@go-to-k/cdkd 0.311.0 → 0.313.0

package/dist/{provider-classes-DktsDsTf.js → provider-classes-DefoNqY7.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as observeThenDisableProtection, A as RESOURCE_NOT_FOUND, An as ProvisioningError, Ar as wrapMaskedAwsError, At as isSecretDerivedValue, B as refusalTypeShown, Bt as isAuxiliaryFailure, C as ambiguousAttemptLead, Cr as isTransientServerError, Ct as logicalIdShown, D as replayedSendWindow, Dr as isThrottlingError, Dt as stateOrphanRecordRemedy, E as replayFollowedAmbiguousAttempt, Er as isMarkedNonRetryable, Et as segmentAfterAnchor, F as isPlainImportJson, H as resolveExplicitPhysicalId, Ht as markAuxiliaryFailure, I as isPlainImportValue, It as clearCreatedBeforeFailure, Jn as isInertUnquoted, K as deleteAfterProtectionFlipWithFinalSnapshot, Kn as commandHole, L as isQuotableImportValue, M as markNotGone, Mn as ResourceUpdateNotSupportedError, Mt as maskerOrIdentity, N as assertRegionMatch, Nt as withDerivedNameMasks, O as setBounded, Or as markNonRetryable, Ot as createMaskedLogSinks, P as VALUE_NOT_SHOWN, Q as logGroupProtectionSite, R as normalizeAwsTagsToCfn, S as RecentIdSet, Sr as isRetryableTransientError, St as compositeIdSkipResult, T as isInsideWindow, Tr as THROTTLING_ERROR_NAMES, Ut as markCreatedBeforeFailure, V as remedyLogicalId, W as ProtectionFlipRegistry, Wt as markSupersedesEarlierCreate, X as isTerminalDbWaitStatus, Yn as pasteableCommand, Z as isTerminalDeleteFailure, Zn as plainOrDescribed, _t as isInterruptedWaitError, a as retractCreatedResource, b as AMBIGUOUS_LATCH_TTL_MS, br as isExplicitDenyError, bt as compositeIdFormatMessage, c as SECRET_DERIVED_READ_LIVE, cn as withPasteableAwsProfile, ct as isAwsCliLiteral, d as readPrincipalLists, dn as clientDefaultsFor, dr as markReplayMayCollide, dt as renderDisableCommand, er as shellQuote, et as protectionFlipKey, fn as credentialFingerprint, fr as relayedNameCollision, ft as ElapsedBudgetRegistry, gr as explicitDenyPolicyKind, h as clearOnUpdateRemoval, hn as CdkdError, i as reportCreatedResource, in as injectiveKeyPrefix, it as userPoolProtectionSite, jt as maskDeep, k as withoutServerErrorRetries, kr as markRedactedCause, kt as createMaskedRetryLogger, l as holdsSecretDerivedEntry, ln as ambientClientDefaults, lt as pasteableAwsCommand, ot as UNNAMEABLE_ID_CLAUSE, p as recordedPrincipalsRepair, pn as AccountIdUnavailableError, q as deleteWithProtectionCompensation, qn as hasClauseBreak, rn as injectiveKey, st as WITHHELD_AWS_COMMAND, tr as withheldTargetClause, tt as rdsFamilyProtectionSite, u as onlySecretDerived, un as ambientCredentialConfig, ur as markNameCollision, ut as protectedReplacementAdvice, v as withRemovalDefaults, vt as startInterruptWatch, w as createAttemptKey, wt as packCompositeId, x as AmbiguousCreateLatch, xt as compositeIdSeparatorRefusal, yr as isAmbiguousOutcomeError, yt as canonicalizeRoute53QueryName, z as quotedRemedyLogicalId } from "./created-resource-sink-DlzoIY-1.js";
+import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-BT2Dfnpt.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $s as coerceCfnBoolean, $t as isAccessDeniedError, A as DYNAMODB_DELETE_POLL_COST_MS, B as relayedIndexBusyDelete, Bc as snapshotPassProvenance, Bi as tagPlanWarning, Bn as redactedDeleteAddressSkip, C as planContributorInsightsOp, Ca as isUsableAttemptedName, Cs as refuseMalformedResourcesForDestroy, D as reverseMapTableContributorInsights, Dd as renderAssemblyPathEscape, E as reverseMapIndexContributorInsights, Ed as displayAssemblyPath, Ei as reserveStackCreateToken, F as resolveDynamoDbDeleteBudgetMs, Fa as s3BucketRegionalDomainName, Fi as DBPROXY_TAG_OPTIONS, Fn as getCurrentProducerRegions, Fr as replacedDeleteFailureVerdict, Fs as withheldAccountClause, G as readTtlSpec, H as isTtlAlreadyDisabled, Hi as stringifyIfAssigned, Ht as withNestedStackContext, I as DELETE_INDEX_WAIT_PROCEED_NOTE, Ia as s3BucketWebsiteUrl, Ii as planTagDiff, J as S3_AUTO_DELETE_OBJECTS_TAG, Ji as waitForLambdaFunctionActive, Js as WARM_THROUGHPUT_MEMBERS, K as sendTtlWaitingOutRateLimit, L as INDEX_SETTLE_POLL_INTERVAL_MS, Lc as markSameGenerationBag, Li as readTagList, Ln as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ls as findSilentDropProperties, Lt as revertNestedChildFromJournal, M as compensateRemovedDeletionProtection, Ma as s3BucketArn, Mi as isRefusedByName, N as deleteBudgetKey, Na as s3BucketDomainName, Ni as markDeleteStarted, Nr as getStackRecords, O as stripIndexContributorInsights, Od as resolveAssemblyPath, Oi as acquireIdempotencyToken, Oo as accountArgs, P as resolveDynamoDbDeleteBudgetClock, Pa as s3BucketDualStackDomainName, Pi as DBPROXY_TAGS_WHAT, Pt as getNestedRevertRun, Q as markRefusedBeforeApplying, Qi as getCurrentResourceSecrets, Qs as toFiniteNumber, Qt as chunks, R as deleteTableWithIndexBusyRetry, Rc as redactForState, Ri as refuseMalformedDesiredTags, Rn as isRedactedRecordedValue, S as indexDeclaresContributorInsights, T as readContributorInsightsSpec, Td as describeFileReadFailure, U as isTtlRateLimited, Uc as hasMaskableValues, V as waitForIndexesSettled, Va as outputReferenceProvenanceOf, Vi as definedAttributes, Vt as getCurrentNestedStackContext, W as planTimeToLive, X as isTruthyCfnBoolean, Xs as isWarmThroughputDecrease, Y as hasCdkAutoDeleteTag, Ys as coerceWarmThroughput$1, Z as getPriorAttempts, Zs as toCfnInteger, _ as streamMemberRefusals, _a as isTerminationProtectionPropagationError, _c as canonicalLambdaFunctionName, _l as carriesSecretMask, _t as enclosingDeadlineRemainingMs, aa as onlySecretReferencesDiffer, ac as replayWarn, al as dynamicReferenceTokens, b as CONTRIBUTOR_INSIGHTS_KEY, ba as reEnableInstanceApiTermination, c as DynamoDBGlobalTableProvider, cc as requireConfigString, cd as decodeListingKey, ct as isAbsoluteAssetPath, d as declaredStreamPolicyMember, da as deleteSkipReason, dd as canonicalizeRegion, di as secretNamedAttributeNamesOf, ec as coerceCfnInteger, en as lookupEachName, f as declaredStreamTagsMember, fa as withIndeterminateGuard, fc as withRetry, fd as derivePartitionAndUrlSuffix, fl as recoverMaskedOutput, g as streamDeclaresTags, ga as ec2InstanceProtectionSite, gc as emrClusterInstancesReplaced, gt as enclosingDeadlineExpired, h as streamDeclaresPolicy, hc as ecsServiceLaunchTypeSetOrChanged, ia as slowCcOperationTimeoutMs, ic as readConfigString, iu as stringifyValue, j as beginDeleteWait, ja as isSettledInstanceState, jc as passedNoEchoParametersOf, jr as awaitInFlightSibling, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, l as STREAM_POLICY_KEY, lt as listNestedTemplateRows, lu as rewriteTemplateAssetReferences, m as reverseMapStreamPolicy, ma as markWaitAbandoned, ml as recordAttributeIdCopy, nc as configIntegerRefusal, oa as unchangedBehindSecretReference, oc as requireConfigArray, p as planStreamMemberOps, pa as isWaitAbandonedError, pc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, pl as physicalNameCopiesOf, q as ECR_AUTO_DELETE_IMAGES_TAG, rc as configStringRefusal, rl as withoutPhysicalNameCopies, rs as refuseMalformedNestedChildOutputs, sc as requireConfigObject, so as getAccountInfo, st as findNestedTemplateTreeDefect, t as DeployEngine, tc as configBooleanRefusal, tn as withApiLimit, tu as timePhase, u as STREAM_TAGS_KEY, ut as renderNestedTemplateTreeDefect, v as streamPolicyMatchesDeclared, va as observeThenDisableInstanceApiTermination, vc as lambdaFunctionNameForMask, vo as parseWebACLArn, w as planIndexContributorInsightsOps, wi as earliestDefined, x as contributorInsightsRefusals, xo as passedParameterClassesOf, y as streamTagsMatchDeclared, ya as reDisableInstanceApiTermination, yc as sameLambdaFunctionAddress, z as maskedLogger, zc as recordReferenceProvenanceEntry, zi as tagMapAsList, zn as redactedDeleteAddressFields, zs as withoutSilentDropProperties } from "./deploy-engine-BF5exXUb.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-qvhlVnrn.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DbnTHlwR.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-1y0kIPCO.js";
-import { RDSProvider } from "./rds-provider-0LUsn9Wl.js";
-import { NeptuneProvider } from "./neptune-provider-D9ac71Ca.js";
-import { ASGProvider } from "./asg-provider-CIg_guZ-.js";
+import { $ as getPriorAttempts, $s as isWarmThroughputDecrease, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ad as renderAssemblyPathEscape, Ai as acquireIdempotencyToken, Ao as accountArgs, B as deleteTableWithIndexBusyRetry, Bc as markSameGenerationBag, Bi as refuseMalformedDesiredTags, Bn as isRedactedRecordedValue, Bs as findSilentDropProperties, C as planContributorInsightsOp, Co as passedParameterClassesOf, D as reverseMapTableContributorInsights, E as reverseMapIndexContributorInsights, Ei as earliestDefined, F as resolveDynamoDbDeleteBudgetClock, Fa as s3BucketDomainName, Fi as markDeleteStarted, Fr as getStackRecords, G as isTtlRateLimited, H as relayedIndexBusyDelete, Hc as recordReferenceProvenanceEntry, Hi as tagPlanWarning, Hn as redactedDeleteAddressSkip, Hs as withoutSilentDropProperties, I as resolveDynamoDbDeleteBudgetMs, Ia as s3BucketDualStackDomainName, Ii as DBPROXY_TAGS_WHAT, It as getNestedRevertRun, J as sendTtlWaitingOutRateLimit, K as planTimeToLive, Kc as hasMaskableValues, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as s3BucketRegionalDomainName, Li as DBPROXY_TAG_OPTIONS, Ln as getCurrentProducerRegions, Lr as replacedDeleteFailureVerdict, Ls as withheldAccountClause, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Na as isSettledInstanceState, Nr as awaitInFlightSibling, O as stripIndexContributorInsights, Od as describeFileReadFailure, Oi as reserveStackCreateToken, P as deleteBudgetKey, Pa as s3BucketArn, Pc as passedNoEchoParametersOf, Pi as isRefusedByName, Q as isTruthyCfnBoolean, Qs as coerceWarmThroughput$1, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketWebsiteUrl, Ri as planTagDiff, S as indexDeclaresContributorInsights, Sa as reEnableInstanceApiTermination, Sc as sameLambdaFunctionAddress, T as readContributorInsightsSpec, Ta as isUsableAttemptedName, Ts as refuseMalformedResourcesForDestroy, U as waitForIndexesSettled, Ua as outputReferenceProvenanceOf, Uc as snapshotPassProvenance, Ui as definedAttributes, Ut as getCurrentNestedStackContext, V as maskedLogger, Vc as redactForState, Vi as tagMapAsList, Vn as redactedDeleteAddressFields, W as isTtlAlreadyDisabled, Wi as stringifyIfAssigned, Wt as withNestedStackContext, X as S3_AUTO_DELETE_OBJECTS_TAG, Xi as waitForLambdaFunctionActive, Y as ECR_AUTO_DELETE_IMAGES_TAG, Z as hasCdkAutoDeleteTag, Zs as WARM_THROUGHPUT_MEMBERS, _ as streamMemberRefusals, _l as recordAttributeIdCopy, ac as configIntegerRefusal, as as refuseMalformedNestedChildOutputs, b as CONTRIBUTOR_INSIGHTS_KEY, ba as observeThenDisableInstanceApiTermination, bc as canonicalLambdaFunctionName, bl as carriesSecretMask, bo as parseWebACLArn, c as DynamoDBGlobalTableProvider, ca as unchangedBehindSecretReference, cc as replayWarn, cl as dynamicReferenceTokens, d as declaredStreamPolicyMember, dc as requireConfigString, dd as decodeListingKey, dt as listNestedTemplateRows, ea as getCurrentResourceSecrets, ec as toCfnInteger, en as chunks, et as markRefusedBeforeApplying, f as declaredStreamTagsMember, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, g as streamDeclaresTags, ga as markWaitAbandoned, gc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, gl as physicalNameCopiesOf, h as streamDeclaresPolicy, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hl as recoverMaskedOutput, ic as configBooleanRefusal, iu as timePhase, j as DYNAMODB_DELETE_POLL_COST_MS, jd as resolveAssemblyPath, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, kd as displayAssemblyPath, l as STREAM_POLICY_KEY, lc as requireConfigArray, lo as getAccountInfo, lt as findNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as withIndeterminateGuard, md as canonicalizeRegion, nc as coerceCfnBoolean, nn as lookupEachName, oa as slowCcOperationTimeoutMs, oc as configStringRefusal, ol as withoutPhysicalNameCopies, p as planStreamMemberOps, pa as deleteSkipReason, pi as secretNamedAttributeNamesOf, q as readTtlSpec, rc as coerceCfnInteger, rn as withApiLimit, sa as onlySecretReferencesDiffer, sc as readConfigString, su as stringifyValue, t as DeployEngine, tc as toFiniteNumber, tn as isAccessDeniedError, u as STREAM_TAGS_KEY, uc as requireConfigObject, ut as isAbsoluteAssetPath, v as streamPolicyMatchesDeclared, va as ec2InstanceProtectionSite, vc as ecsServiceLaunchTypeSetOrChanged, vt as enclosingDeadlineExpired, w as planIndexContributorInsightsOps, x as contributorInsightsRefusals, xa as reDisableInstanceApiTermination, xc as lambdaFunctionNameForMask, y as streamTagsMatchDeclared, ya as isTerminationProtectionPropagationError, yc as emrClusterInstancesReplaced, yt as enclosingDeadlineRemainingMs, z as TABLE_INDEX_NOUN, zi as readTagList, zn as REDACTED_DELETE_ADDRESS_SKIP_REASON, zt as revertNestedChildFromJournal } from "./deploy-engine-CwpnkMCZ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ARR3C50J.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CMP_YVVn.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D7wXWxVo.js";
+import { RDSProvider } from "./rds-provider-Dn-7U1CR.js";
+import { NeptuneProvider } from "./neptune-provider-DfPOAG0q.js";
+import { ASGProvider } from "./asg-provider-CqPtIngx.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -63,7 +63,7 @@ import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as Creat
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableBucketMetricsConfigurationCommand, DeleteTableBucketReplicationCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableBucketEncryptionCommand, GetTableBucketMaintenanceConfigurationCommand, GetTableBucketMetricsConfigurationCommand, GetTableBucketReplicationCommand, GetTableBucketStorageClassCommand, GetTableCommand as GetTableCommand$1, GetTableMaintenanceConfigurationCommand, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, PutTableBucketEncryptionCommand, PutTableBucketMaintenanceConfigurationCommand, PutTableBucketMetricsConfigurationCommand, PutTableBucketReplicationCommand, PutTableBucketStorageClassCommand, PutTableMaintenanceConfigurationCommand, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -9379,13 +9379,17 @@ function toCfnSelfManagedEventSource(selfManagedEventSource) {
 	return renameEndpointsKey(selfManagedEventSource, SDK_KAFKA_ENDPOINTS_KEY, CFN_KAFKA_ENDPOINTS_KEY);
 }
 const KAFKA_CONSUMPTION_MODE_KEY = "ConsumptionMode";
-function declaredConsumptionMode(properties) {
+const KAFKA_DEFAULT_CONSUMPTION_MODE = "Stream";
+function consumptionModeOf(properties) {
