			leftBehind = true;
 			createdUserIdentity = userOrGroupIdentityToken(response.User?.UserId);
+			reportCreatedResource(logicalId, resourceType, userName, createdUserIdentity);
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
 				if (permissionsBoundary) {
@@ -1995,6 +2006,7 @@ var IAMUserGroupProvider = class {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
 					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
+					retractCreatedResource(logicalId, resourceType, userName);
 					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM user ${logicalId} (${v(userName)}) after wiring failure`);
 				} catch (cleanupError) {
@@ -2337,6 +2349,7 @@ var IAMUserGroupProvider = class {
 			const response = await (await this.createClient.get()).send(new CreateGroupCommand(createParams));
 			leftBehind = true;
 			createdGroupIdentity = userOrGroupIdentityToken(response.Group?.GroupId);
+			reportCreatedResource(logicalId, resourceType, groupName, createdGroupIdentity);
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
 				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
@@ -2361,6 +2374,7 @@ var IAMUserGroupProvider = class {
 					await this.detachAllGroupPolicies(groupName, log);
 					await this.deleteAllGroupInlinePolicies(groupName, log);
 					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
+					retractCreatedResource(logicalId, resourceType, groupName);
 					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM group ${logicalId} (${v(groupName)}) after wiring failure`);
 				} catch (cleanupError) {
@@ -4803,6 +4817,7 @@ var S3BucketProvider = class S3BucketProvider {
 				}
 				createdNewBucket = adoptedOwnLeftover || preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
+				if (createdNewBucket) reportCreatedResource(logicalId, resourceType, bucketName);
 				if (createdNewBucket) windowSpent = true;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
 				if (preflight.kind === "region" && !adoptedOwnLeftover) this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
@@ -4832,6 +4847,7 @@ var S3BucketProvider = class S3BucketProvider {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
 					bucketLeftBehind = false;
+					retractCreatedResource(logicalId, resourceType, bucketName);
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) after wiring failure`);
 				} catch (cleanupError) {
 					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}): ${describeAwsFailure(cleanupError).detail}`);
@@ -6263,7 +6279,7 @@ function normalizeStatement(statement) {
 	for (const key of PRINCIPAL_KEYS) if (Object.prototype.hasOwnProperty.call(out, key)) out[key] = normalizePrincipal(out[key]);
 	return out;
 }
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -6287,7 +6303,7 @@ function policyContentKey(document) {
 		if (Object.prototype.hasOwnProperty.call(doc, "Statement")) doc["Statement"] = (Array.isArray(doc["Statement"]) ? doc["Statement"] : [doc["Statement"]]).map(normalizeStatement);
 		value = doc;
 	}
-	return canonicalJson$2(value);
+	return canonicalJson$3(value);
 }
 
 //#endregion
@@ -6565,7 +6581,7 @@ function listedQueues(bag) {
 function isListedQueueUrl(value) {
 	return isSqsQueueUrl(value) && !value.includes(",") && !value.includes("*");
 }
-function canonicalJson$1(value) {
+function canonicalJson$2(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -6580,14 +6596,14 @@ function canonicalJson$1(value) {
 }
 function canonicalPolicy$1(text) {
 	try {
-		return canonicalJson$1(JSON.parse(text));
+		return canonicalJson$2(JSON.parse(text));
 	} catch {
 		return `raw:${text}`;
 	}
 }
 function policyReference(document) {
 	if (typeof document === "string" && document.length > 0) return canonicalPolicy$1(document);
-	if (document !== null && typeof document === "object") return canonicalJson$1(document);
+	if (document !== null && typeof document === "object") return canonicalJson$2(document);
 }
 function splitQueueUrls(physicalId) {
 	return physicalId.split(",").filter((url) => url.length > 0);
@@ -6683,7 +6699,8 @@ var SNSTopicProvider = class {
 			if (properties["MaximumMessageSize"] != null) topicAttributes["MaximumMessageSize"] = stringifyValue(properties["MaximumMessageSize"]);
 			let tags;
 			if (properties["Tags"] != null) tags = desiredTags;
-			const heldBefore = Boolean(properties["ArchivePolicy"]) || Boolean(properties["DataProtectionPolicy"]) || properties["DeliveryStatusLogging"] != null || Array.isArray(properties["Subscription"]) ? await this.topicHeldBefore(topicName) : "free";
+			const wiringDeclared = Boolean(properties["ArchivePolicy"]) || Boolean(properties["DataProtectionPolicy"]) || properties["DeliveryStatusLogging"] != null || Array.isArray(properties["Subscription"]);
+			const heldBefore = wiringDeclared ? await this.topicHeldBefore(topicName) : "free";
 			const createParams = {
 				Name: topicName,
 				...Object.keys(topicAttributes).length > 0 && { Attributes: topicAttributes },
@@ -6691,6 +6708,7 @@ var SNSTopicProvider = class {
 			};
 			const topicArn = (await this.snsClient.send(new CreateTopicCommand(createParams))).TopicArn;
 			if (!topicArn) throw new Error("CreateTopic did not return TopicArn");
+			if (wiringDeclared && heldBefore === "free") reportCreatedResource(logicalId, resourceType, topicArn);
 			try {
 				if (properties["ArchivePolicy"]) {
 					const archivePolicy = typeof properties["ArchivePolicy"] === "string" ? properties["ArchivePolicy"] : JSON.stringify(properties["ArchivePolicy"]);
@@ -6722,6 +6740,7 @@ var SNSTopicProvider = class {
 				if (heldBefore !== "free") warn(skippedCleanupText(heldBefore, `SNS topic ${logicalId} (${topicArn})`, pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()));
 				else try {
 					await this.snsClient.send(new DeleteTopicCommand({ TopicArn: topicArn }));
+					retractCreatedResource(logicalId, resourceType, topicArn);
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = topicArn;
@@ -7609,7 +7628,7 @@ var SNSTopicPolicyProvider = class {
 		if (candidates.length === 0) return [];
 		let reference;
 		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy(document);
-		else if (document !== null && typeof document === "object") reference = canonicalJson(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$1(document);
 		if (reference === void 0) {
 			this.logger.warn(mask(safeMsg`The topics ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`));
 			return [];
@@ -7726,7 +7745,7 @@ function defaultTopicPolicy(topicArn) {
 		}]
 	});
 }
-function canonicalJson(value) {
+function canonicalJson$1(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -7740,7 +7759,7 @@ function canonicalJson(value) {
 }
 function canonicalPolicy(text) {
 	try {
-		return canonicalJson(JSON.parse(text));
+		return canonicalJson$1(JSON.parse(text));
 	} catch {
 		return `raw:${text}`;
 	}
@@ -8059,6 +8078,7 @@ var LambdaFunctionProvider = class {
 			functionCreated = true;
 			createdFunctionName = response.FunctionName || functionName;
 			createdFunctionIdentity = functionIdentityToken(response.FunctionArn, response.LastModified);
+			reportCreatedResource(logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
 			const recursiveLoop = properties["RecursiveLoop"];
 			if (recursiveLoop !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 				FunctionName: functionName,
@@ -8093,6 +8113,7 @@ var LambdaFunctionProvider = class {
 					minDelay: 1,
 					maxDelay: 5
 				}, { FunctionName: functionName });
+				reportCreatedResource(logicalId, resourceType, createdFunctionName);
 				await this.putRuntimeManagementConfig(functionName, runtimeManagementConfig);
 				createdFunctionIdentity = void 0;
 			}, {
@@ -8117,6 +8138,7 @@ var LambdaFunctionProvider = class {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(safeStringify(error))));
 			if (createdFunctionName !== void 0 && !postCreateCleanup.deleted) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
+			else if (createdFunctionName !== void 0) retractCreatedResource(logicalId, resourceType, createdFunctionName);
 			throw thrown;
 		}
 	}
@@ -10398,6 +10420,7 @@ var LambdaMicrovmImageProvider = class {
 			const imageArn = response.imageArn;
 			createdArn = imageArn;
 			if (!imageArn) throw new ProvisioningError(`CreateMicrovmImage succeeded but no imageArn returned for ${logicalId}`, resourceType, logicalId);
+			reportCreatedResource(logicalId, resourceType, imageArn);
 			this.logger.debug(`Created MicroVM image ${logicalId}: ${imageArn} (state=${response.state})`);
 			const noWait = process.env["CDKD_NO_WAIT"] === "true";
 			let latest = {
@@ -10656,15 +10679,15 @@ function buildCommonImageInput(properties) {
 	return input;
 }
 function mapCodeArtifact(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	const uri = value["Uri"];
 	return typeof uri === "string" ? { uri } : void 0;
 }
 function mapLogging(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	if (value["Disabled"] === true) return { disabled: {} };
 	const cloudWatch = value["CloudWatch"];
-	if (isRecord$1(cloudWatch)) {
+	if (isRecord$2(cloudWatch)) {
 		const cw = {};
 		if (typeof cloudWatch["LogGroup"] === "string") cw.logGroup = cloudWatch["LogGroup"];
 		if (typeof cloudWatch["LogStream"] === "string") cw.logStream = cloudWatch["LogStream"];
@@ -10673,32 +10696,32 @@ function mapLogging(value) {
 }
 function mapCpuConfigurations(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$1).map((c) => ({ architecture: c["Architecture"] }));
+	return value.filter(isRecord$2).map((c) => ({ architecture: c["Architecture"] }));
 }
 function mapResources(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$1).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
+	return value.filter(isRecord$2).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
 }
 function mapHooks(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	return lowerFirstKeysDeep(value);
 }
 function mapKeyValueListToRecord(value) {
 	if (!Array.isArray(value)) return void 0;
 	const out = {};
-	for (const entry of value) if (isRecord$1(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
+	for (const entry of value) if (isRecord$2(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
 	return Object.keys(out).length > 0 ? out : void 0;
 }
 function lowerFirstKeysDeep(value) {
 	if (Array.isArray(value)) return value.map(lowerFirstKeysDeep);
-	if (isRecord$1(value)) {
+	if (isRecord$2(value)) {
 		const out = {};
 		for (const [k, v] of Object.entries(value)) out[k.charAt(0).toLowerCase() + k.slice(1)] = lowerFirstKeysDeep(v);
 		return out;
 	}
 	return value;
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -10784,7 +10807,10 @@ var LambdaWebFunctionRevisionProvider = class {
 				throw error;
 			}
 			createdArn = response.revisionArn;
-			if (createdArn) revisionsCreatedByThisProcess.add(createdArn);
+			if (createdArn) {
+				revisionsCreatedByThisProcess.add(createdArn);
+				reportCreatedResource(logicalId, resourceType, createdArn);
+			}
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, replayWindow, log, input.functionName);
 			if (!createdArn || !response.revisionId) throw new ProvisioningError(`CreateWebFunctionRevision succeeded but returned no revision ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
@@ -10798,6 +10824,7 @@ var LambdaWebFunctionRevisionProvider = class {
 			let leftBehindArn = createdArn;
 			if (leftBehindArn) try {
 				await this.delete(logicalId, leftBehindArn, resourceType, void 0, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
+				retractCreatedResource(logicalId, resourceType, leftBehindArn);
 				leftBehindArn = void 0;
 			} catch (cleanupError) {
 				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
@@ -11167,6 +11194,7 @@ var LambdaWebFunctionEndpointProvider = class {
 		try {
 			createdArn = (await this.client.send(new CreateWebFunctionEndpointCommand(input))).endpointArn;
 			if (!createdArn) throw new ProvisioningError(`CreateWebFunctionEndpoint succeeded but returned no endpoint ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			reportCreatedResource(logicalId, resourceType, createdArn);
 			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, resourceType, "create", void 0, context?.maskSecrets);
 			return {
 				physicalId: createdArn,
@@ -11489,6 +11517,11 @@ var LambdaNetworkConnectorProvider = class {
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generatedNameFor("AWS::Lambda::NetworkConnector", logicalId);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
+		if (declaredElasticIp(properties) !== void 0) {
+			const message = elasticIpRefusalMessage(logicalId, "create");
+			if (context?.replayingState !== true) throw new ProvisioningError(message, resourceType, logicalId);
+			this.logger.warn(safeMsg`${message} Proceeding without it: this create replays a cdkd state record.`);
+		}
 		const createToken = acquireIdempotencyToken({
 			scope: "CreateNetworkConnector",
 			logicalId
@@ -11510,6 +11543,7 @@ var LambdaNetworkConnectorProvider = class {
 		try {
 			createdArn = (await this.client.send(new CreateNetworkConnectorCommand(input))).Arn;
 			if (!createdArn) throw new ProvisioningError(`CreateNetworkConnector succeeded but returned no ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
+			reportCreatedResource(logicalId, resourceType, createdArn);
 			const settled = await this.waitForSettled(createdArn, logicalId, "create");
 			createToken.release();
 			return {
@@ -11527,6 +11561,12 @@ var LambdaNetworkConnectorProvider = class {
 		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, physicalId);
+		const desiredElasticIp = declaredElasticIp(properties);
+		if (desiredElasticIp !== void 0 && !isDeepStrictEqual(desiredElasticIp, declaredElasticIp(previousProperties))) {
+			const message = elasticIpRefusalMessage(logicalId, "update");
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
+			this.logger.warn(safeMsg`${message} Proceeding without it: this update restores a recorded or read-back configuration.`);
+		}
 		const updateRole = this.readOperatorRole(properties, logicalId, resourceType, physicalId, context);
 		if (typeof previousProperties["OperatorRole"] === "string" && properties["OperatorRole"] === void 0 && context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`OperatorRole cannot be removed in place for Lambda network connector ${logicalIdShown(logicalId)}: cdkd sends no role when the template declares none, so the current one would stay attached. Set it to another role, or replace the connector (change its Name).`, resourceType, logicalId, physicalId);
 		try {
@@ -11725,6 +11765,15 @@ var LambdaNetworkConnectorProvider = class {
 		return markRedactedCause(build(`${failure.summary}${relayedNameCollision(failure.detail)}`));
 	}
 };
+const ELASTIC_IP_KEY = "ElasticIpConfiguration";
+function declaredElasticIp(properties) {
+	const config = properties["Configuration"];
+	const vpc = isPlainRecord$3(config) ? config["VpcEgressConfiguration"] : void 0;
+	return isPlainRecord$3(vpc) ? vpc[ELASTIC_IP_KEY] : void 0;
+}
+function elasticIpRefusalMessage(logicalId, mode) {
+	return `AWS::Lambda::NetworkConnector ${logicalIdShown(logicalId)}: Configuration.VpcEgressConfiguration.${ELASTIC_IP_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript (@aws-sdk/client-lambda-core) does not model the member, so it would be dropped from the ${mode === "create" ? "CreateNetworkConnector" : "UpdateNetworkConnector"} request without an error. Remove ${ELASTIC_IP_KEY} from Configuration.VpcEgressConfiguration to deploy the connector without it.`;
+}
 var TerminalConnectorStateError = class extends Error {};
 function buildAttributes(resp) {
 	return definedAttributes({
@@ -11739,6 +11788,172 @@ function versionOfArn(arn) {
 	return match ? Number(match[1]) : void 0;
 }
 
+//#endregion
+//#region src/provisioning/delete-gone-wait.ts
+async function waitForGoneAfterDelete(opts) {
+	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+	const now = opts.now ?? Date.now;
+	const userTimeoutMs = resolvedResourceTimeoutMs(opts.resourceType);
+	const maxWaitMs = userTimeoutMs === void 0 ? opts.maxWaitMs : Math.min(opts.maxWaitMs, userTimeoutMs / 2);
+	const startedAt = now();
+	const stopped = `${opts.what}: the delete was ACCEPTED by AWS, but cdkd stopped waiting for it to disappear`;
+	const consequence = "AWS finishes the delete on its side; until it does, a create of the same name is refused with \"already exists\".";
+	const watch = startInterruptWatch(`${opts.what} deletion wait`);
+	try {
+		let lastStatus;
+		let sawNonFailedStatus = false;
+		for (;;) {
+			if (watch.isInterrupted()) {
+				opts.logger.warn(safeMsg`${stopped} (interrupted). ${consequence}`);
+				return;
+			}
+			try {
+				const status = await opts.describe();
+				if (status === void 0) {
+					opts.logger.debug(safeMsg`${opts.what} is gone`);
+					return;
+				}
+				const failure = opts.failedStatus?.(status);
+				if (failure !== void 0) {
+					if (sawNonFailedStatus || now() - startedAt >= opts.pollIntervalMs) throw markWaitAbandoned(failure);
+				} else sawNonFailedStatus = true;
+				lastStatus = status;
+				opts.logger.debug(safeMsg`${opts.what} status: ${status}, waiting for it to disappear`);
+			} catch (error) {
+				if (isWaitAbandonedError(error)) throw error;
+				if (!isThrottlingError(error) && !isTransientServerError(error)) {
+					opts.logger.debug(safeMsg`${opts.what}: status read failed: ${describeAwsFailure(error).detail}`);
+					opts.logger.warn(safeMsg`${stopped}: its status could not be read (${describeAwsFailure(error).summary}). ${consequence}`);
+					return;
+				}
+				opts.logger.debug(safeMsg`${opts.what}: status read throttled or failed transiently, re-polling`);
+			}
+			const remainingMs = maxWaitMs - (now() - startedAt);
+			if (remainingMs <= 0) {
+				opts.logger.warn(safeMsg`${stopped} after ${Math.round(maxWaitMs / 1e3)}s` + safeMsg`${lastStatus !== void 0 ? ` (last status: ${lastStatus})` : ""}. ${consequence}`);
+				return;
+			}
+			await sleep(Math.min(opts.pollIntervalMs, remainingMs));
+		}
+	} finally {
+		watch.dispose();
+	}
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-vector-indexes.ts
+function vectorIndexesByName(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") out.set(name, entry);
+	}
+	return out;
+}
+function vectorIndexForSend(entry) {
+	const out = {};
+	for (const key of [
+		"IndexName",
+		"VectorAttribute",
+		"Projection",
+		"DistanceFunction"
+	]) if (entry[key] !== void 0) out[key] = entry[key];
+	if (entry["Dimensions"] !== void 0) out["Dimensions"] = coerceCfnInteger(entry["Dimensions"]) ?? entry["Dimensions"];
+	if (entry["SearchSchema"] !== void 0) out["SearchSchema"] = entry["SearchSchema"];
+	return out;
+}
+function vectorIndexesForCreate(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Array.isArray(value)) return value;
+	return value.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? vectorIndexForSend(entry) : entry);
+}
+function sortedByJson(list) {
+	if (!Array.isArray(list)) return list;
+	return [...list].sort((a, b) => {
+		const x = JSON.stringify(a) ?? "";
+		const y = JSON.stringify(b) ?? "";
+		return x < y ? -1 : x > y ? 1 : 0;
+	});
+}
+function vectorIndexKey(entry) {
+	const e = entry;
+	const projection = e["Projection"];
+	const normalizedProjection = typeof projection === "object" && projection !== null && !Array.isArray(projection) ? {
+		ProjectionType: projection["ProjectionType"],
+		NonKeyAttributes: sortedByJson(nonEmpty(projection["NonKeyAttributes"]))
+	} : projection;
+	const attribute = e["VectorAttribute"];
+	return JSON.stringify([
+		e["IndexName"],
+		typeof attribute === "object" && attribute !== null ? attribute["AttributeName"] : attribute,
+		coerceCfnInteger(e["Dimensions"]) ?? e["Dimensions"],
+		e["DistanceFunction"],
+		normalizedProjection,
+		sortedByJson(Array.isArray(e["SearchSchema"]) && e["SearchSchema"].length > 0 ? e["SearchSchema"].map((s) => typeof s === "object" && s !== null ? {
+			AttributeName: s["AttributeName"],
+			SearchSchemaElementType: s["SearchSchemaElementType"]
+		} : s) : nonEmpty(e["SearchSchema"]))
+	]);
+}
+function nonEmpty(value) {
+	return Array.isArray(value) && value.length === 0 ? void 0 : value;
+}
+function planVectorIndexUpdates(previous, desired, live) {
+	const prevByName = vectorIndexesByName(previous);
+	const desiredByName = vectorIndexesByName(desired);
+	const liveByName = live === void 0 ? void 0 : new Map(live.filter((d) => typeof d.IndexName === "string").map((d) => [d.IndexName, d]));
+	const plan = {
+		ops: [],
+		changed: [],
+		adopted: [],
+		alreadyGone: []
+	};
+	const liveHolds = (name, entry) => {
+		const l = liveByName?.get(name);
+		return l !== void 0 && l.IndexStatus !== "DELETING" && vectorIndexKey(l) === vectorIndexKey(entry);
+	};
+	for (const name of prevByName.keys()) {
+		if (desiredByName.has(name)) continue;
+		const l = liveByName?.get(name);
+		if (liveByName !== void 0 && (l === void 0 || l.IndexStatus === "DELETING")) {
+			plan.alreadyGone.push(name);
+			continue;
+		}
+		plan.ops.push({ Delete: { IndexName: name } });
+	}
+	for (const [name, entry] of desiredByName) {
+		const before = prevByName.get(name);
+		if (before === void 0) {
+			const l = liveByName?.get(name);
+			if (l === void 0 || l.IndexStatus === "DELETING") plan.ops.push({ Create: vectorIndexForSend(entry) });
+			else if (liveHolds(name, entry)) plan.adopted.push(name);
+			else plan.changed.push(name);
+			continue;
+		}
+		if (vectorIndexKey(before) === vectorIndexKey(entry)) continue;
+		if (!liveHolds(name, entry)) plan.changed.push(name);
+	}
+	return plan;
+}
+function readbackVectorIndexes(live) {
+	if (live === void 0 || live.length === 0) return void 0;
+	return live.map((d) => {
+		const out = {};
+		if (d.IndexName !== void 0) out["IndexName"] = d.IndexName;
+		if (d.VectorAttribute !== void 0) out["VectorAttribute"] = d.VectorAttribute;
+		if (d.Dimensions !== void 0) out["Dimensions"] = d.Dimensions;
+		if (d.DistanceFunction !== void 0) out["DistanceFunction"] = d.DistanceFunction;
+		if (d.Projection !== void 0) out["Projection"] = d.Projection;
+		if (d.SearchSchema !== void 0 && d.SearchSchema.length > 0) out["SearchSchema"] = d.SearchSchema;
+		return out;
+	});
+}
+function vectorIndexesSettled(live) {
+	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
@@ -12150,6 +12365,10 @@ const tableNameReleaseWait = {
 	maxPolls: 600,
 	intervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
 };
+const tableDeleteGoneWait = {
+	maxWaitMs: 600 * DYNAMODB_DELETE_POLL_COST_MS,
+	pollIntervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
+};
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	createClient;
@@ -12161,7 +12380,7 @@ var DynamoDBTableProvider = class {
 		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
 		this.logger.debug(m(build(m(failure.detail)).message));
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${m(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}`);
+		const wrapped = build(`${m(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail, TABLE_INDEX_NOUN)}`);
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Set([
@@ -12183,7 +12402,8 @@ var DynamoDBTableProvider = class {
 		"TimeToLiveSpecification",
 		"ResourcePolicy",
 		"KinesisStreamSpecification",
-		"ContributorInsightsSpecification"
+		"ContributorInsightsSpecification",
+		"VectorIndexes"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])]]);
 	deleteBudgets = new ElapsedBudgetRegistry();
@@ -12257,6 +12477,8 @@ var DynamoDBTableProvider = class {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
 				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, stripIndexContributorInsights(entry), maskSecrets)) : declaredGsis;
 			}
+			const createVectorIndexes = vectorIndexesForCreate(properties["VectorIndexes"]);
+			if (createVectorIndexes !== void 0) createParams.VectorIndexes = createVectorIndexes;
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sseCreateRefusal = sseSpecificationRefusal(properties["SSESpecification"], logicalId);
 			if (sseCreateRefusal !== void 0 && context?.replayingState !== true) throw new ProvisioningError(`${maskSecrets(sseCreateRefusal)}. Nothing was created; fix the template value`, resourceType, logicalId);
@@ -12280,8 +12502,13 @@ var DynamoDBTableProvider = class {
 			const createOut = await (await this.getCreateClient()).send(new CreateTableCommand(createParams));
 			tableCreated = true;
 			createdTableId = createOut?.TableDescription?.TableId;
-			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
-			const tableInfo = await timePhase("provider waits", "DynamoDB table: wait for ACTIVE", () => this.waitForTableActive(tableName), logicalId);
