@go-to-k/cdkd 0.315.0 → 0.317.0

package/dist/{provider-classes-B8kkAZqJ.js → provider-classes-DGFOKPO9.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
-import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-agWtoyga.js";
-import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, X as isProceedDbStatus, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
-import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine--bCIMkkk.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-s5--ZmBZ.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CMtAmRyw.js";
-import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-B1NRKBSQ.js";
-import { RDSProvider } from "./rds-provider-Cm3dsmFW.js";
-import { NeptuneProvider } from "./neptune-provider-BNxotnbp.js";
-import { ASGProvider } from "./asg-provider-DpNkEibf.js";
+import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWpHZk2l.js";
+import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
+import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-BpB3iPvn.js";
+import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-b0rYBotL.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-gTpDZhfz.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BZ-VVfXu.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-CspmK57I.js";
+import { RDSProvider } from "./rds-provider-BUNLNluC.js";
+import { NeptuneProvider } from "./neptune-provider-BfzktOKC.js";
+import { ASGProvider } from "./asg-provider-WornuySB.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -44,7 +44,7 @@ import * as zlib from "node:zlib";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DescribeGlobalClustersCommand as DescribeGlobalClustersCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveFromGlobalClusterCommand as RemoveFromGlobalClusterCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$18, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
@@ -59,13 +59,13 @@ import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFil
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventConfigurationCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventConfigurationCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, CreateWebhookCommand, DeleteProjectCommand, DeleteWebhookCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand, UpdateWebhookCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3VectorsClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableBucketMetricsConfigurationCommand, DeleteTableBucketReplicationCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableBucketEncryptionCommand, GetTableBucketMaintenanceConfigurationCommand, GetTableBucketMetricsConfigurationCommand, GetTableBucketReplicationCommand, GetTableBucketStorageClassCommand, GetTableCommand as GetTableCommand$1, GetTableMaintenanceConfigurationCommand, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, PutTableBucketEncryptionCommand, PutTableBucketMaintenanceConfigurationCommand, PutTableBucketMetricsConfigurationCommand, PutTableBucketReplicationCommand, PutTableBucketStorageClassCommand, PutTableMaintenanceConfigurationCommand, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
-//#region src/provisioning/providers/iam-policy-provider.ts
+// src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
 const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no delete issued";
 const POLICY_MALFORMED_TARGET_SKIP_REASON = "malformed Roles/Groups/Users in state — no delete issued";
@@ -590,8 +590,7 @@ var IAMPolicyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/iam-managed-policy-provider.ts
+// src/provisioning/providers/iam-managed-policy-provider.ts
 const principalsOf = (bag) => readPrincipalLists({
 	Groups: bag["Groups"],
 	Roles: bag["Roles"],
@@ -1217,8 +1216,7 @@ function recordedNonRootPath(arn) {
 	return path === "/" ? void 0 : path;
 }
 
-//#endregion
-//#region src/provisioning/providers/iam-instance-profile-provider.ts
+// src/provisioning/providers/iam-instance-profile-provider.ts
 const INSTANCE_PROFILE_TYPE = "AWS::IAM::InstanceProfile";
 function isInstanceProfileName(id) {
 	return /^[\w+=,.@-]{1,128}$/.test(id);
@@ -1485,8 +1483,7 @@ var IAMInstanceProfileProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/iam-access-key-provider.ts
+// src/provisioning/providers/iam-access-key-provider.ts
 const ACCESS_KEY_ID_PATTERN = /^AKIA[A-Z0-9]{16}$/;
 const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
 var IAMAccessKeyProvider = class {
@@ -1796,8 +1793,7 @@ var IAMAccessKeyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/iam-user-group-provider.ts
+// src/provisioning/providers/iam-user-group-provider.ts
 function isUserOrGroupName(resourceType, id) {
 	return resourceType === "AWS::IAM::User" ? /^[\w+=,.@-]{1,64}$/.test(id) : /^[\w+=,.@-]{1,128}$/.test(id);
 }
@@ -2938,15 +2934,13 @@ var IAMUserGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/utils/cfn-timestamp.ts
+// src/utils/cfn-timestamp.ts
 const OFFSETLESS_DATE_TIME = /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/;
 function parseCfnTimestamp(value) {
 	return new Date(OFFSETLESS_DATE_TIME.test(value) ? `${value}Z` : value);
 }
 
-//#endregion
-//#region src/provisioning/providers/s3-bucket-provider.ts
+// src/provisioning/providers/s3-bucket-provider.ts
 function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
 	const command = renderDisableCommand({
 		before: "aws s3api delete-bucket --bucket",
@@ -6059,8 +6053,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-bucket-policy-provider.ts
+// src/provisioning/providers/s3-bucket-policy-provider.ts
 const OAI_USER_ARN_RE = /^arn:aws[a-z-]*:iam::cloudfront:user\/CloudFront Origin Access Identity ([A-Z0-9]+)$/;
 const IAM_UNIQUE_ID_RE = /^A[A-Z0-9]{15,}$/;
 const oaiCanonicalUserIdCache = /* @__PURE__ */ new Map();
@@ -6262,8 +6255,7 @@ function isS3BucketName(value) {
 	return true;
 }
 
-//#endregion
-//#region src/provisioning/providers/sqs-queue-provider.ts
+// src/provisioning/providers/sqs-queue-provider.ts
 function serializeRedrivePolicy(value) {
 	if (value === null || value === void 0) return "";
 	if (typeof value === "object" && Object.keys(value).length === 0) return "";
@@ -6591,8 +6583,7 @@ var SQSQueueProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/policy-document-content.ts
+// src/provisioning/policy-document-content.ts
 const MASK = "***";
 const PERMANENT_CDKD_CODES = /* @__PURE__ */ new Set(["ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH"]);
 const MARKED_PERMANENT_CODE_PREFIXES = ["INTRINSIC_RESOLUTION_REFUSAL", "ROLLBACK_SECRET_REGION_AMBIGUOUS"];
@@ -6723,8 +6714,7 @@ function policyContentKey(document) {
 	return canonicalJson$3(value);
 }
 
-//#endregion
-//#region src/provisioning/providers/sqs-queue-policy-provider.ts
+// src/provisioning/providers/sqs-queue-policy-provider.ts
 const QUEUE_POLICY_UNREADABLE_SKIP_REASON = "the policy of a queue it wrote could not be read, so whether that queue still carries it is unknown";
 const QUEUE_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON = "the policy document it attempted could not be resolved right now to compare its queues with";
 const QUEUE_POLICY_MISMATCH_LEFT_REASON = "a queue it wrote carries a policy that does not match the document it attempted, so that queue was not cleared";
@@ -7026,8 +7016,7 @@ function splitQueueUrls(physicalId) {
 	return physicalId.split(",").filter((url) => url.length > 0);
 }
 