 	const config = properties["SelfManagedKafkaEventSourceConfig"];
-	if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
-	return config[KAFKA_CONSUMPTION_MODE_KEY];
+	if (typeof config !== "object" || config === null || Array.isArray(config)) return KAFKA_DEFAULT_CONSUMPTION_MODE;
+	return config[KAFKA_CONSUMPTION_MODE_KEY] ?? KAFKA_DEFAULT_CONSUMPTION_MODE;
 }
-function consumptionModeRefusalMessage(logicalId, mode) {
-	return `AWS::Lambda::EventSourceMapping ${logicalId}: SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript does not model the member, so it would be dropped from the ${mode === "create" ? "CreateEventSourceMapping" : "UpdateEventSourceMapping"} request without an error. Remove ${KAFKA_CONSUMPTION_MODE_KEY} from SelfManagedKafkaEventSourceConfig to deploy the mapping without it.`;
+function replayableKafkaConfig(properties) {
+	if (consumptionModeOf(properties) !== "Queue") return void 0;
+	if (properties["StartingPosition"] === void 0 && properties["StartingPositionTimestamp"] === void 0 && properties["MaximumBatchingWindowInSeconds"] === void 0) return;
+	const { [KAFKA_CONSUMPTION_MODE_KEY]: _dropped, ...rest } = properties["SelfManagedKafkaEventSourceConfig"];
+	return rest;
 }
 function kafkaConfigForUpdate(desired, previous, options) {
 	const asObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
@@ -9573,11 +9577,6 @@ var LambdaEventSourceMappingProvider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const functionName = properties["FunctionName"];
 		if (!functionName) throw new ProvisioningError(`FunctionName is required for event source mapping ${logicalId}`, resourceType, logicalId);
-		if (declaredConsumptionMode(properties) !== void 0) {
-			const message = consumptionModeRefusalMessage(logicalId, "create");
-			if (context?.replayingState !== true) throw new ProvisioningError(message, resourceType, logicalId);
-			log.warn(safeMsg`${message} Proceeding without it: this create replays a cdkd state record.`);
-		}
 		try {
 			const params = { FunctionName: functionName };
 			if (properties["EventSourceArn"]) params.EventSourceArn = properties["EventSourceArn"];
@@ -9596,6 +9595,11 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["SourceAccessConfigurations"]) params.SourceAccessConfigurations = properties["SourceAccessConfigurations"];
 			if (properties["SelfManagedEventSource"]) params.SelfManagedEventSource = toSdkSelfManagedEventSource(properties["SelfManagedEventSource"]);
 			if (properties["SelfManagedKafkaEventSourceConfig"]) params.SelfManagedKafkaEventSourceConfig = properties["SelfManagedKafkaEventSourceConfig"];
+			const replayableKafka = context?.replayingState === true ? replayableKafkaConfig(properties) : void 0;
+			if (replayableKafka !== void 0) {
+				log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: the state record holds ConsumptionMode Queue beside a member Lambda refuses with it, so the mapping it records never ran in Queue mode. Proceeding without ConsumptionMode: this create replays a cdkd state record.`);
+				params.SelfManagedKafkaEventSourceConfig = replayableKafka;
+			}
 			if (properties["AmazonManagedKafkaEventSourceConfig"]) params.AmazonManagedKafkaEventSourceConfig = properties["AmazonManagedKafkaEventSourceConfig"];
 			if (properties["DocumentDBEventSourceConfig"]) params.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
 			if (properties["ScalingConfig"]) params.ScalingConfig = properties["ScalingConfig"];
@@ -9632,7 +9636,11 @@ var LambdaEventSourceMappingProvider = class {
 				attributes: {
 					Id: uuid,
 					EventSourceMappingArn: response.EventSourceMappingArn
-				}
+				},
+				...replayableKafka !== void 0 && { effectiveProperties: {
+					...properties,
+					SelfManagedKafkaEventSourceConfig: replayableKafka
+				} }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -9666,18 +9674,15 @@ var LambdaEventSourceMappingProvider = class {
 		const log = this.operationSinks(context?.maskSecrets, properties, previousProperties);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const restoring = context?.replayingState === true || context?.desiredFromAwsReadback === true;
-		for (const key of ["Queues", "Topics"]) {
-			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
-			const reason = `${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`;
+		const refuseChange = (reason) => {
 			if (!restoring) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${reason}; deploy with --replace to delete and recreate the mapping`);
 			log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: ${reason}. Proceeding without it: this update restores a recorded or read-back configuration.`);
+		};
+		for (const key of ["Queues", "Topics"]) {
+			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
+			refuseChange(`${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`);
 		}
-		const desiredMode = declaredConsumptionMode(properties);
-		if (desiredMode !== void 0 && JSON.stringify(desiredMode) !== JSON.stringify(declaredConsumptionMode(previousProperties))) {
-			const message = consumptionModeRefusalMessage(logicalId, "update");
-			if (!restoring) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
-			log.warn(safeMsg`${message} Proceeding without it: this update restores a recorded or read-back configuration.`);
-		}
+		if (JSON.stringify(consumptionModeOf(properties)) !== JSON.stringify(consumptionModeOf(previousProperties))) refuseChange(`SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be changed on an existing event source mapping (UpdateEventSourceMapping refuses it)`);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, restoring);
 		} catch (error) {
@@ -9905,6 +9910,24 @@ var LambdaEventSourceMappingProvider = class {
 		result["Tags"] = tags;
 		return result;
 	}
+	async canonicalizeDriftPair(_resourceType, baseline, aws, properties) {
+		const key = "SelfManagedKafkaEventSourceConfig";
+		const block = baseline[key];
+		if (typeof block !== "object" || block === null || Array.isArray(block) || KAFKA_CONSUMPTION_MODE_KEY in block || consumptionModeOf(aws) !== KAFKA_DEFAULT_CONSUMPTION_MODE || consumptionModeOf(properties ?? {}) !== KAFKA_DEFAULT_CONSUMPTION_MODE || aws[key]?.[KAFKA_CONSUMPTION_MODE_KEY] === void 0) return {
+			baseline,
+			aws
+		};
+		return {
+			baseline: {
+				...baseline,
+				[key]: {
+					...block,
+					[KAFKA_CONSUMPTION_MODE_KEY]: KAFKA_DEFAULT_CONSUMPTION_MODE
+				}
+			},
+			aws
+		};
+	}
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
 		let resp;
@@ -11517,6 +11540,11 @@ var LambdaNetworkConnectorProvider = class {
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generatedNameFor("AWS::Lambda::NetworkConnector", logicalId);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
+		if (declaredElasticIp(properties) !== void 0) {
+			const message = elasticIpRefusalMessage(logicalId, "create");
+			if (context?.replayingState !== true) throw new ProvisioningError(message, resourceType, logicalId);
+			this.logger.warn(safeMsg`${message} Proceeding without it: this create replays a cdkd state record.`);
+		}
 		const createToken = acquireIdempotencyToken({
 			scope: "CreateNetworkConnector",
 			logicalId
@@ -11556,6 +11584,12 @@ var LambdaNetworkConnectorProvider = class {
 		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, physicalId);
+		const desiredElasticIp = declaredElasticIp(properties);
+		if (desiredElasticIp !== void 0 && !isDeepStrictEqual(desiredElasticIp, declaredElasticIp(previousProperties))) {
+			const message = elasticIpRefusalMessage(logicalId, "update");
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
+			this.logger.warn(safeMsg`${message} Proceeding without it: this update restores a recorded or read-back configuration.`);
+		}
 		const updateRole = this.readOperatorRole(properties, logicalId, resourceType, physicalId, context);
 		if (typeof previousProperties["OperatorRole"] === "string" && properties["OperatorRole"] === void 0 && context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`OperatorRole cannot be removed in place for Lambda network connector ${logicalIdShown(logicalId)}: cdkd sends no role when the template declares none, so the current one would stay attached. Set it to another role, or replace the connector (change its Name).`, resourceType, logicalId, physicalId);
 		try {
@@ -11754,6 +11788,15 @@ var LambdaNetworkConnectorProvider = class {
 		return markRedactedCause(build(`${failure.summary}${relayedNameCollision(failure.detail)}`));
 	}
 };
+const ELASTIC_IP_KEY = "ElasticIpConfiguration";
+function declaredElasticIp(properties) {
+	const config = properties["Configuration"];
+	const vpc = isPlainRecord$3(config) ? config["VpcEgressConfiguration"] : void 0;
+	return isPlainRecord$3(vpc) ? vpc[ELASTIC_IP_KEY] : void 0;
+}
+function elasticIpRefusalMessage(logicalId, mode) {
+	return `AWS::Lambda::NetworkConnector ${logicalIdShown(logicalId)}: Configuration.VpcEgressConfiguration.${ELASTIC_IP_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript (@aws-sdk/client-lambda-core) does not model the member, so it would be dropped from the ${mode === "create" ? "CreateNetworkConnector" : "UpdateNetworkConnector"} request without an error. Remove ${ELASTIC_IP_KEY} from Configuration.VpcEgressConfiguration to deploy the connector without it.`;
+}
 var TerminalConnectorStateError = class extends Error {};
 function buildAttributes(resp) {
 	return definedAttributes({
@@ -11820,6 +11863,120 @@ async function waitForGoneAfterDelete(opts) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-vector-indexes.ts
+function vectorIndexesByName(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") out.set(name, entry);
+	}
+	return out;
+}
+function vectorIndexForSend(entry) {
+	const out = {};
+	for (const key of [
+		"IndexName",
+		"VectorAttribute",
+		"Projection",
+		"DistanceFunction"
+	]) if (entry[key] !== void 0) out[key] = entry[key];
+	if (entry["Dimensions"] !== void 0) out["Dimensions"] = coerceCfnInteger(entry["Dimensions"]) ?? entry["Dimensions"];
+	if (entry["SearchSchema"] !== void 0) out["SearchSchema"] = entry["SearchSchema"];
+	return out;
+}
+function vectorIndexesForCreate(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Array.isArray(value)) return value;
+	return value.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? vectorIndexForSend(entry) : entry);
+}
+function sortedByJson(list) {
+	if (!Array.isArray(list)) return list;
+	return [...list].sort((a, b) => {
+		const x = JSON.stringify(a) ?? "";
+		const y = JSON.stringify(b) ?? "";
+		return x < y ? -1 : x > y ? 1 : 0;
+	});
+}
+function vectorIndexKey(entry) {
+	const e = entry;
+	const projection = e["Projection"];
+	const normalizedProjection = typeof projection === "object" && projection !== null && !Array.isArray(projection) ? {
+		ProjectionType: projection["ProjectionType"],
+		NonKeyAttributes: sortedByJson(nonEmpty(projection["NonKeyAttributes"]))
+	} : projection;
+	const attribute = e["VectorAttribute"];
+	return JSON.stringify([
+		e["IndexName"],
+		typeof attribute === "object" && attribute !== null ? attribute["AttributeName"] : attribute,
+		coerceCfnInteger(e["Dimensions"]) ?? e["Dimensions"],
+		e["DistanceFunction"],
+		normalizedProjection,
+		sortedByJson(Array.isArray(e["SearchSchema"]) && e["SearchSchema"].length > 0 ? e["SearchSchema"].map((s) => typeof s === "object" && s !== null ? {
+			AttributeName: s["AttributeName"],
+			SearchSchemaElementType: s["SearchSchemaElementType"]
+		} : s) : nonEmpty(e["SearchSchema"]))
+	]);
+}
+function nonEmpty(value) {
+	return Array.isArray(value) && value.length === 0 ? void 0 : value;
+}
+function planVectorIndexUpdates(previous, desired, live) {
+	const prevByName = vectorIndexesByName(previous);
+	const desiredByName = vectorIndexesByName(desired);
+	const liveByName = live === void 0 ? void 0 : new Map(live.filter((d) => typeof d.IndexName === "string").map((d) => [d.IndexName, d]));
+	const plan = {
+		ops: [],
+		changed: [],
+		adopted: [],
+		alreadyGone: []
+	};
+	const liveHolds = (name, entry) => {
+		const l = liveByName?.get(name);
+		return l !== void 0 && l.IndexStatus !== "DELETING" && vectorIndexKey(l) === vectorIndexKey(entry);
+	};
+	for (const name of prevByName.keys()) {
+		if (desiredByName.has(name)) continue;
+		const l = liveByName?.get(name);
+		if (liveByName !== void 0 && (l === void 0 || l.IndexStatus === "DELETING")) {
+			plan.alreadyGone.push(name);
+			continue;
+		}
+		plan.ops.push({ Delete: { IndexName: name } });
+	}
+	for (const [name, entry] of desiredByName) {
+		const before = prevByName.get(name);
+		if (before === void 0) {
+			const l = liveByName?.get(name);
+			if (l === void 0 || l.IndexStatus === "DELETING") plan.ops.push({ Create: vectorIndexForSend(entry) });
+			else if (liveHolds(name, entry)) plan.adopted.push(name);
+			else plan.changed.push(name);
+			continue;
+		}
+		if (vectorIndexKey(before) === vectorIndexKey(entry)) continue;
+		if (!liveHolds(name, entry)) plan.changed.push(name);
+	}
+	return plan;
+}
+function readbackVectorIndexes(live) {
+	if (live === void 0 || live.length === 0) return void 0;
+	return live.map((d) => {
+		const out = {};
+		if (d.IndexName !== void 0) out["IndexName"] = d.IndexName;
+		if (d.VectorAttribute !== void 0) out["VectorAttribute"] = d.VectorAttribute;
+		if (d.Dimensions !== void 0) out["Dimensions"] = d.Dimensions;
+		if (d.DistanceFunction !== void 0) out["DistanceFunction"] = d.DistanceFunction;
+		if (d.Projection !== void 0) out["Projection"] = d.Projection;
+		if (d.SearchSchema !== void 0 && d.SearchSchema.length > 0) out["SearchSchema"] = d.SearchSchema;
+		return out;
+	});
+}
+function vectorIndexesSettled(live) {
+	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
@@ -12246,7 +12403,7 @@ var DynamoDBTableProvider = class {
 		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
 		this.logger.debug(m(build(m(failure.detail)).message));
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${m(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}`);
+		const wrapped = build(`${m(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail, TABLE_INDEX_NOUN)}`);
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Set([
@@ -12268,7 +12425,8 @@ var DynamoDBTableProvider = class {
 		"TimeToLiveSpecification",
 		"ResourcePolicy",
 		"KinesisStreamSpecification",
-		"ContributorInsightsSpecification"
+		"ContributorInsightsSpecification",
+		"VectorIndexes"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])]]);
 	deleteBudgets = new ElapsedBudgetRegistry();
@@ -12342,6 +12500,8 @@ var DynamoDBTableProvider = class {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