+			reportCreatedResource(logicalId, resourceType, tableName, createdTableId);
+			debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
+			const tableInfo = await timePhase("provider waits", "DynamoDB table: wait for ACTIVE", () => this.waitForTableActive(tableName, maskSecrets), logicalId);
+			if (createVectorIndexes !== void 0) await timePhase("provider waits", "DynamoDB table: wait for vector indexes", () => this.waitForTableAndIndexesActive(tableName, void 0, {
+				after: "CreateTable",
+				maskSecrets
+			}), logicalId);
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"], void 0, "create", {
 				logicalId,
@@ -12292,7 +12519,7 @@ var DynamoDBTableProvider = class {
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
 			await this.applyIndexContributorInsights(tableName, properties["GlobalSecondaryIndexes"], void 0, maskSecrets);
 			await this.applyStreamMembers(logicalId, resourceType, tableName, tableInfo.streamArn, properties["StreamSpecification"], void 0, true, maskSecrets);
-			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
+			debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
 				attributes: {
@@ -12306,7 +12533,8 @@ var DynamoDBTableProvider = class {
 			let tableLeftBehind = false;
 			if (tableCreated) {
 				try {
-					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+					await this.rollBackCreatedTable(logicalId, tableName, maskSecrets);
+					retractCreatedResource(logicalId, resourceType, tableName);
 					debug(`Rolled back partially-created DynamoDB table ${tableName}`);
 				} catch (cleanupError) {
 					tableLeftBehind = true;
@@ -12323,6 +12551,38 @@ var DynamoDBTableProvider = class {
 			throw thrown;
 		}
 	}
+	async rollBackCreatedTable(logicalId, tableName, maskSecrets) {
+		const logger = maskedLogger(this.logger, maskSecrets, tableName);
+		const allowanceMs = Math.min(resolveDynamoDbDeleteBudgetMs(), enclosingDeadlineRemainingMs() - DYNAMODB_DELETE_DEADLINE_MARGIN_MS);
+		const budget = allowanceMs > 0 ? new ElapsedBudget(allowanceMs, resolveDynamoDbDeleteBudgetClock()) : void 0;
+		await deleteTableWithIndexBusyRetry({
+			logicalId,
+			physicalId: tableName,
+			typeLabel: "table",
+			indexNoun: TABLE_INDEX_NOUN,
+			maxRetries: 14,
+			logger,
+			deleteTable: async () => {
+				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+			},
+			reArm: () => {
+				const wait = beginDeleteWait(900, budget);
+				return waitForIndexesSettled({
+					tableName,
+					logicalId,
+					logger,
+					describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName })),
+					maxAttempts: wait.grantedPolls,
+					budgetWait: wait,
+					shortCapUnlessVectorBusy: 60,
+					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+				});
+			},
+			shouldKeepRetrying: () => budget !== void 0 && !budget.isExhausted(),
+			retryWarning: () => `DynamoDB table ${logicalId}: AWS refused the DeleteTable rolling back the partially-created table ${tableName} because ${TABLE_INDEX_NOUN} is still being created, updated or deleted. Waiting for the indexes to settle and retrying (up to ${14} retries in all, within ~${Math.max(1, Math.round((budget?.totalMs ?? 0) / 6e4))} minutes).`,
+			sleepSeam: deleteTableRetryDelays
+		});
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		const maskSecrets = context?.maskSecrets ?? ((text) => text);
@@ -12367,10 +12627,19 @@ var DynamoDBTableProvider = class {
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${lsiMessage}. Nothing was applied to the table; revert the LocalSecondaryIndexes change, or create a new table under a new logical ID (a new table starts empty)`, resourceType, logicalId, physicalId);
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
+			const vectorIndexPlan = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]) ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
+			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
+				const vectorMessage = `AWS::DynamoDB::Table ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((n) => maskSecrets(n)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
+				warn(`${vectorMessage}; that change was not applied`);
+			}
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
 				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
-				beforeWrite: () => markUnsettled("Tags")
+				beforeWrite: () => markUnsettled("Tags"),
+				afterAdded: (keys) => {
+					if (keys.length > 0) context?.markAttempted?.("Tags", keys);
+				}
 			});
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
@@ -12482,7 +12751,7 @@ var DynamoDBTableProvider = class {
 				if (tableClassChanged) markUnsettled("TableClass");
 				if (updateInput.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
-				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
+				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS, { maskSecrets });
 				else await this.waitForTableActiveAfterUpdate(physicalId, 60);
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
@@ -12595,8 +12864,9 @@ var DynamoDBTableProvider = class {
 			if (context?.unsettledProperties?.has("GlobalSecondaryIndexes") === true && currentLiveIndexNames !== void 0) this.warnUndeclaredLiveIndexes(physicalId, currentLiveIndexNames, [previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"]], maskSecrets);
 			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) {
 				markUnsettled("GlobalSecondaryIndexes");
-				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
+				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets, (indexName) => context?.markAttempted?.("GlobalSecondaryIndexes", [indexName]));
 			}
+			if (vectorIndexPlan !== void 0) await this.applyVectorIndexUpdates(physicalId, vectorIndexPlan, properties["AttributeDefinitions"], maskSecrets, () => markUnsettled("VectorIndexes"), (indexName) => context?.markAttempted?.("VectorIndexes", [indexName]));
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) {
 				markUnsettled("PointInTimeRecoverySpecification");
 				await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
@@ -12712,16 +12982,18 @@ var DynamoDBTableProvider = class {
 		}
 		try {
 			const reArmPolls = () => {
-				const wait = beginDeleteWait(60, budget);
+				const wait = beginDeleteWait(900, budget);
 				return {
 					maxAttempts: wait.grantedPolls,
-					budgetWait: wait
+					budgetWait: wait,
+					shortCapUnlessVectorBusy: 60
 				};
 			};
 			await deleteTableWithIndexBusyRetry({
 				logicalId,
 				physicalId,
 				typeLabel: "table",
+				indexNoun: TABLE_INDEX_NOUN,
 				maxRetries: 14,
 				logger: loopLogger,
 				deleteTable: async () => {
@@ -12743,6 +13015,22 @@ var DynamoDBTableProvider = class {
 				},
 				sleepSeam: deleteTableRetryDelays
 			});
+			const mask = maskerOrIdentity(context?.maskSecrets);
+			await waitForGoneAfterDelete({
+				what: mask(`DynamoDB table ${physicalId}`),
+				resourceType,
+				describe: async () => {
+					try {
+						return (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.TableStatus ?? "UNKNOWN";
+					} catch (describeError) {
+						if (describeError instanceof ResourceNotFoundException$1) return void 0;
+						throw describeError;
+					}
+				},
+				logger: loopLogger,
+				pollIntervalMs: tableDeleteGoneWait.pollIntervalMs,
+				maxWaitMs: Math.min(tableDeleteGoneWait.maxWaitMs, budget.remainingMs())
+			});
 			this.logger.debug(`Successfully deleted DynamoDB table ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -12786,6 +13074,13 @@ var DynamoDBTableProvider = class {
 				ResourceArn: tableArn,
 				Tags: tagsToAdd
 			}));
+			let recordedKeys;
+			try {
+				recordedKeys = /* @__PURE__ */ new Set([...planTagDiff(void 0, oldTagsRaw).set.keys()]);
+			} catch {
+				recordedKeys = void 0;
+			}
+			unsettled.afterAdded?.(tagsToAdd.map((t) => t.Key).filter((key) => recordedKeys !== void 0 && !recordedKeys.has(key)));
 			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB table ${tableArn}`);
 		}
 	}
@@ -13090,7 +13385,7 @@ var DynamoDBTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
 		if (ops.length === 0) return;
-		await this.waitForTableAndIndexesActive(tableName);
+		await this.waitForTableAndIndexesActive(tableName, void 0, { maskSecrets });
 		for (const op of ops) {
 			beforeSend();
 			await this.sendContributorInsightsOp(tableName, op, maskSecrets);
@@ -13107,11 +13402,11 @@ var DynamoDBTableProvider = class {
 		})), `set ContributorInsights on ${target}`);
 		debug(`Set ContributorInsightsAction=${op.action}${op.mode !== void 0 ? ` Mode=${op.mode}` : ""} on ${target}`);
 	}
-	async waitForTableActive(tableName, maxAttempts = 60) {
+	async waitForTableActive(tableName, maskSecrets, maxAttempts = 60) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			const response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
 			const status = response.Table?.TableStatus;
-			this.logger.debug(`Table ${tableName} status: ${status} (attempt ${attempt}/${maxAttempts})`);
+			this.logger.debug(maskSecrets(`Table ${tableName} status: ${status} (attempt ${attempt}/${maxAttempts})`));
 			if (status === "ACTIVE") return {
 				tableArn: response.Table?.TableArn,
 				tableId: response.Table?.TableId,
@@ -13149,17 +13444,38 @@ var DynamoDBTableProvider = class {
 		}
 		throw new Error(maskSecrets(`DynamoDB table ${tableName} was still ${last ?? "unread"} ${KINESIS_DESTINATION_SETTLE_POLLS * KINESIS_DESTINATION_SETTLE_POLL_MS / 1e3} seconds after its encryption change`));
 	}
-	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800) {
+	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800, opts = {}) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
 			const tableActive = table?.TableStatus === "ACTIVE";
 			const indexesActive = (table?.GlobalSecondaryIndexes ?? []).every((gsi) => gsi.IndexStatus === "ACTIVE");
-			if (tableActive && indexesActive) return;
+			if (tableActive && indexesActive && vectorIndexesSettled(table?.VectorIndexes)) return;
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
-		throw new Error(`Table ${tableName} and its global secondary indexes did not reach ACTIVE within ${maxAttempts} seconds after UpdateTable`);
+		const m = maskerOrIdentity(opts.maskSecrets);
+		throw new Error(m(`Table ${m(tableName)} and its indexes did not reach ACTIVE within ${maxAttempts} seconds after ${opts.after ?? "UpdateTable"}`));
+	}
+	async applyVectorIndexUpdates(physicalId, plan, desiredAttributeDefinitions, maskSecrets, beforeFirstOp, onCreated) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		for (const name of plan.alreadyGone) debug(`${this.vectorIndexScopeAt(name, physicalId, maskSecrets)} is recorded in cdkd state but not live; skipping its Delete (already removed)`);
+		for (const name of plan.adopted) warn(`${this.vectorIndexScopeAt(name, physicalId, maskSecrets)} already exists in AWS with the declared definition but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+		if (plan.ops.length === 0) return;
+		await this.waitForTableAndIndexesActive(physicalId, void 0, { maskSecrets });
+		beforeFirstOp();
+		for (const op of plan.ops) {
+			const input = {
+				TableName: physicalId,
+				VectorIndexUpdates: [op]
+			};
+			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			if (op.Create?.IndexName !== void 0) onCreated(op.Create.IndexName);
+			await this.waitForTableAndIndexesActive(physicalId, void 0, { maskSecrets });
+			debug(`${op.Create ? "created" : "deleted"} ` + this.vectorIndexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName, physicalId, maskSecrets));
+		}
 	}
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets, onCreated = () => void 0) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const prev = previousGsis ?? [];
@@ -13234,7 +13550,7 @@ var DynamoDBTableProvider = class {
 			}
 			if (updateHasMember) ops.push({ Update: update });
 		}
-		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets);
+		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets, onCreated);
 	}
 	coerceWarmThroughputForSend(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -13261,6 +13577,9 @@ var DynamoDBTableProvider = class {
 			this.logger.warn(maskSecrets(`${this.indexScopeAt(name, physicalId, maskSecrets)} is live, but neither cdkd's record nor the template declares it, so cdkd left it in place while converging the unsettled GlobalSecondaryIndexes (CloudFormation never deletes an index it did not record). It may belong to another tool, or an earlier failed cdkd update may have created it; cdkd cannot tell which. If it should not exist, delete it ` + (secretDerived ? `with an UpdateTable GlobalSecondaryIndexUpdates Delete for the index.` : `with: aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"${name}"}}]' (in the table's region)`)));
 		}
 	}
+	vectorIndexScopeAt(indexName, physicalId, maskSecrets) {
+		return `vector index ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${maskSecrets(physicalId)}`;
+	}
 	indexScopeAt(indexName, physicalId, maskSecrets) {
 		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${physicalId}`;
 	}
@@ -13398,7 +13717,7 @@ var DynamoDBTableProvider = class {
 		}
 		return sendable;
 	}
-	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets) {
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets, onCreated = () => void 0) {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		for (const op of ops) {
 			const input = {
@@ -13407,7 +13726,8 @@ var DynamoDBTableProvider = class {
 			};
 			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
-			await this.waitForTableAndIndexesActive(physicalId);
+			if (op.Create?.IndexName !== void 0) onCreated(op.Create.IndexName);
+			await this.waitForTableAndIndexesActive(physicalId, void 0, { maskSecrets });
 			debug(`${op.Create ? "created" : op.Delete ? "deleted" : "updated"} ${this.indexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName, physicalId, maskSecrets)}`);
 		}
 	}
@@ -13469,7 +13789,8 @@ var DynamoDBTableProvider = class {
 		return [
 			"AttributeDefinitions",
 			"GlobalSecondaryIndexes[]",
-			"LocalSecondaryIndexes[]"
+			"LocalSecondaryIndexes[]",
+			"VectorIndexes"
 		];
 	}
 	getDriftUnknownPaths(resourceType, properties) {
@@ -13547,15 +13868,19 @@ var DynamoDBTableProvider = class {
 			aws
 		};
 	}
-	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
 		const live = await this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
 		if (typeof live !== "object" || live === null) return live;
 		const out = { ...live };
 		if (out["BillingMode"] === "PAY_PER_REQUEST") delete out["ProvisionedThroughput"];
 		if (names.has("GlobalSecondaryIndexes")) {
-			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"]);
+			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"], attemptedItems?.get("GlobalSecondaryIndexes"));
 			if (out["GlobalSecondaryIndexes"] === void 0) delete out["GlobalSecondaryIndexes"];
 		}
+		if (names.has("VectorIndexes")) {
+			out["VectorIndexes"] = projectIndexesOnto(out["VectorIndexes"], recordedProperties?.["VectorIndexes"], desiredProperties?.["VectorIndexes"], attemptedItems?.get("VectorIndexes"));
+			if (out["VectorIndexes"] === void 0) delete out["VectorIndexes"];
+		}
 		const strict = async (key, read) => {
 			if (!names.has(key)) return;
 			const value = await read();
@@ -13644,6 +13969,8 @@ var DynamoDBTableProvider = class {
 				const desiredByName = desiredIndexEntriesByName(properties?.["LocalSecondaryIndexes"]);
 				result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes.map((live) => reverseMapSecondaryIndex(live, live.IndexName === void 0 ? void 0 : desiredByName.get(live.IndexName), bagInformative));
 			}
+			const liveVectorIndexes = readbackVectorIndexes(table.VectorIndexes);
+			if (liveVectorIndexes !== void 0) result["VectorIndexes"] = liveVectorIndexes;
 			if (table.SSEDescription?.Status === "ENABLED") {
 				const sse = { SSEEnabled: true };
 				if (table.SSEDescription.KMSMasterKeyArn !== void 0) sse["KMSMasterKeyId"] = table.SSEDescription.KMSMasterKeyArn;
@@ -13870,9 +14197,9 @@ var DynamoDBTableProvider = class {
 function isTransientStreamReadFailure(err) {
 	return isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1;
 }
-function projectIndexesOnto(live, recorded, desired) {
+function projectIndexesOnto(live, recorded, desired, attempted = /* @__PURE__ */ new Set()) {
 	if (!Array.isArray(live)) return void 0;
-	const named = /* @__PURE__ */ new Set();
+	const named = new Set([...attempted].filter(isUsableAttemptedName));
 	for (const list of [recorded, desired]) {
 		if (!Array.isArray(list)) continue;
 		for (const entry of list) {
@@ -13928,7 +14255,7 @@ var LogsLogGroupProvider = class {
 		"DeletionProtectionEnabled",
 		"BearerTokenAuthenticationEnabled"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["ResourcePolicyDocument", "covered by the separate account-wide AWS::Logs::ResourcePolicy resource type; logs:PutResourcePolicy is account-scoped, not per-log-group, so it has no CreateLogGroup / PutRetentionPolicy counterpart — routed via Cloud Control instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["ResourcePolicyDocument", "not driven by this provider by decision (issue #1412): no CreateLogGroup / PutRetentionPolicy member carries it, and both policy lifecycles — the account-scoped AWS::Logs::ResourcePolicy type and the log-group-scoped logs:PutResourcePolicy (resourceArn + policyScope RESOURCE) — are ones this provider does not take on — routed via Cloud Control, whose handler applies it"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.logsClient = awsClients.cloudWatchLogs;
@@ -13991,6 +14318,7 @@ var LogsLogGroupProvider = class {
 				await this.logsClient.send(new CreateLogGroupCommand(createParams));
 				createdNewLogGroup = true;
 				leftBehind = true;
+				reportCreatedResource(logicalId, resourceType, logGroupName);
 			} catch (createError) {
 				if (createError instanceof ResourceAlreadyExistsException) this.logger.debug(`Log group ${logGroupName} already exists, using existing`);
 				else throw createError;
@@ -14037,6 +14365,7 @@ var LogsLogGroupProvider = class {
 				if (createdNewLogGroup) try {
 					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
 					leftBehind = false;
+					retractCreatedResource(logicalId, resourceType, logGroupName);
 					this.logger.debug(`Cleaned up partially-created log group ${displaySafe(logicalId)} (${displaySafe(logGroupName)}) after wiring failure`);
 				} catch (cleanupError) {
 					const mask = maskerOrIdentity(context?.maskSecrets);
@@ -14387,6 +14716,29 @@ var LogsLogGroupProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/cloudwatch-alarm-provider.ts
+function isDefaultEvaluationWindow(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || keys[0] !== "SlidingWindow") return false;
+	const sliding = value["SlidingWindow"];
+	return sliding !== null && typeof sliding === "object" && !Array.isArray(sliding) && Object.keys(sliding).length === 0;
+}
+const PROMQL_EXCLUDED_MEMBERS = [
+	"Namespace",
+	"MetricName",
+	"Dimensions",
+	"Period",
+	"Unit",
+	"Statistic",
+	"ExtendedStatistic",
+	"Metrics",
+	"Threshold",
+	"ComparisonOperator",
+	"ThresholdMetricId",
+	"EvaluationPeriods",
+	"DatapointsToAlarm",
+	"EvaluationWindow"
+];
 function isAlarmWriteThrottle(error) {
 	return isThrottlingError(error) || error instanceof Error && error.message.includes("Rate exceeded");
 }
@@ -14422,9 +14774,13 @@ var CloudWatchAlarmProvider = class {
 		"Tags",
 		"ExtendedStatistic",
 		"EvaluateLowSampleCountPercentile",
-		"ThresholdMetricId"
+		"ThresholdMetricId",
+		"ActionConfiguration",
+		"WarmUpConfiguration",
+		"EvaluationWindow",
+		"EvaluationCriteria",
+		"EvaluationInterval"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudWatchClient = awsClients.cloudWatch;
@@ -14573,7 +14929,12 @@ var CloudWatchAlarmProvider = class {
 			Unit: emptyToUndefined(properties["Unit"]),
 			ExtendedStatistic: emptyToUndefined(properties["ExtendedStatistic"]),
 			EvaluateLowSampleCountPercentile: emptyToUndefined(properties["EvaluateLowSampleCountPercentile"]),
-			ThresholdMetricId: emptyToUndefined(properties["ThresholdMetricId"])
+			ThresholdMetricId: emptyToUndefined(properties["ThresholdMetricId"]),
+			ActionConfiguration: properties["ActionConfiguration"],
+			WarmUpConfiguration: properties["WarmUpConfiguration"],
+			EvaluationWindow: properties["EvaluationWindow"],
+			EvaluationCriteria: properties["EvaluationCriteria"],
+			EvaluationInterval: properties["EvaluationInterval"]
 		};
 		const metricsValue = properties["Metrics"];
 		if (Array.isArray(metricsValue) && metricsValue.length > 0) params["Metrics"] = metricsValue.map((m) => {
@@ -14605,6 +14966,7 @@ var CloudWatchAlarmProvider = class {
 			params["Period"] = properties["Period"];
 			params["Statistic"] = emptyToUndefined(properties["Statistic"]);
 			params["Dimensions"] = properties["Dimensions"];
+			if (properties["EvaluationCriteria"] !== void 0 && Array.isArray(params["Dimensions"]) && params["Dimensions"].length === 0) delete params["Dimensions"];
 		}
 		return params;
 	}
@@ -14615,30 +14977,40 @@ var CloudWatchAlarmProvider = class {
 		}))).MetricAlarms?.[0];
 		if (!alarm) return RESOURCE_NOT_FOUND;
 		const result = {};
+		const promql = alarm.EvaluationCriteria !== void 0;
 		if (alarm.AlarmName !== void 0) result["AlarmName"] = alarm.AlarmName;
 		result["AlarmDescription"] = alarm.AlarmDescription ?? "";
-		result["MetricName"] = alarm.MetricName ?? "";
-		result["Namespace"] = alarm.Namespace ?? "";
-		result["Statistic"] = alarm.Statistic ?? "";
-		if (alarm.ComparisonOperator !== void 0) result["ComparisonOperator"] = alarm.ComparisonOperator;
-		if (alarm.Threshold !== void 0) result["Threshold"] = alarm.Threshold;
-		if (alarm.EvaluationPeriods !== void 0) result["EvaluationPeriods"] = alarm.EvaluationPeriods;
-		if (alarm.Period !== void 0) result["Period"] = alarm.Period;
-		if (alarm.DatapointsToAlarm !== void 0) result["DatapointsToAlarm"] = alarm.DatapointsToAlarm;
+		if (!promql) {
+			result["MetricName"] = alarm.MetricName ?? "";
+			result["Namespace"] = alarm.Namespace ?? "";
+			result["Statistic"] = alarm.Statistic ?? "";
+			if (alarm.ComparisonOperator !== void 0) result["ComparisonOperator"] = alarm.ComparisonOperator;
+			if (alarm.Threshold !== void 0) result["Threshold"] = alarm.Threshold;
+			if (alarm.EvaluationPeriods !== void 0) result["EvaluationPeriods"] = alarm.EvaluationPeriods;
+			if (alarm.Period !== void 0) result["Period"] = alarm.Period;
+			if (alarm.DatapointsToAlarm !== void 0) result["DatapointsToAlarm"] = alarm.DatapointsToAlarm;
+		}
 		result["ActionsEnabled"] = alarm.ActionsEnabled ?? true;
 		result["AlarmActions"] = alarm.AlarmActions ? [...alarm.AlarmActions] : [];
 		result["OKActions"] = alarm.OKActions ? [...alarm.OKActions] : [];
 		result["InsufficientDataActions"] = alarm.InsufficientDataActions ? [...alarm.InsufficientDataActions] : [];
 		result["TreatMissingData"] = alarm.TreatMissingData ?? "";
-		result["Unit"] = alarm.Unit ?? "";
-		result["Dimensions"] = (alarm.Dimensions ?? []).map((d) => ({
-			...d.Name !== void 0 ? { Name: d.Name } : {},
-			...d.Value !== void 0 ? { Value: d.Value } : {}
-		}));
-		result["Metrics"] = (alarm.Metrics ?? []).map((m) => m);
-		if (alarm.ExtendedStatistic !== void 0) result["ExtendedStatistic"] = alarm.ExtendedStatistic;
+		if (!promql) {
+			result["Unit"] = alarm.Unit ?? "";
+			result["Dimensions"] = (alarm.Dimensions ?? []).map((d) => ({
+				...d.Name !== void 0 ? { Name: d.Name } : {},
+				...d.Value !== void 0 ? { Value: d.Value } : {}
+			}));
+			result["Metrics"] = (alarm.Metrics ?? []).map((m) => m);
+		}
+		if (!promql && alarm.ExtendedStatistic !== void 0) result["ExtendedStatistic"] = alarm.ExtendedStatistic;
 		if (alarm.EvaluateLowSampleCountPercentile !== void 0) result["EvaluateLowSampleCountPercentile"] = alarm.EvaluateLowSampleCountPercentile;
-		if (alarm.ThresholdMetricId !== void 0) result["ThresholdMetricId"] = alarm.ThresholdMetricId;
+		if (!promql && alarm.ThresholdMetricId !== void 0) result["ThresholdMetricId"] = alarm.ThresholdMetricId;
+		if (alarm.ActionConfiguration !== void 0) result["ActionConfiguration"] = alarm.ActionConfiguration;
+		if (alarm.WarmUpConfiguration !== void 0) result["WarmUpConfiguration"] = alarm.WarmUpConfiguration;
+		if (!promql && alarm.EvaluationWindow !== void 0 && !isDefaultEvaluationWindow(alarm.EvaluationWindow)) result["EvaluationWindow"] = alarm.EvaluationWindow;
+		if (alarm.EvaluationCriteria !== void 0) result["EvaluationCriteria"] = alarm.EvaluationCriteria;
+		if (promql && alarm.EvaluationInterval !== void 0) result["EvaluationInterval"] = alarm.EvaluationInterval;