-//#endregion
-//#region src/provisioning/providers/create-ownership.ts
+// src/provisioning/providers/create-ownership.ts
 async function nameHeldBefore(lookup, isAbsent) {
 	try {
 		return await lookup() ? "held" : "free";
@@ -7044,8 +7033,7 @@ function skippedCleanupText(heldBefore, what, command) {
 	return heldBefore === "held" ? `${what} already existed before this create attempt (it may be an earlier attempt of this same deploy, an earlier failed deploy, or another stack's or someone else's resource), and the create handed it back, so cdkd did not delete it after the wiring failure; this deploy may have changed its configuration. A resource under a cdkd-generated name is adopted by the next deploy if its create-time settings are unchanged, so it needs no action if it is this stack's. Delete it only after confirming from its tags and creation time that no one else uses it: ${command}` : `cdkd could not tell whether this create made ${what} (the lookup before the create did not answer), so it was not deleted after the wiring failure. If this deploy created it, delete it before the next deploy: ${command}`;
 }
 
-//#endregion
-//#region src/provisioning/providers/sns-topic-provider.ts
+// src/provisioning/providers/sns-topic-provider.ts
 const SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT = "262144";
 function snsTopicAttributes(topicArn) {
 	return {
@@ -7601,8 +7589,7 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/providers/sns-subscription-provider.ts
+// src/provisioning/providers/sns-subscription-provider.ts
 const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
 const MUTABLE_ATTRIBUTES = [
 	"RawMessageDelivery",
@@ -7865,8 +7852,7 @@ function isPendingConfirmationError(error) {
 	return error instanceof InvalidParameterException && error.message.toLowerCase().includes("pending confirmation");
 }
 
-//#endregion
-//#region src/provisioning/providers/sns-topic-policy-provider.ts
+// src/provisioning/providers/sns-topic-policy-provider.ts
 const TOPIC_POLICY_UNREADABLE_SKIP_REASON = "the policy of a topic it wrote could not be read, so whether that topic still carries it is unknown";
 const TOPIC_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON = "the policy document it attempted could not be resolved right now to compare its topics with";
 const TOPIC_POLICY_MISMATCH_LEFT_REASON = "a topic it wrote carries a policy that does not match the document it attempted, so that topic was not reset";
@@ -8182,8 +8168,7 @@ function canonicalPolicy(text) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-create-client.ts
+// src/provisioning/providers/lambda-create-client.ts
 var LambdaCreateClientCache = class {
 	client;
 	shared;
@@ -8204,8 +8189,7 @@ var LambdaCreateClientCache = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-function-provider.ts
+// src/provisioning/providers/lambda-function-provider.ts
 function isFunctionName(id) {
 	return /^[A-Za-z0-9_-]{1,64}$/.test(id);
 }
@@ -9236,8 +9220,7 @@ var LambdaFunctionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-permission-provider.ts
+// src/provisioning/providers/lambda-permission-provider.ts
 const PERMISSION_FUNCTION_NAME_SKIP_REASON = "FunctionName missing from state — no delete issued";
 const PERMISSION_STATEMENT_ID_SKIP_REASON = "empty StatementId in state physicalId — no delete issued";
 const DEPLOY_SKIP_CAVEAT$1 = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the resource by hand.";
@@ -9468,8 +9451,7 @@ function permissionStatementId(logicalId) {
 	return statementId;
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-url-provider.ts
+// src/provisioning/providers/lambda-url-provider.ts
 var LambdaUrlProvider = class {
 	lambdaClient;
 	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
@@ -9678,8 +9660,7 @@ var LambdaUrlProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/orphan-report.ts
+// src/provisioning/providers/orphan-report.ts
 async function orphanCommandRegionArg(client, aws) {
 	let region;
 	try {
@@ -9744,8 +9725,7 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	log.warn(`${lead} (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${afterward} Inspect each before deleting anything: ${inspect}.${incomplete}`);
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-eventsource-provider.ts
+// src/provisioning/providers/lambda-eventsource-provider.ts
 const createEventSourceMappingLatch = new AmbiguousCreateLatch("lambda:CreateEventSourceMapping");
 const mappingsCreatedByThisProcess = new RecentIdSet();
 const ARN_SERVICE_RE = /^arn:aws[a-z0-9-]*:([^:]+):/;
@@ -10364,8 +10344,7 @@ var LambdaEventSourceMappingProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-layer-provider.ts
+// src/provisioning/providers/lambda-layer-provider.ts
 const publishLayerVersionLatch = new AmbiguousCreateLatch("lambda:PublishLayerVersion");
 const versionsPublishedByThisProcess = new RecentIdSet();
 function parseLayerCreatedDate(value) {
@@ -10556,8 +10535,7 @@ var LambdaLayerVersionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
+// src/provisioning/providers/lambda-event-invoke-config-provider.ts
 function stringOrUndefined(value) {
 	return typeof value === "string" ? value : void 0;
 }
@@ -10795,8 +10773,7 @@ var LambdaEventInvokeConfigProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-microvm-image-provider.ts
+// src/provisioning/providers/lambda-microvm-image-provider.ts
 var LambdaMicrovmImageProvider = class {
 	client;
 	logger = getLogger().child("LambdaMicrovmImageProvider");
@@ -11119,15 +11096,15 @@ function buildCommonImageInput(properties) {
 	return input;
 }
 function mapCodeArtifact(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	const uri = value["Uri"];
 	return typeof uri === "string" ? { uri } : void 0;
 }
 function mapLogging(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	if (value["Disabled"] === true) return { disabled: {} };
 	const cloudWatch = value["CloudWatch"];
-	if (isRecord$2(cloudWatch)) {
+	if (isRecord$3(cloudWatch)) {
 		const cw = {};
 		if (typeof cloudWatch["LogGroup"] === "string") cw.logGroup = cloudWatch["LogGroup"];
 		if (typeof cloudWatch["LogStream"] === "string") cw.logStream = cloudWatch["LogStream"];
@@ -11136,37 +11113,36 @@ function mapLogging(value) {
 }
 function mapCpuConfigurations(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$2).map((c) => ({ architecture: c["Architecture"] }));
+	return value.filter(isRecord$3).map((c) => ({ architecture: c["Architecture"] }));
 }
 function mapResources(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$2).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
+	return value.filter(isRecord$3).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
 }
 function mapHooks(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	return lowerFirstKeysDeep(value);
 }
 function mapKeyValueListToRecord(value) {
 	if (!Array.isArray(value)) return void 0;
 	const out = {};
-	for (const entry of value) if (isRecord$2(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
+	for (const entry of value) if (isRecord$3(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
 	return Object.keys(out).length > 0 ? out : void 0;
 }
 function lowerFirstKeysDeep(value) {
 	if (Array.isArray(value)) return value.map(lowerFirstKeysDeep);
-	if (isRecord$2(value)) {
+	if (isRecord$3(value)) {
 		const out = {};
 		for (const [k, v] of Object.entries(value)) out[k.charAt(0).toLowerCase() + k.slice(1)] = lowerFirstKeysDeep(v);
 		return out;
 	}
 	return value;
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-web-function-arns.ts
+// src/provisioning/providers/lambda-web-function-arns.ts
 const CHILD_ARN = /^(arn:[^:]+:lambda:[^:]+:\d{12}:web-function\/[^/]+)\/(revision|endpoint)\/([^/]+)$/;
 function parseWebFunctionChildArn(arn, kind) {
 	const match = CHILD_ARN.exec(arn);
@@ -11200,8 +11176,7 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-web-function-revision-provider.ts
+// src/provisioning/providers/lambda-web-function-revision-provider.ts
 const createRevisionLatch = new AmbiguousCreateLatch("lambda-web:CreateWebFunctionRevision");
 const revisionsCreatedByThisProcess = new RecentIdSet();
 var LambdaWebFunctionRevisionProvider = class {
@@ -11561,8 +11536,7 @@ function serviceConfigToCfn(config) {
 	return out;
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-web-function-endpoint-provider.ts
+// src/provisioning/providers/lambda-web-function-endpoint-provider.ts
 var LambdaWebFunctionEndpointProvider = class {
 	client;
 	logger = getLogger().child("LambdaWebFunctionEndpointProvider");
@@ -11924,8 +11898,7 @@ function buildAttributes$1(resp) {
 	return attributes;
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-network-connector-provider.ts
+// src/provisioning/providers/lambda-network-connector-provider.ts
 const POLL_INTERVAL_MS$2 = 1e3;
 const MAX_POLL_ATTEMPTS = 1200;
 var LambdaNetworkConnectorProvider = class {
@@ -12228,8 +12201,7 @@ function versionOfArn(arn) {
 	return match ? Number(match[1]) : void 0;
 }
 