 				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, stripIndexContributorInsights(entry), maskSecrets)) : declaredGsis;
 			}
+			const createVectorIndexes = vectorIndexesForCreate(properties["VectorIndexes"]);
+			if (createVectorIndexes !== void 0) createParams.VectorIndexes = createVectorIndexes;
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sseCreateRefusal = sseSpecificationRefusal(properties["SSESpecification"], logicalId);
 			if (sseCreateRefusal !== void 0 && context?.replayingState !== true) throw new ProvisioningError(`${maskSecrets(sseCreateRefusal)}. Nothing was created; fix the template value`, resourceType, logicalId);
@@ -12366,8 +12526,12 @@ var DynamoDBTableProvider = class {
 			tableCreated = true;
 			createdTableId = createOut?.TableDescription?.TableId;
 			reportCreatedResource(logicalId, resourceType, tableName, createdTableId);
-			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
-			const tableInfo = await timePhase("provider waits", "DynamoDB table: wait for ACTIVE", () => this.waitForTableActive(tableName), logicalId);
+			debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
+			const tableInfo = await timePhase("provider waits", "DynamoDB table: wait for ACTIVE", () => this.waitForTableActive(tableName, maskSecrets), logicalId);
+			if (createVectorIndexes !== void 0) await timePhase("provider waits", "DynamoDB table: wait for vector indexes", () => this.waitForTableAndIndexesActive(tableName, void 0, {
+				after: "CreateTable",
+				maskSecrets
+			}), logicalId);
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"], void 0, "create", {
 				logicalId,
@@ -12378,7 +12542,7 @@ var DynamoDBTableProvider = class {
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
 			await this.applyIndexContributorInsights(tableName, properties["GlobalSecondaryIndexes"], void 0, maskSecrets);
 			await this.applyStreamMembers(logicalId, resourceType, tableName, tableInfo.streamArn, properties["StreamSpecification"], void 0, true, maskSecrets);
-			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
+			debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
 				attributes: {
@@ -12392,7 +12556,7 @@ var DynamoDBTableProvider = class {
 			let tableLeftBehind = false;
 			if (tableCreated) {
 				try {
-					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+					await this.rollBackCreatedTable(logicalId, tableName, maskSecrets);
 					retractCreatedResource(logicalId, resourceType, tableName);
 					debug(`Rolled back partially-created DynamoDB table ${tableName}`);
 				} catch (cleanupError) {
@@ -12410,6 +12574,38 @@ var DynamoDBTableProvider = class {
 			throw thrown;
 		}
 	}
+	async rollBackCreatedTable(logicalId, tableName, maskSecrets) {
+		const logger = maskedLogger(this.logger, maskSecrets, tableName);
+		const allowanceMs = Math.min(resolveDynamoDbDeleteBudgetMs(), enclosingDeadlineRemainingMs() - DYNAMODB_DELETE_DEADLINE_MARGIN_MS);
+		const budget = allowanceMs > 0 ? new ElapsedBudget(allowanceMs, resolveDynamoDbDeleteBudgetClock()) : void 0;
+		await deleteTableWithIndexBusyRetry({
+			logicalId,
+			physicalId: tableName,
+			typeLabel: "table",
+			indexNoun: TABLE_INDEX_NOUN,
+			maxRetries: 14,
+			logger,
+			deleteTable: async () => {
+				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+			},
+			reArm: () => {
+				const wait = beginDeleteWait(900, budget);
+				return waitForIndexesSettled({
+					tableName,
+					logicalId,
+					logger,
+					describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName })),
+					maxAttempts: wait.grantedPolls,
+					budgetWait: wait,
+					shortCapUnlessVectorBusy: 60,
+					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+				});
+			},
+			shouldKeepRetrying: () => budget !== void 0 && !budget.isExhausted(),
+			retryWarning: () => `DynamoDB table ${logicalId}: AWS refused the DeleteTable rolling back the partially-created table ${tableName} because ${TABLE_INDEX_NOUN} is still being created, updated or deleted. Waiting for the indexes to settle and retrying (up to ${14} retries in all, within ~${Math.max(1, Math.round((budget?.totalMs ?? 0) / 6e4))} minutes).`,
+			sleepSeam: deleteTableRetryDelays
+		});
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		const maskSecrets = context?.maskSecrets ?? ((text) => text);
@@ -12454,6 +12650,12 @@ var DynamoDBTableProvider = class {
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${lsiMessage}. Nothing was applied to the table; revert the LocalSecondaryIndexes change, or create a new table under a new logical ID (a new table starts empty)`, resourceType, logicalId, physicalId);
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
+			const vectorIndexPlan = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]) ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
+			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
+				const vectorMessage = `AWS::DynamoDB::Table ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((n) => maskSecrets(n)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
+				warn(`${vectorMessage}; that change was not applied`);
+			}
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
 				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
@@ -12572,7 +12774,7 @@ var DynamoDBTableProvider = class {
 				if (tableClassChanged) markUnsettled("TableClass");
 				if (updateInput.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
-				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
+				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS, { maskSecrets });
 				else await this.waitForTableActiveAfterUpdate(physicalId, 60);
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
@@ -12687,6 +12889,7 @@ var DynamoDBTableProvider = class {
 				markUnsettled("GlobalSecondaryIndexes");
 				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets, (indexName) => context?.markAttempted?.("GlobalSecondaryIndexes", [indexName]));
 			}
+			if (vectorIndexPlan !== void 0) await this.applyVectorIndexUpdates(physicalId, vectorIndexPlan, properties["AttributeDefinitions"], maskSecrets, () => markUnsettled("VectorIndexes"), (indexName) => context?.markAttempted?.("VectorIndexes", [indexName]));
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) {
 				markUnsettled("PointInTimeRecoverySpecification");
 				await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
@@ -12802,16 +13005,18 @@ var DynamoDBTableProvider = class {
 		}
 		try {
 			const reArmPolls = () => {
-				const wait = beginDeleteWait(60, budget);
+				const wait = beginDeleteWait(900, budget);
 				return {
 					maxAttempts: wait.grantedPolls,
-					budgetWait: wait
+					budgetWait: wait,
+					shortCapUnlessVectorBusy: 60
 				};
 			};
 			await deleteTableWithIndexBusyRetry({
 				logicalId,
 				physicalId,
 				typeLabel: "table",
+				indexNoun: TABLE_INDEX_NOUN,
 				maxRetries: 14,
 				logger: loopLogger,
 				deleteTable: async () => {
@@ -13203,7 +13408,7 @@ var DynamoDBTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
 		if (ops.length === 0) return;
-		await this.waitForTableAndIndexesActive(tableName);
+		await this.waitForTableAndIndexesActive(tableName, void 0, { maskSecrets });
 		for (const op of ops) {
 			beforeSend();
 			await this.sendContributorInsightsOp(tableName, op, maskSecrets);
@@ -13220,11 +13425,11 @@ var DynamoDBTableProvider = class {
 		})), `set ContributorInsights on ${target}`);
 		debug(`Set ContributorInsightsAction=${op.action}${op.mode !== void 0 ? ` Mode=${op.mode}` : ""} on ${target}`);
 	}
-	async waitForTableActive(tableName, maxAttempts = 60) {
+	async waitForTableActive(tableName, maskSecrets, maxAttempts = 60) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			const response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
 			const status = response.Table?.TableStatus;
-			this.logger.debug(`Table ${tableName} status: ${status} (attempt ${attempt}/${maxAttempts})`);
+			this.logger.debug(maskSecrets(`Table ${tableName} status: ${status} (attempt ${attempt}/${maxAttempts})`));
 			if (status === "ACTIVE") return {
 				tableArn: response.Table?.TableArn,
 				tableId: response.Table?.TableId,
@@ -13262,15 +13467,36 @@ var DynamoDBTableProvider = class {
 		}
 		throw new Error(maskSecrets(`DynamoDB table ${tableName} was still ${last ?? "unread"} ${KINESIS_DESTINATION_SETTLE_POLLS * KINESIS_DESTINATION_SETTLE_POLL_MS / 1e3} seconds after its encryption change`));
 	}
-	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800) {
+	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800, opts = {}) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
 			const tableActive = table?.TableStatus === "ACTIVE";
 			const indexesActive = (table?.GlobalSecondaryIndexes ?? []).every((gsi) => gsi.IndexStatus === "ACTIVE");
-			if (tableActive && indexesActive) return;
+			if (tableActive && indexesActive && vectorIndexesSettled(table?.VectorIndexes)) return;
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
-		throw new Error(`Table ${tableName} and its global secondary indexes did not reach ACTIVE within ${maxAttempts} seconds after UpdateTable`);
+		const m = maskerOrIdentity(opts.maskSecrets);
+		throw new Error(m(`Table ${m(tableName)} and its indexes did not reach ACTIVE within ${maxAttempts} seconds after ${opts.after ?? "UpdateTable"}`));
+	}
+	async applyVectorIndexUpdates(physicalId, plan, desiredAttributeDefinitions, maskSecrets, beforeFirstOp, onCreated) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		for (const name of plan.alreadyGone) debug(`${this.vectorIndexScopeAt(name, physicalId, maskSecrets)} is recorded in cdkd state but not live; skipping its Delete (already removed)`);
+		for (const name of plan.adopted) warn(`${this.vectorIndexScopeAt(name, physicalId, maskSecrets)} already exists in AWS with the declared definition but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+		if (plan.ops.length === 0) return;
+		await this.waitForTableAndIndexesActive(physicalId, void 0, { maskSecrets });
+		beforeFirstOp();
+		for (const op of plan.ops) {
+			const input = {
+				TableName: physicalId,
+				VectorIndexUpdates: [op]
+			};
+			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			if (op.Create?.IndexName !== void 0) onCreated(op.Create.IndexName);
+			await this.waitForTableAndIndexesActive(physicalId, void 0, { maskSecrets });
+			debug(`${op.Create ? "created" : "deleted"} ` + this.vectorIndexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName, physicalId, maskSecrets));
+		}
 	}
 	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets, onCreated = () => void 0) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -13374,6 +13600,9 @@ var DynamoDBTableProvider = class {
 			this.logger.warn(maskSecrets(`${this.indexScopeAt(name, physicalId, maskSecrets)} is live, but neither cdkd's record nor the template declares it, so cdkd left it in place while converging the unsettled GlobalSecondaryIndexes (CloudFormation never deletes an index it did not record). It may belong to another tool, or an earlier failed cdkd update may have created it; cdkd cannot tell which. If it should not exist, delete it ` + (secretDerived ? `with an UpdateTable GlobalSecondaryIndexUpdates Delete for the index.` : `with: aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"${name}"}}]' (in the table's region)`)));
 		}
 	}
+	vectorIndexScopeAt(indexName, physicalId, maskSecrets) {
+		return `vector index ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${maskSecrets(physicalId)}`;
+	}
 	indexScopeAt(indexName, physicalId, maskSecrets) {
 		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${physicalId}`;
 	}
@@ -13521,7 +13750,7 @@ var DynamoDBTableProvider = class {
 			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
 			if (op.Create?.IndexName !== void 0) onCreated(op.Create.IndexName);
-			await this.waitForTableAndIndexesActive(physicalId);
+			await this.waitForTableAndIndexesActive(physicalId, void 0, { maskSecrets });
 			debug(`${op.Create ? "created" : op.Delete ? "deleted" : "updated"} ${this.indexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName, physicalId, maskSecrets)}`);
 		}
 	}
@@ -13583,7 +13812,8 @@ var DynamoDBTableProvider = class {
 		return [
 			"AttributeDefinitions",
 			"GlobalSecondaryIndexes[]",
-			"LocalSecondaryIndexes[]"
+			"LocalSecondaryIndexes[]",
+			"VectorIndexes"
 		];
 	}
 	getDriftUnknownPaths(resourceType, properties) {
@@ -13670,6 +13900,10 @@ var DynamoDBTableProvider = class {
 			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"], attemptedItems?.get("GlobalSecondaryIndexes"));
 			if (out["GlobalSecondaryIndexes"] === void 0) delete out["GlobalSecondaryIndexes"];
 		}
+		if (names.has("VectorIndexes")) {
+			out["VectorIndexes"] = projectIndexesOnto(out["VectorIndexes"], recordedProperties?.["VectorIndexes"], desiredProperties?.["VectorIndexes"], attemptedItems?.get("VectorIndexes"));
+			if (out["VectorIndexes"] === void 0) delete out["VectorIndexes"];
+		}
 		const strict = async (key, read) => {
 			if (!names.has(key)) return;
 			const value = await read();
@@ -13758,6 +13992,8 @@ var DynamoDBTableProvider = class {
 				const desiredByName = desiredIndexEntriesByName(properties?.["LocalSecondaryIndexes"]);
 				result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes.map((live) => reverseMapSecondaryIndex(live, live.IndexName === void 0 ? void 0 : desiredByName.get(live.IndexName), bagInformative));
 			}
+			const liveVectorIndexes = readbackVectorIndexes(table.VectorIndexes);
+			if (liveVectorIndexes !== void 0) result["VectorIndexes"] = liveVectorIndexes;
 			if (table.SSEDescription?.Status === "ENABLED") {
 				const sse = { SSEEnabled: true };
 				if (table.SSEDescription.KMSMasterKeyArn !== void 0) sse["KMSMasterKeyId"] = table.SSEDescription.KMSMasterKeyArn;
@@ -22917,6 +23153,20 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 		])]
 	]);
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Map([["IdentitySource", []]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Set([
+		"ApiId",
+		"RouteKey",
+		"AuthorizationScopes",
+		"Target",
+		"AuthorizationType",
+		"AuthorizerId",
+		"OperationName",
+		"ApiKeyRequired",
+		"RequestModels",
+		"RequestParameters",
+		"ModelSelectionExpression",
+		"RouteResponseSelectionExpression"
+	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Map([
 		["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 		["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
@@ -23954,12 +24204,15 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 			input.OperationName = properties["OperationName"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const r = this.clearableUpdate(properties["ApiKeyRequired"], previousProperties["ApiKeyRequired"], false);