 		if (alarm.AlarmArn) try {
 			const tagsResp = await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
@@ -14647,6 +15019,26 @@ var CloudWatchAlarmProvider = class {
 		}
 		return result;
 	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		if (resourceType !== "AWS::CloudWatch::Alarm" || !isDefaultEvaluationWindow(baseline["EvaluationWindow"]) || aws["EvaluationWindow"] !== void 0) return {
+			baseline,
+			aws
+		};
+		const trimmed = { ...baseline };
+		delete trimmed["EvaluationWindow"];
+		return {
+			baseline: trimmed,
+			aws
+		};
+	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		if (resourceType !== "AWS::CloudWatch::Alarm") return [];
+		if (properties["EvaluationCriteria"] !== void 0) return [...PROMQL_EXCLUDED_MEMBERS].filter((key) => properties[key] === void 0);
+		const keys = ["EvaluationCriteria", "EvaluationInterval"];
+		const declared = properties["EvaluationWindow"];
+		if (declared === void 0 || isDefaultEvaluationWindow(declared)) keys.push("EvaluationWindow");
+		return keys;
+	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["AlarmName"]) return void 0;
 		return generatedNameFor("AWS::CloudWatch::Alarm", logicalId);
@@ -15721,6 +16113,7 @@ var EventBridgeRuleProvider = class {
 			if (properties["Tags"]) putRuleParams["Tags"] = desiredTags;
 			const ruleArn = (await this.eventBridgeClient.send(new PutRuleCommand(putRuleParams))).RuleArn;
 			this.logger.debug(`Created EventBridge rule: ${ruleName} (${ruleArn})`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, ruleArn);
 			const eventBusName = properties["EventBusName"];
 			try {
 				if (targets && targets.length > 0) {
@@ -15750,6 +16143,7 @@ var EventBridgeRuleProvider = class {
 						Name: ruleName,
 						EventBusName: eventBusName
 					}));
+					retractCreatedResource(logicalId, resourceType, ruleArn);
 					this.logger.debug(`Cleaned up partially-created EventBridge rule ${logicalId} (${ruleName}) after wiring failure`);
 				} catch (cleanupError) {
 					leftLiveArn = ruleArn;
@@ -16122,6 +16516,7 @@ var EventBridgeBusProvider = class {
 			if (properties["LogConfig"] !== void 0) createParams.LogConfig = properties["LogConfig"];
 			const response = await (await this.getCreateClient()).send(new CreateEventBusCommand(createParams));
 			busCreated = true;
+			reportCreatedResource(logicalId, resourceType, name);
 			const policy = policyDocument(properties["Policy"]);
 			if (policy !== void 0) await this.eventBridgeClient.send(new PutPermissionCommand({
 				EventBusName: name,
@@ -17151,6 +17546,7 @@ var EC2Provider = class {
 			}
 			const vpcId = response.Vpc.VpcId;
 			ec2IdsCreatedByThisProcess.add(vpcId);
+			reportCreatedResource(logicalId, resourceType, vpcId);
 			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
 			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, vpcReplayWindow, context);
 			let defaultSgId;
@@ -17179,6 +17575,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteVpcCommand({ VpcId: vpcId }));
+					retractCreatedResource(logicalId, resourceType, vpcId);
 					this.logger.debug(`Cleaned up partially-created VPC ${logicalId} (${vpcId}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindId = vpcId;
@@ -17334,6 +17731,7 @@ var EC2Provider = class {
 			}
 			const subnetId = response.Subnet.SubnetId;
 			ec2IdsCreatedByThisProcess.add(subnetId);
+			reportCreatedResource(logicalId, resourceType, subnetId);
 			const subnetReplayWindow = replayedSendWindow(response, attemptStartMs);
 			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, desiredTags, subnetReplayWindow, context);
 			const availabilityZone = response.Subnet.AvailabilityZone;
@@ -17350,6 +17748,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSubnetCommand({ SubnetId: subnetId }));
+					retractCreatedResource(logicalId, resourceType, subnetId);
 					this.logger.debug(`Cleaned up partially-created Subnet ${logicalId} (${subnetId}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindId = subnetId;
@@ -17604,6 +18003,7 @@ var EC2Provider = class {
 			} catch {
 				createdId = allocationId;
 			}
+			reportCreatedResource(logicalId, resourceType, createdId);
 			ec2IdsCreatedByThisProcess.add(allocationId);
 			const eipReplayWindow = replayedSendWindow(response, attemptStartMs);
 			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, desiredTags, eipReplayWindow, context);
@@ -17636,6 +18036,7 @@ var EC2Provider = class {
 				} finally {
 					watch.dispose();
 				}
+				retractCreatedResource(logicalId, resourceType, createdId);
 				createdId = void 0;
 				this.logger.debug(safeMsg`Released partially-created EIP ${logicalId} (${allocatedId})`);
 			} catch (cleanupError) {
@@ -17772,6 +18173,7 @@ var EC2Provider = class {
 					VpnGatewayId: gatewayId
 				}));
 				attachSent = true;
+				reportCreatedResource(logicalId, resourceType, physicalId);
 				await this.waitForVpnGatewayAttachment(gatewayId, vpcId, "attached", logicalId);
 			}
 			this.logger.debug(`Successfully created VPCGatewayAttachment ${logicalId}: ${physicalId}`);
@@ -18068,6 +18470,7 @@ var EC2Provider = class {
 			})));
 			const natGatewayId = response.NatGateway.NatGatewayId;
 			createdId = natGatewayId;
+			reportCreatedResource(logicalId, resourceType, natGatewayId);
 			if (!tagsApplied) await this.applyTags(natGatewayId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
 			let described;
 			if (process.env["CDKD_NO_WAIT"] !== "true") {
@@ -18465,6 +18868,7 @@ var EC2Provider = class {
 				...TagSpecifications && { TagSpecifications }
 			})));
 			const groupId = response.GroupId;
+			reportCreatedResource(logicalId, resourceType, groupId);
 			try {
 				const ingressRules = properties["SecurityGroupIngress"];
 				const egressRules = properties["SecurityGroupEgress"];
@@ -18481,6 +18885,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
+					retractCreatedResource(logicalId, resourceType, groupId);
 					this.logger.debug(`Cleaned up partially-created SecurityGroup ${logicalId} (${groupId}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindId = groupId;
@@ -19027,6 +19432,7 @@ var EC2Provider = class {
 			const instance = response.Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
 			const instanceId = instance.InstanceId;
+			reportCreatedResource(logicalId, resourceType, instanceId);
 			try {
 				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
 				if (process.env["CDKD_NO_WAIT"] !== "true") {
@@ -19056,6 +19462,7 @@ var EC2Provider = class {
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new TerminateInstancesCommand({ InstanceIds: [instanceId] }));
+					retractCreatedResource(logicalId, resourceType, instanceId);
 					runInstancesToken.release();
 					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
 				} catch (cleanupError) {
@@ -21655,6 +22062,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				documentationVersion: properties["DocumentationVersion"],
 				canarySettings: toSdkCanarySettings(properties["CanarySetting"])
 			}));
+			reportCreatedResource(logicalId, resourceType, stageName);
 			const methodSettings = properties["MethodSettings"];
 			const postCreateOps = buildMethodSettingsPatchOps(void 0, methodSettings);
 			const accessLogSetting = properties["AccessLogSetting"];
@@ -21688,6 +22096,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						restApiId,
 						stageName
 					}));
+					retractCreatedResource(logicalId, resourceType, stageName);
 				} catch (cleanupError) {
 					stageLeftBehind = true;
 					const cleanupFailure = describeAwsFailure(cleanupError);
@@ -21945,6 +22354,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				}
 				await putMethod();
 			}
+			reportCreatedResource(logicalId, resourceType, physicalId);
 			try {
 				const integration = properties["Integration"];
 				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand(putIntegrationInput({
@@ -21973,6 +22383,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						resourceId,
 						httpMethod
 					}));
+					retractCreatedResource(logicalId, resourceType, physicalId);
 					log.debug(`Cleaned up partially-created API Gateway Method ${logicalId} (${methodPath}) after wiring failure`);
 				} catch (cleanupError) {
 					methodLeftBehind = true;
@@ -22719,6 +23130,20 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 		])]
 	]);
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Map([["IdentitySource", []]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Set([
+		"ApiId",
+		"RouteKey",
+		"AuthorizationScopes",
+		"Target",
+		"AuthorizationType",
+		"AuthorizerId",
+		"OperationName",
+		"ApiKeyRequired",
+		"RequestModels",
+		"RequestParameters",
+		"ModelSelectionExpression",
+		"RouteResponseSelectionExpression"
+	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Map([
 		["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 		["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
@@ -23756,12 +24181,15 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 			input.OperationName = properties["OperationName"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const r = this.clearableUpdate(properties["ApiKeyRequired"], previousProperties["ApiKeyRequired"], false);
 			if (r.changed) {
 				input.ApiKeyRequired = r.value;
 				changed = true;
 			}
+		} else if (properties["ApiKeyRequired"] !== void 0 && properties["ApiKeyRequired"] !== previousProperties["ApiKeyRequired"]) {
+			input.ApiKeyRequired = properties["ApiKeyRequired"];
+			changed = true;
 		}
 		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestModels"], previousProperties["RequestModels"]);
@@ -25099,14 +25527,57 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 //#region src/provisioning/providers/agentcore-runtime-provider.ts
 const CFN_MAP_KEYS = /* @__PURE__ */ new Set(["Tags", "AdvertisedScopeMapping"]);
 const SDK_MAP_KEYS = /* @__PURE__ */ new Set(["tags", "advertisedScopeMapping"]);
+const RUNTIME_TAGS_WHAT = "a map of tag keys to scalar values or a list of tags with a non-empty string Key and a scalar Value";
+function isUserTagKey(key) {
+	return !key.startsWith("aws:");
+}
+function desiredRuntimeTags(raw, resourceType, logicalId, physicalId) {
+	const tags = refuseMalformedDesiredTags(tagMapAsList(raw), resourceType, logicalId, physicalId, "Tags", RUNTIME_TAGS_WHAT);
+	if (!tags.every((t) => isUserTagKey(t.Key))) throw markNonRetryable(new ProvisioningError(`${physicalId !== void 0 ? "desired " : ""}Tags of ${resourceType} ${logicalId} holds a reserved aws: key, which AWS does not let a user set — the resource was not ${physicalId !== void 0 ? "updated" : "created"}`, resourceType, logicalId, physicalId));
+	return tags;
+}
+const CREATE_TAG_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	2e3,
+	4e3
+];
+function isTransientTagFailure(error) {
+	return isThrottlingError(error) || error instanceof ResourceNotFoundException$6 || error instanceof Error && error.name === "ResourceNotFoundException";
+}
+function isNonEmptyObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+}
+function writeSharedRuntimeMembers(input, properties) {
+	const requestHeaders = properties["RequestHeaderConfiguration"];
+	if (isNonEmptyObject(requestHeaders)) input["requestHeaderConfiguration"] = pascalToCamelCaseKeys(requestHeaders, CFN_MAP_KEYS);
+	const filesystems = properties["FilesystemConfigurations"];
+	if (Array.isArray(filesystems) && filesystems.length > 0) input["filesystemConfigurations"] = pascalToCamelCaseKeys(filesystems, CFN_MAP_KEYS);
+	const capacityProvider = properties["CapacityProviderConfiguration"];
+	if (isNonEmptyObject(capacityProvider)) input["capacityProviderConfiguration"] = pascalToCamelCaseKeys(capacityProvider, CFN_MAP_KEYS);
+	const platformVersion = properties["PlatformVersion"];
+	if (platformVersion !== void 0 && platformVersion !== null && platformVersion !== "") input["platformVersion"] = platformVersion;
+}
 var AgentCoreRuntimeProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreRuntimeProvider");
+	sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+	async sendCreateTagCall(send) {
+		for (let attempt = 0;; attempt++) try {
+			return await send();
+		} catch (error) {
+			const delay = CREATE_TAG_RETRY_DELAYS_MS[attempt];
+			if (delay === void 0 || !isTransientTagFailure(error)) throw error;
+			this.logger.debug(safeMsg`Post-create tag call failed transiently (${describeAwsFailure(error).summary}); retrying in ${delay}ms`);
+			await this.sleep(delay);
+		}
+	}
 	wrapCaughtError(mask, error, build) {
 		const failure = describeAwsFailure(error);
 		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
 		this.logger.debug(mask(build(mask(failure.detail)).message));
-		const wrapped = build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
+		const wrapped = build(`${mask(failure.summary)}${relay}`);
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Runtime", /* @__PURE__ */ new Set([
@@ -25119,7 +25590,12 @@ var AgentCoreRuntimeProvider = class {
 		"ProtocolConfiguration",
 		"LifecycleConfiguration",
 		"EnvironmentVariables",
-		"ClientToken"
+		"ClientToken",
+		"RequestHeaderConfiguration",
+		"FilesystemConfigurations",
+		"CapacityProviderConfiguration",
+		"PlatformVersion",
+		"Tags"
 	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -25131,6 +25607,8 @@ var AgentCoreRuntimeProvider = class {
 		if (!agentRuntimeName) throw new ProvisioningError(`AgentRuntimeName is required for ${logicalId}`, resourceType, logicalId);
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for ${logicalId}`, resourceType, logicalId);
+		const desiredTags = desiredRuntimeTags(properties["Tags"], resourceType, logicalId);
+		let createdRuntimeId;
 		try {
 			const input = {
 				agentRuntimeName,
@@ -25148,24 +25626,34 @@ var AgentCoreRuntimeProvider = class {
 			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
+			writeSharedRuntimeMembers(input, properties);
+			if (desiredTags.length > 0) input["tags"] = Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value]));
 			const response = await this.client.send(new CreateAgentRuntimeCommand(input));
 			const agentRuntimeId = response.agentRuntimeId;
 			const agentRuntimeArn = response.agentRuntimeArn;
+			createdRuntimeId = agentRuntimeId;
+			reportCreatedResource(logicalId, resourceType, agentRuntimeId);
 			this.logger.debug(`Created BedrockAgentCore Runtime: ${agentRuntimeId} (${agentRuntimeArn})`);
+			if (desiredTags.length > 0) await this.ensureCreateTags(agentRuntimeId, agentRuntimeArn, desiredTags);
 			return {
 				physicalId: agentRuntimeId,
 				attributes: this.buildAttributes(response, agentRuntimeName)
 			};
 		} catch (error) {
+			if (createdRuntimeId !== void 0) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdRuntimeId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdRuntimeId);
+			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating BedrockAgentCore Runtime ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for ${logicalId}`, resourceType, logicalId, physicalId);
+		desiredRuntimeTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		try {
 			const input = {
 				agentRuntimeId: physicalId,
@@ -25183,8 +25671,10 @@ var AgentCoreRuntimeProvider = class {
 			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
+			writeSharedRuntimeMembers(input, properties);
 			const response = await this.client.send(new UpdateAgentRuntimeCommand(input));
 			const agentRuntimeId = response.agentRuntimeId;
+			await this.syncTags(logicalId, resourceType, physicalId, response.agentRuntimeArn, previousProperties["Tags"], properties["Tags"], mask);
 			this.logger.debug(`Successfully updated BedrockAgentCore Runtime ${logicalId}`);
 			return {
 				physicalId: agentRuntimeId,
@@ -25192,10 +25682,44 @@ var AgentCoreRuntimeProvider = class {
 				attributes: this.buildAttributes(response, properties["AgentRuntimeName"])
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update BedrockAgentCore Runtime ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async ensureCreateTags(agentRuntimeId, resourceArn, desired) {
+		let live;
+		try {
+			live = (await this.sendCreateTagCall(() => this.client.send(new ListTagsForResourceCommand$6({ resourceArn })))).tags ?? {};
+		} catch (err) {
+			this.logger.debug(safeMsg`Could not read the tags of new runtime ${agentRuntimeId} (${describeAwsFailure(err).detail}); setting every declared tag`);
+		}
+		const missing = Object.fromEntries(desired.filter((t) => live?.[t.Key] !== t.Value).map((t) => [t.Key, t.Value]));
+		if (Object.keys(missing).length === 0) return;
+		if (live !== void 0) this.logger.debug(safeMsg`New runtime ${agentRuntimeId} lacks ${Object.keys(missing).length} of the tag(s) CreateAgentRuntime was sent; setting them with TagResource`);
+		await this.sendCreateTagCall(() => this.client.send(new TagResourceCommand$9({
+			resourceArn,
+			tags: missing
+		})));
+	}
+	async syncTags(logicalId, resourceType, physicalId, responseArn, previousTagsRaw, nextTagsRaw, mask) {
+		const plan = planTagDiff(tagMapAsList(previousTagsRaw), tagMapAsList(nextTagsRaw));
+		const warning = tagPlanWarning(plan, resourceType, logicalId);
+		if (warning !== void 0) this.logger.warn(mask(warning));
+		const remove = plan.remove.filter(isUserTagKey);
+		const set = Object.fromEntries([...plan.set].filter(([k]) => isUserTagKey(k)));
+		if (remove.length === 0 && Object.keys(set).length === 0) return;
+		const resourceArn = responseArn ?? (await this.client.send(new GetAgentRuntimeCommand({ agentRuntimeId: physicalId }))).agentRuntimeArn;
+		if (!resourceArn) throw new ProvisioningError(`Cannot apply the Tags change to ${logicalId}: AWS returned no runtime ARN`, resourceType, logicalId, physicalId);
+		if (remove.length > 0) await this.client.send(new UntagResourceCommand$9({
+			resourceArn,
+			tagKeys: remove
+		}));
+		if (Object.keys(set).length > 0) await this.client.send(new TagResourceCommand$9({
+			resourceArn,
+			tags: set
+		}));
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting BedrockAgentCore Runtime ${logicalId}: ${physicalId}`);
 		try {
@@ -25263,6 +25787,16 @@ var AgentCoreRuntimeProvider = class {
 		}
 		if (resp.lifecycleConfiguration !== void 0) result["LifecycleConfiguration"] = camelToPascalCaseKeys(resp.lifecycleConfiguration, SDK_MAP_KEYS);
 		if (resp.environmentVariables !== void 0) result["EnvironmentVariables"] = resp.environmentVariables;
+		result["RequestHeaderConfiguration"] = resp.requestHeaderConfiguration !== void 0 ? camelToPascalCaseKeys(resp.requestHeaderConfiguration, SDK_MAP_KEYS) : {};
+		result["FilesystemConfigurations"] = resp.filesystemConfigurations !== void 0 ? camelToPascalCaseKeys(resp.filesystemConfigurations, SDK_MAP_KEYS) : [];
+		result["CapacityProviderConfiguration"] = resp.capacityProviderConfiguration !== void 0 ? camelToPascalCaseKeys(resp.capacityProviderConfiguration, SDK_MAP_KEYS) : {};
+		result["PlatformVersion"] = resp.platformVersion ?? "";
+		if (resp.agentRuntimeArn) try {
+			const tagsResp = await this.client.send(new ListTagsForResourceCommand$6({ resourceArn: resp.agentRuntimeArn }));
+			result["Tags"] = Object.fromEntries(Object.entries(tagsResp.tags ?? {}).filter(([k]) => isUserTagKey(k)));
+		} catch (err) {
+			this.logger.debug(safeMsg`Failed to read tags for runtime ${physicalId}: ${describeAwsFailure(err).detail}`);
+		}
 		return result;
 	}
 	async import(input) {
@@ -26108,6 +26642,60 @@ function isEcsErrorNamed(error, names) {
 	return typeof name === "string" && names.includes(name);
 }
 const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+function requestedRolloutOf(service) {
+	if (!service) return void 0;
+	const primary = service.deployments?.find((d) => d.status === "PRIMARY");
+	const deploymentId = typeof primary?.id === "string" && primary.id ? primary.id : void 0;
+	const taskDefinitionRaw = primary?.taskDefinition ?? service.taskDefinition;
+	const taskDefinition = typeof taskDefinitionRaw === "string" && taskDefinitionRaw ? taskDefinitionRaw : void 0;
+	if (deploymentId === void 0 && taskDefinition === void 0) return void 0;
+	return {
+		deploymentId,
+		taskDefinition
+	};
+}
+function failedRequestedDeployment(requested, deployments) {
+	if (!Array.isArray(deployments)) return void 0;
+	const target = requested?.deploymentId !== void 0 ? deployments.find((d) => d?.id === requested.deploymentId) : deployments.find((d) => d?.status === "PRIMARY");
+	return target?.rolloutState === "FAILED" ? target : void 0;
+}
+function taskDefinitionRevision(arn) {
+	const match = typeof arn === "string" ? /:task-definition\/[^:]+:(\d+)$/.exec(arn) : null;
+	return match ? match[1] : void 0;
+}
+function describeRollout(rollout) {
+	const revision = taskDefinitionRevision(rollout.taskDefinition);
+	const id = typeof rollout.id === "string" && /^ecs-svc\/\d+$/.test(rollout.id) ? rollout.id : void 0;
+	if (id && revision) return `deployment ${id} (task definition revision ${revision})`;
+	if (id) return `deployment ${id}`;
+	if (revision) return `task definition revision ${revision}`;
+	return "another deployment";
+}
+var EcsCircuitBreakerVerdict = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "EcsCircuitBreakerVerdict";
+	}
+};
+function wrapBreakerFailedError(failed) {
+	return new EcsCircuitBreakerVerdict(`its deployment circuit breaker failed the rollout of ${describeRollout(failed)} (deployment FAILED). The new tasks failed to start or failed their health checks`);
+}
+function controllerSkipsWait(properties) {
+	let type;
+	try {
+		type = readConfigString(properties["DeploymentController"], "Type", "ECS", "DeploymentController");
+	} catch {
+		return "its DeploymentController could not be read";
+	}
+	if (type === "ECS") return void 0;
+	if (type === "CODE_DEPLOY" || type === "EXTERNAL") return `its DeploymentController is ${type}, which ECS does not settle`;
+	return "its DeploymentController type is not one cdkd can settle";
+}
+function rolloutSupersededBy(requested, settled) {
+	if (!requested || !settled) return void 0;
+	if (requested.deploymentId !== void 0 && typeof settled.id === "string" && settled.id) return settled.id === requested.deploymentId ? void 0 : describeRollout(settled);
+	if (requested.taskDefinition !== void 0 && typeof settled.taskDefinition === "string" && settled.taskDefinition) return settled.taskDefinition === requested.taskDefinition ? void 0 : describeRollout(settled);
+}
 function markNotGoneOnNotFoundClass$1(error, wrapped) {
 	return error instanceof Error && error.name.includes("NotFound") ? markNotGone(wrapped) : wrapped;
 }
@@ -26257,7 +26845,7 @@ var ECSProvider = class {
 		switch (resourceType) {
 			case "AWS::ECS::Cluster": return this.createCluster(logicalId, resourceType, properties, this.operationSinks(context, [[properties["ClusterName"], properties["ClusterName"]]]));
 			case "AWS::ECS::TaskDefinition": return this.createTaskDefinition(logicalId, resourceType, properties, this.operationSinks(context, [[properties["Family"], properties["Family"]]]));
-			case "AWS::ECS::Service": return this.createService(logicalId, resourceType, properties, this.operationSinks(context, [[properties["ServiceName"], properties["ServiceName"]], [properties["Cluster"], clusterNameOfRef(properties["Cluster"])]]));
+			case "AWS::ECS::Service": return this.createService(logicalId, resourceType, properties, this.operationSinks(context, [[properties["ServiceName"], properties["ServiceName"]], [properties["Cluster"], clusterNameOfRef(properties["Cluster"])]]), context?.replayingState === true);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -26274,7 +26862,7 @@ var ECSProvider = class {
 					[properties["Cluster"], recordedCluster],
 					[previousProperties["Cluster"], recordedCluster],
 					[properties["Cluster"], clusterNameOfRef(properties["Cluster"])]
-				]), context?.desiredFromAwsReadback === true);
+				]), context?.desiredFromAwsReadback === true, context?.replayingState === true);
 			}
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -26494,14 +27082,15 @@ var ECSProvider = class {
 			default: return;
 		}
 	}
-	async createService(logicalId, resourceType, properties, log) {
+	async createService(logicalId, resourceType, properties, log, replayingState) {
 		log.debug(`Creating ECS service ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
 		const serviceName = properties["ServiceName"] || generatedNameFor("AWS::ECS::Service", logicalId);
 		let survivorArn;
 		try {
-			const heldBefore = process.env["CDKD_FULL_WAIT"] === "true" ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
+			const skipReason = controllerSkipsWait(properties);
+			const heldBefore = process.env["CDKD_NO_WAIT"] !== "true" && skipReason === void 0 && !replayingState ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