-//#endregion
-//#region src/provisioning/delete-gone-wait.ts
+// src/provisioning/delete-gone-wait.ts
 async function waitForGoneAfterDelete(opts) {
 	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
 	const now = opts.now ?? Date.now;
@@ -12280,8 +12252,7 @@ async function waitForGoneAfterDelete(opts) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/dynamodb-table-provider.ts
+// src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
 	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
 }
@@ -14551,8 +14522,7 @@ function projectIndexesOnto(live, recorded, desired, attempted = /* @__PURE__ */
 	return kept.length > 0 ? kept : void 0;
 }
 
-//#endregion
-//#region src/provisioning/providers/logs-loggroup-provider.ts
+// src/provisioning/providers/logs-loggroup-provider.ts
 const LOG_GROUP_TYPE = "AWS::Logs::LogGroup";
 function isLogGroupName(id) {
 	return /^[A-Za-z0-9._/#-]{1,512}$/.test(id);
@@ -15051,8 +15021,7 @@ var LogsLogGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudwatch-alarm-provider.ts
+// src/provisioning/providers/cloudwatch-alarm-provider.ts
 function isDefaultEvaluationWindow(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -15420,8 +15389,7 @@ var CloudWatchAlarmProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudwatch-anomaly-detector-provider.ts
+// src/provisioning/providers/cloudwatch-anomaly-detector-provider.ts
 const ID_ATTRIBUTES = ["AnomalyDetectorId", "Id"];
 var CloudWatchAnomalyDetectorProvider = class {
 	cloudWatchClient;
@@ -15590,8 +15558,7 @@ function hasDescriptor(params) {
 	return params.SingleMetricAnomalyDetector !== void 0 || params.MetricMathAnomalyDetector !== void 0 || params.Namespace !== void 0 || params.MetricName !== void 0;
 }
 
-//#endregion
-//#region src/provisioning/providers/secretsmanager-secret-provider.ts
+// src/provisioning/providers/secretsmanager-secret-provider.ts
 function asJson(value) {
 	return value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
 }
@@ -16030,8 +15997,7 @@ var SecretsManagerSecretProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ssm-parameter-provider.ts
+// src/provisioning/providers/ssm-parameter-provider.ts
 var SSMParameterProvider = class SSMParameterProvider {
 	ssmClient;
 	createClient;
@@ -16321,8 +16287,7 @@ function ssmPoliciesParameter(policies) {
 	return JSON.stringify(policies);
 }
 
-//#endregion
-//#region src/provisioning/providers/eventbridge-rule-provider.ts
+// src/provisioning/providers/eventbridge-rule-provider.ts
 var EventBridgeRuleProvider = class {
 	eventBridgeClient;
 	logger = getLogger().child("EventBridgeRuleProvider");
@@ -16763,8 +16728,7 @@ var EventBridgeRuleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/eventbridge-bus-provider.ts
+// src/provisioning/providers/eventbridge-bus-provider.ts
 function sanitizeDeadLetterConfig(value) {
 	if (value === null || value === void 0) return void 0;
 	if (typeof value !== "object") return void 0;
@@ -17050,8 +17014,7 @@ var EventBridgeBusProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ec2-provider.ts
+// src/provisioning/providers/ec2-provider.ts
 const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
 	label: "VPCGatewayAttachment",
 	segments: ["gatewayId", "vpcId"]
@@ -21767,8 +21730,7 @@ function isDefaultEgressRule(rule) {
 	return true;
 }
 
-//#endregion
-//#region src/provisioning/providers/apigateway-provider.ts
+// src/provisioning/providers/apigateway-provider.ts
 const createAuthorizerLatch$1 = new AmbiguousCreateLatch("apigateway:CreateAuthorizer");
 const createDeploymentLatch = new AmbiguousCreateLatch("apigateway:CreateDeployment");
 const authorizersCreatedByThisProcess$1 = new RecentIdSet();
@@ -23366,8 +23328,7 @@ function methodChildCalls(ids, desired, previous) {
 	return calls;
 }
 