 			if (r.changed) {
 				input.ApiKeyRequired = r.value;
 				changed = true;
 			}
+		} else if (properties["ApiKeyRequired"] !== void 0 && properties["ApiKeyRequired"] !== previousProperties["ApiKeyRequired"]) {
+			input.ApiKeyRequired = properties["ApiKeyRequired"];
+			changed = true;
 		}
 		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestModels"], previousProperties["RequestModels"]);
@@ -26412,6 +26665,60 @@ function isEcsErrorNamed(error, names) {
 	return typeof name === "string" && names.includes(name);
 }
 const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+function requestedRolloutOf(service) {
+	if (!service) return void 0;
+	const primary = service.deployments?.find((d) => d.status === "PRIMARY");
+	const deploymentId = typeof primary?.id === "string" && primary.id ? primary.id : void 0;
+	const taskDefinitionRaw = primary?.taskDefinition ?? service.taskDefinition;
+	const taskDefinition = typeof taskDefinitionRaw === "string" && taskDefinitionRaw ? taskDefinitionRaw : void 0;
+	if (deploymentId === void 0 && taskDefinition === void 0) return void 0;
+	return {
+		deploymentId,
+		taskDefinition
+	};
+}
+function failedRequestedDeployment(requested, deployments) {
+	if (!Array.isArray(deployments)) return void 0;
+	const target = requested?.deploymentId !== void 0 ? deployments.find((d) => d?.id === requested.deploymentId) : deployments.find((d) => d?.status === "PRIMARY");
+	return target?.rolloutState === "FAILED" ? target : void 0;
+}
+function taskDefinitionRevision(arn) {
+	const match = typeof arn === "string" ? /:task-definition\/[^:]+:(\d+)$/.exec(arn) : null;
+	return match ? match[1] : void 0;
+}
+function describeRollout(rollout) {
+	const revision = taskDefinitionRevision(rollout.taskDefinition);
+	const id = typeof rollout.id === "string" && /^ecs-svc\/\d+$/.test(rollout.id) ? rollout.id : void 0;
+	if (id && revision) return `deployment ${id} (task definition revision ${revision})`;
+	if (id) return `deployment ${id}`;
+	if (revision) return `task definition revision ${revision}`;
+	return "another deployment";
+}
+var EcsCircuitBreakerVerdict = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "EcsCircuitBreakerVerdict";
+	}
+};
+function wrapBreakerFailedError(failed) {
+	return new EcsCircuitBreakerVerdict(`its deployment circuit breaker failed the rollout of ${describeRollout(failed)} (deployment FAILED). The new tasks failed to start or failed their health checks`);
+}
+function controllerSkipsWait(properties) {
+	let type;
+	try {
+		type = readConfigString(properties["DeploymentController"], "Type", "ECS", "DeploymentController");
+	} catch {
+		return "its DeploymentController could not be read";
+	}
+	if (type === "ECS") return void 0;
+	if (type === "CODE_DEPLOY" || type === "EXTERNAL") return `its DeploymentController is ${type}, which ECS does not settle`;
+	return "its DeploymentController type is not one cdkd can settle";
+}
+function rolloutSupersededBy(requested, settled) {
+	if (!requested || !settled) return void 0;
+	if (requested.deploymentId !== void 0 && typeof settled.id === "string" && settled.id) return settled.id === requested.deploymentId ? void 0 : describeRollout(settled);
+	if (requested.taskDefinition !== void 0 && typeof settled.taskDefinition === "string" && settled.taskDefinition) return settled.taskDefinition === requested.taskDefinition ? void 0 : describeRollout(settled);
+}
 function markNotGoneOnNotFoundClass$1(error, wrapped) {
 	return error instanceof Error && error.name.includes("NotFound") ? markNotGone(wrapped) : wrapped;
 }
@@ -26561,7 +26868,7 @@ var ECSProvider = class {
 		switch (resourceType) {
 			case "AWS::ECS::Cluster": return this.createCluster(logicalId, resourceType, properties, this.operationSinks(context, [[properties["ClusterName"], properties["ClusterName"]]]));
 			case "AWS::ECS::TaskDefinition": return this.createTaskDefinition(logicalId, resourceType, properties, this.operationSinks(context, [[properties["Family"], properties["Family"]]]));
-			case "AWS::ECS::Service": return this.createService(logicalId, resourceType, properties, this.operationSinks(context, [[properties["ServiceName"], properties["ServiceName"]], [properties["Cluster"], clusterNameOfRef(properties["Cluster"])]]));
+			case "AWS::ECS::Service": return this.createService(logicalId, resourceType, properties, this.operationSinks(context, [[properties["ServiceName"], properties["ServiceName"]], [properties["Cluster"], clusterNameOfRef(properties["Cluster"])]]), context?.replayingState === true);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -26578,7 +26885,7 @@ var ECSProvider = class {
 					[properties["Cluster"], recordedCluster],
 					[previousProperties["Cluster"], recordedCluster],
 					[properties["Cluster"], clusterNameOfRef(properties["Cluster"])]
-				]), context?.desiredFromAwsReadback === true);
+				]), context?.desiredFromAwsReadback === true, context?.replayingState === true);
 			}
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -26798,14 +27105,15 @@ var ECSProvider = class {
 			default: return;
 		}
 	}
-	async createService(logicalId, resourceType, properties, log) {
+	async createService(logicalId, resourceType, properties, log, replayingState) {
 		log.debug(`Creating ECS service ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
 		const serviceName = properties["ServiceName"] || generatedNameFor("AWS::ECS::Service", logicalId);
 		let survivorArn;
 		try {
-			const heldBefore = process.env["CDKD_FULL_WAIT"] === "true" ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
+			const skipReason = controllerSkipsWait(properties);
+			const heldBefore = process.env["CDKD_NO_WAIT"] !== "true" && skipReason === void 0 && !replayingState ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
 			const service = (await client.send(new CreateServiceCommand({
 				cluster: properties["Cluster"],
 				serviceName,
@@ -26838,8 +27146,18 @@ var ECSProvider = class {
 			log.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
 			if (heldBefore === "free") reportCreatedResource(logicalId, resourceType, service.serviceArn);
 			try {
-				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"], log);
+				await this.settleService(logicalId, service.serviceName ?? service.serviceArn, properties["Cluster"], log, requestedRolloutOf(service), skipReason);
 			} catch (waitError) {
+				if (replayingState) {
+					log.warn(`${this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log, false).message} Continuing the rollback: the restored service stays recorded.`);
+					return {
+						physicalId: service.serviceArn,
+						attributes: {
+							ServiceArn: service.serviceArn,
+							Name: service.serviceName
+						}
+					};
+				}
 				const aws = pasteableAwsCommand(log.mask);
 				const cleanupCluster = properties["Cluster"];
 				const clusterArg = cleanupCluster ? aws` --cluster ${cleanupCluster}` : aws``;
@@ -26861,10 +27179,7 @@ var ECSProvider = class {
 					if (cleanupFailure.redacted) log.debug(`${cleanupHead}${cleanupFailure.detail}`);
 					log.warn(`${cleanupHead}${cleanupFailure.redacted ? `${cleanupFailure.summary} ` : `${cleanupFailure.detail}. `}Manual deletion may be required before the next deploy: ${deleteCommand.render()}`);
 				}
-				const waitFailure = describeAwsFailure(waitError);
-				if (waitFailure.redacted) log.debug(`ECS service ${logicalId} steady-state wait failed: ${waitFailure.detail}`);
-				const steadyStateError = new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state under --full-wait: ${waitFailure.summary.replace(/\.$/, "")}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}`, { cause: waitError });
-				throw waitFailure.redacted ? markRedactedCause(steadyStateError) : steadyStateError;
+				throw this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log);
 			}
 			return {
 				physicalId: service.serviceArn,
@@ -26907,30 +27222,68 @@ var ECSProvider = class {
 		reduced.name = error.name;
 		return markRedactedCause(reduced);
 	}
-	async settleService(logicalId, serviceRef, cluster, log) {
-		if (process.env["CDKD_FULL_WAIT"] === "true") {
+	wrapSteadyStateError(logicalId, waitError, cluster, log, offerNoWait = true) {
+		const aws = pasteableAwsCommand(log.mask);
+		const clusterArg = cluster ? aws` --cluster ${cluster}` : aws``;
+		const listStopped = aws`aws ecs list-tasks${clusterArg} --desired-status STOPPED`;
+		const waitFailure = describeAwsFailure(waitError);
+		if (waitFailure.redacted) log.debug(`ECS service ${logicalId} steady-state wait failed: ${waitFailure.detail}`);
+		const flagsAvailable = offerNoWait && process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true";
+		const timeoutHint = flagsAvailable && !(waitError instanceof EcsCircuitBreakerVerdict) ? ` To wait longer, raise the limit with --resource-timeout AWS::ECS::Service=${commandHole("duration")}.` : "";
+		const noWaitHint = flagsAvailable ? " To deploy without waiting for steady state, pass --no-wait." : "";
+		const steadyStateError = new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state: ${waitFailure.summary.replace(/\.$/, "")}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}.${timeoutHint}${noWaitHint}`, { cause: waitError });
+		return waitFailure.redacted ? markRedactedCause(steadyStateError) : steadyStateError;
+	}
+	async settleService(logicalId, serviceRef, cluster, log, requested, skipReason) {
+		if (skipReason !== void 0) {
+			this.logger.info(log.mask(`ECS service ${logicalIdShown(logicalId)} accepted (not waiting for steady state: ${skipReason}).`));
+			return;
+		}
+		if (process.env["CDKD_NO_WAIT"] !== "true") {
 			log.debug(`Waiting for ECS service ${logicalId} to reach steady state...`);
 			const maxWaitTime = Math.max(600, (resolvedResourceTimeoutMs("AWS::ECS::Service") ?? 0) / 1e3);
+			const client = this.getClient();
+			const breakerVerdict = new AbortController();
+			let failedRollout;
+			const watchedClient = { send: async (command) => {
+				const output = await client.send(command);
+				if (failedRollout === void 0) {
+					failedRollout = failedRequestedDeployment(requested, output?.services?.[0]?.deployments);
+					if (failedRollout !== void 0) breakerVerdict.abort();
+				}
+				return output;
+			} };
 			try {
 				await waitUntilServicesStable({
-					client: this.getClient(),
+					client: watchedClient,
 					maxWaitTime,
 					minDelay: 5,
-					maxDelay: 10
+					maxDelay: 10,
+					abortSignal: breakerVerdict.signal
 				}, {
 					cluster,
 					services: [serviceRef]
 				});
 			} catch (waiterError) {
+				if (failedRollout !== void 0) {
+					log.debug(`ECS service ${logicalId} deployment ${failedRollout.id ?? "(no id)"} FAILED: ${failedRollout.rolloutStateReason ?? "(no rollout reason)"}`);
+					throw wrapBreakerFailedError(failedRollout);
+				}
 				throw this.wrapWaiterResultError(waiterError, logicalId, log);
 			}
+			if (failedRollout !== void 0) throw wrapBreakerFailedError(failedRollout);
 			const rolloutDeadline = Date.now() + 12e4;
+			let settledDeployment;
 			for (;;) {
 				const deployments = (await this.getClient().send(new DescribeServicesCommand({
 					cluster,
 					services: [serviceRef]
 				})))?.services?.[0]?.deployments;
-				const rolloutState = deployments && deployments.length === 1 ? deployments[0]?.rolloutState : void 0;
+				const failedNow = failedRequestedDeployment(requested, deployments);
+				if (failedNow !== void 0) throw wrapBreakerFailedError(failedNow);
+				settledDeployment = deployments && deployments.length === 1 ? deployments[0] : void 0;
+				const rolloutState = settledDeployment?.rolloutState;
+				if (settledDeployment !== void 0 && rolloutState === "FAILED") throw wrapBreakerFailedError(settledDeployment);
 				if (rolloutState === void 0 || rolloutState === "COMPLETED") break;
 				if (Date.now() >= rolloutDeadline) {
 					log.warn(`ECS service ${logicalId} is steady but its rollout is still ${rolloutState} after the post-stability grace window; continuing`);
@@ -26938,15 +27291,22 @@ var ECSProvider = class {
 				}
 				await settleRolloutDelays.sleep(3e3);
 			}
+			const supersededBy = rolloutSupersededBy(requested, settledDeployment);
+			if (supersededBy !== void 0) {
+				log.debug(`ECS service ${logicalId} settled deployment ${settledDeployment?.id ?? "(no id)"}: ${settledDeployment?.rolloutStateReason ?? "(no rollout reason)"}`);
+				throw new EcsCircuitBreakerVerdict(`its deployment circuit breaker rolled the rollout back: the service settled on ${supersededBy}, not on the deployment this update started (${describeRollout({
+					id: requested.deploymentId,
+					taskDefinition: requested.taskDefinition
+				})}). The new tasks failed to start or failed their health checks`);
+			}
 			log.debug(`ECS service ${logicalId} reached steady state`);
 			return;
 		}
 		const aws = pasteableAwsCommand(log.mask);
 		const clusterArg = cluster ? aws` --cluster ${cluster}` : aws``;
-		const fullWaitHint = process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true" ? "; pass --full-wait to wait" : "";
-		this.logger.info(log.mask(`ECS service ${logicalIdShown(logicalId)} accepted (not waiting for steady state${fullWaitHint}). To wait manually: ${aws`aws ecs wait services-stable${clusterArg} --services ${serviceRef}`.render()}`));
+		this.logger.info(log.mask(`ECS service ${logicalIdShown(logicalId)} accepted (not waiting for steady state under --no-wait). To wait manually: ${aws`aws ecs wait services-stable${clusterArg} --services ${serviceRef}`.render()}`));
 	}
-	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, log, desiredFromAwsReadback) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, log, desiredFromAwsReadback, replayingState) {
 		log.debug(`Updating ECS service ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const client = this.getClient();
@@ -27016,7 +27376,12 @@ var ECSProvider = class {
 				forceNewDeployment: forceNewDeploymentInput
 			}))).service;
 			if (service?.serviceArn) await this.applyTagDiff(service.serviceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
-			await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"], log);
+			try {
+				await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"], log, requestedRolloutOf(service), desiredFromAwsReadback ? "a drift revert does not wait for it" : controllerSkipsWait(properties));
+			} catch (waitError) {
+				if (replayingState) log.warn(`${this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log, false).message} The rollback update was applied; continuing.`);