 			const service = (await client.send(new CreateServiceCommand({
 				cluster: properties["Cluster"],
 				serviceName,
@@ -26532,9 +27121,20 @@ var ECSProvider = class {
 			}))).service;
 			if (!service || !service.serviceArn) throw new Error("CreateService did not return service ARN");
 			log.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, service.serviceArn);
 			try {
-				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"], log);
+				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"], log, requestedRolloutOf(service), skipReason);
 			} catch (waitError) {
+				if (replayingState) {
+					log.warn(`${this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log, false).message} Continuing the rollback: the restored service stays recorded.`);
+					return {
+						physicalId: service.serviceArn,
+						attributes: {
+							ServiceArn: service.serviceArn,
+							Name: service.serviceName
+						}
+					};
+				}
 				const aws = pasteableAwsCommand(log.mask);
 				const cleanupCluster = properties["Cluster"];
 				const clusterArg = cleanupCluster ? aws` --cluster ${cleanupCluster}` : aws``;
@@ -26547,6 +27147,7 @@ var ECSProvider = class {
 						service: service.serviceArn,
 						force: true
 					}));
+					retractCreatedResource(logicalId, resourceType, service.serviceArn);
 					log.warn(`Deleted partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed, so the next deploy's CreateService does not collide on the name. Its stopped tasks remain inspectable for about an hour: ${listStopped.render()}`);
 				} catch (cleanupError) {
 					survivorArn = service.serviceArn;
@@ -26555,10 +27156,7 @@ var ECSProvider = class {
 					if (cleanupFailure.redacted) log.debug(`${cleanupHead}${cleanupFailure.detail}`);
 					log.warn(`${cleanupHead}${cleanupFailure.redacted ? `${cleanupFailure.summary} ` : `${cleanupFailure.detail}. `}Manual deletion may be required before the next deploy: ${deleteCommand.render()}`);
 				}
-				const waitFailure = describeAwsFailure(waitError);
-				if (waitFailure.redacted) log.debug(`ECS service ${logicalId} steady-state wait failed: ${waitFailure.detail}`);
-				const steadyStateError = new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state under --full-wait: ${waitFailure.summary.replace(/\.$/, "")}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}`, { cause: waitError });
-				throw waitFailure.redacted ? markRedactedCause(steadyStateError) : steadyStateError;
+				throw this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log);
 			}
 			return {
 				physicalId: service.serviceArn,
@@ -26601,30 +27199,68 @@ var ECSProvider = class {
 		reduced.name = error.name;
 		return markRedactedCause(reduced);
 	}
-	async settleService(logicalId, serviceRef, cluster, log) {
-		if (process.env["CDKD_FULL_WAIT"] === "true") {
+	wrapSteadyStateError(logicalId, waitError, cluster, log, offerNoWait = true) {
+		const aws = pasteableAwsCommand(log.mask);
+		const clusterArg = cluster ? aws` --cluster ${cluster}` : aws``;
+		const listStopped = aws`aws ecs list-tasks${clusterArg} --desired-status STOPPED`;
+		const waitFailure = describeAwsFailure(waitError);
+		if (waitFailure.redacted) log.debug(`ECS service ${logicalId} steady-state wait failed: ${waitFailure.detail}`);
+		const flagsAvailable = offerNoWait && process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true";
+		const timeoutHint = flagsAvailable && !(waitError instanceof EcsCircuitBreakerVerdict) ? ` To wait longer, raise the limit with --resource-timeout AWS::ECS::Service=${commandHole("duration")}.` : "";
+		const noWaitHint = flagsAvailable ? " To deploy without waiting for steady state, pass --no-wait." : "";
+		const steadyStateError = new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state: ${waitFailure.summary.replace(/\.$/, "")}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}.${timeoutHint}${noWaitHint}`, { cause: waitError });
+		return waitFailure.redacted ? markRedactedCause(steadyStateError) : steadyStateError;
+	}
+	async settleService(logicalId, serviceRef, cluster, log, requested, skipReason) {
+		if (skipReason !== void 0) {
+			this.logger.info(log.mask(`ECS service ${logicalIdShown(logicalId)} accepted (not waiting for steady state: ${skipReason}).`));
+			return;
+		}
+		if (process.env["CDKD_NO_WAIT"] !== "true") {
 			log.debug(`Waiting for ECS service ${logicalId} to reach steady state...`);
 			const maxWaitTime = Math.max(600, (resolvedResourceTimeoutMs("AWS::ECS::Service") ?? 0) / 1e3);
+			const client = this.getClient();
+			const breakerVerdict = new AbortController();
+			let failedRollout;
+			const watchedClient = { send: async (command) => {
+				const output = await client.send(command);
+				if (failedRollout === void 0) {
+					failedRollout = failedRequestedDeployment(requested, output?.services?.[0]?.deployments);
+					if (failedRollout !== void 0) breakerVerdict.abort();
+				}
+				return output;
+			} };
 			try {
 				await waitUntilServicesStable({
-					client: this.getClient(),
+					client: watchedClient,
 					maxWaitTime,
 					minDelay: 5,
-					maxDelay: 10
+					maxDelay: 10,
+					abortSignal: breakerVerdict.signal
 				}, {
 					cluster,
 					services: [serviceRef]
 				});
 			} catch (waiterError) {
+				if (failedRollout !== void 0) {
+					log.debug(`ECS service ${logicalId} deployment ${failedRollout.id ?? "(no id)"} FAILED: ${failedRollout.rolloutStateReason ?? "(no rollout reason)"}`);
+					throw wrapBreakerFailedError(failedRollout);
+				}
 				throw this.wrapWaiterResultError(waiterError, logicalId, log);
 			}
+			if (failedRollout !== void 0) throw wrapBreakerFailedError(failedRollout);
 			const rolloutDeadline = Date.now() + 12e4;
+			let settledDeployment;
 			for (;;) {
 				const deployments = (await this.getClient().send(new DescribeServicesCommand({
 					cluster,
 					services: [serviceRef]
 				})))?.services?.[0]?.deployments;
-				const rolloutState = deployments && deployments.length === 1 ? deployments[0]?.rolloutState : void 0;
+				const failedNow = failedRequestedDeployment(requested, deployments);
+				if (failedNow !== void 0) throw wrapBreakerFailedError(failedNow);
+				settledDeployment = deployments && deployments.length === 1 ? deployments[0] : void 0;
+				const rolloutState = settledDeployment?.rolloutState;
+				if (settledDeployment !== void 0 && rolloutState === "FAILED") throw wrapBreakerFailedError(settledDeployment);
 				if (rolloutState === void 0 || rolloutState === "COMPLETED") break;
 				if (Date.now() >= rolloutDeadline) {
 					log.warn(`ECS service ${logicalId} is steady but its rollout is still ${rolloutState} after the post-stability grace window; continuing`);
@@ -26632,15 +27268,22 @@ var ECSProvider = class {
 				}
 				await settleRolloutDelays.sleep(3e3);
 			}
+			const supersededBy = rolloutSupersededBy(requested, settledDeployment);
+			if (supersededBy !== void 0) {
+				log.debug(`ECS service ${logicalId} settled deployment ${settledDeployment?.id ?? "(no id)"}: ${settledDeployment?.rolloutStateReason ?? "(no rollout reason)"}`);
+				throw new EcsCircuitBreakerVerdict(`its deployment circuit breaker rolled the rollout back: the service settled on ${supersededBy}, not on the deployment this update started (${describeRollout({
+					id: requested.deploymentId,
+					taskDefinition: requested.taskDefinition
+				})}). The new tasks failed to start or failed their health checks`);
+			}
 			log.debug(`ECS service ${logicalId} reached steady state`);
 			return;
 		}
 		const aws = pasteableAwsCommand(log.mask);
 		const clusterArg = cluster ? aws` --cluster ${cluster}` : aws``;
-		const fullWaitHint = process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true" ? "; pass --full-wait to wait" : "";
-		this.logger.info(log.mask(`ECS service ${logicalIdShown(logicalId)} accepted (not waiting for steady state${fullWaitHint}). To wait manually: ${aws`aws ecs wait services-stable${clusterArg} --services ${serviceRef}`.render()}`));
+		this.logger.info(log.mask(`ECS service ${logicalIdShown(logicalId)} accepted (not waiting for steady state under --no-wait). To wait manually: ${aws`aws ecs wait services-stable${clusterArg} --services ${serviceRef}`.render()}`));
 	}
-	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, log, desiredFromAwsReadback) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, log, desiredFromAwsReadback, replayingState) {
 		log.debug(`Updating ECS service ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const client = this.getClient();
@@ -26710,7 +27353,12 @@ var ECSProvider = class {
 				forceNewDeployment: forceNewDeploymentInput
 			}))).service;
 			if (service?.serviceArn) await this.applyTagDiff(service.serviceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
-			await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"], log);
+			try {
+				await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"], log, requestedRolloutOf(service), desiredFromAwsReadback ? "a drift revert does not wait for it" : controllerSkipsWait(properties));
+			} catch (waitError) {
+				if (replayingState) log.warn(`${this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log, false).message} The rollback update was applied; continuing.`);
+				else throw this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log);
+			}
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -27982,6 +28630,7 @@ var ELBv2Provider = class {
 			if (!lb || !lb.LoadBalancerArn) throw new Error("CreateLoadBalancer did not return LoadBalancer ARN");
 			const lbArn = lb.LoadBalancerArn;
 			this.logger.debug(`Successfully created LoadBalancer ${logicalId}: ${lbArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, lbArn);
 			try {
 				if (waitForActive) {
 					this.logger.debug(`Waiting for LoadBalancer ${logicalId} to reach active state...`);
@@ -28020,6 +28669,7 @@ var ELBv2Provider = class {
 				if (heldBefore !== "free") this.logger.warn(maskerOrIdentity(maskSecrets)(skippedCleanupText(heldBefore, `LoadBalancer ${logicalId} (${lbArn})`, pasteableAwsCommand(maskSecrets)`aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`.render())));
 				else try {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
+					retractCreatedResource(logicalId, resourceType, lbArn);
 					this.logger.debug(`Cleaned up partially-created LoadBalancer ${logicalId} (${lbArn}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = lbArn;
@@ -28288,6 +28938,7 @@ var ELBv2Provider = class {
 			if (!tg || !tg.TargetGroupArn) throw new Error("CreateTargetGroup did not return TargetGroup ARN");
 			const tgArn = tg.TargetGroupArn;
 			this.logger.debug(`Successfully created TargetGroup ${logicalId}: ${tgArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, tgArn);
 			try {
 				if (tgAttributes.length > 0) {
 					await this.getClient().send(new ModifyTargetGroupAttributesCommand({
@@ -28310,6 +28961,7 @@ var ELBv2Provider = class {
 					if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating TargetGroup ${logicalId} (${tgArn}) but before its targets were registered. Nothing in cdkd state refers to it, so cdkd is deleting it now. If that delete fails, remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render()}`));
 					try {
 						await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
+						retractCreatedResource(logicalId, resourceType, tgArn);
 						this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
 					} catch (cleanupError) {
 						leftBehindArn = tgArn;
@@ -28483,6 +29135,7 @@ var ELBv2Provider = class {
 			if (!listener || !listener.ListenerArn) throw new Error("CreateListener did not return Listener ARN");
 			const listenerArn = listener.ListenerArn;
 			this.logger.debug(`Successfully created Listener ${logicalId}: ${listenerArn}`);
+			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, listenerArn);
 			try {
 				if (listenerAttributes.length > 0) {
 					const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
@@ -28508,6 +29161,7 @@ var ELBv2Provider = class {
 				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
+					retractCreatedResource(logicalId, resourceType, listenerArn);
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = listenerArn;
@@ -29048,6 +29702,7 @@ const POLL_INTERVAL_MS$1 = 5e3;
 const POLL_TIMEOUT_MS$1 = 18e5;
 const RETAINED_ON_REMOVAL = [
 	"Auth",
+	"DefaultAuthScheme",
 	"RequireTLS",
 	"IdleClientTimeout",
 	"DebugLogging",
@@ -29059,7 +29714,14 @@ const CFN_KEEPS_ON_REMOVAL$1 = /* @__PURE__ */ new Set([
 	"DebugLogging",
 	"VpcSecurityGroupIds"
 ]);
-const authRemovalRefused = (properties) => {
+const authRemovalRefused = (properties, previousProperties) => authRequired({ DefaultAuthScheme: properties["DefaultAuthScheme"] !== void 0 ? properties["DefaultAuthScheme"] : previousProperties["DefaultAuthScheme"] });
+const leavesProxyWithoutAuth = (properties, previousProperties) => {
+	const desired = properties["Auth"];
+	const declaredEmpty = desired === null || Array.isArray(desired) && desired.length === 0;
+	if (properties["DefaultAuthScheme"] === "NONE" && previousProperties["DefaultAuthScheme"] !== "NONE" && (desired === void 0 || declaredEmpty)) return true;
+	return declaredEmpty && JSON.stringify(desired) !== JSON.stringify(previousProperties["Auth"]) && authRemovalRefused(properties, previousProperties);
+};
+const authRequired = (properties) => {
 	const scheme = properties["DefaultAuthScheme"];
 	return scheme === void 0 || scheme === "NONE";
 };
@@ -29079,6 +29741,9 @@ var RDSDBProxyProvider = class {
 		"RequireTLS",
 		"IdleClientTimeout",
 		"DebugLogging",
+		"DefaultAuthScheme",
+		"EndpointNetworkType",
+		"TargetConnectionNetworkType",
 		"Tags"
 	])]]);
 	getClient() {
@@ -29105,18 +29770,21 @@ var RDSDBProxyProvider = class {
 		const engineFamily = properties["EngineFamily"];
 		if (!engineFamily) throw new ProvisioningError(`EngineFamily is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const auth = properties["Auth"];
-		if (!auth || auth.length === 0) throw new ProvisioningError(`Auth (at least one entry) is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
+		if ((!auth || auth.length === 0) && authRequired(properties)) throw new ProvisioningError(`Auth (at least one entry) is required for AWS::RDS::DBProxy ${logicalId} while DefaultAuthScheme is NONE or unset`, resourceType, logicalId);
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const vpcSubnetIds = properties["VpcSubnetIds"];
 		if (!vpcSubnetIds || vpcSubnetIds.length === 0) throw new ProvisioningError(`VpcSubnetIds (at least one) is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const client = this.getClient();
-		this.logger.debug(`Creating DBProxy ${dbProxyName} (${engineFamily})`);
+		this.logger.debug(mask(`Creating DBProxy ${dbProxyName} (${engineFamily})`));
 		try {
 			await this.getCreateClient().send(new CreateDBProxyCommand({
 				DBProxyName: dbProxyName,
 				EngineFamily: engineFamily,
-				Auth: auth,
+				Auth: auth && auth.length > 0 ? auth : void 0,
+				DefaultAuthScheme: properties["DefaultAuthScheme"],
+				EndpointNetworkType: properties["EndpointNetworkType"],
+				TargetConnectionNetworkType: properties["TargetConnectionNetworkType"],
 				RoleArn: roleArn,
 				VpcSubnetIds: vpcSubnetIds,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
@@ -29128,6 +29796,7 @@ var RDSDBProxyProvider = class {
 		} catch (error) {
 			throw this.wrapCaughtError(error, "CREATE", resourceType, logicalId, void 0, mask);
 		}
+		reportCreatedResource(logicalId, resourceType, dbProxyName);
 		let endpoint;
 		let dbProxyArn;
 		let vpcId;
@@ -29167,13 +29836,16 @@ var RDSDBProxyProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
-		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && this.removedRetained(properties, previousProperties, context).includes("Auth") && authRemovalRefused(properties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): Auth was removed from the template, but AWS requires Auth while DefaultAuthScheme is NONE or unset, and CloudFormation's update fails on the same change. Declare Auth again; nothing was changed.`, resourceType, logicalId, physicalId));
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && this.removedRetained(properties, previousProperties, context).includes("Auth") && authRemovalRefused(properties, previousProperties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): Auth was removed from the template, but AWS requires Auth while DefaultAuthScheme is NONE or unset, and CloudFormation's update fails on the same change. Declare Auth again; nothing was changed.`, resourceType, logicalId, physicalId));
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && leavesProxyWithoutAuth(properties, previousProperties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): the update leaves the proxy with no Auth while DefaultAuthScheme is NONE or unset, and AWS requires Auth then. Declare Auth; nothing was changed.`, resourceType, logicalId, physicalId));
 		const client = this.getClient();
 		const { mask } = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["DBProxyName"], physicalId]]);
 		for (const field of [
 			"DBProxyName",
 			"EngineFamily",
-			"VpcSubnetIds"
+			"VpcSubnetIds",
+			"EndpointNetworkType",
+			"TargetConnectionNetworkType"
 		]) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field]) && !await unchangedBehindSecretReference({
 			resourceType,
 			key: field,
@@ -29186,6 +29858,7 @@ var RDSDBProxyProvider = class {
 		let hasModify = false;
 		for (const key of [
 			"Auth",
+			"DefaultAuthScheme",
 			"RequireTLS",
 			"IdleClientTimeout",
 			"DebugLogging",
@@ -29313,7 +29986,10 @@ var RDSDBProxyProvider = class {
 				SecretArn: a.SecretArn,
 				IAMAuth: a.IAMAuth,
 				ClientPasswordAuthType: a.ClientPasswordAuthType
-			}))
+			})),
+			...p.DefaultAuthScheme !== void 0 && { DefaultAuthScheme: p.DefaultAuthScheme },
+			...p.EndpointNetworkType !== void 0 && { EndpointNetworkType: p.EndpointNetworkType },
+			...p.TargetConnectionNetworkType !== void 0 && { TargetConnectionNetworkType: p.TargetConnectionNetworkType }
 		};
 		if (p.DBProxyArn) try {
 			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }));
@@ -29416,6 +30092,7 @@ var RDSDBProxyEndpointProvider = class {
 		"VpcSubnetIds",
 		"VpcSecurityGroupIds",
 		"TargetRole",
+		"EndpointNetworkType",
 		"Tags"
 	])]]);
 	getClient() {
@@ -29452,11 +30129,13 @@ var RDSDBProxyEndpointProvider = class {
 				VpcSubnetIds: vpcSubnetIds,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
 				TargetRole: properties["TargetRole"],
+				EndpointNetworkType: properties["EndpointNetworkType"],
 				Tags: tags.length > 0 ? tags : void 0
 			}));
 		} catch (error) {
 			throw this.wrapCaughtError(error, "CREATE", resourceType, logicalId, void 0, mask);
 		}
+		reportCreatedResource(logicalId, resourceType, dbProxyEndpointName);
 		let endpoint;
 		let arn;
 		let isDefault;
@@ -29506,7 +30185,8 @@ var RDSDBProxyEndpointProvider = class {
 			"DBProxyName",
 			"DBProxyEndpointName",
 			"VpcSubnetIds",
-			"TargetRole"
+			"TargetRole",
+			"EndpointNetworkType"
 		]) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field]) && !await unchangedBehindSecretReference({
 			resourceType,
 			key: field,
@@ -29610,7 +30290,8 @@ var RDSDBProxyEndpointProvider = class {
 			DBProxyName: e.DBProxyName,
 			VpcSubnetIds: e.VpcSubnetIds ?? [],
 			VpcSecurityGroupIds: e.VpcSecurityGroupIds ?? [],
-			TargetRole: e.TargetRole ?? "READ_WRITE"
+			TargetRole: e.TargetRole ?? "READ_WRITE",
+			...e.EndpointNetworkType !== void 0 && { EndpointNetworkType: e.EndpointNetworkType }
 		};
 		if (e.DBProxyEndpointArn) try {
 			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }));
@@ -29816,6 +30497,7 @@ var RDSDBProxyTargetGroupProvider = class {
 			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0, mask), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
 		}
 		if (!targetGroupArn) throw await this.retireRegistrationAfterFailedCreate(new ProvisioningError(`Failed to recover TargetGroupArn for ${dbProxyName}/${targetGroupName} after create`, resourceType, logicalId), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
+		if (dbClusterIdentifiers.length > 0 || dbInstanceIdentifiers.length > 0) reportCreatedResource(logicalId, resourceType, targetGroupArn);
 		if (tags.length > 0) try {
 			await client.send(new AddTagsToResourceCommand$2({
 				ResourceName: targetGroupArn,
@@ -30135,6 +30817,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				DBClusterIdentifiers: clusters,
 				DBInstanceIdentifiers: instances
 			}));
+			if (leftBehind) retractCreatedResource(leftBehind.logicalId, leftBehind.resourceType, leftBehind.physicalId);
 			return original;
 		} catch (cleanupError) {
 			const aws = pasteableAwsCommand(maskSecrets);
@@ -30271,6 +30954,25 @@ function masterUserPasswordToSend(properties, previousProperties, context) {
 	return typeof desired === "string" && typeof recorded === "string" && recorded === desired && dynamicReferenceTokens(recorded).length === 0 && recorded !== "***" ? void 0 : desired;
 }
 const DOCDB_DEFAULT_PORT = 27017;
+const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
+	"DeletionProtection",
+	"BackupRetentionPeriod",
+	"VpcSecurityGroupIds",
+	"EngineVersion",
+	"PreferredBackupWindow",
+	"PreferredMaintenanceWindow",
+	"DBClusterParameterGroupName"
+];
+const DOCDB_INSTANCE_KEPT_ON_REMOVAL = ["PreferredMaintenanceWindow"];
+function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType) {
+	const removedSet = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
+	const removed = keys.filter((key) => removedSet.has(key));
+	if (removed.length === 0) return void 0;
+	const one = removed.length === 1;
+	const names = `${one ? "property" : "properties"} ${removed.join(", ")}`;
+	const modify = resourceType === "AWS::DocDB::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
+	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place, as CloudFormation does. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
+}
 const SECURITY_GROUP_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying"]);
 const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "rebooting"]);
 function numberOrUndefined(value) {
@@ -30312,6 +31014,25 @@ var DocDBProvider = class {
 	logger = getLogger().child("DocDBProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
+		"DBClusterIdentifier",
+		"DBSubnetGroupName",
+		"KmsKeyId",
+		"MasterUsername",
+		"StorageEncrypted",
+		"Port",
+		"Tags",
+		"MasterUserPassword",
+		...DOCDB_CLUSTER_KEPT_ON_REMOVAL
+	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
+		"DBInstanceIdentifier",
+		"DBClusterIdentifier",
+		"AvailabilityZone",
+		"DBInstanceClass",
+		"Tags",
+		"AutoMinorVersionUpgrade",
+		...DOCDB_INSTANCE_KEPT_ON_REMOVAL
+	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
 		"DBClusterIdentifier",
 		"EngineVersion",
@@ -30365,7 +31086,7 @@ var DocDBProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -30410,6 +31131,7 @@ var DocDBProvider = class {
 			}));
 			clusterCreated = true;
 			createdResourceId = response.DBCluster?.DbClusterResourceId;
+			reportCreatedResource(logicalId, resourceType, dbClusterIdentifier, createdResourceId);
 			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
@@ -30456,6 +31178,8 @@ var DocDBProvider = class {
 				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, SECURITY_GROUP_CHANGE_MEMBER_STATUSES, "VPC security groups");
 			}
 			if (described?.DBClusterArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			const keptWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
+			if (keptWarning !== void 0) this.logger.warn(keptWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -30565,6 +31289,7 @@ var DocDBProvider = class {
 			}));
 			instanceCreated = true;
 			createdResourceId = response.DBInstance?.DbiResourceId;
+			reportCreatedResource(logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
 			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(logicalId, dbInstanceIdentifier);
@@ -30578,8 +31303,9 @@ var DocDBProvider = class {
 			throw thrown;
 		}
 	}
-	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
+		const mask = context?.maskSecrets;
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			await modifyDbInstanceWhenAvailable({
@@ -30600,6 +31326,8 @@ var DocDBProvider = class {
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			const keptWarning = keptOnRemovalWarning$1(DOCDB_INSTANCE_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