-//#endregion
-//#region src/provisioning/providers/apigatewayv2-provider.ts
+// src/provisioning/providers/apigatewayv2-provider.ts
 const createApiLatch = new AmbiguousCreateLatch("apigatewayv2:CreateApi");
 const createIntegrationLatch = new AmbiguousCreateLatch("apigatewayv2:CreateIntegration");
 const createAuthorizerLatch = new AmbiguousCreateLatch("apigatewayv2:CreateAuthorizer");
@@ -24836,8 +24797,7 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudfront-oai-provider.ts
+// src/provisioning/providers/cloudfront-oai-provider.ts
 var CloudFrontOAIProvider = class {
 	cloudFrontClient;
 	logger = getLogger().child("CloudFrontOAIProvider");
@@ -24986,8 +24946,7 @@ var CloudFrontOAIProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudfront-oac-provider.ts
+// src/provisioning/providers/cloudfront-oac-provider.ts
 var CloudFrontOACProvider = class {
 	cloudFrontClient;
 	createClient;
@@ -25152,8 +25111,7 @@ var CloudFrontOACProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudfront-distribution-provider.ts
+// src/provisioning/providers/cloudfront-distribution-provider.ts
 function shownId(id) {
 	return isPlainImportValue(id) ? id : VALUE_NOT_SHOWN;
 }
@@ -25831,8 +25789,7 @@ var CloudFrontDistributionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-case-convert.ts
+// src/provisioning/providers/agentcore-case-convert.ts
 function pascalToCamelCaseKeys(value, preserveKeys) {
 	if (value === null || value === void 0) return value;
 	if (Array.isArray(value)) return value.map((item) => pascalToCamelCaseKeys(item, preserveKeys));
@@ -25860,8 +25817,7 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 	return value;
 }
 
-//#endregion
-//#region src/provisioning/providers/agentcore-runtime-provider.ts
+// src/provisioning/providers/agentcore-runtime-provider.ts
 const CFN_MAP_KEYS = /* @__PURE__ */ new Set(["Tags", "AdvertisedScopeMapping"]);
 const SDK_MAP_KEYS = /* @__PURE__ */ new Set(["tags", "advertisedScopeMapping"]);
 const RUNTIME_TAGS_WHAT = "a map of tag keys to scalar values or a list of tags with a non-empty string Key and a scalar Value";
@@ -26155,8 +26111,7 @@ var AgentCoreRuntimeProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-browser-provider.ts
+// src/provisioning/providers/agentcore-browser-provider.ts
 const DEFAULT_BROWSER_ID = "aws.browser.v1";
 var AgentCoreBrowserProvider = class {
 	client;
@@ -26230,8 +26185,7 @@ var AgentCoreBrowserProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-code-interpreter-provider.ts
+// src/provisioning/providers/agentcore-code-interpreter-provider.ts
 const DEFAULT_CODE_INTERPRETER_ID = "aws.codeinterpreter.v1";
 var AgentCoreCodeInterpreterProvider = class {
 	client;
@@ -26300,8 +26254,7 @@ var AgentCoreCodeInterpreterProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-evaluator-provider.ts
+// src/provisioning/providers/agentcore-evaluator-provider.ts
 const CFN_PRESERVE_KEYS = /* @__PURE__ */ new Set(["AdditionalModelRequestFields"]);
 const SDK_PRESERVE_KEYS = /* @__PURE__ */ new Set(["additionalModelRequestFields"]);
 function evaluatorIdFromArn(arnOrId) {
@@ -26495,8 +26448,7 @@ var AgentCoreEvaluatorProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/stepfunctions-provider.ts
+// src/provisioning/providers/stepfunctions-provider.ts
 function stateMachineRevisionId(described) {
 	return described.revisionId ?? "INITIAL";
 }
@@ -26904,8 +26856,7 @@ function wasMeaningfullyConfigured(value, discriminatorKey) {
 	return value[discriminatorKey] !== void 0;
 }
 
-//#endregion
-//#region src/provisioning/providers/ecs-provider.ts
+// src/provisioning/providers/ecs-provider.ts
 const registerTaskDefinitionLatch = new AmbiguousCreateLatch("ecs:RegisterTaskDefinition");
 const taskDefinitionsRegisteredByThisProcess = new RecentIdSet();
 function familyOfTaskDefinitionArn(arn) {
@@ -28522,8 +28473,7 @@ var ECSProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/elbv2-provider.ts
+// src/provisioning/providers/elbv2-provider.ts
 function loadBalancerNameFromArn(arn) {
 	return nameFromElbv2Arn(arn, ":loadbalancer/", 3);
 }
@@ -30033,8 +29983,7 @@ var ELBv2Provider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/rds-dbproxy-provider.ts
+// src/provisioning/providers/rds-dbproxy-provider.ts
 const POLL_INTERVAL_MS$1 = 5e3;
 const POLL_TIMEOUT_MS$1 = 18e5;
 const RETAINED_ON_REMOVAL = [
@@ -30413,8 +30362,7 @@ var RDSDBProxyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/rds-dbproxy-endpoint-provider.ts
+// src/provisioning/providers/rds-dbproxy-endpoint-provider.ts
 const POLL_INTERVAL_MS = 5e3;
 const POLL_TIMEOUT_MS = 18e5;
 var RDSDBProxyEndpointProvider = class {
@@ -30716,8 +30664,7 @@ var RDSDBProxyEndpointProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/rds-dbproxy-targetgroup-provider.ts
+// src/provisioning/providers/rds-dbproxy-targetgroup-provider.ts
 const RDS_TARGET_IDENTIFIER = /^[A-Za-z][A-Za-z0-9-]{0,62}$/;
 function readTargetLists(values) {
 	const lists = {
@@ -31231,8 +31178,7 @@ function withoutKey(bag, key) {
 	return rest;
 }
 