+				else throw this.wrapSteadyStateError(logicalId, waitError, properties["Cluster"], log);
+			}
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -29360,6 +29725,7 @@ const POLL_INTERVAL_MS$1 = 5e3;
 const POLL_TIMEOUT_MS$1 = 18e5;
 const RETAINED_ON_REMOVAL = [
 	"Auth",
+	"DefaultAuthScheme",
 	"RequireTLS",
 	"IdleClientTimeout",
 	"DebugLogging",
@@ -29371,7 +29737,14 @@ const CFN_KEEPS_ON_REMOVAL$1 = /* @__PURE__ */ new Set([
 	"DebugLogging",
 	"VpcSecurityGroupIds"
 ]);
-const authRemovalRefused = (properties) => {
+const authRemovalRefused = (properties, previousProperties) => authRequired({ DefaultAuthScheme: properties["DefaultAuthScheme"] !== void 0 ? properties["DefaultAuthScheme"] : previousProperties["DefaultAuthScheme"] });
+const leavesProxyWithoutAuth = (properties, previousProperties) => {
+	const desired = properties["Auth"];
+	const declaredEmpty = desired === null || Array.isArray(desired) && desired.length === 0;
+	if (properties["DefaultAuthScheme"] === "NONE" && previousProperties["DefaultAuthScheme"] !== "NONE" && (desired === void 0 || declaredEmpty)) return true;
+	return declaredEmpty && JSON.stringify(desired) !== JSON.stringify(previousProperties["Auth"]) && authRemovalRefused(properties, previousProperties);
+};
+const authRequired = (properties) => {
 	const scheme = properties["DefaultAuthScheme"];
 	return scheme === void 0 || scheme === "NONE";
 };
@@ -29391,6 +29764,9 @@ var RDSDBProxyProvider = class {
 		"RequireTLS",
 		"IdleClientTimeout",
 		"DebugLogging",
+		"DefaultAuthScheme",
+		"EndpointNetworkType",
+		"TargetConnectionNetworkType",
 		"Tags"
 	])]]);
 	getClient() {
@@ -29417,18 +29793,21 @@ var RDSDBProxyProvider = class {
 		const engineFamily = properties["EngineFamily"];
 		if (!engineFamily) throw new ProvisioningError(`EngineFamily is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const auth = properties["Auth"];
-		if (!auth || auth.length === 0) throw new ProvisioningError(`Auth (at least one entry) is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
+		if ((!auth || auth.length === 0) && authRequired(properties)) throw new ProvisioningError(`Auth (at least one entry) is required for AWS::RDS::DBProxy ${logicalId} while DefaultAuthScheme is NONE or unset`, resourceType, logicalId);
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const vpcSubnetIds = properties["VpcSubnetIds"];
 		if (!vpcSubnetIds || vpcSubnetIds.length === 0) throw new ProvisioningError(`VpcSubnetIds (at least one) is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const client = this.getClient();
-		this.logger.debug(`Creating DBProxy ${dbProxyName} (${engineFamily})`);
+		this.logger.debug(mask(`Creating DBProxy ${dbProxyName} (${engineFamily})`));
 		try {
 			await this.getCreateClient().send(new CreateDBProxyCommand({
 				DBProxyName: dbProxyName,
 				EngineFamily: engineFamily,
-				Auth: auth,
+				Auth: auth && auth.length > 0 ? auth : void 0,
+				DefaultAuthScheme: properties["DefaultAuthScheme"],
+				EndpointNetworkType: properties["EndpointNetworkType"],
+				TargetConnectionNetworkType: properties["TargetConnectionNetworkType"],
 				RoleArn: roleArn,
 				VpcSubnetIds: vpcSubnetIds,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
@@ -29480,13 +29859,16 @@ var RDSDBProxyProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
-		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && this.removedRetained(properties, previousProperties, context).includes("Auth") && authRemovalRefused(properties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): Auth was removed from the template, but AWS requires Auth while DefaultAuthScheme is NONE or unset, and CloudFormation's update fails on the same change. Declare Auth again; nothing was changed.`, resourceType, logicalId, physicalId));
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && this.removedRetained(properties, previousProperties, context).includes("Auth") && authRemovalRefused(properties, previousProperties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): Auth was removed from the template, but AWS requires Auth while DefaultAuthScheme is NONE or unset, and CloudFormation's update fails on the same change. Declare Auth again; nothing was changed.`, resourceType, logicalId, physicalId));
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && leavesProxyWithoutAuth(properties, previousProperties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): the update leaves the proxy with no Auth while DefaultAuthScheme is NONE or unset, and AWS requires Auth then. Declare Auth; nothing was changed.`, resourceType, logicalId, physicalId));
 		const client = this.getClient();
 		const { mask } = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["DBProxyName"], physicalId]]);
 		for (const field of [
 			"DBProxyName",
 			"EngineFamily",
-			"VpcSubnetIds"
+			"VpcSubnetIds",
+			"EndpointNetworkType",
+			"TargetConnectionNetworkType"
 		]) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field]) && !await unchangedBehindSecretReference({
 			resourceType,
 			key: field,
@@ -29499,6 +29881,7 @@ var RDSDBProxyProvider = class {
 		let hasModify = false;
 		for (const key of [
 			"Auth",
+			"DefaultAuthScheme",
 			"RequireTLS",
 			"IdleClientTimeout",
 			"DebugLogging",
@@ -29626,7 +30009,10 @@ var RDSDBProxyProvider = class {
 				SecretArn: a.SecretArn,
 				IAMAuth: a.IAMAuth,
 				ClientPasswordAuthType: a.ClientPasswordAuthType
-			}))
+			})),
+			...p.DefaultAuthScheme !== void 0 && { DefaultAuthScheme: p.DefaultAuthScheme },
+			...p.EndpointNetworkType !== void 0 && { EndpointNetworkType: p.EndpointNetworkType },
+			...p.TargetConnectionNetworkType !== void 0 && { TargetConnectionNetworkType: p.TargetConnectionNetworkType }
 		};
 		if (p.DBProxyArn) try {
 			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }));
@@ -29729,6 +30115,7 @@ var RDSDBProxyEndpointProvider = class {
 		"VpcSubnetIds",
 		"VpcSecurityGroupIds",
 		"TargetRole",
+		"EndpointNetworkType",
 		"Tags"
 	])]]);
 	getClient() {
@@ -29765,6 +30152,7 @@ var RDSDBProxyEndpointProvider = class {
 				VpcSubnetIds: vpcSubnetIds,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
 				TargetRole: properties["TargetRole"],
+				EndpointNetworkType: properties["EndpointNetworkType"],
 				Tags: tags.length > 0 ? tags : void 0
 			}));
 		} catch (error) {
@@ -29820,7 +30208,8 @@ var RDSDBProxyEndpointProvider = class {
 			"DBProxyName",
 			"DBProxyEndpointName",
 			"VpcSubnetIds",
-			"TargetRole"
+			"TargetRole",
+			"EndpointNetworkType"
 		]) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field]) && !await unchangedBehindSecretReference({
 			resourceType,
 			key: field,
@@ -29924,7 +30313,8 @@ var RDSDBProxyEndpointProvider = class {
 			DBProxyName: e.DBProxyName,
 			VpcSubnetIds: e.VpcSubnetIds ?? [],
 			VpcSecurityGroupIds: e.VpcSecurityGroupIds ?? [],
-			TargetRole: e.TargetRole ?? "READ_WRITE"
+			TargetRole: e.TargetRole ?? "READ_WRITE",
+			...e.EndpointNetworkType !== void 0 && { EndpointNetworkType: e.EndpointNetworkType }
 		};
 		if (e.DBProxyEndpointArn) try {
 			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }));
@@ -30587,6 +30977,25 @@ function masterUserPasswordToSend(properties, previousProperties, context) {
 	return typeof desired === "string" && typeof recorded === "string" && recorded === desired && dynamicReferenceTokens(recorded).length === 0 && recorded !== "***" ? void 0 : desired;
 }
 const DOCDB_DEFAULT_PORT = 27017;
+const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
+	"DeletionProtection",
+	"BackupRetentionPeriod",
+	"VpcSecurityGroupIds",
+	"EngineVersion",
+	"PreferredBackupWindow",
+	"PreferredMaintenanceWindow",
+	"DBClusterParameterGroupName"
+];
+const DOCDB_INSTANCE_KEPT_ON_REMOVAL = ["PreferredMaintenanceWindow"];
+function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType) {
+	const removedSet = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
+	const removed = keys.filter((key) => removedSet.has(key));
+	if (removed.length === 0) return void 0;
+	const one = removed.length === 1;
+	const names = `${one ? "property" : "properties"} ${removed.join(", ")}`;
+	const modify = resourceType === "AWS::DocDB::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
+	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place, as CloudFormation does. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
+}
 const SECURITY_GROUP_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying"]);
 const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "rebooting"]);
 function numberOrUndefined(value) {
@@ -30628,6 +31037,25 @@ var DocDBProvider = class {
 	logger = getLogger().child("DocDBProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
+		"DBClusterIdentifier",
+		"DBSubnetGroupName",
+		"KmsKeyId",
+		"MasterUsername",
+		"StorageEncrypted",
+		"Port",
+		"Tags",
+		"MasterUserPassword",
+		...DOCDB_CLUSTER_KEPT_ON_REMOVAL
+	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
+		"DBInstanceIdentifier",
+		"DBClusterIdentifier",
+		"AvailabilityZone",
+		"DBInstanceClass",
+		"Tags",
+		"AutoMinorVersionUpgrade",
+		...DOCDB_INSTANCE_KEPT_ON_REMOVAL
+	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
 		"DBClusterIdentifier",
 		"EngineVersion",
@@ -30681,7 +31109,7 @@ var DocDBProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -30773,6 +31201,8 @@ var DocDBProvider = class {
 				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, SECURITY_GROUP_CHANGE_MEMBER_STATUSES, "VPC security groups");
 			}
 			if (described?.DBClusterArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			const keptWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
+			if (keptWarning !== void 0) this.logger.warn(keptWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -30896,8 +31326,9 @@ var DocDBProvider = class {
 			throw thrown;
 		}
 	}
-	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
+		const mask = context?.maskSecrets;
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			await modifyDbInstanceWhenAvailable({
@@ -30918,6 +31349,8 @@ var DocDBProvider = class {
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			const keptWarning = keptOnRemovalWarning$1(DOCDB_INSTANCE_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
+			if (keptWarning !== void 0) this.logger.warn(keptWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -34150,6 +34583,36 @@ function nodesToRemove(nodes, desiredCount, desiredZones) {
 	if (keep.size + unnamed < desiredCount) return void 0;
 	return named.map((n) => n.id).filter((id) => !keep.has(id)).sort();
 }
+const KEPT_ON_REMOVAL$1 = [
+	"EngineVersion",
+	"CacheParameterGroupName",
+	"PreferredMaintenanceWindow",
+	"SnapshotWindow",
+	"IpDiscovery",
+	"SnapshotRetentionLimit",
+	"AutoMinorVersionUpgrade",
+	"NotificationTopicArn",
+	"VpcSecurityGroupIds",
+	"TransitEncryptionEnabled",
+	"PreferredAvailabilityZone"
+];
+const NOT_MODIFIABLE = /* @__PURE__ */ new Set(["TransitEncryptionEnabled", "PreferredAvailabilityZone"]);
+const PLACEMENT_ON_REMOVAL = ["AZMode", "PreferredAvailabilityZones"];
+const removalWarnings = (logicalId, kept, placement, caller) => {
+	const lines = [];
+	const head = (names) => safeMsg`${logicalId} (AWS::ElastiCache::CacheCluster): ${names.length === 1 ? "property" : "properties"} ${names.join(", ")}`;
+	if (kept.length > 0) {
+		const one = kept.length === 1;
+		const fixed = kept.filter((name) => NOT_MODIFIABLE.has(name));
+		const replaceNote = fixed.length === 0 ? "" : safeMsg` (${fixed.join(", ")} ${fixed.length === 1 ? "changes" : "change"} only by replacing the cluster)`;
+		lines.push(caller === "rollback" ? `${head(kept)} ${one ? "is" : "are"} absent from the state being restored; the rollback sends nothing for ${one ? "it" : "them"}, so the cluster keeps the value it holds now.` : `${head(kept)} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; cdkd sends nothing for a removed property. To change a value, declare it explicitly${replaceNote}.`);
+	}
+	if (placement.length > 0) {
+		const one = placement.length === 1;
+		lines.push(caller === "rollback" ? `${head(placement)} ${one ? "is" : "are"} absent from the state being restored; the rollback leaves the cluster unchanged.` : `${head(placement)} ${one ? "was" : "were"} removed from the template; cdkd sends nothing for a removed property, so the nodes stay in their zones. CloudFormation updates a cross-az cluster, or a single-az one that keeps its zone list, in place. It replaces a memcached single-az cluster left with no zone, and cdkd plans that replacement too (go-to-k/cdkd#5558). To move the nodes, replace the cluster, for example by changing its logical ID.`);
+	}
+	return lines;
+};
 var ElastiCacheProvider = class {
 	client;
 	createClient;
@@ -34199,6 +34662,22 @@ var ElastiCacheProvider = class {
 		"TransitEncryptionEnabled"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Set([
+		"CacheSubnetGroupName",
+		"ClusterName",
+		"Engine",
+		"NetworkType",
+		"Port",
+		"SnapshotName",
+		"SnapshotArns",
+		"CacheSecurityGroupNames",
+		"CacheNodeType",
+		"NumCacheNodes",
+		"Tags",
+		"LogDeliveryConfigurations",
+		...KEPT_ON_REMOVAL$1,
+		...PLACEMENT_ON_REMOVAL
+	])]]);
 	getClient() {
 		if (!this.client) {
 			this.client = new ElastiCacheClient({
@@ -34228,7 +34707,7 @@ var ElastiCacheProvider = class {
 		const mask = context?.maskSecrets;
 		switch (resourceType) {
 			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, mask);
-			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask);
+			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -34360,7 +34839,7 @@ var ElastiCacheProvider = class {
 			throw thrown;
 		}
 	}
-	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask, context) {
 		this.logger.debug(`Updating CacheCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
@@ -34399,6 +34878,7 @@ var ElastiCacheProvider = class {
 			const described = await this.describeCacheCluster(physicalId);
 			this.warnTransitEncryptionNotApplied(logicalId, properties, previousProperties, described?.TransitEncryptionEnabled);
 			if (described?.ARN) await this.applyTagDiff(described.ARN, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			this.warnRemovalsLeftInPlace(logicalId, properties, previousProperties, context);
 			const attributes = {};
 			if (described?.CacheNodes?.[0]?.Endpoint) {
 				const endpoint = described.CacheNodes[0].Endpoint;
@@ -34499,6 +34979,13 @@ var ElastiCacheProvider = class {
 		if (notApplied.length === 0) return;