+			if (keptWarning !== void 0) this.logger.warn(keptWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -31268,6 +31996,7 @@ var Route53Provider = class {
 			if (!hostedZone?.Id) throw new Error("CreateHostedZone did not return HostedZone.Id");
 			const zoneId = hostedZone.Id.replace("/hostedzone/", "");
 			createdZoneId = zoneId;
+			reportCreatedResource(logicalId, resourceType, zoneId);
 			if (vpcs && vpcs.length > 1) for (let i = 1; i < vpcs.length; i++) {
 				const additionalVpc = vpcs[i];
 				this.logger.debug(`Associating additional VPC ${String(additionalVpc["VPCId"])} with hosted zone ${zoneId}`);
@@ -31293,6 +32022,7 @@ var Route53Provider = class {
 						await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 						await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
 						zoneRolledBack = true;
+						retractCreatedResource(logicalId, resourceType, zoneId);
 						callerReferenceToken.release();
 					} catch (deleteError) {
 						const head = `Best-effort rollback DeleteHostedZone for ${zoneId} also failed: `;
@@ -32213,6 +32943,27 @@ function sanitizeDescription(value) {
 function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+const DATA_PROTECTION_FALSE_DEFAULTS = ["ExcludeRuleMatchDetails", "ExcludeRateBasedDetails"];
+function toCfnDataProtectionConfig(config, baseline) {
+	const entries = config["DataProtections"];
+	if (!Array.isArray(entries)) return config;
+	const baseEntries = isPlainObject$2(baseline) && Array.isArray(baseline["DataProtections"]) ? baseline["DataProtections"] : [];
+	return {
+		...config,
+		DataProtections: entries.map((entry, i) => {
+			if (!isPlainObject$2(entry)) return entry;
+			const base = baseEntries[i];
+			const converted = { ...entry };
+			for (const key of DATA_PROTECTION_FALSE_DEFAULTS) if (converted[key] === false && !(isPlainObject$2(base) && key in base)) delete converted[key];
+			return converted;
+		})
+	};
+}
+function applicationConfigForUpdate(next, previous) {
+	if (next === void 0 || next === null) return void 0;
+	if (isDeepStrictEqual(next, previous)) return void 0;
+	return next;
+}
 function toSdkByteMatchStatement(byteMatchStatement) {
 	const encoded = byteMatchStatement["SearchStringBase64"];
 	if (typeof encoded !== "string") return byteMatchStatement;
@@ -32391,7 +33142,11 @@ var WAFv2WebACLProvider = class {
 		"CaptchaConfig",
 		"ChallengeConfig",
 		"TokenDomains",
-		"AssociationConfig"
+		"AssociationConfig",
+		"DataProtectionConfig",
+		"OnSourceDDoSProtectionConfig",
+		"ApplicationConfig",
+		"MonetizationConfig"
 	])]]);
 	getClient() {
 		if (!this.wafv2Client) {
@@ -32432,7 +33187,11 @@ var WAFv2WebACLProvider = class {
 				CaptchaConfig: properties["CaptchaConfig"],
 				ChallengeConfig: properties["ChallengeConfig"],
 				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
+				AssociationConfig: properties["AssociationConfig"],
+				DataProtectionConfig: properties["DataProtectionConfig"],
+				OnSourceDDoSProtectionConfig: properties["OnSourceDDoSProtectionConfig"],
+				ApplicationConfig: properties["ApplicationConfig"],
+				MonetizationConfig: properties["MonetizationConfig"]
 			}))).Summary;
 			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
 			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
@@ -32486,7 +33245,11 @@ var WAFv2WebACLProvider = class {
 				CaptchaConfig: properties["CaptchaConfig"],
 				ChallengeConfig: properties["ChallengeConfig"],
 				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
+				AssociationConfig: properties["AssociationConfig"],
+				DataProtectionConfig: properties["DataProtectionConfig"],
+				OnSourceDDoSProtectionConfig: properties["OnSourceDDoSProtectionConfig"],
+				ApplicationConfig: applicationConfigForUpdate(properties["ApplicationConfig"], previousProperties["ApplicationConfig"]),
+				MonetizationConfig: properties["MonetizationConfig"]
 			}));
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
@@ -32593,6 +33356,10 @@ var WAFv2WebACLProvider = class {
 		if (webACL.ChallengeConfig) result["ChallengeConfig"] = webACL.ChallengeConfig;
 		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
 		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
+		if (webACL.DataProtectionConfig) result["DataProtectionConfig"] = toCfnDataProtectionConfig(webACL.DataProtectionConfig, properties?.["DataProtectionConfig"]);
+		if (webACL.OnSourceDDoSProtectionConfig) result["OnSourceDDoSProtectionConfig"] = webACL.OnSourceDDoSProtectionConfig;
+		if (webACL.ApplicationConfig) result["ApplicationConfig"] = webACL.ApplicationConfig;
+		if (webACL.MonetizationConfig) result["MonetizationConfig"] = webACL.MonetizationConfig;
 		try {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
@@ -33068,6 +33835,7 @@ var CognitoUserPoolProvider = class {
 			if (!userPool?.Id) throw new Error("CreateUserPool did not return UserPool.Id");
 			const userPoolId = userPool.Id;
 			createdUserPoolId = userPoolId;
+			reportCreatedResource(logicalId, resourceType, userPoolId);
 			const replayWindow = replayedSendWindow(created, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleOrphanPools(logicalId, poolName, replayWindow, createMaskedLogSinks(this.logger, context?.maskSecrets), userPoolId);
 			const userPoolArn = userPool.Arn;
@@ -33095,6 +33863,7 @@ var CognitoUserPoolProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				try {
 					await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: createdUserPoolId }));
+					retractCreatedResource(logicalId, resourceType, createdUserPoolId);
 					this.logger.debug(`Rolled back partially-created Cognito User Pool ${createdUserPoolId}`);
 				} catch (rollbackError) {
 					poolLeftBehind = true;
@@ -33791,6 +34560,36 @@ function nodesToRemove(nodes, desiredCount, desiredZones) {
 	if (keep.size + unnamed < desiredCount) return void 0;
 	return named.map((n) => n.id).filter((id) => !keep.has(id)).sort();
 }
+const KEPT_ON_REMOVAL$1 = [
+	"EngineVersion",
+	"CacheParameterGroupName",
+	"PreferredMaintenanceWindow",
+	"SnapshotWindow",
+	"IpDiscovery",
+	"SnapshotRetentionLimit",
+	"AutoMinorVersionUpgrade",
+	"NotificationTopicArn",
+	"VpcSecurityGroupIds",
+	"TransitEncryptionEnabled",
+	"PreferredAvailabilityZone"
+];
+const NOT_MODIFIABLE = /* @__PURE__ */ new Set(["TransitEncryptionEnabled", "PreferredAvailabilityZone"]);
+const PLACEMENT_ON_REMOVAL = ["AZMode", "PreferredAvailabilityZones"];
+const removalWarnings = (logicalId, kept, placement, caller) => {
+	const lines = [];
+	const head = (names) => safeMsg`${logicalId} (AWS::ElastiCache::CacheCluster): ${names.length === 1 ? "property" : "properties"} ${names.join(", ")}`;
+	if (kept.length > 0) {
+		const one = kept.length === 1;
+		const fixed = kept.filter((name) => NOT_MODIFIABLE.has(name));
+		const replaceNote = fixed.length === 0 ? "" : safeMsg` (${fixed.join(", ")} ${fixed.length === 1 ? "changes" : "change"} only by replacing the cluster)`;
+		lines.push(caller === "rollback" ? `${head(kept)} ${one ? "is" : "are"} absent from the state being restored; the rollback sends nothing for ${one ? "it" : "them"}, so the cluster keeps the value it holds now.` : `${head(kept)} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; cdkd sends nothing for a removed property. To change a value, declare it explicitly${replaceNote}.`);
+	}
+	if (placement.length > 0) {
+		const one = placement.length === 1;
+		lines.push(caller === "rollback" ? `${head(placement)} ${one ? "is" : "are"} absent from the state being restored; the rollback leaves the cluster unchanged.` : `${head(placement)} ${one ? "was" : "were"} removed from the template; cdkd sends nothing for a removed property, so the nodes stay in their zones. CloudFormation updates a cross-az cluster, or a single-az one that keeps its zone list, in place. It replaces a memcached single-az cluster left with no zone, and cdkd plans that replacement too (go-to-k/cdkd#5558). To move the nodes, replace the cluster, for example by changing its logical ID.`);
+	}
+	return lines;
+};
 var ElastiCacheProvider = class {
 	client;
 	createClient;
@@ -33840,6 +34639,22 @@ var ElastiCacheProvider = class {
 		"TransitEncryptionEnabled"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Set([
+		"CacheSubnetGroupName",
+		"ClusterName",
+		"Engine",
+		"NetworkType",
+		"Port",
+		"SnapshotName",
+		"SnapshotArns",
+		"CacheSecurityGroupNames",
+		"CacheNodeType",
+		"NumCacheNodes",
+		"Tags",
+		"LogDeliveryConfigurations",
+		...KEPT_ON_REMOVAL$1,
+		...PLACEMENT_ON_REMOVAL
+	])]]);
 	getClient() {
 		if (!this.client) {
 			this.client = new ElastiCacheClient({
@@ -33869,7 +34684,7 @@ var ElastiCacheProvider = class {
 		const mask = context?.maskSecrets;
 		switch (resourceType) {
 			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, mask);
-			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask);
+			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -33976,6 +34791,7 @@ var ElastiCacheProvider = class {
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
+			reportCreatedResource(logicalId, resourceType, cacheClusterId);
 			this.logger.debug(`Successfully created CacheCluster ${logicalId}: ${cacheClusterId}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(cacheClusterId);
 			const described = await this.describeCacheCluster(cacheClusterId);
@@ -34000,7 +34816,7 @@ var ElastiCacheProvider = class {
 			throw thrown;
 		}
 	}
-	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask, context) {
 		this.logger.debug(`Updating CacheCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
@@ -34039,6 +34855,7 @@ var ElastiCacheProvider = class {
 			const described = await this.describeCacheCluster(physicalId);
 			this.warnTransitEncryptionNotApplied(logicalId, properties, previousProperties, described?.TransitEncryptionEnabled);
 			if (described?.ARN) await this.applyTagDiff(described.ARN, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			this.warnRemovalsLeftInPlace(logicalId, properties, previousProperties, context);
 			const attributes = {};
 			if (described?.CacheNodes?.[0]?.Endpoint) {
 				const endpoint = described.CacheNodes[0].Endpoint;
@@ -34139,6 +34956,13 @@ var ElastiCacheProvider = class {
 		if (notApplied.length === 0) return;
 		this.logger.warn(safeMsg`CacheCluster ${logicalId}: the ${notApplied.join(", ")} change is not applied to the ` + "existing cluster (ModifyCacheCluster cannot change it, and CloudFormation leaves it unchanged too). To apply it, replace the cluster, for example by changing its logical ID.");
 	}
+	warnRemovalsLeftInPlace(logicalId, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback) return;
+		const removed = context?.removedProperties;
+		const wasRemoved = (key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0;
+		const lines = removalWarnings(logicalId, KEPT_ON_REMOVAL$1.filter(wasRemoved), PLACEMENT_ON_REMOVAL.filter(wasRemoved), context?.replayingState ? "rollback" : "deploy");
+		for (const line of lines) this.logger.warn(line);
+	}
 	buildLogDeliveryConfigurationsForUpdate(newConfigs, previousConfigs) {
 		const kept = newConfigs ?? [];
 		const keptLogTypes = new Set(kept.map((c) => c.LogType).filter((t) => t !== void 0));
@@ -34786,6 +35610,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			if (!service || !service.Id) throw new Error("CreateService did not return Service ID");
 			const serviceId = service.Id;
 			leftBehindServiceId = serviceId;
+			reportCreatedResource(logicalId, resourceType, serviceId);
 			this.logger.debug(`Successfully created service discovery service ${logicalId}: ${serviceId}`);
 			try {
 				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
@@ -34810,6 +35635,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					leftBehindServiceId = void 0;
+					retractCreatedResource(logicalId, resourceType, serviceId);
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
 					const cleanupFailure = describeAwsFailure(cleanupError);
@@ -35303,6 +36129,25 @@ const APPSYNC_APIKEY_ID_FORMAT = {
 	label: "AppSync ApiKey",
 	segments: ["apiId", "apiKeyId"]
 };
+const CFN_APPSYNC_ARN_RESOURCE_PATHS = {
+	"AWS::AppSync::GraphQLApi": /^apis\/([^/|]+)$/,
+	"AWS::AppSync::DataSource": /^apis\/([^/|]+)\/datasources\/([^/|]+)$/,
+	"AWS::AppSync::Resolver": /^apis\/([^/|]+)\/types\/([^/|]+)\/resolvers\/([^/|]+)$/,
+	"AWS::AppSync::ApiKey": /^apis\/([^/|]+)\/apikeys?\/([^/|]+)$/
+};
+function graphQLSchemaApiId(physicalId) {
+	const schema = /^([a-z0-9]+)GraphQLSchema$/.exec(physicalId);
+	return schema ? schema[1] : physicalId;
+}
+function appSyncPhysicalIdFromCfn(resourceType, logicalId, physicalId, region) {
+	if (resourceType === "AWS::AppSync::GraphQLSchema") return graphQLSchemaApiId(physicalId);
+	const pathPattern = CFN_APPSYNC_ARN_RESOURCE_PATHS[resourceType];
+	const arn = /^arn:[^:]+:appsync:([^:]*):[^:]*:(.+)$/.exec(physicalId);
+	const segments = pathPattern && arn ? pathPattern.exec(arn[2]) : null;
+	if (!arn || !segments) return physicalId;
+	if (canonicalizeRegion(arn[1]) !== canonicalizeRegion(region)) throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType} ${physicalId} is in region ${arn[1]}, not the import region ${region}`, resourceType, logicalId, physicalId));
+	return segments.slice(1).join("|");
+}
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 	"UserPoolConfig",
 	"OpenIDConnectConfig",
@@ -35442,7 +36287,7 @@ var AppSyncProvider = class {
 		}
 		if (resourceType === "AWS::AppSync::ApiKey" && parts.length === 2) {
 			const [apiId, apiKeyId] = parts;
-			const apiKeyArn = await arn(`apis/${apiId}/apikey/${apiKeyId}`);
+			const apiKeyArn = await arn(`apis/${apiId}/apikeys/${apiKeyId}`);
 			return {
 				ApiKey: apiKeyId,
 				...apiKeyArn && { Arn: apiKeyArn }
@@ -35591,12 +36436,13 @@ var AppSyncProvider = class {
 		};
 	}
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties, mask = maskerOrIdentity(void 0)) {
+		const recordedApiId = graphQLSchemaApiId(physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"] && !await unchangedBehindSecretReference({
 			resourceType,
 			key: "ApiId",
 			desired: properties["ApiId"],
 			previous: previousProperties["ApiId"],
-			physicalName: physicalId,
+			physicalName: recordedApiId,
 			maskSecrets: mask
 		})) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync GraphQLSchema.ApiId cannot move a schema to another API in place (CloudFormation fails a template change of it too) — deploy with --replace, or give the schema a new logical ID, to create it on the new API");
 		const newDef = properties["Definition"];
@@ -35621,7 +36467,7 @@ var AppSyncProvider = class {
 			physicalId,
 			wasReplaced: false
 		};
-		const apiId = properties["ApiId"] ?? physicalId;
+		const apiId = properties["ApiId"] ?? recordedApiId;
 		try {
 			await this.getClient().send(new StartSchemaCreationCommand({
 				apiId,
@@ -36234,6 +37080,7 @@ var AppSyncProvider = class {
 				throw error;
 			}
 			createdApiId = response.graphqlApi?.apiId;
+			if (createdApiId) reportCreatedResource(logicalId, resourceType, createdApiId);
 			const apiId = response.graphqlApi.apiId;
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleOrphanApis(logicalId, input, replayWindow, maskerOrIdentity(context?.maskSecrets), apiId);
@@ -36257,6 +37104,7 @@ var AppSyncProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				try {
 					await this.getClient().send(new DeleteGraphqlApiCommand({ apiId: createdApiId }));
+					retractCreatedResource(logicalId, resourceType, createdApiId);
 					this.logger.debug(`Rolled back partially-created GraphQL API ${createdApiId}`);
 				} catch (rollbackError) {
 					apiLeftBehind = true;
@@ -36543,7 +37391,7 @@ var AppSyncProvider = class {
 			maskSecrets: context?.maskSecrets,
 			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
 		});
-		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikey/${apiKeyId}`, logicalId, physicalId);
+		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikeys/${apiKeyId}`, logicalId, physicalId);
 		return {
 			physicalId,
 			attributes: {
@@ -36628,10 +37476,11 @@ var AppSyncProvider = class {
 		}
 	}
 	async readGraphQLSchema(physicalId, properties) {
+		const apiId = graphQLSchemaApiId(physicalId);
 		let resp;
 		try {
 			resp = await this.getClient().send(new GetIntrospectionSchemaCommand({
-				apiId: physicalId,
+				apiId,
 				format: "SDL"
 			}));
 		} catch (err) {
@@ -36648,7 +37497,7 @@ var AppSyncProvider = class {
 			if (await this.canonicalizeSdl(stateDefinition, "state") === canonicalAws) definitionToReturn = stateDefinition;
 		}
 		return {
-			ApiId: physicalId,
+			ApiId: apiId,
 			Definition: definitionToReturn
 		};
 	}
@@ -36889,14 +37738,18 @@ var AppSyncProvider = class {
 		return RESOURCE_NOT_FOUND;
 	}
 	async import(input) {
+		const known = input.knownPhysicalId && appSyncPhysicalIdFromCfn(input.resourceType, input.logicalId, input.knownPhysicalId, input.region);
 		if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
-			if (input.knownPhysicalId) return {
-				physicalId: input.knownPhysicalId,
-				attributes: await this.childImportAttributes(input.resourceType, input.knownPhysicalId, input.region)
+			if (known) return {
+				physicalId: known,
+				attributes: await this.childImportAttributes(input.resourceType, known, input.region)
 			};
 			return null;
 		}
-		const explicit = resolveExplicitPhysicalId(input, null);
+		const explicit = resolveExplicitPhysicalId(known ? {
+			...input,
+			knownPhysicalId: known
+		} : input, null);
 		if (explicit) try {
 			const response = await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
 			return {
@@ -39391,6 +40244,7 @@ var KMSProvider = class {
 					heldAtMs: Date.now()
 				});
 				createdKeyId = keyId;
+				reportCreatedResource(logicalId, resourceType, keyId);
 				const declinedAtMs = supersededAttempts.get(attemptKey);
 				supersededAttempts.delete(attemptKey);
 				supersededPending = declinedAtMs !== void 0 && Date.now() - declinedAtMs <= 18e5;
@@ -39398,6 +40252,7 @@ var KMSProvider = class {
 				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
 			createdKeyId = keyId;
+			reportCreatedResource(logicalId, resourceType, keyId);
 			if (enableKeyRotation === true) {
 				const rotationPeriodInDays = properties["RotationPeriodInDays"];
 				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
@@ -40623,58 +41478,6 @@ var BudgetsBudgetProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/delete-gone-wait.ts
-async function waitForGoneAfterDelete(opts) {
-	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-	const now = opts.now ?? Date.now;
-	const userTimeoutMs = resolvedResourceTimeoutMs(opts.resourceType);
-	const maxWaitMs = userTimeoutMs === void 0 ? opts.maxWaitMs : Math.min(opts.maxWaitMs, userTimeoutMs / 2);
-	const startedAt = now();
-	const stopped = `${opts.what}: the delete was ACCEPTED by AWS, but cdkd stopped waiting for it to disappear`;
-	const consequence = "AWS finishes the delete on its side; until it does, a create of the same name is refused with \"already exists\".";
-	const watch = startInterruptWatch(`${opts.what} deletion wait`);
-	try {
-		let lastStatus;
-		let sawNonFailedStatus = false;
-		for (;;) {
-			if (watch.isInterrupted()) {
-				opts.logger.warn(safeMsg`${stopped} (interrupted). ${consequence}`);
-				return;
-			}
-			try {
-				const status = await opts.describe();
-				if (status === void 0) {
-					opts.logger.debug(safeMsg`${opts.what} is gone`);
-					return;
-				}
-				const failure = opts.failedStatus?.(status);
-				if (failure !== void 0) {
-					if (sawNonFailedStatus || now() - startedAt >= opts.pollIntervalMs) throw markWaitAbandoned(failure);
-				} else sawNonFailedStatus = true;
-				lastStatus = status;
-				opts.logger.debug(safeMsg`${opts.what} status: ${status}, waiting for it to disappear`);
-			} catch (error) {
-				if (isWaitAbandonedError(error)) throw error;
-				if (!isThrottlingError(error) && !isTransientServerError(error)) {
-					opts.logger.debug(safeMsg`${opts.what}: status read failed: ${describeAwsFailure(error).detail}`);
-					opts.logger.warn(safeMsg`${stopped}: its status could not be read (${describeAwsFailure(error).summary}). ${consequence}`);
-					return;
-				}
-				opts.logger.debug(safeMsg`${opts.what}: status read throttled or failed transiently, re-polling`);
-			}
-			const remainingMs = maxWaitMs - (now() - startedAt);
-			if (remainingMs <= 0) {
-				opts.logger.warn(safeMsg`${stopped} after ${Math.round(maxWaitMs / 1e3)}s` + safeMsg`${lastStatus !== void 0 ? ` (last status: ${lastStatus})` : ""}. ${consequence}`);
-				return;
-			}
-			await sleep(Math.min(opts.pollIntervalMs, remainingMs));
-		}
-	} finally {
-		watch.dispose();
-	}
-}
-
 //#endregion
 //#region src/provisioning/providers/kinesis-provider.ts
 function isKmsEncryption(value) {
@@ -40864,6 +41667,7 @@ var KinesisStreamProvider = class {
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			streamCreated = true;
+			reportCreatedResource(logicalId, resourceType, streamName);
 			this.logger.debug(`CreateStream initiated for ${streamName}, waiting for ACTIVE status`);
 			const streamInfo = await this.waitForStreamActive(streamName);
 			const retentionPeriodHours = retentionRead.kind === "usable" ? retentionRead.hours : void 0;
@@ -40969,7 +41773,10 @@ var KinesisStreamProvider = class {
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
 				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
-				beforeWrite: () => markUnsettled("Tags")
+				beforeWrite: () => markUnsettled("Tags"),
+				afterAdded: (keys) => {
+					if (keys.length > 0) context?.markAttempted?.("Tags", keys);
+				}
 			});
 			const newEncryption = properties["StreamEncryption"];
 			const oldEncryption = previousProperties["StreamEncryption"];
@@ -41031,10 +41838,13 @@ var KinesisStreamProvider = class {
 				}
 				if (toEnable.length > 0) {
 					this.logger.debug(`Enabling ${toEnable.length} shard-level metric(s) on ${physicalId}`);
-					await this.getClient().send(new EnableEnhancedMonitoringCommand({
+					const current = expandShardLevelMetrics((await this.getClient().send(new EnableEnhancedMonitoringCommand({
 						StreamName: physicalId,
 						ShardLevelMetrics: toEnable
-					}));
+					})))?.CurrentShardLevelMetrics ?? []);
+					const before = new Set(Array.isArray(current) ? current : []);
+					const added = toEnable.filter((metric) => !before.has(metric));
+					if (added.length > 0) context?.markAttempted?.("DesiredShardLevelMetrics", added);
 					await this.waitForStreamActive(physicalId);
 				}
 			}
@@ -41201,6 +42011,13 @@ var KinesisStreamProvider = class {
 				StreamName: streamName,
 				Tags: tagsToAdd
 			}));
+			let recordedKeys;
+			try {
+				recordedKeys = /* @__PURE__ */ new Set([...planTagDiff(void 0, oldTagsRaw).set.keys()]);
+			} catch {
+				recordedKeys = void 0;
+			}
+			unsettled.afterAdded?.(Object.keys(tagsToAdd).filter((key) => recordedKeys !== void 0 && !recordedKeys.has(key)));
 			this.logger.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream ${streamName}`);
 		}
 	}
@@ -41217,7 +42034,7 @@ var KinesisStreamProvider = class {
 		const secretDerived = mask(physicalId) !== physicalId;
 		warn(`Kinesis stream ${physicalId} has shard-level metrics enabled that neither cdkd's record nor the template declares (${undeclared.join(", ")}), so cdkd left them enabled while converging the unsettled DesiredShardLevelMetrics (CloudFormation never disables a metric it did not record). Another tool may have enabled them, or an earlier failed cdkd update may have; cdkd cannot tell which. If they should be off, disable them ` + (secretDerived ? `with DisableEnhancedMonitoring for those metrics.` : `with: aws kinesis disable-enhanced-monitoring --stream-name ${physicalId} --shard-level-metrics ${undeclared.join(" ")} (in the stream's region)`));
 	}
-	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
 		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
 		if (typeof live !== "object" || live === null) return live;
 		const out = { ...live };
@@ -41226,6 +42043,7 @@ var KinesisStreamProvider = class {
 				const expanded = expandShardLevelMetrics(bag?.["DesiredShardLevelMetrics"]);
 				return isUsableMetricsList(expanded) ? expanded : [];
 			}));
+			for (const metric of attemptedItems?.get("DesiredShardLevelMetrics") ?? []) if (metric !== "ALL" && isUsableAttemptedName(metric)) named.add(metric);
 			const liveMetrics = expandShardLevelMetrics(out["DesiredShardLevelMetrics"]);
 			out["DesiredShardLevelMetrics"] = (Array.isArray(liveMetrics) ? liveMetrics : []).filter((metric) => typeof metric === "string" && named.has(metric));
 		}
@@ -41386,6 +42204,7 @@ var KinesisStreamConsumerProvider = class {