-//#endregion
-//#region src/provisioning/providers/docdb-shared.ts
+// src/provisioning/providers/docdb-shared.ts
 function wrapDocDBFailure(logger, mask, error, build) {
 	const m = maskerOrIdentity(mask);
 	const failure = describeAwsFailure(error);
@@ -31315,8 +31261,7 @@ async function attachDocDBTags(client, logger, result, arn) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/docdb-provider.ts
+// src/provisioning/providers/docdb-provider.ts
 function masterUserPasswordToSend(properties, previousProperties, context) {
 	const desired = properties["MasterUserPassword"];
 	if (desired === void 0 || desired === null) return void 0;
@@ -31385,6 +31330,45 @@ const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "reboo
 function numberOrUndefined(value) {
 	return value == null ? void 0 : Number(value);
 }
+function docdbGlobalClusterId(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function withRecordedGlobalCluster(bag, previousProperties) {
+	const { GlobalClusterIdentifier: _dropped, ...rest } = bag;
+	const previous = previousProperties["GlobalClusterIdentifier"];
+	return previous === void 0 ? rest : {
+		...rest,
+		GlobalClusterIdentifier: previous
+	};
+}
+function readableGlobalClusterId(value) {
+	return value == null || typeof value === "string";
+}
+const DETACH_MAX_WAIT_MS = 18e5;
+const GLOBAL_CLUSTER_BUSY_MAX_WAIT_MS = 6e5;
+const TRANSIENT_DETACH_FAULTS = /* @__PURE__ */ new Set([
+	"InvalidDBClusterStateFault",
+	"InvalidGlobalClusterStateFault",
+	"ThrottlingException",
+	"Throttling",
+	"RequestLimitExceeded"
+]);
+function awsErrorName(error) {
+	return error?.name ?? "";
+}
+var GlobalClusterDetachError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "GlobalClusterDetachError";
+	}
+};
+function docdbEngineVersionToSend(properties, previousProperties, context) {
+	if (context?.replayingState === true) return void 0;
+	const desired = properties["EngineVersion"];
+	if (desired == null) return void 0;
+	const previous = previousProperties["EngineVersion"];
+	return previous != null && String(previous) === String(desired) ? void 0 : desired;
+}
 function clusterPortToSend(properties, previousProperties) {
 	if (properties["Port"] != null) return Number(properties["Port"]);
 	if (previousProperties["Port"] == null) return void 0;
@@ -31432,6 +31416,7 @@ var DocDBProvider = class {
 		"Tags",
 		"MasterUserPassword",
 		"RotateMasterUserPassword",
+		"GlobalClusterIdentifier",
 		...DOCDB_CLUSTER_KEPT_ON_REMOVAL,
 		...DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
@@ -31463,6 +31448,7 @@ var DocDBProvider = class {
 		"AvailabilityZones",
 		"CopyTagsToSnapshot",
 		"EnableCloudwatchLogsExports",
+		"GlobalClusterIdentifier",
 		"ManageMasterUserPassword",
 		"MasterUserSecretKmsKeyId",
 		"NetworkType",
@@ -31513,9 +31499,9 @@ var DocDBProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::DocDB::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, context);
+			case "AWS::DocDB::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, properties, context);
 			case "AWS::DocDB::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -31534,6 +31520,11 @@ var DocDBProvider = class {
 		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, true);
 		const managedPassword = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
 		const password = this.passwordBesideManaged(managedPassword, false, properties["MasterUserPassword"], resourceType, logicalId, origin);
+		if (!readableGlobalClusterId(properties["GlobalClusterIdentifier"])) {
+			if (!replayingState) this.refuseBlock(logicalId, resourceType, void 0, "GlobalClusterIdentifier is not a string");
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded GlobalClusterIdentifier is unusable, so it is not sent.`);
+		}
+		const globalClusterId = docdbGlobalClusterId(properties["GlobalClusterIdentifier"]);
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
@@ -31560,6 +31551,7 @@ var DocDBProvider = class {
 				MasterUserSecretKmsKeyId: properties["MasterUserSecretKmsKeyId"],
 				NetworkType: properties["NetworkType"],
 				StorageType: properties["StorageType"],
+				...globalClusterId !== void 0 && { GlobalClusterIdentifier: globalClusterId },
 				...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
 				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
 				...tags.length > 0 && { Tags: tags }
@@ -31588,7 +31580,9 @@ var DocDBProvider = class {
 			physicalId
 		};
 		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, false);
+		const globalClusterPlan = await this.planGlobalClusterUpdate(physicalId, properties, previousProperties, resourceType, logicalId, origin, context?.desiredFromAwsReadback === true);
 		const logExportConfig = logTypes === void 0 ? void 0 : docdbLogExportChange(logTypes, docdbStringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
+		let detachedFrom;
 		try {
 			const credentials = await this.planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin);
 			const vpcSgIds = properties["VpcSecurityGroupIds"];
@@ -31602,10 +31596,16 @@ var DocDBProvider = class {
 			const storageChange = declaredChange(storageType, previousProperties["StorageType"], live?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE);
 			const previousScaling = docdbServerlessScaling(previousProperties["ServerlessV2ScalingConfiguration"]);
 			const scalingChange = scaling != null && (scaling.MinCapacity !== previousScaling?.MinCapacity || scaling.MaxCapacity !== previousScaling?.MaxCapacity);
+			if (globalClusterPlan.kind === "detach") {
+				if (await this.detachFromGlobalCluster(logicalId, physicalId, globalClusterPlan.globalClusterId, {
+					beforeDelete: false,
+					removeProtection: false
+				}, { stripped: false }, maskerOrIdentity(context?.maskSecrets))) detachedFrom = globalClusterPlan.globalClusterId;
+			}
 			this.markChangedUnsettled(CLUSTER_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await this.getClient().send(new ModifyDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
-				EngineVersion: properties["EngineVersion"],
+				EngineVersion: docdbEngineVersionToSend(properties, previousProperties, context),
 				DeletionProtection: properties["DeletionProtection"],
 				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
 				PreferredBackupWindow: properties["PreferredBackupWindow"],
@@ -31666,19 +31666,21 @@ var DocDBProvider = class {
 					...described,
 					Port: portToSend
 				} : described),
-				...credentials.effectiveProperties !== void 0 && { effectiveProperties: credentials.effectiveProperties }
+				...(credentials.effectiveProperties !== void 0 || globalClusterPlan.kind === "keep") && { effectiveProperties: globalClusterPlan.kind === "keep" ? withRecordedGlobalCluster(credentials.effectiveProperties ?? properties, previousProperties) : credentials.effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
+			if (error instanceof GlobalClusterDetachError) throw markNonRetryable(new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${error.message}`, resourceType, logicalId, physicalId, error));
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const detachedNote = detachedFrom !== void 0 ? " (it was already detached from its global cluster, and stays a standalone cluster)" : "";
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}${detachedNote}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async deleteDBCluster(logicalId, physicalId, resourceType, context) {
+	async deleteDBCluster(logicalId, physicalId, resourceType, properties, context) {
 		await deleteWithProtectionCompensation({
 			registry: this.protectionFlips,
 			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
-			run: (flip) => this.deleteDBClusterOnce(logicalId, physicalId, resourceType, context, flip),
+			run: (flip) => this.deleteDBClusterOnce(logicalId, physicalId, resourceType, properties, context, flip),
 			compensation: {
 				logicalId,
 				physicalId,
@@ -31702,8 +31704,10 @@ var DocDBProvider = class {
 			}
 		});
 	}
-	async deleteDBClusterOnce(logicalId, physicalId, resourceType, context, flip) {
+	async deleteDBClusterOnce(logicalId, physicalId, resourceType, properties, context, flip) {
 		this.logger.debug(`Deleting DocDB DBCluster ${logicalId}`);
+		let detachedFrom;
+		const progress = { stripped: false };
 		try {
 			if (context?.removeProtection === true) try {
 				await observeThenDisableProtection({
@@ -31725,6 +31729,11 @@ var DocDBProvider = class {
 			} catch (disableError) {
 				if (!isDocDBNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DocDB DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
 			}
+			const globalClusterId = docdbGlobalClusterId(properties?.["GlobalClusterIdentifier"]);
+			if (globalClusterId !== void 0) detachedFrom = await this.detachFromGlobalCluster(logicalId, physicalId, globalClusterId, {
+				beforeDelete: true,
+				removeProtection: context?.removeProtection === true
+			}, progress, maskerOrIdentity(context?.maskSecrets)) ? globalClusterId : void 0;
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			const sendDelete = () => this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
@@ -31740,6 +31749,10 @@ var DocDBProvider = class {
 			this.logger.debug(`Successfully initiated deletion of DocDB DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(logicalId, physicalId);
 		} catch (error) {
+			if (error instanceof GlobalClusterDetachError) {