 		this.logger.warn(safeMsg`CacheCluster ${logicalId}: the ${notApplied.join(", ")} change is not applied to the ` + "existing cluster (ModifyCacheCluster cannot change it, and CloudFormation leaves it unchanged too). To apply it, replace the cluster, for example by changing its logical ID.");
 	}
+	warnRemovalsLeftInPlace(logicalId, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback) return;
+		const removed = context?.removedProperties;
+		const wasRemoved = (key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0;
+		const lines = removalWarnings(logicalId, KEPT_ON_REMOVAL$1.filter(wasRemoved), PLACEMENT_ON_REMOVAL.filter(wasRemoved), context?.replayingState ? "rollback" : "deploy");
+		for (const line of lines) this.logger.warn(line);
+	}
 	buildLogDeliveryConfigurationsForUpdate(newConfigs, previousConfigs) {
 		const kept = newConfigs ?? [];
 		const keptLogTypes = new Set(kept.map((c) => c.LogType).filter((t) => t !== void 0));
@@ -35665,6 +36152,25 @@ const APPSYNC_APIKEY_ID_FORMAT = {
 	label: "AppSync ApiKey",
 	segments: ["apiId", "apiKeyId"]
 };
+const CFN_APPSYNC_ARN_RESOURCE_PATHS = {
+	"AWS::AppSync::GraphQLApi": /^apis\/([^/|]+)$/,
+	"AWS::AppSync::DataSource": /^apis\/([^/|]+)\/datasources\/([^/|]+)$/,
+	"AWS::AppSync::Resolver": /^apis\/([^/|]+)\/types\/([^/|]+)\/resolvers\/([^/|]+)$/,
+	"AWS::AppSync::ApiKey": /^apis\/([^/|]+)\/apikeys?\/([^/|]+)$/
+};
+function graphQLSchemaApiId(physicalId) {
+	const schema = /^([a-z0-9]+)GraphQLSchema$/.exec(physicalId);
+	return schema ? schema[1] : physicalId;
+}
+function appSyncPhysicalIdFromCfn(resourceType, logicalId, physicalId, region) {
+	if (resourceType === "AWS::AppSync::GraphQLSchema") return graphQLSchemaApiId(physicalId);
+	const pathPattern = CFN_APPSYNC_ARN_RESOURCE_PATHS[resourceType];
+	const arn = /^arn:[^:]+:appsync:([^:]*):[^:]*:(.+)$/.exec(physicalId);
+	const segments = pathPattern && arn ? pathPattern.exec(arn[2]) : null;
+	if (!arn || !segments) return physicalId;
+	if (canonicalizeRegion(arn[1]) !== canonicalizeRegion(region)) throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType} ${physicalId} is in region ${arn[1]}, not the import region ${region}`, resourceType, logicalId, physicalId));
+	return segments.slice(1).join("|");
+}
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 	"UserPoolConfig",
 	"OpenIDConnectConfig",
@@ -35804,7 +36310,7 @@ var AppSyncProvider = class {
 		}
 		if (resourceType === "AWS::AppSync::ApiKey" && parts.length === 2) {
 			const [apiId, apiKeyId] = parts;
-			const apiKeyArn = await arn(`apis/${apiId}/apikey/${apiKeyId}`);
+			const apiKeyArn = await arn(`apis/${apiId}/apikeys/${apiKeyId}`);
 			return {
 				ApiKey: apiKeyId,
 				...apiKeyArn && { Arn: apiKeyArn }
@@ -35953,12 +36459,13 @@ var AppSyncProvider = class {
 		};
 	}
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties, mask = maskerOrIdentity(void 0)) {
+		const recordedApiId = graphQLSchemaApiId(physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"] && !await unchangedBehindSecretReference({
 			resourceType,
 			key: "ApiId",
 			desired: properties["ApiId"],
 			previous: previousProperties["ApiId"],
-			physicalName: physicalId,
+			physicalName: recordedApiId,
 			maskSecrets: mask
 		})) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync GraphQLSchema.ApiId cannot move a schema to another API in place (CloudFormation fails a template change of it too) — deploy with --replace, or give the schema a new logical ID, to create it on the new API");
 		const newDef = properties["Definition"];
@@ -35983,7 +36490,7 @@ var AppSyncProvider = class {
 			physicalId,
 			wasReplaced: false
 		};
-		const apiId = properties["ApiId"] ?? physicalId;
+		const apiId = properties["ApiId"] ?? recordedApiId;
 		try {
 			await this.getClient().send(new StartSchemaCreationCommand({
 				apiId,
@@ -36907,7 +37414,7 @@ var AppSyncProvider = class {
 			maskSecrets: context?.maskSecrets,
 			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
 		});
-		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikey/${apiKeyId}`, logicalId, physicalId);
+		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikeys/${apiKeyId}`, logicalId, physicalId);
 		return {
 			physicalId,
 			attributes: {
@@ -36992,10 +37499,11 @@ var AppSyncProvider = class {
 		}
 	}
 	async readGraphQLSchema(physicalId, properties) {
+		const apiId = graphQLSchemaApiId(physicalId);
 		let resp;
 		try {
 			resp = await this.getClient().send(new GetIntrospectionSchemaCommand({
-				apiId: physicalId,
+				apiId,
 				format: "SDL"
 			}));
 		} catch (err) {
@@ -37012,7 +37520,7 @@ var AppSyncProvider = class {
 			if (await this.canonicalizeSdl(stateDefinition, "state") === canonicalAws) definitionToReturn = stateDefinition;
 		}
 		return {
-			ApiId: physicalId,
+			ApiId: apiId,
 			Definition: definitionToReturn
 		};
 	}
@@ -37253,14 +37761,18 @@ var AppSyncProvider = class {
 		return RESOURCE_NOT_FOUND;
 	}
 	async import(input) {
+		const known = input.knownPhysicalId && appSyncPhysicalIdFromCfn(input.resourceType, input.logicalId, input.knownPhysicalId, input.region);
 		if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
-			if (input.knownPhysicalId) return {
-				physicalId: input.knownPhysicalId,
-				attributes: await this.childImportAttributes(input.resourceType, input.knownPhysicalId, input.region)
+			if (known) return {
+				physicalId: known,
+				attributes: await this.childImportAttributes(input.resourceType, known, input.region)
 			};
 			return null;
 		}
-		const explicit = resolveExplicitPhysicalId(input, null);
+		const explicit = resolveExplicitPhysicalId(known ? {
+			...input,
+			knownPhysicalId: known
+		} : input, null);
 		if (explicit) try {
 			const response = await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
 			return {
@@ -43077,7 +43589,7 @@ var EFSProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		switch (resourceType) {
-			case "AWS::EFS::FileSystem": return this.updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::EFS::FileSystem": return this.updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.replayingState === true || context?.desiredFromAwsReadback === true);
 			case "AWS::EFS::MountTarget": return this.updateMountTarget(logicalId, physicalId, resourceType, properties, log);
 			case "AWS::EFS::AccessPoint": return this.updateAccessPoint(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
@@ -43125,7 +43637,7 @@ var EFSProvider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log, stateBorneDesired) {
 		for (const key of [
 			"Encrypted",
 			"KmsKeyId",
@@ -43140,8 +43652,13 @@ var EFSProvider = class {
 		const newProvisioned = properties["ProvisionedThroughputInMibps"];
 		const oldThroughputMode = previousProperties["ThroughputMode"];
 		const oldProvisioned = previousProperties["ProvisionedThroughputInMibps"];
+		const throughputValueMissing = newThroughputMode === "provisioned" && newProvisioned === void 0 && (oldProvisioned !== void 0 || oldThroughputMode !== "provisioned");
+		if (throughputValueMissing) {
+			if (!stateBorneDesired) throw new ProvisioningError(`Failed to update EFS FileSystem ${logicalId}: Throughput value must be specified for provisioned throughput mode. The template sets ThroughputMode: provisioned without ProvisionedThroughputInMibps, which CloudFormation rejects too. Set ProvisionedThroughputInMibps, or change ThroughputMode (e.g. to bursting or elastic).`, resourceType, logicalId, physicalId);
+			log.warn(`EFS FileSystem ${logicalId}: the desired properties (from cdkd state or an AWS readback, not the template) set ThroughputMode: provisioned without ProvisionedThroughputInMibps, which AWS rejects; leaving the file system's throughput as it is on AWS and applying the rest of the update. Its throughput may now differ from the record: run cdkd drift to see it.`);
+		}
 		const effectiveThroughputMode = newThroughputMode === void 0 && newProvisioned === void 0 && oldThroughputMode === "provisioned" ? "bursting" : newThroughputMode;
-		const throughputModeChanged = effectiveThroughputMode !== void 0 && effectiveThroughputMode !== oldThroughputMode;
+		const throughputModeChanged = !throughputValueMissing && effectiveThroughputMode !== void 0 && effectiveThroughputMode !== oldThroughputMode;
 		const provisionedChanged = newProvisioned !== void 0 && newProvisioned !== oldProvisioned;
 		const changed = (key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
 		const lifecycleChanged = changed("LifecyclePolicies");
@@ -43967,7 +44484,7 @@ const cfnKeepsOnRemoval = (name, shape, removed) => {
 	if (narrow) return narrow(shape, removed);
 	return !cfnRefusesRemoval(name, shape) && !shape.storageTypes.includes("INTELLIGENT_TIERING") && (CFN_KEEPS_ON_REMOVAL.has(name) || typeof shape.fileSystemType === "string" && CFN_KEEPS_TOP_LEVEL_ON_REMOVAL.get(shape.fileSystemType)?.has(name) === true);
 };
-const leftInPlaceWarning$2 = (logicalId, names, caller, shape) => {
+const leftInPlaceWarning$3 = (logicalId, names, caller, shape) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -44331,7 +44848,7 @@ var FSxFileSystemProvider = class {
 		const leftInPlaceNames = [...TOP_LEVEL_LEFT_IN_PLACE_PROPS.filter((key) => properties[key] === void 0 && previousProperties[key] !== void 0), ...leftInPlace.map((key) => `${variantConfigKey}.${key}`)];
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning$2(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy", {
+			this.logger.warn(leftInPlaceWarning$3(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy", {
 				fileSystemType: properties["FileSystemType"] ?? previousProperties["FileSystemType"],
 				storageTypes: [previousProperties["StorageType"], properties["StorageType"]],
 				deploymentTypes: [previousProperties, properties].map((side) => variantConfigKey ? side[variantConfigKey]?.["DeploymentType"] : void 0),
@@ -45487,7 +46004,7 @@ const toNumber$1 = (v) => {
 };
 const jsonEqual$1 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const LEFT_IN_PLACE_ON_REMOVAL$1 = ["ResizeSpecifications", "InstanceTypeConfigs"];
-const leftInPlaceWarning$1 = (logicalId, names, caller) => {
+const leftInPlaceWarning$2 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -45676,7 +46193,7 @@ var EMRInstanceFleetConfigProvider = class {
 		const leftInPlaceNames = LEFT_IN_PLACE_ON_REMOVAL$1.filter((key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0);
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning$1(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
+			this.logger.warn(leftInPlaceWarning$2(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 		};
 		const leftInPlace = new Set(LEFT_IN_PLACE_ON_REMOVAL$1);
 		if (![...MUTABLE].some((k) => changed(k) && !(leftInPlace.has(k) && properties[k] === void 0))) {
@@ -45837,7 +46354,7 @@ const MUTABLE_TOP_LEVEL_PROPS = /* @__PURE__ */ new Set([
 	"AutoTerminationPolicy"
 ]);
 const LEFT_IN_PLACE_ON_REMOVAL = ["StepConcurrencyLevel"];
-const leftInPlaceWarning = (logicalId, names, caller) => {
+const leftInPlaceWarning$1 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -46398,7 +46915,7 @@ var EMRClusterProvider = class {
 		const leftInPlaceNames = LEFT_IN_PLACE_ON_REMOVAL.filter((key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0);
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
+			this.logger.warn(leftInPlaceWarning$1(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 		};
 		const visibleChanged = changed("VisibleToAllUsers");
 		const stepConcurrencyChanged = changed("StepConcurrencyLevel") && properties["StepConcurrencyLevel"] !== void 0;
@@ -48057,6 +48574,19 @@ function withoutTrailIdentifiers(text, physicalId) {
 	}
 	return out;
 }
+function removalsLeftInPlace(properties, previousProperties, context, globalEventsResetSkipped) {
+	if (context?.desiredFromAwsReadback) return [];
+	const removed = context?.removedProperties;
+	const wasRemoved = (key) => previousProperties[key] != null && properties[key] == null && (removed === void 0 || removed.has(key));
+	const org = previousProperties["IsOrganizationTrail"];
+	const globalEvents = previousProperties["IncludeGlobalServiceEvents"];
+	return [...wasRemoved("IsOrganizationTrail") && org !== false && org !== "false" ? ["IsOrganizationTrail"] : [], ...globalEventsResetSkipped && wasRemoved("IncludeGlobalServiceEvents") && globalEvents !== false && globalEvents !== "false" ? ["IncludeGlobalServiceEvents"] : []];
+}
+function leftInPlaceWarning(logicalId, names, caller) {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::CloudTrail::Trail): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateTrail keeps a field it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::CloudTrail::Trail): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS value in place (whether CloudFormation resets it is unmeasured). Declare the intended value explicitly to change it.`;
+}
 var CloudTrailProvider = class {
 	client;
 	createClient;
@@ -48072,6 +48602,23 @@ var CloudTrailProvider = class {
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([["IsMultiRegionTrail", false], ["EnableLogFileValidation", false]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
+		"S3BucketName",
+		"IsLogging",
+		"TrailName",
+		"S3KeyPrefix",
+		"SnsTopicName",
+		"KMSKeyId",
+		"CloudWatchLogsLogGroupArn",
+		"CloudWatchLogsRoleArn",
+		"EventSelectors",
+		"AdvancedEventSelectors",
+		"InsightSelectors",
+		"AggregationConfigurations",
+		"Tags",
+		"IncludeGlobalServiceEvents",
+		"IsOrganizationTrail"
+	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
 		"S3BucketName",
 		"TrailName",
@@ -48201,7 +48748,8 @@ var CloudTrailProvider = class {
 		const s3BucketName = properties["S3BucketName"];
 		const s3KeyPrefix = clearOnUpdateRemoval(emptyToUndefined(properties["S3KeyPrefix"]), emptyToUndefined(previousProperties["S3KeyPrefix"]), "");
 		const isMultiRegionTrail = properties["IsMultiRegionTrail"];
-		const includeGlobalServiceEvents = isMultiRegionTrail === false ? clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false) : properties["IncludeGlobalServiceEvents"];
+		const globalEventsResetSkipped = isMultiRegionTrail !== false;
+		const includeGlobalServiceEvents = globalEventsResetSkipped ? properties["IncludeGlobalServiceEvents"] : clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false);
 		const enableLogFileValidation = properties["EnableLogFileValidation"];
 		const isLogging = properties["IsLogging"];
 		const cwPair = resolveCloudWatchLogsPair(properties);
@@ -48226,6 +48774,8 @@ var CloudTrailProvider = class {
 				SnsTopicName: snsTopicName,
 				IsOrganizationTrail: isOrganizationTrail
 			}));
+			const keptNames = removalsLeftInPlace(properties, previousProperties, context, globalEventsResetSkipped);