 			if (!consumer?.ConsumerARN || !consumer.ConsumerName) throw new ProvisioningError("RegisterStreamConsumer did not return ConsumerARN/ConsumerName", resourceType, logicalId);
 			const consumerArn = consumer.ConsumerARN;
 			createdArn = consumerArn;
+			reportCreatedResource(logicalId, resourceType, consumerArn);
 			await this.waitForConsumerActive(consumerArn);
 			this.logger.debug(`Successfully registered Kinesis stream consumer ${logicalId}`);
 			return {
@@ -42259,6 +43078,7 @@ var PipesPipeProvider = class {
 				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			createdIdentity = pipeIdentityToken(name, created?.Arn, created?.CreationTime);
+			reportCreatedResource(logicalId, resourceType, name, createdIdentity);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Pipe ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
@@ -42566,7 +43386,10 @@ var PipesPipeProvider = class {
 		try {
 			await this.getClient().send(new DeletePipeCommand({ Name: name }));
 		} catch (cleanupError) {
-			if (cleanupError instanceof NotFoundException$6) return original;
+			if (cleanupError instanceof NotFoundException$6) {
+				retractCreatedResource(logicalId, resourceType, name);
+				return original;
+			}
 			return orphaned(describeAwsFailure(cleanupError).summary);
 		}
 		let gone = false;
@@ -42592,10 +43415,12 @@ var PipesPipeProvider = class {
 			return orphaned("its delete did not complete (AWS reports a failed or rolled-back delete)");
 		}
 		if (gone) {
+			retractCreatedResource(logicalId, resourceType, name);
 			original.message += " (cdkd deleted the pipe it had created, so nothing is left behind)";
 			return original;
 		}
 		if (sawDeleting) {
+			retractCreatedResource(logicalId, resourceType, name);
 			original.message += " (cdkd started deleting the pipe it had created; a re-deploy may report the name in use until AWS finishes)";
 			return original;
 		}
@@ -42741,7 +43566,7 @@ var EFSProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		switch (resourceType) {
-			case "AWS::EFS::FileSystem": return this.updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::EFS::FileSystem": return this.updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.replayingState === true || context?.desiredFromAwsReadback === true);
 			case "AWS::EFS::MountTarget": return this.updateMountTarget(logicalId, physicalId, resourceType, properties, log);
 			case "AWS::EFS::AccessPoint": return this.updateAccessPoint(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
@@ -42789,7 +43614,7 @@ var EFSProvider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log, stateBorneDesired) {
 		for (const key of [
 			"Encrypted",
 			"KmsKeyId",
@@ -42804,8 +43629,13 @@ var EFSProvider = class {
 		const newProvisioned = properties["ProvisionedThroughputInMibps"];
 		const oldThroughputMode = previousProperties["ThroughputMode"];
 		const oldProvisioned = previousProperties["ProvisionedThroughputInMibps"];
+		const throughputValueMissing = newThroughputMode === "provisioned" && newProvisioned === void 0 && (oldProvisioned !== void 0 || oldThroughputMode !== "provisioned");
+		if (throughputValueMissing) {
+			if (!stateBorneDesired) throw new ProvisioningError(`Failed to update EFS FileSystem ${logicalId}: Throughput value must be specified for provisioned throughput mode. The template sets ThroughputMode: provisioned without ProvisionedThroughputInMibps, which CloudFormation rejects too. Set ProvisionedThroughputInMibps, or change ThroughputMode (e.g. to bursting or elastic).`, resourceType, logicalId, physicalId);
+			log.warn(`EFS FileSystem ${logicalId}: the desired properties (from cdkd state or an AWS readback, not the template) set ThroughputMode: provisioned without ProvisionedThroughputInMibps, which AWS rejects; leaving the file system's throughput as it is on AWS and applying the rest of the update. Its throughput may now differ from the record: run cdkd drift to see it.`);
+		}
 		const effectiveThroughputMode = newThroughputMode === void 0 && newProvisioned === void 0 && oldThroughputMode === "provisioned" ? "bursting" : newThroughputMode;
-		const throughputModeChanged = effectiveThroughputMode !== void 0 && effectiveThroughputMode !== oldThroughputMode;
+		const throughputModeChanged = !throughputValueMissing && effectiveThroughputMode !== void 0 && effectiveThroughputMode !== oldThroughputMode;
 		const provisionedChanged = newProvisioned !== void 0 && newProvisioned !== oldProvisioned;
 		const changed = (key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
 		const lifecycleChanged = changed("LifecyclePolicies");
@@ -42926,6 +43756,7 @@ var EFSProvider = class {
 				}))
 			});
 			fileSystemId = created.fileSystemId;
+			reportCreatedResource(logicalId, resourceType, fileSystemId);
 			const available = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, log);
 			const arn = created.arn ?? available.FileSystemArn;
 			await this.applyLifecyclePolicies(fileSystemId, properties["LifecyclePolicies"], log);
@@ -42947,6 +43778,7 @@ var EFSProvider = class {
 				try {
 					await this.getClient().send(new DeleteFileSystemCommand({ FileSystemId: fileSystemId }));
 					this.unconfirmedCreationTokens.delete(creationToken);
+					retractCreatedResource(logicalId, resourceType, fileSystemId);
 					log.debug(`Rolled back partially-created EFS FileSystem ${fileSystemId}`);
 				} catch (cleanupError) {
 					fileSystemLeftBehind = true;
@@ -43124,6 +43956,7 @@ var EFSProvider = class {
 			}));
 			const mountTargetId = response.MountTargetId;
 			createdMountTargetId = mountTargetId;
+			reportCreatedResource(logicalId, resourceType, mountTargetId);
 			log.debug(`Created EFS MountTarget ${logicalId}: ${mountTargetId}, waiting for available state`);
 			await this.waitForMountTargetAvailable(mountTargetId, logicalId, resourceType, log);
 			log.debug(`Successfully created EFS MountTarget ${logicalId}: ${mountTargetId}`);
@@ -43775,6 +44608,7 @@ var FSxFileSystemProvider = class {
 				throw markNonRetryable(new ProvisioningError(safeMsg`FSx answered the create of ${logicalId} with file system ${returnedId}, which ${createdAt === void 0 ? "carries no creation time" : "predates this create"}: the create token cdkd derives for this stack's file system is held by it, and it is NOT recorded in cdkd state. It is not one this deploy, or an interrupted earlier deploy of this stack, made: it was created under this token by an earlier cdkd version, or a completed deploy recorded it and cdkd later let go of it, and it may hold data, so cdkd neither records nor deletes it. Inspect it with: ${inspect} --file-system-ids ${returnedId} -- then import it into this stack, or delete it once you are sure its data is not needed, and deploy again.`, resourceType, logicalId));
 			}
 			fileSystemId = returnedId;
+			reportCreatedResource(logicalId, resourceType, returnedId);
 			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, context?.maskSecrets);
 			this.logger.debug(`Successfully created FSx FileSystem ${logicalId}: ${fileSystemId}`);
 			this.createTokenFirstSentAt.delete(clientRequestToken);
@@ -43786,6 +44620,7 @@ var FSxFileSystemProvider = class {
 			let survivorId;
 			if (fileSystemId !== void 0) try {
 				await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: fileSystemId }));
+				retractCreatedResource(logicalId, resourceType, fileSystemId);
 				this.createTokenFirstSentAt.delete(clientRequestToken);
 				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
@@ -44712,11 +45547,11 @@ var FSxFileSystemProvider = class {
 
 //#endregion
 //#region src/provisioning/emr-configuration.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toSdkConfiguration(raw) {
-	if (!isRecord(raw)) return raw;
+	if (!isRecord$1(raw)) return raw;
 	const { ConfigurationProperties, Configurations, ...rest } = raw;
 	return {
 		...rest,
@@ -44733,9 +45568,9 @@ function toSdkStepConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((step) => {
-		if (!isRecord(step)) return step;
+		if (!isRecord$1(step)) return step;
 		const hadoopJarStep = step["HadoopJarStep"];
-		if (!isRecord(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
+		if (!isRecord$1(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
 		const { StepProperties, ...restHadoopJarStep } = hadoopJarStep;
 		return {
 			...step,
@@ -44750,7 +45585,7 @@ function toSdkInstanceTypeConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((instanceTypeConfig) => {
-		if (!isRecord(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
+		if (!isRecord$1(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
 		return {
 			...instanceTypeConfig,
 			Configurations: toSdkConfigurations(instanceTypeConfig["Configurations"])
@@ -44897,6 +45732,7 @@ var EMRInstanceGroupConfigProvider = class {
 			const groupId = response.InstanceGroupIds?.[0];
 			if (groupId) groupsCreatedByThisProcess.add(groupId);
 			createdGroupId = groupId;
+			reportCreatedResource(logicalId, resourceType, groupId ?? "");
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0 && group.InstanceRole === "TASK") await reportOrphans(replayWindow);
 			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
@@ -44923,6 +45759,7 @@ var EMRInstanceGroupConfigProvider = class {
 						}]
 					}));
 					log.warn(safeMsg`Scaled partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0; EMR has no delete API, so the empty group stays on cluster ${log.value(jobFlowId)} until it terminates`);
+					retractCreatedResource(logicalId, resourceType, leftBehindGroupId);
 					leftBehindGroupId = void 0;
 				} catch (cleanupError) {
 					const cleanupHead = safeMsg`Failed to scale partially-created EMR TASK instance group ${logicalId} (${leftBehindGroupId}) to 0: `;
@@ -45272,6 +46109,7 @@ var EMRInstanceFleetConfigProvider = class {
 			const fleetId = response.InstanceFleetId;
 			if (fleetId) fleetsCreatedByThisProcess.add(fleetId);
 			createdFleetId = fleetId;
+			reportCreatedResource(logicalId, resourceType, fleetId ?? "");
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0 && fleet.InstanceFleetType === "TASK") await reportOrphans(replayWindow);
 			if (!fleetId) throw new ProvisioningError(`EMR AddInstanceFleet for ${logicalId} returned no instance fleet id`, resourceType, logicalId);
@@ -45763,6 +46601,7 @@ var EMRClusterProvider = class {
 			}
 			clusterId = response.JobFlowId;
 			if (clusterId) clustersCreatedByThisProcess.add(clusterId);
+			reportCreatedResource(logicalId, resourceType, clusterId ?? "");
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			if (!clusterId) throw new ProvisioningError(`EMR RunJobFlow for ${logicalId} returned no JobFlowId`, resourceType, logicalId);
@@ -45780,6 +46619,7 @@ var EMRClusterProvider = class {
 					TerminationProtected: false
 				}));
 				await this.getClient().send(new TerminateJobFlowsCommand({ JobFlowIds: [clusterId] }));
+				retractCreatedResource(logicalId, resourceType, clusterId);
 				this.logger.warn(`Rolled back partially-created EMR Cluster ${clusterId}`);
 			} catch (cleanupError) {
 				survivorId = clusterId;
@@ -46739,6 +47579,7 @@ var FirehoseProvider = class {
 			const response = await this.getCreateClient().send(new CreateDeliveryStreamCommand(input));
 			const physicalId = deliveryStreamName || input.DeliveryStreamName || response.DeliveryStreamARN?.split("/").pop() || "";
 			createdStreamName = physicalId;
+			reportCreatedResource(logicalId, resourceType, physicalId);
 			const arn = response.DeliveryStreamARN;
 			this.logger.debug(`Successfully created Firehose delivery stream ${logicalId}: ${physicalId}`);
 			await this.waitForActive(physicalId, logicalId, resourceType, maskerOrIdentity(context?.maskSecrets));
@@ -47634,7 +48475,7 @@ function readListBlock(raw, path) {
 		};
 	}
 }
-function listOf(read) {
+function listOf$1(read) {
 	return read.kind === "list" ? read.value : void 0;
 }
 function retainPreviousLists(desired, previous, keys, live) {
@@ -47805,6 +48646,7 @@ var CloudTrailProvider = class {
 			trailCreated = true;
 			const trailArn = result.TrailARN;
 			createdTrailArn = result.TrailARN;
+			if (createdTrailArn) reportCreatedResource(logicalId, resourceType, createdTrailArn);
 			const basicForCreate = eventSelectors && eventSelectors.length > 0 ? eventSelectors : void 0;
 			if (basicForCreate || advancedEventSelectors && advancedEventSelectors.length > 0) {
 				this.logger.debug(`Setting event selectors for CloudTrail Trail ${logicalId}`);
@@ -47882,14 +48724,14 @@ var CloudTrailProvider = class {
 			const advancedRead = readListBlock(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors");
 			for (const read of [basicRead, advancedRead]) if (read.kind === "unusable") this.logger.warn(safeMsg`${read.detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
 			const selectorsUnusable = basicRead.kind === "unusable" || advancedRead.kind === "unusable";
-			const newEventSelectors = listOf(basicRead);
-			const newAdvancedSelectors = listOf(advancedRead);
+			const newEventSelectors = listOf$1(basicRead);
+			const newAdvancedSelectors = listOf$1(advancedRead);
 			const oldEventSelectors = previousProperties["EventSelectors"];
 			const oldAdvancedSelectors = previousProperties["AdvancedEventSelectors"];
 			const hadAdvancedSelectors = Array.isArray(oldAdvancedSelectors) && oldAdvancedSelectors.length > 0;
 			const aggregationRead = readListBlock(properties["AggregationConfigurations"], "AWS::CloudTrail::Trail AggregationConfigurations");
 			if (aggregationRead.kind === "unusable") this.logger.warn(safeMsg`${aggregationRead.detail} The trail's existing aggregation configurations are left untouched for this update rather than cleared.`);
-			const newAggregation = listOf(aggregationRead);
+			const newAggregation = listOf$1(aggregationRead);
 			const aggregationChanged = aggregationRead.kind !== "unusable" && setKey(newAggregation) !== setKey(previousProperties["AggregationConfigurations"]);
 			const aggregationCleared = aggregationChanged && nonEmptyListOf(aggregationRead) === void 0;
 			const putAggregation = async () => {
@@ -48294,7 +49136,8 @@ var CodeBuildProvider = class {
 				batchReportMode: cfnBuildBatchConfig["BatchReportMode"],
 				restrictions: restrictions ? {
 					maximumBuildsAllowed: restrictions["MaximumBuildsAllowed"],
-					computeTypesAllowed: restrictions["ComputeTypesAllowed"]
+					computeTypesAllowed: restrictions["ComputeTypesAllowed"],
+					fleetsAllowed: restrictions["FleetsAllowed"]
 				} : void 0
 			};
 		}
@@ -48363,6 +49206,7 @@ var CodeBuildProvider = class {
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
 			createdName = projectName;
+			reportCreatedResource(logicalId, resourceType, createdName);
 			if (visibilityRead.kind === "usable" && (visibilityRead.visibility !== DEFAULT_PROJECT_VISIBILITY || visibilityRead.resourceAccessRole !== void 0)) await this.applyVisibility(projectArn, visibilityRead);
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
 			return {
@@ -48602,6 +49446,7 @@ var CodeBuildProvider = class {
 				const r = {};
 				if (project.buildBatchConfig.restrictions.maximumBuildsAllowed !== void 0) r["MaximumBuildsAllowed"] = project.buildBatchConfig.restrictions.maximumBuildsAllowed;
 				if (project.buildBatchConfig.restrictions.computeTypesAllowed !== void 0) r["ComputeTypesAllowed"] = project.buildBatchConfig.restrictions.computeTypesAllowed;
+				if (project.buildBatchConfig.restrictions.fleetsAllowed !== void 0) r["FleetsAllowed"] = project.buildBatchConfig.restrictions.fleetsAllowed;
 				bbc["Restrictions"] = r;
 			}
 			if (project.buildBatchConfig.timeoutInMins !== void 0) bbc["TimeoutInMins"] = project.buildBatchConfig.timeoutInMins;
@@ -48784,6 +49629,7 @@ var CodeCommitRepositoryProvider = class {
 			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
 			const createdName = metadata.repositoryName;
 			leftLiveName = createdName;
+			reportCreatedResource(logicalId, resourceType, createdName);
 			try {
 				const code = properties["Code"];
 				if (code) await this.seedInitialCommit(createdName, code);
@@ -48797,7 +49643,10 @@ var CodeCommitRepositoryProvider = class {
 				}
 			} catch (postCreateError) {
 				this.logger.warn(`Post-create step failed for CodeCommit Repository ${logicalId}; deleting the just-created repository ${createdName} to avoid an orphan`);
-				if (await this.bestEffortDelete(createdName, maskerOrIdentity(context?.maskSecrets))) leftLiveName = void 0;
+				if (await this.bestEffortDelete(createdName, maskerOrIdentity(context?.maskSecrets))) {
+					retractCreatedResource(logicalId, resourceType, leftLiveName);
+					leftLiveName = void 0;
+				}
 				throw markAuxiliaryFailure(postCreateError, logicalId);
 			}
 			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${createdName}`);
@@ -49166,6 +50015,28 @@ var CodeCommitRepositoryProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+const KEPT_ON_REMOVAL = [
+	"Description",
+	"ExecutionRoleArn",
+	"State",
+	"PolicyDetails",
+	"CreateInterval",
+	"RetainInterval",
+	"CopyTags",
+	"ExtendDeletion",
+	"CrossRegionCopyTargets",
+	"Exclusions"
+];
+function keptRemovedNames(properties, previousProperties, context) {
+	if (context?.desiredFromAwsReadback) return [];
+	const removed = context?.removedProperties;
+	return KEPT_ON_REMOVAL.filter((key) => previousProperties[key] != null && properties[key] == null && (removed === void 0 || removed.has(key) || properties[key] === null));
+}
+const keptOnRemovalWarning = (logicalId, names, caller) => {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::DLM::LifecyclePolicy): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateLifecyclePolicy keeps a field it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::DLM::LifecyclePolicy): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; UpdateLifecyclePolicy keeps a field it is not sent. Declare the intended value explicitly to change it.`;
+};
 const createLifecyclePolicyLatch = new AmbiguousCreateLatch("dlm:CreateLifecyclePolicy");
 const policiesCreatedByThisProcess = new RecentIdSet();
 var DLMLifecyclePolicyProvider = class {
@@ -49195,6 +50066,11 @@ var DLMLifecyclePolicyProvider = class {
 		"CrossRegionCopyTargets",
 		"Exclusions"
 	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
+		...KEPT_ON_REMOVAL,
+		"Tags",
+		"DefaultPolicy"
+	])]]);
 	getClient() {
 		if (!this.client) this.client = new DLMClient({
 			...ambientClientDefaults(),
@@ -49319,6 +50195,8 @@ var DLMLifecyclePolicyProvider = class {
 				...properties["CreateInterval"] != null && { CreateInterval: Number(properties["CreateInterval"]) },
 				...properties["RetainInterval"] != null && { RetainInterval: Number(properties["RetainInterval"]) }
 			}));
+			const keptNames = keptRemovedNames(properties, previousProperties, context);
+			if (keptNames.length > 0) this.logger.warn(keptOnRemovalWarning(logicalId, keptNames, context?.replayingState ? "rollback" : "deploy"));
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 			if (tagWarning !== void 0) this.logger.warn(tagWarning);
@@ -49657,6 +50535,370 @@ function notEmptyRefusalMessage(bucketName, maskSecrets) {
 	const remedy = command ? `Delete all objects first (e.g. ${command}) and destroy again.` : secretDerived ? "Delete all objects first, via the console, and destroy again: the bucket name is derived from a secret, so cdkd does not print it." : "Delete all objects first, via the console, and destroy again: the bucket name cdkd recorded cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.";
 	return mask(`bucket ${displayIdent(mask(bucketName))} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. ${remedy}`);
 }
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function itemId(item) {
+	if (!isRecord(item)) return void 0;
+	const id = item["Id"];
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
+function canonicalJson(value) {
+	const sorted = (v) => {
+		if (Array.isArray(v)) return v.map(sorted);
+		if (isRecord(v)) return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sorted(v[k])]));
+		return v;
+	};
+	return JSON.stringify(sorted(value)) ?? "undefined";
+}
+function sameJson(a, b) {
+	return canonicalJson(a) === canonicalJson(b);
+}
+function optionalString(value, path, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "string") refuse(path, "a string");
+	return value;
+}
+function optionalBoolean(value, path, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "boolean") return value;
+	if (value === "true") return true;
+	if (value === "false") return false;
+	return refuse(path, "a boolean");
+}
+function optionalInteger(value, path, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return value;
+	if (typeof value === "string" && /^[0-9]{1,15}$/.test(value)) return Number(value);
+	return refuse(path, "a non-negative integer");
+}
+function listOf(value, path, refuse) {
+	if (!Array.isArray(value)) refuse(path, "a list");
+	return value;
+}
+function encryptionToSdk(value, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (!isRecord(value)) refuse("BucketEncryption", "an object");
+	const rules = listOf(value["ServerSideEncryptionConfiguration"], "BucketEncryption.ServerSideEncryptionConfiguration", refuse);
+	if (rules.length === 0) return void 0;
+	return { Rules: rules.map((rule, i) => {
+		const path = `BucketEncryption.ServerSideEncryptionConfiguration[${i}]`;
+		if (!isRecord(rule)) refuse(path, "an object");
+		const out = {};
+		const byDefault = rule["ServerSideEncryptionByDefault"];
+		if (byDefault !== void 0 && byDefault !== null) {
+			if (!isRecord(byDefault)) refuse(`${path}.ServerSideEncryptionByDefault`, "an object");
+			const algorithm = optionalString(byDefault["SSEAlgorithm"], `${path}.ServerSideEncryptionByDefault.SSEAlgorithm`, refuse);
+			const keyId = optionalString(byDefault["KMSMasterKeyID"], `${path}.ServerSideEncryptionByDefault.KMSMasterKeyID`, refuse);
+			out.ApplyServerSideEncryptionByDefault = {
+				SSEAlgorithm: algorithm,
+				...keyId !== void 0 ? { KMSMasterKeyID: keyId } : {}
+			};
+		}
+		const bucketKey = optionalBoolean(rule["BucketKeyEnabled"], `${path}.BucketKeyEnabled`, refuse);
+		if (bucketKey !== void 0) out.BucketKeyEnabled = bucketKey;
+		return out;
+	}) };
+}
+function lifecycleFilterToSdk(rule, path, refuse) {
+	const prefix = optionalString(rule["Prefix"], `${path}.Prefix`, refuse);
+	const greater = optionalInteger(rule["ObjectSizeGreaterThan"], `${path}.ObjectSizeGreaterThan`, refuse);
+	const less = optionalInteger(rule["ObjectSizeLessThan"], `${path}.ObjectSizeLessThan`, refuse);
+	const members = {
+		...prefix !== void 0 ? { Prefix: prefix } : {},
+		...greater !== void 0 ? { ObjectSizeGreaterThan: greater } : {},
+		...less !== void 0 ? { ObjectSizeLessThan: less } : {}
+	};
+	const count = Object.keys(members).length;
+	if (count === 0) return { Prefix: "" };
+	if (count === 1) return members;
+	return { And: members };
+}
+function lifecycleToSdk(value, refuse) {
+	if (value === void 0 || value === null) return void 0;
+	if (!isRecord(value)) refuse("LifecycleConfiguration", "an object");
+	const rules = listOf(value["Rules"], "LifecycleConfiguration.Rules", refuse);
+	if (rules.length === 0) return void 0;
+	return { Rules: rules.map((rule, i) => {
+		const path = `LifecycleConfiguration.Rules[${i}]`;
+		if (!isRecord(rule)) refuse(path, "an object");
+		const id = optionalString(rule["Id"], `${path}.Id`, refuse);
+		const status = optionalString(rule["Status"], `${path}.Status`, refuse);
+		const days = optionalInteger(rule["ExpirationInDays"], `${path}.ExpirationInDays`, refuse);
+		const out = {
+			...id !== void 0 ? { ID: id } : {},
+			Status: status,
+			Filter: lifecycleFilterToSdk(rule, path, refuse)
+		};
+		if (days !== void 0) out.Expiration = { Days: days };
+		const abort = rule["AbortIncompleteMultipartUpload"];
+		if (abort !== void 0 && abort !== null) {
+			if (!isRecord(abort)) refuse(`${path}.AbortIncompleteMultipartUpload`, "an object");
+			const after = optionalInteger(abort["DaysAfterInitiation"], `${path}.AbortIncompleteMultipartUpload.DaysAfterInitiation`, refuse);
+			out.AbortIncompleteMultipartUpload = after !== void 0 ? { DaysAfterInitiation: after } : {};
+		}
+		return out;
+	}) };
+}
+function keyedItems(value, property, refuse) {
+	const out = /* @__PURE__ */ new Map();
+	if (value === void 0 || value === null) return out;
+	listOf(value, property, refuse).forEach((item, i) => {
+		if (!isRecord(item)) refuse(`${property}[${i}]`, "an object");
+		const id = itemId(item);
+		if (id === void 0) refuse(`${property}[${i}].Id`, "a non-empty string");
+		if (out.has(id)) refuse(`${property}[${i}].Id`, "an Id no other item of the list carries");