+				const detachFailure = markNotGone(markNonRetryable(new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${error.message}`, resourceType, logicalId, physicalId, error)));
+				throw progress.stripped ? markDeleteStarted(detachFailure) : detachFailure;
+			}
 			if (isDocDBNotFoundError(error, "DBClusterNotFoundFault")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
@@ -31748,7 +31761,95 @@ var DocDBProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const detachedNote = detachedFrom !== void 0 ? " (it was already detached from its global cluster, and stays a standalone cluster)" : "";
+			const failure = this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}${detachedNote}`, resourceType, logicalId, physicalId, cause));
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
+		}
+	}
+	wrapGlobalClusterDetachError(error, mask, build) {
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(build(mask(failure.detail))));
+		return new GlobalClusterDetachError(build(mask(failure.summary)));
+	}
+	async detachFromGlobalCluster(logicalId, physicalId, globalClusterId, { beforeDelete, removeProtection }, progress, mask) {
+		let cluster = await this.describeDBCluster(physicalId);
+		for (let i = 0; removeProtection && cluster?.DeletionProtection === true && i < 6; i++) {
+			await this.sleep(5e3);
+			cluster = await this.describeDBCluster(physicalId);
+		}
+		if (cluster === void 0) return false;
+		if (beforeDelete && cluster.DeletionProtection === true) throw new GlobalClusterDetachError(safeMsg`${physicalId} has deletion protection on, so cdkd did not detach it from global cluster ${globalClusterId}; turn it off (cdkd destroy --remove-protection does) and re-run`);
+		const clusterArn = cluster.DBClusterArn;
+		if (typeof clusterArn !== "string" || clusterArn === "") throw new GlobalClusterDetachError(safeMsg`could not read the ARN of ${physicalId} to detach it from global cluster ${globalClusterId}`);
+		const startTime = Date.now();
+		let delay = 5e3;
+		const backOff = async () => {
+			if (Date.now() - startTime >= DETACH_MAX_WAIT_MS) throw new GlobalClusterDetachError(safeMsg`timed out waiting for ${physicalId} to leave global cluster ${globalClusterId}`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		};
+		const readMembers = async (build) => {
+			try {
+				return (await this.getClient().send(new DescribeGlobalClustersCommand$1({ GlobalClusterIdentifier: globalClusterId }))).GlobalClusters?.[0]?.GlobalClusterMembers ?? [];
+			} catch (error) {
+				const name = awsErrorName(error);
+				if (name === "GlobalClusterNotFoundFault") return [];
+				if (TRANSIENT_DETACH_FAULTS.has(name)) return void 0;
+				throw this.wrapGlobalClusterDetachError(error, mask, build);
+			}
+		};
+		const isMember = async (build) => {
+			return (await readMembers(build))?.some((member) => member.DBClusterArn === clusterArn);
+		};
+		for (;;) {
+			const members = await readMembers((text) => safeMsg`could not read whether ${physicalId} is a member of global cluster ${globalClusterId} (${text})`);
+			if (members !== void 0) {
+				const own = members.find((member) => member.DBClusterArn === clusterArn);
+				if (own === void 0) return false;
+				const others = members.filter((member) => member.DBClusterArn !== clusterArn).map((member) => /^arn:[^:]*:rds:[^:]*:[^:]*:cluster:(.+)$/.exec(member.DBClusterArn ?? "")?.[1] ?? "(unnamed)");
+				if (own.IsWriter === true && others.length > 0) throw new GlobalClusterDetachError(safeMsg`${physicalId} is the primary of global cluster ${globalClusterId}, which still has other members (${others.join(", ")}); detach or delete them first, then re-run`);
+				break;
+			}
+			await backOff();
+		}
+		let globalBusySince;
+		for (;;) try {
+			await this.getClient().send(new RemoveFromGlobalClusterCommand$1({
+				GlobalClusterIdentifier: globalClusterId,
+				DbClusterIdentifier: clusterArn
+			}));
+			progress.stripped = true;
+			this.logger.info(beforeDelete ? safeMsg`Detaching DocDB DBCluster ${logicalId} from global cluster ${globalClusterId} before the delete` : safeMsg`Detaching DocDB DBCluster ${logicalId} from global cluster ${globalClusterId}: GlobalClusterIdentifier was removed`);
+			break;
+		} catch (error) {
+			const name = awsErrorName(error);
+			if (name === "GlobalClusterNotFoundFault") return false;
+			if (name === "DBClusterNotFoundFault") {
+				progress.stripped = true;
+				break;
+			}
+			if (name === "InvalidGlobalClusterStateFault") {
+				globalBusySince ??= Date.now();
+				if (Date.now() - globalBusySince >= GLOBAL_CLUSTER_BUSY_MAX_WAIT_MS) throw this.wrapGlobalClusterDetachError(error, mask, (text) => safeMsg`detaching ${physicalId} from global cluster ${globalClusterId} failed (${text})`);
+			}
+			if (!TRANSIENT_DETACH_FAULTS.has(name)) throw this.wrapGlobalClusterDetachError(error, mask, (text) => safeMsg`detaching ${physicalId} from global cluster ${globalClusterId} failed (${text})`);
+			await backOff();
+		}
+		for (;;) {
+			if (await isMember((text) => safeMsg`could not confirm ${physicalId} left global cluster ${globalClusterId} (${text})`) === false) {
+				let after;
+				try {
+					after = await this.describeDBCluster(physicalId);
+				} catch (error) {
+					if (!TRANSIENT_DETACH_FAULTS.has(awsErrorName(error))) throw error;
+					await backOff();
+					continue;
+				}
+				if (after === void 0) return true;
+				this.logger.debug(safeMsg`DocDB DBCluster ${physicalId} status after the detach: ${after.Status}`);
+				if (after.Status === "available") return true;
+			}
+			await backOff();
 		}
 	}
 	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
@@ -31864,6 +31965,53 @@ var DocDBProvider = class {
 	refuseBlock(logicalId, resourceType, physicalId, text) {
 		throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType === "AWS::DocDB::DBInstance" ? "DocDB DBInstance" : "DocDB DBCluster"} ${logicalId}: ${text}; nothing was changed.`, resourceType, logicalId, physicalId));
 	}
+	async planGlobalClusterUpdate(physicalId, properties, previousProperties, resourceType, logicalId, origin, fromReadback) {
+		const desired = properties["GlobalClusterIdentifier"];
+		if (fromReadback && desired === void 0) return previousProperties["GlobalClusterIdentifier"] !== void 0 ? { kind: "keep" } : { kind: "none" };
+		const readable = readableGlobalClusterId(desired);
+		const desiredId = docdbGlobalClusterId(desired);
+		const previousId = docdbGlobalClusterId(previousProperties["GlobalClusterIdentifier"]);
+		if (readable && desiredId === previousId) return { kind: "none" };
+		if (readable && desiredId === void 0 && previousId !== void 0) {
+			if (origin.stateBorne) {
+				const member = await this.liveGlobalClusterMatches(physicalId, previousId);
+				if (member === void 0) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the cluster's membership of global cluster ${previousId} could not be read, so the record treats it as absent; if it is still a member, a later destroy may need aws docdb remove-from-global-cluster first.`);
+				if (member !== true) return { kind: "none" };
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): the restored state has no GlobalClusterIdentifier, but cdkd did not add the cluster to global cluster ${previousId} (it was already a member), so it leaves it there.`);
+				return { kind: "keep" };
+			}
+			return {
+				kind: "detach",
+				globalClusterId: previousId
+			};
+		}
+		if (readable && await this.liveGlobalClusterMatches(physicalId, desiredId) === true) return { kind: "none" };
+		const text = readable ? "Changing GlobalClusterIdentifier to a different global cluster is not supported unless the cluster is already part of the target global cluster (CloudFormation refuses it too). To join a different global cluster, replace the cluster, for example with a new DBClusterIdentifier" : "GlobalClusterIdentifier is not a string";
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, physicalId, text);
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${text}; the cluster keeps its current global cluster membership.`);
+		return { kind: "keep" };
+	}
+	async liveGlobalClusterMatches(physicalId, desiredId) {
+		try {
+			const arn = (await this.describeDBCluster(physicalId))?.DBClusterArn;
+			if (typeof arn !== "string" || arn === "") return void 0;
+			let liveId;
+			let marker;
+			do {
+				const page = await this.getClient().send(new DescribeGlobalClustersCommand$1({ ...marker !== void 0 && { Marker: marker } }));
+				const holder = (page.GlobalClusters ?? []).find((global) => (global.GlobalClusterMembers ?? []).some((member) => member.DBClusterArn === arn));
+				if (holder !== void 0) {
+					liveId = holder.GlobalClusterIdentifier;
+					break;
+				}
+				marker = page.Marker;
+			} while (marker);
+			return liveId === desiredId;
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not read a DocDB cluster's global cluster membership: ${describeAwsFailure(error).summary}`);
+			return;
+		}
+	}
 	readClusterBlocks(properties, resourceType, logicalId, origin, creating) {
 		const leaveOut = (key) => {
 			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
@@ -32149,6 +32297,7 @@ var DocDBProvider = class {
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::DocDB::DBCluster") return [
 			"AvailabilityZones",
+			"GlobalClusterIdentifier",
 			"MasterUserSecretKmsKeyId",
 			"RotateMasterUserPassword"
 		];
@@ -32307,8 +32456,7 @@ function securityGroupListChanged(sent, previous) {
 	return [...sent].sort().join(" ") !== [...before].sort().join(" ");
 }
 