+			if (keptNames.length > 0) this.logger.warn(leftInPlaceWarning(logicalId, keptNames, context?.replayingState ? "rollback" : "deploy"));
 			const basicRead = readListBlock(properties["EventSelectors"], "AWS::CloudTrail::Trail EventSelectors");
 			const advancedRead = readListBlock(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors");
 			for (const read of [basicRead, advancedRead]) if (read.kind === "unusable") this.logger.warn(safeMsg`${read.detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
@@ -48642,7 +49192,8 @@ var CodeBuildProvider = class {
 				batchReportMode: cfnBuildBatchConfig["BatchReportMode"],
 				restrictions: restrictions ? {
 					maximumBuildsAllowed: restrictions["MaximumBuildsAllowed"],
-					computeTypesAllowed: restrictions["ComputeTypesAllowed"]
+					computeTypesAllowed: restrictions["ComputeTypesAllowed"],
+					fleetsAllowed: restrictions["FleetsAllowed"]
 				} : void 0
 			};
 		}
@@ -48951,6 +49502,7 @@ var CodeBuildProvider = class {
 				const r = {};
 				if (project.buildBatchConfig.restrictions.maximumBuildsAllowed !== void 0) r["MaximumBuildsAllowed"] = project.buildBatchConfig.restrictions.maximumBuildsAllowed;
 				if (project.buildBatchConfig.restrictions.computeTypesAllowed !== void 0) r["ComputeTypesAllowed"] = project.buildBatchConfig.restrictions.computeTypesAllowed;
+				if (project.buildBatchConfig.restrictions.fleetsAllowed !== void 0) r["FleetsAllowed"] = project.buildBatchConfig.restrictions.fleetsAllowed;
 				bbc["Restrictions"] = r;
 			}
 			if (project.buildBatchConfig.timeoutInMins !== void 0) bbc["TimeoutInMins"] = project.buildBatchConfig.timeoutInMins;
@@ -49519,6 +50071,28 @@ var CodeCommitRepositoryProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+const KEPT_ON_REMOVAL = [
+	"Description",
+	"ExecutionRoleArn",
+	"State",
+	"PolicyDetails",
+	"CreateInterval",
+	"RetainInterval",
+	"CopyTags",
+	"ExtendDeletion",
+	"CrossRegionCopyTargets",
+	"Exclusions"
+];
+function keptRemovedNames(properties, previousProperties, context) {
+	if (context?.desiredFromAwsReadback) return [];
+	const removed = context?.removedProperties;
+	return KEPT_ON_REMOVAL.filter((key) => previousProperties[key] != null && properties[key] == null && (removed === void 0 || removed.has(key) || properties[key] === null));
+}
+const keptOnRemovalWarning = (logicalId, names, caller) => {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::DLM::LifecyclePolicy): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateLifecyclePolicy keeps a field it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::DLM::LifecyclePolicy): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; UpdateLifecyclePolicy keeps a field it is not sent. Declare the intended value explicitly to change it.`;
+};
 const createLifecyclePolicyLatch = new AmbiguousCreateLatch("dlm:CreateLifecyclePolicy");
 const policiesCreatedByThisProcess = new RecentIdSet();
 var DLMLifecyclePolicyProvider = class {
@@ -49548,6 +50122,11 @@ var DLMLifecyclePolicyProvider = class {
 		"CrossRegionCopyTargets",
 		"Exclusions"
 	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
+		...KEPT_ON_REMOVAL,
+		"Tags",
+		"DefaultPolicy"
+	])]]);
 	getClient() {
 		if (!this.client) this.client = new DLMClient({
 			...ambientClientDefaults(),
@@ -49672,6 +50251,8 @@ var DLMLifecyclePolicyProvider = class {
 				...properties["CreateInterval"] != null && { CreateInterval: Number(properties["CreateInterval"]) },
 				...properties["RetainInterval"] != null && { RetainInterval: Number(properties["RetainInterval"]) }
 			}));
+			const keptNames = keptRemovedNames(properties, previousProperties, context);
+			if (keptNames.length > 0) this.logger.warn(keptOnRemovalWarning(logicalId, keptNames, context?.replayingState ? "rollback" : "deploy"));
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 			if (tagWarning !== void 0) this.logger.warn(tagWarning);
@@ -50875,6 +51456,173 @@ function tableIdentityFromGetTable(tableARN, namespace, name) {
 		name
 	};
 }
+function isCfnObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function desiredObject(properties, key, resourceType, logicalId, physicalId) {
+	const value = properties[key];
+	if (value === void 0) return void 0;
+	if (isCfnObject(value)) return value;
+	throw new ProvisioningError(`${key} for ${resourceType} ${logicalId} must be an object; refusing before any call`, resourceType, logicalId, physicalId);
+}
+function recordedObject(properties, key) {
+	const value = properties[key];
+	return isCfnObject(value) ? value : void 0;
+}
+var NotAnInteger = class extends Error {
+	member;
+	constructor(member) {
+		super(`${member} must be an integer`);
+		this.member = member;
+	}
+};
+function integer(value, member) {
+	if (value === void 0) return void 0;
+	const n = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	if (Number.isInteger(n)) return n;
+	throw new NotAnInteger(member);
+}
+function refuseNonIntegers(convert, key, resourceType, logicalId, physicalId) {
+	try {
+		return convert();
+	} catch (error) {
+		if (!(error instanceof NotAnInteger)) throw error;
+		throw new ProvisioningError(`${key}.${error.member} for ${resourceType} ${logicalId} must be an integer; refusing before any call`, resourceType, logicalId, physicalId, error);
+	}
+}
+function list(value) {
+	return Array.isArray(value) ? value : void 0;
+}
+function defined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function maintenanceStatus(value) {
+	return typeof value === "string" ? value.toLowerCase() : void 0;
+}
+function sdkEncryption(cfn) {
+	return defined({
+		sseAlgorithm: cfn["SSEAlgorithm"],
+		kmsKeyArn: cfn["KMSKeyArn"]
+	});
+}
+function sdkStorageClass(cfn) {
+	return defined({ storageClass: cfn["StorageClass"] });
+}
+function sdkReplication(cfn) {
+	return defined({
+		role: cfn["Role"],
+		rules: list(cfn["Rules"])?.map((rule) => defined({ destinations: list(isCfnObject(rule) ? rule["Destinations"] : void 0)?.map((destination) => defined({ destinationTableBucketARN: isCfnObject(destination) ? destination["DestinationTableBucketARN"] : void 0 })) }))
+	});
+}
+function sdkUnreferencedFileRemoval(cfn) {
+	const unreferencedDays = integer(cfn["UnreferencedDays"], "UnreferencedDays");
+	const nonCurrentDays = integer(cfn["NoncurrentDays"], "NoncurrentDays");
+	return defined({
+		status: maintenanceStatus(cfn["Status"]),
+		settings: unreferencedDays === void 0 && nonCurrentDays === void 0 ? void 0 : { icebergUnreferencedFileRemoval: defined({
+			unreferencedDays,
+			nonCurrentDays
+		}) }
+	});
+}
+function sdkCompaction(cfn) {
+	const targetFileSizeMB = integer(cfn["TargetFileSizeMB"], "TargetFileSizeMB");
+	return defined({
+		status: maintenanceStatus(cfn["Status"]),
+		settings: targetFileSizeMB === void 0 ? void 0 : { icebergCompaction: { targetFileSizeMB } }
+	});
+}
+function sdkSnapshotManagement(cfn) {
+	const minSnapshotsToKeep = integer(cfn["MinSnapshotsToKeep"], "MinSnapshotsToKeep");
+	const maxSnapshotAgeHours = integer(cfn["MaxSnapshotAgeHours"], "MaxSnapshotAgeHours");
+	return defined({
+		status: maintenanceStatus(cfn["Status"]),
+		settings: minSnapshotsToKeep === void 0 && maxSnapshotAgeHours === void 0 ? void 0 : { icebergSnapshotManagement: defined({
+			minSnapshotsToKeep,
+			maxSnapshotAgeHours
+		}) }
+	});
+}
+function mapObjects(value, map) {
+	return list(value)?.map((element) => map(isCfnObject(element) ? element : {}));
+}
+function sdkIcebergMetadata(cfn) {
+	const schema = isCfnObject(cfn["IcebergSchema"]) ? cfn["IcebergSchema"] : void 0;
+	const schemaV2 = isCfnObject(cfn["IcebergSchemaV2"]) ? cfn["IcebergSchemaV2"] : void 0;
+	const partitionSpec = isCfnObject(cfn["IcebergPartitionSpec"]) ? cfn["IcebergPartitionSpec"] : void 0;
+	const sortOrder = isCfnObject(cfn["IcebergSortOrder"]) ? cfn["IcebergSortOrder"] : void 0;
+	return defined({
+		schema: schema && defined({ fields: mapObjects(schema["SchemaFieldList"], (f) => defined({
+			id: integer(f["Id"], "IcebergSchema.SchemaFieldList.Id"),
+			name: f["Name"],
+			type: f["Type"],
+			required: f["Required"]
+		})) }),
+		schemaV2: schemaV2 && defined({
+			type: schemaV2["SchemaV2FieldType"],
+			fields: mapObjects(schemaV2["SchemaV2FieldList"], (f) => defined({
+				id: integer(f["Id"], "IcebergSchemaV2.SchemaV2FieldList.Id"),
+				name: f["Name"],
+				type: f["Type"],
+				required: f["Required"],
+				doc: f["Doc"]
+			})),
+			schemaId: integer(schemaV2["SchemaId"], "IcebergSchemaV2.SchemaId"),
+			identifierFieldIds: list(schemaV2["IdentifierFieldIds"])?.map((id) => integer(id, "IcebergSchemaV2.IdentifierFieldIds"))
+		}),
+		partitionSpec: partitionSpec && defined({
+			fields: mapObjects(partitionSpec["Fields"], (f) => defined({
+				sourceId: integer(f["SourceId"], "IcebergPartitionSpec.Fields.SourceId"),
+				transform: f["Transform"],
+				name: f["Name"],
+				fieldId: integer(f["FieldId"], "IcebergPartitionSpec.Fields.FieldId")
+			})),
+			specId: integer(partitionSpec["SpecId"], "IcebergPartitionSpec.SpecId")
+		}),
+		writeOrder: sortOrder && defined({
+			orderId: integer(sortOrder["OrderId"], "IcebergSortOrder.OrderId"),
+			fields: mapObjects(sortOrder["Fields"], (f) => defined({
+				sourceId: integer(f["SourceId"], "IcebergSortOrder.Fields.SourceId"),
+				transform: f["Transform"],
+				direction: f["Direction"],
+				nullOrder: f["NullOrder"]
+			}))
+		}),
+		properties: isCfnObject(cfn["TableProperties"]) ? cfn["TableProperties"] : void 0
+	});
+}
+const UPDATABLE_CONFIG_KEYS = {
+	"AWS::S3Tables::TableBucket": [
+		"EncryptionConfiguration",
+		"StorageClassConfiguration",
+		"MetricsConfiguration",
+		"UnreferencedFileRemoval",
+		"ReplicationConfiguration"
+	],
+	"AWS::S3Tables::Table": ["Compaction", "SnapshotManagement"]
+};
+function metricsEnabled(metrics, resourceType, logicalId, physicalId) {
+	const status = metrics?.["Status"];
+	if (status === void 0 || status === "Disabled") return false;
+	if (status === "Enabled") return true;
+	throw new ProvisioningError(safeMsg`MetricsConfiguration.Status for ${resourceType} ${logicalId} must be 'Enabled' or 'Disabled'; refusing before any call`, resourceType, logicalId, physicalId);
+}
+const TABLE_MAINTENANCE = [[
+	"Compaction",
+	"icebergCompaction",
+	sdkCompaction
+], [
+	"SnapshotManagement",
+	"icebergSnapshotManagement",
+	sdkSnapshotManagement
+]];
+const INTEGER_BEARING_CONFIGS = {
+	"AWS::S3Tables::TableBucket": [["UnreferencedFileRemoval", sdkUnreferencedFileRemoval]],
+	"AWS::S3Tables::Table": TABLE_MAINTENANCE.map(([key, , toSdk]) => [key, toSdk])
+};
+function cfnBucketStatus(status) {
+	return status === void 0 ? void 0 : `${status.charAt(0).toUpperCase()}${status.slice(1)}`;
+}
 function sentence(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -50891,7 +51639,15 @@ var S3TablesProvider = class {
 		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([
-		["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Set(["TableBucketName", "Tags"])],
+		["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Set([
+			"TableBucketName",
+			"Tags",
+			"EncryptionConfiguration",
+			"StorageClassConfiguration",
+			"MetricsConfiguration",
+			"UnreferencedFileRemoval",
+			"ReplicationConfiguration"
+		])],
 		["AWS::S3Tables::Namespace", /* @__PURE__ */ new Set(["TableBucketARN", "Namespace"])],
 		["AWS::S3Tables::Table", /* @__PURE__ */ new Set([
 			"TableBucketARN",
@@ -50900,9 +51656,24 @@ var S3TablesProvider = class {
 			"Name",
 			"OpenTableFormat",
 			"Format",
-			"Tags"
+			"Tags",
+			"IcebergMetadata",
+			"StorageClassConfiguration",
+			"Compaction",
+			"SnapshotManagement",
+			"WithoutMetadata"
 		])]
 	]);
+	getDriftUnknownPaths(resourceType) {
+		return resourceType === "AWS::S3Tables::Table" ? [
+			"IcebergMetadata",
+			"StorageClassConfiguration",
+			"WithoutMetadata"
+		] : [];
+	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		return resourceType === "AWS::S3Tables::TableBucket" && properties["ReplicationConfiguration"] === void 0 ? ["ReplicationConfiguration"] : [];
+	}
 	getClient() {
 		if (!this.client) {
 			this.client = new S3TablesClient({
@@ -50931,18 +51702,25 @@ var S3TablesProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		if (resourceType === "AWS::S3Tables::Table" || resourceType === "AWS::S3Tables::TableBucket") refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		for (const key of UPDATABLE_CONFIG_KEYS[resourceType] ?? []) desiredObject(properties, key, resourceType, logicalId, physicalId);
+		for (const [key, convert] of INTEGER_BEARING_CONFIGS[resourceType] ?? []) {
+			const value = desiredObject(properties, key, resourceType, logicalId, physicalId);
+			if (value !== void 0) refuseNonIntegers(() => convert(value), key, resourceType, logicalId, physicalId);
+		}
+		if (resourceType === "AWS::S3Tables::TableBucket") metricsEnabled(recordedObject(properties, "MetricsConfiguration"), resourceType, logicalId, physicalId);
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.recordedAttributes);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.recordedAttributes, (key) => context?.markUnsettled?.(key));
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask, recordedAttributes) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, mask, recordedAttributes, markUnsettled) {
 		if (resourceType === "AWS::S3Tables::Table") {
 			const rename = await this.planTableRename(logicalId, physicalId, resourceType, properties, mask);
 			await this.applyTableTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+			await this.applyTableMaintenanceUpdate(logicalId, physicalId, resourceType, properties, previousProperties, markUnsettled);
 			if (rename === void 0) return {
 				physicalId,
 				wasReplaced: false
@@ -50957,8 +51735,10 @@ var S3TablesProvider = class {
 				physicalId: rename.physicalId,
 				wasReplaced: false
 			};
-		} else if (resourceType === "AWS::S3Tables::TableBucket") await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
-		else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
+		} else if (resourceType === "AWS::S3Tables::TableBucket") {
+			await this.applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousProperties["Tags"], properties["Tags"], mask);
+			await this.applyTableBucketConfigUpdate(logicalId, physicalId, resourceType, properties, previousProperties, markUnsettled);
+		} else this.logger.debug(`Update is no-op for ${resourceType} ${logicalId}`);
 		return {
 			physicalId,
 			wasReplaced: false
@@ -50979,11 +51759,32 @@ var S3TablesProvider = class {
 		const tableBucketName = properties["TableBucketName"];
 		if (!tableBucketName) throw new ProvisioningError(`TableBucketName is required for S3 Table Bucket ${logicalId}`, resourceType, logicalId);