+		out.set(id, item);
+	});
+	return out;
+}
+function recordedItems(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const item of value) {
+		const id = itemId(item);
+		if (id !== void 0 && !out.has(id)) out.set(id, item);
+	}
+	return out;
+}
+function metricsItemToSdk(id, item, path, refuse) {
+	const prefix = optionalString(item["Prefix"], `${path}.Prefix`, refuse);
+	const accessPoint = optionalString(item["AccessPointArn"], `${path}.AccessPointArn`, refuse);
+	if (prefix !== void 0 && accessPoint !== void 0) return {
+		Id: id,
+		Filter: { And: {
+			Prefix: prefix,
+			AccessPointArn: accessPoint
+		} }
+	};
+	if (prefix !== void 0) return {
+		Id: id,
+		Filter: { Prefix: prefix }
+	};
+	if (accessPoint !== void 0) return {
+		Id: id,
+		Filter: { AccessPointArn: accessPoint }
+	};
+	return { Id: id };
+}
+function inventoryItemToSdk(id, item, path, refuse) {
+	const destination = item["Destination"];
+	if (!isRecord(destination)) refuse(`${path}.Destination`, "an object");
+	const bucketArn = optionalString(destination["BucketArn"], `${path}.Destination.BucketArn`, refuse);
+	const accountId = optionalString(destination["BucketAccountId"], `${path}.Destination.BucketAccountId`, refuse);
+	const format = optionalString(destination["Format"], `${path}.Destination.Format`, refuse);
+	const destPrefix = optionalString(destination["Prefix"], `${path}.Destination.Prefix`, refuse);
+	const enabled = optionalBoolean(item["Enabled"], `${path}.Enabled`, refuse);
+	const versions = optionalString(item["IncludedObjectVersions"], `${path}.IncludedObjectVersions`, refuse);
+	const prefix = optionalString(item["Prefix"], `${path}.Prefix`, refuse);
+	const frequency = optionalString(item["ScheduleFrequency"], `${path}.ScheduleFrequency`, refuse);
+	const fields = item["OptionalFields"];
+	let optionalFields;
+	if (fields !== void 0 && fields !== null) optionalFields = listOf(fields, `${path}.OptionalFields`, refuse).map((f, j) => {
+		if (typeof f !== "string") refuse(`${path}.OptionalFields[${j}]`, "a string");
+		return f;
+	});
+	return {
+		Id: id,
+		Destination: { S3BucketDestination: {
+			Bucket: bucketArn,
+			Format: format,
+			...accountId !== void 0 ? { AccountId: accountId } : {},
+			...destPrefix !== void 0 ? { Prefix: destPrefix } : {}
+		} },
+		IsEnabled: enabled,
+		IncludedObjectVersions: versions,
+		Schedule: { Frequency: frequency },
+		...prefix !== void 0 ? { Filter: { Prefix: prefix } } : {},
+		...optionalFields !== void 0 ? { OptionalFields: optionalFields } : {}
+	};
+}
+function desiredConfigurations(properties, refuse, onUnusable) {
+	const warnOut = (error, what) => onUnusable?.(`${error.message.replace(/ — the resource was not created$/, "")}; replaying a recorded state, so the bucket is created without ${what}`);
+	const build = (fallback, what, run) => {
+		if (!onUnusable) return run();
+		try {
+			return run();
+		} catch (error) {
+			if (!(error instanceof ProvisioningError)) throw error;
+			warnOut(error, what);
+			return fallback;
+		}
+	};
+	const buildList = (property, toSdk) => {
+		if (!onUnusable) {
+			const out = /* @__PURE__ */ new Map();
+			let i = 0;
+			for (const [id, item] of keyedItems(properties[property], property, refuse)) out.set(id, toSdk(id, item, `${property}[${i++}]`));
+			return out;
+		}
+		const out = /* @__PURE__ */ new Map();
+		const value = properties[property];
+		if (value === void 0 || value === null) return out;
+		build(void 0, `any ${property} item`, () => listOf(value, property, refuse))?.forEach((item, i) => {
+			const path = `${property}[${i}]`;
+			build(void 0, `${path}`, () => {
+				if (!isRecord(item)) refuse(path, "an object");
+				const id = itemId(item);
+				if (id === void 0) refuse(`${path}.Id`, "a non-empty string");
+				if (out.has(id)) refuse(`${path}.Id`, "an Id no other item of the list carries");
+				out.set(id, toSdk(id, item, path));
+			});
+		});
+		return out;
+	};
+	const metrics = buildList("MetricsConfigurations", (id, item, path) => metricsItemToSdk(id, item, path, refuse));
+	const inventory = buildList("InventoryConfigurations", (id, item, path) => inventoryItemToSdk(id, item, path, refuse));
+	return {
+		encryption: build(void 0, "its BucketEncryption", () => encryptionToSdk(properties["BucketEncryption"], refuse)),
+		lifecycle: build(void 0, "its LifecycleConfiguration", () => lifecycleToSdk(properties["LifecycleConfiguration"], refuse)),
+		metrics,
+		inventory
+	};
+}
+function configurationRefuser(resourceType, logicalId, physicalId) {
+	const updating = physicalId !== void 0;
+	return (path, expected) => {
+		throw markNonRetryable(new ProvisioningError(`${updating ? "desired " : ""}${path} of ${resourceType} ${logicalId} is not ${expected} — the resource was not ${updating ? "updated" : "created"}`, resourceType, logicalId, physicalId));
+	};
+}
+function encryptionFromSdk(rules) {
+	return { ServerSideEncryptionConfiguration: rules.map((rule) => {
+		const out = {};
+		const byDefault = rule.ApplyServerSideEncryptionByDefault;
+		if (byDefault) out["ServerSideEncryptionByDefault"] = {
+			...byDefault.SSEAlgorithm !== void 0 ? { SSEAlgorithm: byDefault.SSEAlgorithm } : {},
+			...byDefault.KMSMasterKeyID !== void 0 ? { KMSMasterKeyID: byDefault.KMSMasterKeyID } : {}
+		};
+		if (rule.BucketKeyEnabled !== void 0) out["BucketKeyEnabled"] = rule.BucketKeyEnabled;
+		return out;
+	}) };
+}
+function lifecycleFromSdk(rules) {
+	return { Rules: rules.map((rule) => {
+		const out = {};
+		if (rule.ID !== void 0) out["Id"] = rule.ID;
+		if (rule.Status !== void 0) out["Status"] = rule.Status;
+		const scope = {
+			...rule.Filter?.And ?? {},
+			...rule.Filter ?? {}
+		};
+		const prefix = scope["Prefix"] ?? rule.Prefix;
+		if (prefix !== void 0 && prefix !== "") out["Prefix"] = prefix;
+		if (typeof scope["ObjectSizeGreaterThan"] === "number") out["ObjectSizeGreaterThan"] = String(scope["ObjectSizeGreaterThan"]);
+		if (typeof scope["ObjectSizeLessThan"] === "number") out["ObjectSizeLessThan"] = String(scope["ObjectSizeLessThan"]);
+		if (rule.Expiration?.Days !== void 0) out["ExpirationInDays"] = rule.Expiration.Days;
+		if (rule.AbortIncompleteMultipartUpload) {
+			const after = rule.AbortIncompleteMultipartUpload.DaysAfterInitiation;
+			out["AbortIncompleteMultipartUpload"] = after !== void 0 ? { DaysAfterInitiation: after } : {};
+		}
+		return out;
+	}) };
+}
+function metricsFromSdk(item) {
+	const filter = item.Filter;
+	const scope = filter?.And ?? filter ?? {};
+	return {
+		Id: item.Id,
+		...scope.Prefix !== void 0 ? { Prefix: scope.Prefix } : {},
+		...scope.AccessPointArn !== void 0 ? { AccessPointArn: scope.AccessPointArn } : {}
+	};
+}
+function inventoryFromSdk(item) {
+	const dest = item.Destination?.S3BucketDestination;
+	return {
+		Id: item.Id,
+		Destination: {
+			...dest?.Bucket !== void 0 ? { BucketArn: dest.Bucket } : {},
+			...dest?.AccountId !== void 0 ? { BucketAccountId: dest.AccountId } : {},
+			...dest?.Format !== void 0 ? { Format: dest.Format } : {},
+			...dest?.Prefix !== void 0 ? { Prefix: dest.Prefix } : {}
+		},
+		...item.IsEnabled !== void 0 ? { Enabled: item.IsEnabled } : {},
+		...item.IncludedObjectVersions !== void 0 ? { IncludedObjectVersions: item.IncludedObjectVersions } : {},
+		...item.Filter?.Prefix !== void 0 ? { Prefix: item.Filter.Prefix } : {},
+		...item.Schedule?.Frequency !== void 0 ? { ScheduleFrequency: item.Schedule.Frequency } : {},
+		...item.OptionalFields !== void 0 && item.OptionalFields.length > 0 ? { OptionalFields: [...item.OptionalFields] } : {}
+	};
+}
+function impliedBucketKey(algorithm) {
+	if (algorithm === "AES256") return false;
+	if (algorithm === "aws:kms") return true;
+}
+function canonicalizeConfigurationsForDrift(properties) {
+	let out = properties;
+	const encryption = properties["BucketEncryption"];
+	if (isRecord(encryption) && Array.isArray(encryption["ServerSideEncryptionConfiguration"])) {
+		let changed = false;
+		const rules = encryption["ServerSideEncryptionConfiguration"].map((rule) => {
+			if (!isRecord(rule) || !("BucketKeyEnabled" in rule)) return rule;
+			const byDefault = rule["ServerSideEncryptionByDefault"];
+			const implied = impliedBucketKey(isRecord(byDefault) ? byDefault["SSEAlgorithm"] : void 0);
+			const declared = rule["BucketKeyEnabled"];
+			if (implied === void 0 || (declared === "true" ? true : declared === "false" ? false : declared) !== implied) return rule;
+			changed = true;
+			const { BucketKeyEnabled: _dropped, ...rest } = rule;
+			return rest;
+		});
+		if (changed) out = {
+			...out,
+			BucketEncryption: {
+				...encryption,
+				ServerSideEncryptionConfiguration: rules
+			}
+		};
+	}
+	const lifecycle = properties["LifecycleConfiguration"];
+	if (isRecord(lifecycle) && Array.isArray(lifecycle["Rules"])) {
+		let changed = false;
+		const rules = lifecycle["Rules"].map((rule) => {
+			if (!isRecord(rule) || rule["Prefix"] !== "") return rule;
+			changed = true;
+			const { Prefix: _dropped, ...rest } = rule;
+			return rest;
+		});
+		if (changed) out = {
+			...out,
+			LifecycleConfiguration: {
+				...lifecycle,
+				Rules: rules
+			}
+		};
+	}
+	return out;
+}
+function liveMatchesDesired(name, desired, live) {
+	const d = canonicalizeConfigurationsForDrift({ [name]: desired[name] })[name];
+	let l = canonicalizeConfigurationsForDrift({ [name]: live[name] })[name];
+	if (name === "LifecycleConfiguration" && isRecord(d) && isRecord(l)) {
+		const dRules = Array.isArray(d["Rules"]) ? d["Rules"] : [];
+		const lRules = Array.isArray(l["Rules"]) ? l["Rules"] : [];
+		l = {
+			...l,
+			Rules: lRules.map((rule, i) => {
+				const declared = dRules[i];
+				if (!isRecord(rule) || !isRecord(declared) || "Id" in declared) return rule;
+				const { Id: _assigned, ...rest } = rule;
+				return rest;
+			})
+		};
+	}
+	if (name === "MetricsConfigurations" || name === "InventoryConfigurations") {
+		const withSortedFields = (item) => isRecord(item) && Array.isArray(item["OptionalFields"]) ? {
+			...item,
+			OptionalFields: [...item["OptionalFields"]].map(String).sort()
+		} : item;
+		const asSet = (v) => Array.isArray(v) ? v.map((item) => canonicalJson(withSortedFields(item))).sort() : [canonicalJson(v)];
+		return sameJson(asSet(d), asSet(l));
+	}
+	return sameJson(d, l);
+}
+const CONFIGURATION_READ_ACTIONS = {
+	BucketEncryption: "s3express:GetEncryptionConfiguration",
+	LifecycleConfiguration: "s3express:GetLifecycleConfiguration",
+	MetricsConfigurations: "s3express:GetMetricsConfiguration",
+	InventoryConfigurations: "s3express:GetInventoryConfiguration"
+};
 var S3DirectoryBucketProvider = class {
 	s3Client;
 	createClient;
@@ -49674,8 +50916,44 @@ var S3DirectoryBucketProvider = class {
 		"DataRedundancy",
 		"LocationName",
 		"BucketName",
-		"Tags"
+		"Tags",
+		"BucketEncryption",
+		"LifecycleConfiguration",
+		"MetricsConfigurations",
+		"InventoryConfigurations"
 	])]]);
+	async readUnsettled(physicalId, _logicalId, _resourceType, names, recordedProperties, desiredProperties) {
+		const live = await this.readState(physicalId);
+		if (live === RESOURCE_NOT_FOUND) return live;
+		const desired = desiredProperties ?? recordedProperties ?? {};
+		const out = {};
+		for (const name of names) {
+			if (!Object.hasOwn(live, name)) continue;
+			if (desired[name] !== void 0 && liveMatchesDesired(name, desired, live)) {
+				out[name] = desired[name];
+				continue;
+			}
+			if (name === "MetricsConfigurations" || name === "InventoryConfigurations") {
+				const named = /* @__PURE__ */ new Set([...recordedItems(recordedProperties?.[name]).keys(), ...recordedItems(desiredProperties?.[name]).keys()]);
+				const items = live[name];
+				out[name] = Array.isArray(items) ? items.filter((item) => {
+					const id = itemId(item);
+					return id !== void 0 && named.has(id);
+				}) : items;
+				continue;
+			}
+			out[name] = live[name];
+		}
+		return out;
+	}
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::S3Express::DirectoryBucket") return [];
+		return ["MetricsConfigurations", "InventoryConfigurations"];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::S3Express::DirectoryBucket") return properties;
+		return canonicalizeConfigurationsForDrift(properties);
+	}
 	ec2Client;
 	s3ControlClient;
 	providerRegion = ambientRegion();
@@ -49739,6 +51017,7 @@ var S3DirectoryBucketProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 Express Directory Bucket ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const configs = desiredConfigurations(properties, configurationRefuser(resourceType, logicalId), replayWarn(this.logger, context).onUnusable);
 		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy", replayWarn(this.logger, context));
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
@@ -49746,6 +51025,7 @@ var S3DirectoryBucketProvider = class {
 		if (!bucketName) bucketName = generatedNameFor("AWS::S3Express::DirectoryBucket", logicalId, { zoneId: azId });
 		const tags = desiredTags;
 		const includeTags = tags.length > 0;
+		let bucketCreated = false;
 		try {
 			const attributes = await this.buildAttributes(bucketName);
 			await (await this.getCreateClient()).send(new CreateBucketCommand({
@@ -49762,19 +51042,112 @@ var S3DirectoryBucketProvider = class {
 					...includeTags ? { Tags: tags } : {}
 				}
 			}));
+			bucketCreated = true;
 			this.logger.debug(`Created S3 Express Directory Bucket: ${bucketName}`);
+			await this.applyConfigurations(bucketName, configs, properties, {}, true);
 			return {
 				physicalId: bucketName,
 				attributes
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${text}`, resourceType, logicalId, bucketName, cause));
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${text}`, resourceType, logicalId, bucketName, cause));
+			if (bucketCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, bucketName);
+			throw thrown;
+		}
+	}
+	async applyConfigurations(bucketName, desired, desiredRaw, previousRaw, creating, markUnsettled = () => {}) {
+		const changed = (desiredValue, previousValue) => creating || !sameJson(desiredValue, previousValue);
+		const holds = (value, toSdk) => {
+			try {
+				return toSdk(value, () => {
+					throw new Error("malformed");
+				}) !== void 0;
+			} catch {
+				return true;
+			}
+		};
+		if (changed(desiredRaw["BucketEncryption"], previousRaw["BucketEncryption"])) {
+			if (desired.encryption) {
+				markUnsettled("BucketEncryption");
+				await this.s3Client.send(new PutBucketEncryptionCommand({
+					Bucket: bucketName,
+					ServerSideEncryptionConfiguration: desired.encryption
+				}));
+			} else if (!creating && holds(previousRaw["BucketEncryption"], encryptionToSdk)) {
+				markUnsettled("BucketEncryption");
+				await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
+				this.logger.debug("Sent DeleteBucketEncryption: the default encryption is back to SSE-S3");
+			}
+		}
+		if (changed(desiredRaw["LifecycleConfiguration"], previousRaw["LifecycleConfiguration"])) {
+			if (desired.lifecycle) {
+				markUnsettled("LifecycleConfiguration");
+				await this.s3Client.send(new PutBucketLifecycleConfigurationCommand({
+					Bucket: bucketName,
+					LifecycleConfiguration: desired.lifecycle
+				}));
+			} else if (!creating && holds(previousRaw["LifecycleConfiguration"], lifecycleToSdk)) {
+				markUnsettled("LifecycleConfiguration");
+				await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
+				this.logger.debug("Sent DeleteBucketLifecycle: every lifecycle rule is removed");
+			}
+		}
+		const desiredMetrics = recordedItems(desiredRaw["MetricsConfigurations"]);
+		const previousMetrics = creating ? /* @__PURE__ */ new Map() : recordedItems(previousRaw["MetricsConfigurations"]);
+		for (const [id, config] of desired.metrics) {
+			if (previousMetrics.has(id) && sameJson(previousMetrics.get(id), desiredMetrics.get(id))) continue;
+			markUnsettled("MetricsConfigurations");
+			await this.s3Client.send(new PutBucketMetricsConfigurationCommand({
+				Bucket: bucketName,
+				Id: id,
+				MetricsConfiguration: config
+			}));
+		}
+		for (const id of previousMetrics.keys()) {
+			if (desired.metrics.has(id)) continue;
+			markUnsettled("MetricsConfigurations");
+			await this.deleteItemIdempotently(new DeleteBucketMetricsConfigurationCommand({
+				Bucket: bucketName,
+				Id: id
+			}));
+		}
+		const desiredInventory = recordedItems(desiredRaw["InventoryConfigurations"]);
+		const previousInventory = creating ? /* @__PURE__ */ new Map() : recordedItems(previousRaw["InventoryConfigurations"]);
+		for (const [id, config] of desired.inventory) {
+			if (previousInventory.has(id) && sameJson(previousInventory.get(id), desiredInventory.get(id))) continue;
+			markUnsettled("InventoryConfigurations");
+			await this.s3Client.send(new PutBucketInventoryConfigurationCommand({
+				Bucket: bucketName,
+				Id: id,
+				InventoryConfiguration: config
+			}));
+		}
+		for (const id of previousInventory.keys()) {
+			if (desired.inventory.has(id)) continue;
+			markUnsettled("InventoryConfigurations");
+			await this.deleteItemIdempotently(new DeleteBucketInventoryConfigurationCommand({
+				Bucket: bucketName,
+				Id: id
+			}));
+		}
+	}
+	async deleteItemIdempotently(command) {
+		try {
+			if (command instanceof DeleteBucketMetricsConfigurationCommand) await this.s3Client.send(command);
+			else await this.s3Client.send(command);
+		} catch (error) {
+			if (error instanceof Error && error.name === "NoSuchConfiguration") {
+				this.logger.debug("A configuration this update deletes is already gone");
+				return;
+			}
+			throw error;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		if (context?.expectedRegion) for (const clientRegion of [await this.s3Client.config.region(), await this.getS3ControlClient().config.region()]) assertRegionMatch(clientRegion, context.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const configs = desiredConfigurations(properties, configurationRefuser(resourceType, logicalId, physicalId));
 		try {
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
@@ -49787,18 +51160,25 @@ var S3DirectoryBucketProvider = class {
 			if (removedKeys.length > 0 || tagsToApply.length > 0) {
 				const accountId = await this.getAccountId();
 				const resourceArn = await this.buildBucketArn(physicalId, accountId);
-				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$29({
-					AccountId: accountId,
-					ResourceArn: resourceArn,
-					TagKeys: removedKeys
-				}));
-				if (tagsToApply.length > 0) await this.getS3ControlClient().send(new TagResourceCommand$28({
-					AccountId: accountId,
-					ResourceArn: resourceArn,
-					Tags: tagsToApply
-				}));
+				if (removedKeys.length > 0) {
+					context?.markUnsettled?.("Tags");
+					await this.getS3ControlClient().send(new UntagResourceCommand$29({
+						AccountId: accountId,
+						ResourceArn: resourceArn,
+						TagKeys: removedKeys
+					}));
+				}
+				if (tagsToApply.length > 0) {
+					context?.markUnsettled?.("Tags");
+					await this.getS3ControlClient().send(new TagResourceCommand$28({
+						AccountId: accountId,
+						ResourceArn: resourceArn,
+						Tags: tagsToApply
+					}));
+				}
 				this.logger.debug(`Updated tags for S3 Express Directory Bucket ${physicalId}`);
-			} else this.logger.debug(`Update for S3 Express Directory Bucket ${logicalId} is a no-op (no tag changes; other properties are immutable)`);
+			}
+			await this.applyConfigurations(physicalId, configs, properties, previousProperties, false, (key) => context?.markUnsettled?.(key));
 			return {
 				physicalId,
 				wasReplaced: false
@@ -49871,6 +51251,9 @@ var S3DirectoryBucketProvider = class {
 		} while (continuationToken);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		return this.readState(physicalId);
+	}
+	async readState(physicalId) {
 		let locationType;
 		try {
 			locationType = (await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId })))?.BucketLocationType;
@@ -49882,8 +51265,63 @@ var S3DirectoryBucketProvider = class {
 		const result = { BucketName: physicalId };
 		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = locationType === "LocalZone" ? "SingleLocalZone" : "SingleAvailabilityZone";
 		result["Tags"] = await this.readTags(physicalId);
+		const reads = [
+			["BucketEncryption", () => this.readEncryption(physicalId)],
+			["LifecycleConfiguration", () => this.readLifecycle(physicalId)],
+			["MetricsConfigurations", () => this.readMetrics(physicalId)],
+			["InventoryConfigurations", () => this.readInventory(physicalId)]
+		];
+		(await Promise.all(reads.map(([key, read]) => read().catch((error) => {
+			const name = error?.name;
+			if (name === "AccessDenied" || name === "AccessDeniedException") throw new Error(`Reading ${key} of an S3 Express directory bucket needs ${CONFIGURATION_READ_ACTIONS[key]}: grant it to read the bucket back`, { cause: error });
+			throw error;
+		})))).forEach((value, i) => {
+			result[reads[i][0]] = value;
+		});
 		return result;
 	}
+	async readEncryption(bucket) {
+		try {
+			return encryptionFromSdk((await this.s3Client.send(new GetBucketEncryptionCommand({ Bucket: bucket }))).ServerSideEncryptionConfiguration?.Rules ?? []);
+		} catch (err) {
+			if (err.name === "ServerSideEncryptionConfigurationNotFoundError") return { ServerSideEncryptionConfiguration: [] };
+			throw err;
+		}
+	}
+	async readLifecycle(bucket) {
+		try {
+			return lifecycleFromSdk((await this.s3Client.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules ?? []);
+		} catch (err) {
+			if (err.name === "NoSuchLifecycleConfiguration") return { Rules: [] };
+			throw err;
+		}
+	}
+	async readMetrics(bucket) {
+		const out = [];
+		let token;
+		do {
+			const resp = await this.s3Client.send(new ListBucketMetricsConfigurationsCommand({
+				Bucket: bucket,
+				ContinuationToken: token
+			}));
+			for (const item of resp.MetricsConfigurationList ?? []) out.push(metricsFromSdk(item));
+			token = resp.IsTruncated ? resp.NextContinuationToken : void 0;
+		} while (token);
+		return out;
+	}
+	async readInventory(bucket) {
+		const out = [];
+		let token;
+		do {
+			const resp = await this.s3Client.send(new ListBucketInventoryConfigurationsCommand({
+				Bucket: bucket,
+				ContinuationToken: token
+			}));
+			for (const item of resp.InventoryConfigurationList ?? []) out.push(inventoryFromSdk(item));
+			token = resp.IsTruncated ? resp.NextContinuationToken : void 0;
+		} while (token);
+		return out;
+	}
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
@@ -49962,6 +51400,173 @@ function tableIdentityFromGetTable(tableARN, namespace, name) {
 		name
 	};
 }
+function isCfnObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function desiredObject(properties, key, resourceType, logicalId, physicalId) {
+	const value = properties[key];
+	if (value === void 0) return void 0;
+	if (isCfnObject(value)) return value;
+	throw new ProvisioningError(`${key} for ${resourceType} ${logicalId} must be an object; refusing before any call`, resourceType, logicalId, physicalId);
+}
+function recordedObject(properties, key) {
+	const value = properties[key];
+	return isCfnObject(value) ? value : void 0;
+}
+var NotAnInteger = class extends Error {
+	member;
+	constructor(member) {
+		super(`${member} must be an integer`);
+		this.member = member;
+	}
+};
+function integer(value, member) {
+	if (value === void 0) return void 0;
+	const n = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	if (Number.isInteger(n)) return n;
+	throw new NotAnInteger(member);
+}
+function refuseNonIntegers(convert, key, resourceType, logicalId, physicalId) {
+	try {
+		return convert();
+	} catch (error) {
+		if (!(error instanceof NotAnInteger)) throw error;
+		throw new ProvisioningError(`${key}.${error.member} for ${resourceType} ${logicalId} must be an integer; refusing before any call`, resourceType, logicalId, physicalId, error);
+	}
+}
+function list(value) {
+	return Array.isArray(value) ? value : void 0;
+}
+function defined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function maintenanceStatus(value) {
+	return typeof value === "string" ? value.toLowerCase() : void 0;
+}
+function sdkEncryption(cfn) {
+	return defined({
+		sseAlgorithm: cfn["SSEAlgorithm"],
+		kmsKeyArn: cfn["KMSKeyArn"]
+	});
+}
+function sdkStorageClass(cfn) {
+	return defined({ storageClass: cfn["StorageClass"] });
+}
+function sdkReplication(cfn) {
+	return defined({
+		role: cfn["Role"],
+		rules: list(cfn["Rules"])?.map((rule) => defined({ destinations: list(isCfnObject(rule) ? rule["Destinations"] : void 0)?.map((destination) => defined({ destinationTableBucketARN: isCfnObject(destination) ? destination["DestinationTableBucketARN"] : void 0 })) }))
+	});
+}