-//#endregion
-//#region src/provisioning/providers/docdb-subnet-group-provider.ts
+// src/provisioning/providers/docdb-subnet-group-provider.ts
 var DocDBSubnetGroupProvider = class {
 	docdbClient;
 	createClient;
@@ -32445,8 +32593,7 @@ var DocDBSubnetGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/route53-provider.ts
+// src/provisioning/providers/route53-provider.ts
 function isZoneDisabledForMutationError(error) {
 	return error instanceof Error && error.message.includes("is marked disabled for mutation");
 }
@@ -33601,8 +33748,7 @@ var Route53Provider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/wafv2-provider.ts
+// src/provisioning/providers/wafv2-provider.ts
 function sanitizeDescription(value) {
 	if (value === void 0 || value === null) return void 0;
 	if (typeof value === "string" && value.length === 0) return void 0;
@@ -34068,8 +34214,7 @@ var WAFv2WebACLProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cognito-provider.ts
+// src/provisioning/providers/cognito-provider.ts
 const USER_POOL_ECHO_MEMBERS = [
 	"LambdaConfig",
 	"UserPoolAddOns",
@@ -35216,11 +35361,11 @@ var CognitoUserPoolProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/elasticache-provider.ts
+// src/provisioning/providers/elasticache-provider.ts
 const CACHE_DELETE_WAIT_MS = Math.max(6e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "DELETE"));
 const NODE_TYPE_MODIFY_WAIT_MS = Math.max(36e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "UPDATE"));
 const MODIFY_DROPPED_AFTER_MS = 12e4;
+const TERMINAL_CLUSTER_STATUSES = /* @__PURE__ */ new Set(["restore-failed", "incompatible-network"]);
 function availabilityZonesNotCovered(a, b) {
 	const remaining = [...b];
 	const out = [];
@@ -35325,6 +35470,7 @@ var ElastiCacheProvider = class {
 		"Tags",
 		"NotificationTopicArn",
 		"SnapshotName",
+		"SnapshotArns",
 		"LogDeliveryConfigurations",
 		"NetworkType",
 		"IpDiscovery",
@@ -35476,6 +35622,7 @@ var ElastiCacheProvider = class {
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				NotificationTopicArn: properties["NotificationTopicArn"],
 				SnapshotName: properties["SnapshotName"],
+				SnapshotArns: properties["SnapshotArns"],
 				LogDeliveryConfigurations: properties["LogDeliveryConfigurations"],
 				NetworkType: properties["NetworkType"],
 				IpDiscovery: properties["IpDiscovery"],
@@ -35725,6 +35872,7 @@ var ElastiCacheProvider = class {
 			const cluster = await this.describeCacheCluster(cacheClusterId);
 			const status = cluster?.CacheClusterStatus;
 			this.logger.debug(`CacheCluster ${cacheClusterId} status: ${status}`);
+			if (status !== void 0 && TERMINAL_CLUSTER_STATUSES.has(status)) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is ${status} and will not become available. Check the cluster's events (aws elasticache describe-events --source-type cache-cluster --source-identifier ${cacheClusterId}) for the reason.`);
 			const liveNodeType = cluster?.CacheNodeType;
 			const removalDone = removedNodeIds.length === 0 || cluster?.CacheNodes !== void 0 && !cluster.CacheNodes.some((n) => n.CacheNodeId !== void 0 && removedNodeIds.includes(n.CacheNodeId));
 			if (status === "available" && removalDone && (expectedNodeType === void 0 || liveNodeType === expectedNodeType)) return;
@@ -35756,6 +35904,9 @@ var ElastiCacheProvider = class {
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
+	getDriftUnknownPaths(resourceType) {
+		return resourceType === "AWS::ElastiCache::CacheCluster" ? ["SnapshotArns", "SnapshotName"] : [];
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
 			case "AWS::ElastiCache::CacheCluster": return this.readCacheCluster(physicalId);
@@ -35863,8 +36014,7 @@ var ElastiCacheProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/servicediscovery-provider.ts
+// src/provisioning/providers/servicediscovery-provider.ts
 const PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL = 60;
 const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
 const CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES = 9;
@@ -36797,8 +36947,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/appsync-provider.ts
+// src/provisioning/providers/appsync-provider.ts
 const createGraphqlApiLatch = new AmbiguousCreateLatch("CreateGraphqlApi");
 const graphqlApisCreatedByThisProcess = new RecentIdSet();
 const MAX_GRAPHQL_API_LIST_PAGES = 40;
@@ -38460,8 +38609,7 @@ var AppSyncProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/glue-provider.ts
+// src/provisioning/providers/glue-provider.ts
 const GLUE_TABLE_ID_FORMAT = {
 	label: "Glue Table",
 	segments: ["databaseName", "tableName"]
@@ -40802,8 +40950,7 @@ var GlueTriggerProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/kms-provider.ts
+// src/provisioning/providers/kms-provider.ts
 const createKeyLatch = new AmbiguousCreateLatch("CreateKey");
 const keysCreatedByThisProcess = new RecentIdSet();
 const pendingKeys = /* @__PURE__ */ new Map();
@@ -41434,8 +41581,7 @@ function templateBool(value) {
 	return Boolean(value);
 }
 