 		const tags = this.tagListToSdkMap(desiredTags);
+		const encryption = desiredObject(properties, "EncryptionConfiguration", resourceType, logicalId);
+		const storageClass = desiredObject(properties, "StorageClassConfiguration", resourceType, logicalId);
+		const metricsOn = metricsEnabled(desiredObject(properties, "MetricsConfiguration", resourceType, logicalId), resourceType, logicalId);
+		const unreferenced = desiredObject(properties, "UnreferencedFileRemoval", resourceType, logicalId);
+		const replication = desiredObject(properties, "ReplicationConfiguration", resourceType, logicalId);
+		const unreferencedValue = unreferenced && refuseNonIntegers(() => sdkUnreferencedFileRemoval(unreferenced), "UnreferencedFileRemoval", resourceType, logicalId);
+		let createdArn;
 		try {
 			const tableBucketARN = (await this.getCreateClient().send(new CreateTableBucketCommand({
 				name: tableBucketName,
+				...encryption !== void 0 && { encryptionConfiguration: sdkEncryption(encryption) },
+				...storageClass !== void 0 && { storageClassConfiguration: sdkStorageClass(storageClass) },
 				...tags !== void 0 && { tags }
 			}))).arn;
+			createdArn = tableBucketARN;
+			reportCreatedResource(logicalId, resourceType, tableBucketARN);
+			if (metricsOn) await this.getClient().send(new PutTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+			if (unreferencedValue !== void 0) await this.getClient().send(new PutTableBucketMaintenanceConfigurationCommand({
+				tableBucketARN,
+				type: "icebergUnreferencedFileRemoval",
+				value: unreferencedValue
+			}));
+			if (replication !== void 0) await this.getClient().send(new PutTableBucketReplicationCommand({
+				tableBucketARN,
+				configuration: sdkReplication(replication)
+			}));
 			this.logger.debug(`Successfully created S3 Table Bucket ${logicalId}: ${tableBucketARN}`);
 			return {
 				physicalId: tableBucketARN,
@@ -50991,7 +51792,104 @@ var S3TablesProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create S3 Table Bucket ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create S3 Table Bucket ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdArn !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
+		}
+	}
+	async applyTableBucketConfigUpdate(logicalId, tableBucketARN, resourceType, properties, previousProperties, markUnsettled) {
+		const changed = (key) => {
+			const next = desiredObject(properties, key, resourceType, logicalId, tableBucketARN);
+			return [next, !isDeepStrictEqual(next, recordedObject(previousProperties, key))];
+		};
+		const client = this.getClient();
+		const [encryption, encryptionChanged] = changed("EncryptionConfiguration");
+		if (encryptionChanged) {
+			if (encryption !== void 0) {
+				markUnsettled("EncryptionConfiguration");
+				await client.send(new PutTableBucketEncryptionCommand({
+					tableBucketARN,
+					encryptionConfiguration: sdkEncryption(encryption)
+				}));
+			} else this.warnRemovalKept(logicalId, "EncryptionConfiguration");
+		}
+		const [storageClass, storageClassChanged] = changed("StorageClassConfiguration");
+		if (storageClassChanged) {
+			if (storageClass !== void 0) {
+				markUnsettled("StorageClassConfiguration");
+				await client.send(new PutTableBucketStorageClassCommand({
+					tableBucketARN,
+					storageClassConfiguration: sdkStorageClass(storageClass)
+				}));
+			} else this.warnRemovalKept(logicalId, "StorageClassConfiguration");
+		}
+		const metricsOn = metricsEnabled(desiredObject(properties, "MetricsConfiguration", resourceType, logicalId, tableBucketARN), resourceType, logicalId);
+		const metricsWasOn = recordedObject(previousProperties, "MetricsConfiguration")?.["Status"] === "Enabled";
+		if (metricsOn && !metricsWasOn) {
+			markUnsettled("MetricsConfiguration");
+			await client.send(new PutTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+		} else if (!metricsOn && metricsWasOn) {
+			markUnsettled("MetricsConfiguration");
+			await this.deleteBucketConfig(tableBucketARN, new DeleteTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+		}
+		const [unreferenced, unreferencedChanged] = changed("UnreferencedFileRemoval");
+		if (unreferencedChanged) {
+			if (unreferenced !== void 0) {
+				markUnsettled("UnreferencedFileRemoval");
+				await client.send(new PutTableBucketMaintenanceConfigurationCommand({
+					tableBucketARN,
+					type: "icebergUnreferencedFileRemoval",
+					value: sdkUnreferencedFileRemoval(unreferenced)
+				}));
+			} else this.warnRemovalKept(logicalId, "UnreferencedFileRemoval");
+		}
+		const [replication, replicationChanged] = changed("ReplicationConfiguration");
+		if (replicationChanged) {
+			if (replication !== void 0) {
+				markUnsettled("ReplicationConfiguration");
+				await client.send(new PutTableBucketReplicationCommand({
+					tableBucketARN,
+					configuration: sdkReplication(replication)
+				}));
+			} else {
+				markUnsettled("ReplicationConfiguration");
+				await this.deleteBucketConfig(tableBucketARN, new DeleteTableBucketReplicationCommand({ tableBucketARN }));
+			}
+		}
+	}
+	async applyTableMaintenanceUpdate(logicalId, physicalId, resourceType, properties, previousProperties, markUnsettled) {
+		const writes = [];
+		for (const [key, type, toSdk] of TABLE_MAINTENANCE) {
+			const next = desiredObject(properties, key, resourceType, logicalId, physicalId);
+			if (isDeepStrictEqual(next, recordedObject(previousProperties, key))) continue;
+			if (next === void 0) this.warnRemovalKept(logicalId, key);
+			else writes.push({
+				key,
+				type,
+				value: toSdk(next)
+			});
+		}
+		if (writes.length === 0) return;
+		const table = await this.resolveTableParts(physicalId);
+		if (table === "not-found" || table === "unparseable") throw new ProvisioningError(table === "not-found" ? safeMsg`S3 Tables Table '${physicalId}' no longer exists (state is out of sync); ` + `refusing to record a maintenance configuration that was not applied` : compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+		for (const { key, type, value } of writes) {
+			markUnsettled(key);
+			await this.getClient().send(new PutTableMaintenanceConfigurationCommand({
+				...table,
+				type,
+				value
+			}));
+		}
+	}
+	warnRemovalKept(logicalId, key) {
+		this.logger.warn(safeMsg`${logicalId}: ${key} was removed from the template; cdkd leaves its current AWS value in ` + `place. Declare the value you want (e.g. its default) to change it.`);
+	}
+	async deleteBucketConfig(tableBucketARN, command) {
+		try {
+			await this.getClient().send(command);
+		} catch (error) {
+			if (!(error instanceof NotFoundException$7)) throw error;
+			await this.getClient().send(new GetTableBucketCommand({ tableBucketARN }));
 		}
 	}
 	async deleteTableBucket(logicalId, physicalId, resourceType, context) {
@@ -51126,6 +52024,17 @@ var S3TablesProvider = class {
 		const format = properties["OpenTableFormat"] ?? properties["Format"];
 		if (!format) throw new ProvisioningError(`OpenTableFormat is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
 		const tags = this.tagListToSdkMap(desiredTags);
+		const icebergCfn = desiredObject(properties, "IcebergMetadata", resourceType, logicalId);
+		const iceberg = icebergCfn && refuseNonIntegers(() => sdkIcebergMetadata(icebergCfn), "IcebergMetadata", resourceType, logicalId);
+		const storageClass = desiredObject(properties, "StorageClassConfiguration", resourceType, logicalId);
+		const maintenance = [];
+		for (const [key, type, toSdk] of TABLE_MAINTENANCE) {
+			const value = desiredObject(properties, key, resourceType, logicalId);
+			if (value !== void 0) maintenance.push({
+				type,
+				value: refuseNonIntegers(() => toSdk(value), key, resourceType, logicalId)
+			});
+		}
 		const physicalId = packCompositeId(resourceType, logicalId, [
 			{
 				name: "tableBucketARN",
@@ -51150,10 +52059,18 @@ var S3TablesProvider = class {
 				namespace,
 				name,
 				format,
+				...iceberg !== void 0 && { metadata: { iceberg } },
+				...storageClass !== void 0 && { storageClassConfiguration: sdkStorageClass(storageClass) },
 				...tags !== void 0 && { tags }
 			}));
 			tableCreated = true;
 			reportCreatedResource(logicalId, resourceType, physicalId);
+			for (const write of maintenance) await this.getClient().send(new PutTableMaintenanceConfigurationCommand({
+				tableBucketARN,
+				namespace,
+				name,
+				...write
+			}));
 			if (!response.tableARN) throw new ProvisioningError(`CreateTable did not return a tableARN for ${logicalId} (${physicalId}) — refusing to record an empty TableARN attribute`, resourceType, logicalId, physicalId);
 			const tableARN = response.tableARN;
 			this.logger.debug(`Successfully created S3 Tables Table ${logicalId}: ${physicalId}`);
@@ -51189,8 +52106,58 @@ var S3TablesProvider = class {
 		const result = {};
 		if (bucket.name !== void 0) result["TableBucketName"] = bucket.name;
 		result["Tags"] = await this.readTagsBestEffort(physicalId);
+		Object.assign(result, await this.readTableBucketConfigs(physicalId));
 		return result;
 	}
+	async readTableBucketConfigs(tableBucketARN, strict = false) {
+		const client = this.getClient();
+		const out = {};
+		await this.readConfig(out, "EncryptionConfiguration", async () => {
+			const e = (await client.send(new GetTableBucketEncryptionCommand({ tableBucketARN }))).encryptionConfiguration;
+			return defined({
+				SSEAlgorithm: e?.sseAlgorithm ?? "AES256",
+				KMSKeyArn: e?.kmsKeyArn
+			});
+		}, { SSEAlgorithm: "AES256" }, strict);
+		await this.readConfig(out, "StorageClassConfiguration", async () => {
+			return { StorageClass: (await client.send(new GetTableBucketStorageClassCommand({ tableBucketARN }))).storageClassConfiguration?.storageClass ?? "STANDARD" };
+		}, { StorageClass: "STANDARD" }, strict);
+		await this.readConfig(out, "MetricsConfiguration", async () => {
+			await client.send(new GetTableBucketMetricsConfigurationCommand({ tableBucketARN }));
+			return { Status: "Enabled" };
+		}, { Status: "Disabled" }, strict);
+		await this.readConfig(out, "UnreferencedFileRemoval", async () => {
+			const value = (await client.send(new GetTableBucketMaintenanceConfigurationCommand({ tableBucketARN }))).configuration?.icebergUnreferencedFileRemoval;
+			const settings = value?.settings?.icebergUnreferencedFileRemoval;
+			return defined({
+				Status: cfnBucketStatus(value?.status) ?? "Enabled",
+				UnreferencedDays: settings?.unreferencedDays,
+				NoncurrentDays: settings?.nonCurrentDays
+			});
+		}, { Status: "Enabled" }, strict);
+		await this.readConfig(out, "ReplicationConfiguration", async () => {
+			const c = (await client.send(new GetTableBucketReplicationCommand({ tableBucketARN }))).configuration;
+			if (c === void 0) return void 0;
+			return defined({
+				Role: c.role,
+				Rules: (c.rules ?? []).map((rule) => ({ Destinations: (rule.destinations ?? []).map((d) => ({ DestinationTableBucketARN: d.destinationTableBucketARN })) }))
+			});
+		}, "absent", strict);
+		return out;
+	}
+	async readConfig(out, key, read, notFound, strict = false) {
+		try {
+			const value = await read();
+			if (value !== void 0) out[key] = value;
+		} catch (err) {
+			if (err instanceof NotFoundException$7) {
+				if (notFound !== "absent") out[key] = notFound;
+				return;
+			}
+			if (strict) throw err;
+			this.logger.debug(safeMsg`readCurrentState: reading ${key} failed: ${describeAwsFailure(err).detail} — leaving it out`);
+		}
+	}
 	async readNamespaceCurrentState(physicalId) {
 		const [tableBucketARN, namespaceName] = physicalId.split("|");
 		if (!tableBucketARN || !namespaceName) return void 0;
@@ -51264,8 +52231,62 @@ var S3TablesProvider = class {
 			result["Format"] = resp.format;
 		}
 		result["Tags"] = resp.tableARN ? await this.readTagsBestEffort(resp.tableARN) : [];
+		Object.assign(result, await this.readTableMaintenance(physicalId, {
+			tableBucketARN,
+			namespace,
+			name
+		}));
 		return result;
 	}
+	async readTableMaintenance(physicalId, table, strict = false) {
+		const result = {};
+		let maintenance;
+		let maintenanceRead = true;
+		try {
+			maintenance = (await this.getClient().send(new GetTableMaintenanceConfigurationCommand(table))).configuration;
+		} catch (err) {
+			maintenanceRead = err instanceof NotFoundException$7;
+			if (!maintenanceRead) {
+				if (strict) throw err;
+				this.logger.debug(safeMsg`readCurrentState: reading the maintenance configuration of ${physicalId} failed: ` + safeMsg`${describeAwsFailure(err).detail} — leaving Compaction / SnapshotManagement out`);
+			}
+		}
+		if (maintenanceRead) {
+			const compaction = maintenance?.icebergCompaction;
+			const compactionSettings = compaction?.settings && "icebergCompaction" in compaction.settings ? compaction.settings.icebergCompaction : void 0;
+			result["Compaction"] = defined({
+				Status: compaction?.status ?? "enabled",
+				TargetFileSizeMB: compactionSettings?.targetFileSizeMB
+			});
+			const snapshots = maintenance?.icebergSnapshotManagement;
+			const snapshotSettings = snapshots?.settings && "icebergSnapshotManagement" in snapshots.settings ? snapshots.settings.icebergSnapshotManagement : void 0;
+			result["SnapshotManagement"] = defined({
+				Status: snapshots?.status ?? "enabled",
+				MinSnapshotsToKeep: snapshotSettings?.minSnapshotsToKeep,
+				MaxSnapshotAgeHours: snapshotSettings?.maxSnapshotAgeHours
+			});
+		}
+		return result;
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names) {
+		let live;
+		if (resourceType === "AWS::S3Tables::TableBucket") {
+			try {
+				await this.getClient().send(new GetTableBucketCommand({ tableBucketARN: physicalId }));
+			} catch (err) {
+				if (err instanceof NotFoundException$7) return RESOURCE_NOT_FOUND;
+				throw err;
+			}
+			live = await this.readTableBucketConfigs(physicalId, true);
+		} else if (resourceType === "AWS::S3Tables::Table") {
+			const table = await this.resolveTableParts(physicalId);
+			if (table === "not-found") return RESOURCE_NOT_FOUND;
+			if (table === "unparseable") throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+			if (await this.lookupTableArn(table.tableBucketARN, table.namespace, table.name) === null) return RESOURCE_NOT_FOUND;
+			live = await this.readTableMaintenance(physicalId, table, true);
+		} else return;
+		return Object.fromEntries(Object.entries(live).filter(([key]) => names.has(key)));
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::S3Tables::TableBucket": return this.importTableBucket(input);
@@ -52713,4 +53734,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DktsDsTf.js.map
+//# sourceMappingURL=provider-classes-DefoNqY7.js.map