+function sdkUnreferencedFileRemoval(cfn) {
+	const unreferencedDays = integer(cfn["UnreferencedDays"], "UnreferencedDays");
+	const nonCurrentDays = integer(cfn["NoncurrentDays"], "NoncurrentDays");
+	return defined({
+		status: maintenanceStatus(cfn["Status"]),
+		settings: unreferencedDays === void 0 && nonCurrentDays === void 0 ? void 0 : { icebergUnreferencedFileRemoval: defined({
+			unreferencedDays,
+			nonCurrentDays
+		}) }
+	});
+}
+function sdkCompaction(cfn) {
+	const targetFileSizeMB = integer(cfn["TargetFileSizeMB"], "TargetFileSizeMB");
+	return defined({
+		status: maintenanceStatus(cfn["Status"]),
+		settings: targetFileSizeMB === void 0 ? void 0 : { icebergCompaction: { targetFileSizeMB } }
+	});
+}
+function sdkSnapshotManagement(cfn) {
+	const minSnapshotsToKeep = integer(cfn["MinSnapshotsToKeep"], "MinSnapshotsToKeep");
+	const maxSnapshotAgeHours = integer(cfn["MaxSnapshotAgeHours"], "MaxSnapshotAgeHours");
+	return defined({
+		status: maintenanceStatus(cfn["Status"]),
+		settings: minSnapshotsToKeep === void 0 && maxSnapshotAgeHours === void 0 ? void 0 : { icebergSnapshotManagement: defined({
+			minSnapshotsToKeep,
+			maxSnapshotAgeHours
+		}) }
+	});
+}
+function mapObjects(value, map) {
+	return list(value)?.map((element) => map(isCfnObject(element) ? element : {}));
+}
+function sdkIcebergMetadata(cfn) {
+	const schema = isCfnObject(cfn["IcebergSchema"]) ? cfn["IcebergSchema"] : void 0;
+	const schemaV2 = isCfnObject(cfn["IcebergSchemaV2"]) ? cfn["IcebergSchemaV2"] : void 0;
+	const partitionSpec = isCfnObject(cfn["IcebergPartitionSpec"]) ? cfn["IcebergPartitionSpec"] : void 0;
+	const sortOrder = isCfnObject(cfn["IcebergSortOrder"]) ? cfn["IcebergSortOrder"] : void 0;
+	return defined({
+		schema: schema && defined({ fields: mapObjects(schema["SchemaFieldList"], (f) => defined({
+			id: integer(f["Id"], "IcebergSchema.SchemaFieldList.Id"),
+			name: f["Name"],
+			type: f["Type"],
+			required: f["Required"]
+		})) }),
+		schemaV2: schemaV2 && defined({
+			type: schemaV2["SchemaV2FieldType"],
+			fields: mapObjects(schemaV2["SchemaV2FieldList"], (f) => defined({
+				id: integer(f["Id"], "IcebergSchemaV2.SchemaV2FieldList.Id"),
+				name: f["Name"],
+				type: f["Type"],
+				required: f["Required"],
+				doc: f["Doc"]
+			})),
+			schemaId: integer(schemaV2["SchemaId"], "IcebergSchemaV2.SchemaId"),
+			identifierFieldIds: list(schemaV2["IdentifierFieldIds"])?.map((id) => integer(id, "IcebergSchemaV2.IdentifierFieldIds"))
+		}),
+		partitionSpec: partitionSpec && defined({
+			fields: mapObjects(partitionSpec["Fields"], (f) => defined({
+				sourceId: integer(f["SourceId"], "IcebergPartitionSpec.Fields.SourceId"),
+				transform: f["Transform"],
+				name: f["Name"],
+				fieldId: integer(f["FieldId"], "IcebergPartitionSpec.Fields.FieldId")
+			})),
+			specId: integer(partitionSpec["SpecId"], "IcebergPartitionSpec.SpecId")
+		}),
+		writeOrder: sortOrder && defined({
+			orderId: integer(sortOrder["OrderId"], "IcebergSortOrder.OrderId"),
+			fields: mapObjects(sortOrder["Fields"], (f) => defined({
+				sourceId: integer(f["SourceId"], "IcebergSortOrder.Fields.SourceId"),
+				transform: f["Transform"],
+				direction: f["Direction"],
+				nullOrder: f["NullOrder"]
+			}))
+		}),
+		properties: isCfnObject(cfn["TableProperties"]) ? cfn["TableProperties"] : void 0
+	});
+}
+const UPDATABLE_CONFIG_KEYS = {
+	"AWS::S3Tables::TableBucket": [
+		"EncryptionConfiguration",
+		"StorageClassConfiguration",
+		"MetricsConfiguration",
+		"UnreferencedFileRemoval",
+		"ReplicationConfiguration"
+	],
+	"AWS::S3Tables::Table": ["Compaction", "SnapshotManagement"]
+};
+function metricsEnabled(metrics, resourceType, logicalId, physicalId) {
+	const status = metrics?.["Status"];
+	if (status === void 0 || status === "Disabled") return false;
+	if (status === "Enabled") return true;
+	throw new ProvisioningError(safeMsg`MetricsConfiguration.Status for ${resourceType} ${logicalId} must be 'Enabled' or 'Disabled'; refusing before any call`, resourceType, logicalId, physicalId);
+}
+const TABLE_MAINTENANCE = [[
+	"Compaction",
+	"icebergCompaction",
+	sdkCompaction
+], [
+	"SnapshotManagement",
+	"icebergSnapshotManagement",
+	sdkSnapshotManagement
+]];
+const INTEGER_BEARING_CONFIGS = {
+	"AWS::S3Tables::TableBucket": [["UnreferencedFileRemoval", sdkUnreferencedFileRemoval]],
+	"AWS::S3Tables::Table": TABLE_MAINTENANCE.map(([key, , toSdk]) => [key, toSdk])
+};
+function cfnBucketStatus(status) {
+	return status === void 0 ? void 0 : `${status.charAt(0).toUpperCase()}${status.slice(1)}`;
+}
 function sentence(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -49978,7 +51583,15 @@ var S3TablesProvider = class {
 		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([
-		["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Set(["TableBucketName", "Tags"])],
+		["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Set([
+			"TableBucketName",
+			"Tags",
+			"EncryptionConfiguration",
+			"StorageClassConfiguration",
+			"MetricsConfiguration",
+			"UnreferencedFileRemoval",
+			"ReplicationConfiguration"
+		])],
 		["AWS::S3Tables::Namespace", /* @__PURE__ */ new Set(["TableBucketARN", "Namespace"])],
 		["AWS::S3Tables::Table", /* @__PURE__ */ new Set([
 			"TableBucketARN",
@@ -49987,9 +51600,24 @@ var S3TablesProvider = class {
 			"Name",
 			"OpenTableFormat",
 			"Format",
-			"Tags"
+			"Tags",
+			"IcebergMetadata",
+			"StorageClassConfiguration",
+			"Compaction",
+			"SnapshotManagement",
+			"WithoutMetadata"
 		])]
 	]);
+	getDriftUnknownPaths(resourceType) {
+		return resourceType === "AWS::S3Tables::Table" ? [
+			"IcebergMetadata",
+			"StorageClassConfiguration",
+			"WithoutMetadata"
+		] : [];
+	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		return resourceType === "AWS::S3Tables::TableBucket" && properties["ReplicationConfiguration"] === void 0 ? ["ReplicationConfiguration"] : [];
+	}
 	getClient() {
 		if (!this.client) {
 			this.client = new S3TablesClient({
@@ -50018,18 +51646,25 @@ var S3TablesProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		if (resourceType === "AWS::S3Tables::Table" || resourceType === "AWS::S3Tables::TableBucket") refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		for (const key of UPDATABLE_CONFIG_KEYS[resourceType] ?? []) desiredObject(properties, key, resourceType, logicalId, physicalId);
+		for (const [key, convert] of INTEGER_BEARING_CONFIGS[resourceType] ?? []) {
+			const value = desiredObject(properties, key, resourceType, logicalId, physicalId);
+			if (value !== void 0) refuseNonIntegers(() => convert(value), key, resourceType, logicalId, physicalId);
+		}
+		if (resourceType === "AWS::S3Tables::TableBucket") metricsEnabled(recordedObject(properties, "MetricsConfiguration"), resourceType, logicalId, physicalId);
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.recordedAttributes);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.recordedAttributes, (key) => context?.markUnsettled?.(key));
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask, recordedAttributes) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask, recordedAttributes, markUnsettled) {
 		if (resourceType === "AWS::S3Tables::Table") {
 			const rename = await this.planTableRename(logicalId, physicalId, resourceType, properties, mask);
 			await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+			await this.applyTableMaintenanceUpdate(logicalId, physicalId, resourceType, properties, previousProperties, markUnsettled);
 			if (rename === void 0) return {
 				physicalId,
 				wasReplaced: false
@@ -50044,8 +51679,10 @@ var S3TablesProvider = class {
 				physicalId: rename.physicalId,
 				wasReplaced: false
 			};
-		} else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
-		else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
+		} else if (resourceType === "AWS::S3Tables::TableBucket") {
+			await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+			await this.applyTableBucketConfigUpdate(logicalId, physicalId, resourceType, properties, previousProperties, markUnsettled);
+		} else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
 		return {
 			physicalId,
 			wasReplaced: false
@@ -50066,11 +51703,32 @@ var S3TablesProvider = class {
 		const tableBucketName = properties["TableBucketName"];
 		if (!tableBucketName) throw new ProvisioningError(`TableBucketName is required for S3 Table Bucket ${logicalId}`, resourceType, logicalId);
 		const tags = this.tagListToSdkMap(desiredTags);
+		const encryption = desiredObject(properties, "EncryptionConfiguration", resourceType, logicalId);
+		const storageClass = desiredObject(properties, "StorageClassConfiguration", resourceType, logicalId);
+		const metricsOn = metricsEnabled(desiredObject(properties, "MetricsConfiguration", resourceType, logicalId), resourceType, logicalId);
+		const unreferenced = desiredObject(properties, "UnreferencedFileRemoval", resourceType, logicalId);
+		const replication = desiredObject(properties, "ReplicationConfiguration", resourceType, logicalId);
+		const unreferencedValue = unreferenced && refuseNonIntegers(() => sdkUnreferencedFileRemoval(unreferenced), "UnreferencedFileRemoval", resourceType, logicalId);
+		let createdArn;
 		try {
 			const tableBucketARN = (await this.getCreateClient().send(new CreateTableBucketCommand({
 				name: tableBucketName,
+				...encryption !== void 0 && { encryptionConfiguration: sdkEncryption(encryption) },
+				...storageClass !== void 0 && { storageClassConfiguration: sdkStorageClass(storageClass) },
 				...tags !== void 0 && { tags }
 			}))).arn;
+			createdArn = tableBucketARN;
+			reportCreatedResource(logicalId, resourceType, tableBucketARN);
+			if (metricsOn) await this.getClient().send(new PutTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+			if (unreferencedValue !== void 0) await this.getClient().send(new PutTableBucketMaintenanceConfigurationCommand({
+				tableBucketARN,
+				type: "icebergUnreferencedFileRemoval",
+				value: unreferencedValue
+			}));
+			if (replication !== void 0) await this.getClient().send(new PutTableBucketReplicationCommand({
+				tableBucketARN,
+				configuration: sdkReplication(replication)
+			}));
 			this.logger.debug(`Successfully created S3 Table Bucket ${logicalId}: ${tableBucketARN}`);
 			return {
 				physicalId: tableBucketARN,
@@ -50078,7 +51736,104 @@ var S3TablesProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create S3 Table Bucket ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create S3 Table Bucket ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdArn !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	async applyTableBucketConfigUpdate(logicalId, tableBucketARN, resourceType, properties, previousProperties, markUnsettled) {
+		const changed = (key) => {
+			const next = desiredObject(properties, key, resourceType, logicalId, tableBucketARN);
+			return [next, !isDeepStrictEqual(next, recordedObject(previousProperties, key))];
+		};
+		const client = this.getClient();
+		const [encryption, encryptionChanged] = changed("EncryptionConfiguration");
+		if (encryptionChanged) {
+			if (encryption !== void 0) {
+				markUnsettled("EncryptionConfiguration");
+				await client.send(new PutTableBucketEncryptionCommand({
+					tableBucketARN,
+					encryptionConfiguration: sdkEncryption(encryption)
+				}));
+			} else this.warnRemovalKept(logicalId, "EncryptionConfiguration");
+		}
+		const [storageClass, storageClassChanged] = changed("StorageClassConfiguration");
+		if (storageClassChanged) {
+			if (storageClass !== void 0) {
+				markUnsettled("StorageClassConfiguration");
+				await client.send(new PutTableBucketStorageClassCommand({
+					tableBucketARN,
+					storageClassConfiguration: sdkStorageClass(storageClass)
+				}));
+			} else this.warnRemovalKept(logicalId, "StorageClassConfiguration");
+		}
+		const metricsOn = metricsEnabled(desiredObject(properties, "MetricsConfiguration", resourceType, logicalId, tableBucketARN), resourceType, logicalId);
+		const metricsWasOn = recordedObject(previousProperties, "MetricsConfiguration")?.["Status"] === "Enabled";
+		if (metricsOn && !metricsWasOn) {
+			markUnsettled("MetricsConfiguration");
+			await client.send(new PutTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+		} else if (!metricsOn && metricsWasOn) {
+			markUnsettled("MetricsConfiguration");
+			await this.deleteBucketConfig(tableBucketARN, new DeleteTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+		}
+		const [unreferenced, unreferencedChanged] = changed("UnreferencedFileRemoval");
+		if (unreferencedChanged) {
+			if (unreferenced !== void 0) {
+				markUnsettled("UnreferencedFileRemoval");
+				await client.send(new PutTableBucketMaintenanceConfigurationCommand({
+					tableBucketARN,
+					type: "icebergUnreferencedFileRemoval",
+					value: sdkUnreferencedFileRemoval(unreferenced)
+				}));
+			} else this.warnRemovalKept(logicalId, "UnreferencedFileRemoval");
+		}
+		const [replication, replicationChanged] = changed("ReplicationConfiguration");
+		if (replicationChanged) {
+			if (replication !== void 0) {
+				markUnsettled("ReplicationConfiguration");
+				await client.send(new PutTableBucketReplicationCommand({
+					tableBucketARN,
+					configuration: sdkReplication(replication)
+				}));
+			} else {
+				markUnsettled("ReplicationConfiguration");
+				await this.deleteBucketConfig(tableBucketARN, new DeleteTableBucketReplicationCommand({ tableBucketARN }));
+			}
+		}
+	}
+	async applyTableMaintenanceUpdate(logicalId, physicalId, resourceType, properties, previousProperties, markUnsettled) {
+		const writes = [];
+		for (const [key, type, toSdk] of TABLE_MAINTENANCE) {
+			const next = desiredObject(properties, key, resourceType, logicalId, physicalId);
+			if (isDeepStrictEqual(next, recordedObject(previousProperties, key))) continue;
+			if (next === void 0) this.warnRemovalKept(logicalId, key);
+			else writes.push({
+				key,
+				type,
+				value: toSdk(next)
+			});
+		}
+		if (writes.length === 0) return;
+		const table = await this.resolveTableParts(physicalId);
+		if (table === "not-found" || table === "unparseable") throw new ProvisioningError(table === "not-found" ? safeMsg`S3 Tables Table '${physicalId}' no longer exists (state is out of sync); ` + `refusing to record a maintenance configuration that was not applied` : compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+		for (const { key, type, value } of writes) {
+			markUnsettled(key);
+			await this.getClient().send(new PutTableMaintenanceConfigurationCommand({
+				...table,
+				type,
+				value
+			}));
+		}
+	}
+	warnRemovalKept(logicalId, key) {
+		this.logger.warn(safeMsg`${logicalId}: ${key} was removed from the template; cdkd leaves its current AWS value in ` + `place. Declare the value you want (e.g. its default) to change it.`);
+	}
+	async deleteBucketConfig(tableBucketARN, command) {
+		try {
+			await this.getClient().send(command);
+		} catch (error) {
+			if (!(error instanceof NotFoundException$7)) throw error;
+			await this.getClient().send(new GetTableBucketCommand({ tableBucketARN }));
 		}
 	}
 	async deleteTableBucket(logicalId, physicalId, resourceType, context) {
@@ -50213,6 +51968,17 @@ var S3TablesProvider = class {
 		const format = properties["OpenTableFormat"] ?? properties["Format"];
 		if (!format) throw new ProvisioningError(`OpenTableFormat is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
 		const tags = this.tagListToSdkMap(desiredTags);
+		const icebergCfn = desiredObject(properties, "IcebergMetadata", resourceType, logicalId);
+		const iceberg = icebergCfn && refuseNonIntegers(() => sdkIcebergMetadata(icebergCfn), "IcebergMetadata", resourceType, logicalId);
+		const storageClass = desiredObject(properties, "StorageClassConfiguration", resourceType, logicalId);
+		const maintenance = [];
+		for (const [key, type, toSdk] of TABLE_MAINTENANCE) {
+			const value = desiredObject(properties, key, resourceType, logicalId);
+			if (value !== void 0) maintenance.push({
+				type,
+				value: refuseNonIntegers(() => toSdk(value), key, resourceType, logicalId)
+			});
+		}
 		const physicalId = packCompositeId(resourceType, logicalId, [
 			{
 				name: "tableBucketARN",
@@ -50237,9 +52003,18 @@ var S3TablesProvider = class {
 				namespace,
 				name,
 				format,
+				...iceberg !== void 0 && { metadata: { iceberg } },
+				...storageClass !== void 0 && { storageClassConfiguration: sdkStorageClass(storageClass) },
 				...tags !== void 0 && { tags }
 			}));
 			tableCreated = true;
+			reportCreatedResource(logicalId, resourceType, physicalId);
+			for (const write of maintenance) await this.getClient().send(new PutTableMaintenanceConfigurationCommand({
+				tableBucketARN,
+				namespace,
+				name,
+				...write
+			}));
 			if (!response.tableARN) throw new ProvisioningError(`CreateTable did not return a tableARN for ${logicalId} (${physicalId}) — refusing to record an empty TableARN attribute`, resourceType, logicalId, physicalId);
 			const tableARN = response.tableARN;
 			this.logger.debug(`Successfully created S3 Tables Table ${logicalId}: ${physicalId}`);
@@ -50275,8 +52050,58 @@ var S3TablesProvider = class {
 		const result = {};
 		if (bucket.name !== void 0) result["TableBucketName"] = bucket.name;
 		result["Tags"] = await this.readTagsBestEffort(physicalId);
+		Object.assign(result, await this.readTableBucketConfigs(physicalId));
 		return result;
 	}
+	async readTableBucketConfigs(tableBucketARN, strict = false) {
+		const client = this.getClient();
+		const out = {};
+		await this.readConfig(out, "EncryptionConfiguration", async () => {
+			const e = (await client.send(new GetTableBucketEncryptionCommand({ tableBucketARN }))).encryptionConfiguration;
+			return defined({
+				SSEAlgorithm: e?.sseAlgorithm ?? "AES256",
+				KMSKeyArn: e?.kmsKeyArn
+			});
+		}, { SSEAlgorithm: "AES256" }, strict);
+		await this.readConfig(out, "StorageClassConfiguration", async () => {
+			return { StorageClass: (await client.send(new GetTableBucketStorageClassCommand({ tableBucketARN }))).storageClassConfiguration?.storageClass ?? "STANDARD" };
+		}, { StorageClass: "STANDARD" }, strict);
+		await this.readConfig(out, "MetricsConfiguration", async () => {
+			await client.send(new GetTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+			return { Status: "Enabled" };
+		}, { Status: "Disabled" }, strict);
+		await this.readConfig(out, "UnreferencedFileRemoval", async () => {
+			const value = (await client.send(new GetTableBucketMaintenanceConfigurationCommand({ tableBucketARN }))).configuration?.icebergUnreferencedFileRemoval;
+			const settings = value?.settings?.icebergUnreferencedFileRemoval;
+			return defined({
+				Status: cfnBucketStatus(value?.status) ?? "Enabled",
+				UnreferencedDays: settings?.unreferencedDays,
+				NoncurrentDays: settings?.nonCurrentDays
+			});
+		}, { Status: "Enabled" }, strict);
+		await this.readConfig(out, "ReplicationConfiguration", async () => {
+			const c = (await client.send(new GetTableBucketReplicationCommand({ tableBucketARN }))).configuration;
+			if (c === void 0) return void 0;
+			return defined({
+				Role: c.role,
+				Rules: (c.rules ?? []).map((rule) => ({ Destinations: (rule.destinations ?? []).map((d) => ({ DestinationTableBucketARN: d.destinationTableBucketARN })) }))
+			});
+		}, "absent", strict);
+		return out;
+	}
+	async readConfig(out, key, read, notFound, strict = false) {
+		try {
+			const value = await read();
+			if (value !== void 0) out[key] = value;
+		} catch (err) {
+			if (err instanceof NotFoundException$7) {
+				if (notFound !== "absent") out[key] = notFound;
+				return;
+			}
+			if (strict) throw err;
+			this.logger.debug(safeMsg`readCurrentState: reading ${key} failed: ${describeAwsFailure(err).detail} — leaving it out`);
+		}
+	}
 	async readNamespaceCurrentState(physicalId) {
 		const [tableBucketARN, namespaceName] = physicalId.split("|");
 		if (!tableBucketARN || !namespaceName) return void 0;
@@ -50350,8 +52175,62 @@ var S3TablesProvider = class {
 			result["Format"] = resp.format;
 		}
 		result["Tags"] = resp.tableARN ? await this.readTagsBestEffort(resp.tableARN) : [];
+		Object.assign(result, await this.readTableMaintenance(physicalId, {
+			tableBucketARN,
+			namespace,
+			name
+		}));
 		return result;
 	}
+	async readTableMaintenance(physicalId, table, strict = false) {
+		const result = {};
+		let maintenance;
+		let maintenanceRead = true;
+		try {
+			maintenance = (await this.getClient().send(new GetTableMaintenanceConfigurationCommand(table))).configuration;
+		} catch (err) {
+			maintenanceRead = err instanceof NotFoundException$7;
+			if (!maintenanceRead) {
+				if (strict) throw err;
+				this.logger.debug(safeMsg`readCurrentState: reading the maintenance configuration of ${physicalId} failed: ` + safeMsg`${describeAwsFailure(err).detail} — leaving Compaction / SnapshotManagement out`);
+			}
+		}
+		if (maintenanceRead) {
+			const compaction = maintenance?.icebergCompaction;
+			const compactionSettings = compaction?.settings && "icebergCompaction" in compaction.settings ? compaction.settings.icebergCompaction : void 0;
+			result["Compaction"] = defined({
+				Status: compaction?.status ?? "enabled",
+				TargetFileSizeMB: compactionSettings?.targetFileSizeMB
+			});
+			const snapshots = maintenance?.icebergSnapshotManagement;
+			const snapshotSettings = snapshots?.settings && "icebergSnapshotManagement" in snapshots.settings ? snapshots.settings.icebergSnapshotManagement : void 0;
+			result["SnapshotManagement"] = defined({
+				Status: snapshots?.status ?? "enabled",
+				MinSnapshotsToKeep: snapshotSettings?.minSnapshotsToKeep,
+				MaxSnapshotAgeHours: snapshotSettings?.maxSnapshotAgeHours
+			});
+		}
+		return result;
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names) {
+		let live;
+		if (resourceType === "AWS::S3Tables::TableBucket") {
+			try {
+				await this.getClient().send(new GetTableBucketCommand({ tableBucketARN: physicalId }));
+			} catch (err) {
+				if (err instanceof NotFoundException$7) return RESOURCE_NOT_FOUND;
+				throw err;
+			}
+			live = await this.readTableBucketConfigs(physicalId, true);
+		} else if (resourceType === "AWS::S3Tables::Table") {
+			const table = await this.resolveTableParts(physicalId);
+			if (table === "not-found") return RESOURCE_NOT_FOUND;
+			if (table === "unparseable") throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+			if (await this.lookupTableArn(table.tableBucketARN, table.namespace, table.name) === null) return RESOURCE_NOT_FOUND;
+			live = await this.readTableMaintenance(physicalId, table, true);
+		} else return;
+		return Object.fromEntries(Object.entries(live).filter(([key]) => names.has(key)));
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::S3Tables::TableBucket": return this.importTableBucket(input);
@@ -50767,6 +52646,7 @@ var ECRProvider = class {
 				...tags ? { tags } : {}
 			}));
 			repositoryCreated = true;
+			reportCreatedResource(logicalId, resourceType, repositoryName);
 			const repo = response.repository;
 			if (!repo?.repositoryName) throw new Error("CreateRepository did not return repository name");
 			const lifecyclePolicy = properties["LifecyclePolicy"];
@@ -51495,6 +53375,7 @@ var ACMCertificateProvider = class {
 			const certificateArn = (await this.acmClient.send(new RequestCertificateCommand(input))).CertificateArn;
 			if (!certificateArn) throw new ProvisioningError(`RequestCertificate succeeded but no CertificateArn returned for ${logicalId}`, resourceType, logicalId);
 			requestedArn = certificateArn;
+			reportCreatedResource(logicalId, resourceType, certificateArn);
 			this.logger.debug(`Requested ACM certificate: ${certificateArn}`);
 			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId, resourceType, dnsValidationZones(properties));
 			else this.logger.warn(`Skipping wait for ACM certificate ${logicalId} (CDKD_NO_WAIT=true). Downstream consumers (CloudFront / ALB) will fail until the cert reaches ISSUED.`);
@@ -51508,6 +53389,7 @@ var ACMCertificateProvider = class {
 			};
 		} catch (error) {
 			const survivorNote = requestedArn ? await this.cleanupRequestedCertificate(requestedArn, logicalId, idempotencyToken, context?.maskSecrets) : void 0;
+			if (requestedArn && survivorNote === void 0) retractCreatedResource(logicalId, resourceType, requestedArn);
 			if (error instanceof CdkdError) {
 				if (survivorNote === void 0) throw error;
 				const thrown = new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
@@ -51796,4 +53678,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-KsrvwO_r.js.map
+//# sourceMappingURL=provider-classes-Dz0pYmlJ.js.map