-//#endregion
-//#region src/provisioning/providers/budgets-budget-provider.ts
+// src/provisioning/providers/budgets-budget-provider.ts
 const BUDGET_LIST_WHAT = {
 	NotificationsWithSubscribers: "entries with a Notification (NotificationType, ComparisonOperator, numeric Threshold) and Subscribers (SubscriptionType, Address)",
 	ResourceTags: "tags with a string Key"
@@ -42170,8 +42316,7 @@ var BudgetsBudgetProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/kinesis-provider.ts
+// src/provisioning/providers/kinesis-provider.ts
 function isKmsEncryption(value) {
 	if (!value) return false;
 	return value["EncryptionType"] === "KMS";
@@ -42831,8 +42976,7 @@ var KinesisStreamProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/kinesis-streamconsumer-provider.ts
+// src/provisioning/providers/kinesis-streamconsumer-provider.ts
 function consumerArnParts(consumerArn) {
 	const at = consumerArn.lastIndexOf("/consumer/");
 	if (at <= 0) return void 0;
@@ -43053,8 +43197,7 @@ function tagListToMap(tags) {
 	return Object.fromEntries(tags.map((t) => [t.Key, t.Value]));
 }
 
-//#endregion
-//#region src/provisioning/providers/scheduler-schedule-provider.ts
+// src/provisioning/providers/scheduler-schedule-provider.ts
 const RECORDED_CREATION_DATE_KEY = "cdkd:CreationDate";
 function recordedCreationDate(attributes) {
 	const value = attributes?.[RECORDED_CREATION_DATE_KEY];
@@ -43490,8 +43633,7 @@ var SchedulerScheduleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/pipes-provider.ts
+// src/provisioning/providers/pipes-provider.ts
 const PIPE_TYPE = "AWS::Pipes::Pipe";
 function isPipeName(id) {
 	return /^[.\-_A-Za-z0-9]{1,64}$/.test(id);
@@ -44125,8 +44267,7 @@ var PipesPipeProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/server-clock.ts
+// src/provisioning/providers/server-clock.ts
 const SERVER_CLOCK_MARGIN_MS = 5e3;
 const CLOCK_FALLBACK_MARGIN_MS = 3e5;
 const readings = /* @__PURE__ */ new WeakMap();
@@ -44163,8 +44304,7 @@ function earliestOwnCreationTime(firstSentLocalMs, reading) {
 	return firstSentLocalMs + (reading.serverDateMs - reading.receivedAtMs) - SERVER_CLOCK_MARGIN_MS;
 }
 
-//#endregion
-//#region src/provisioning/providers/efs-provider.ts
+// src/provisioning/providers/efs-provider.ts
 function samePosixUser(requested, described) {
 	if (requested == null || described == null) return requested == null && described == null;
 	const gids = (user) => JSON.stringify([...new Set(user.SecondaryGids ?? [])].sort((a, b) => a - b));
@@ -45006,8 +45146,7 @@ var EFSProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/fsx-filesystem-provider.ts
+// src/provisioning/providers/fsx-filesystem-provider.ts
 const DEFAULT_MAX_WAIT_MS$3 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
 const FILE_SYSTEM_ID_PATTERN = /^fs-[0-9a-f]+$/;
@@ -46237,13 +46376,12 @@ var FSxFileSystemProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/emr-configuration.ts
-function isRecord$1(value) {
+// src/provisioning/emr-configuration.ts
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toSdkConfiguration(raw) {
-	if (!isRecord$1(raw)) return raw;
+	if (!isRecord$2(raw)) return raw;
 	const { ConfigurationProperties, Configurations, ...rest } = raw;
 	return {
 		...rest,
@@ -46260,9 +46398,9 @@ function toSdkStepConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((step) => {
-		if (!isRecord$1(step)) return step;
+		if (!isRecord$2(step)) return step;
 		const hadoopJarStep = step["HadoopJarStep"];
-		if (!isRecord$1(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
+		if (!isRecord$2(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
 		const { StepProperties, ...restHadoopJarStep } = hadoopJarStep;
 		return {
 			...step,
@@ -46277,7 +46415,7 @@ function toSdkInstanceTypeConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((instanceTypeConfig) => {
-		if (!isRecord$1(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
+		if (!isRecord$2(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
 		return {
 			...instanceTypeConfig,
 			Configurations: toSdkConfigurations(instanceTypeConfig["Configurations"])
@@ -46285,8 +46423,7 @@ function toSdkInstanceTypeConfigs(value) {
 	});
 }
 
-//#endregion
-//#region src/provisioning/providers/emr-instance-group-config-provider.ts
+// src/provisioning/providers/emr-instance-group-config-provider.ts
 const DEFAULT_MAX_WAIT_MS$2 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$2 = 15e3;
 const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -46660,8 +46797,7 @@ var EMRInstanceGroupConfigProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/emr-instance-fleet-config-provider.ts
+// src/provisioning/providers/emr-instance-fleet-config-provider.ts
 const DEFAULT_MAX_WAIT_MS$1 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -47009,8 +47145,7 @@ var EMRInstanceFleetConfigProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/emr-cluster-provider.ts
+// src/provisioning/providers/emr-cluster-provider.ts
 const DEFAULT_MAX_WAIT_MS = 36e5;
 const DEFAULT_POLL_INTERVAL_MS = 15e3;
 const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
@@ -48012,8 +48147,7 @@ var EMRClusterProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/firehose-provider.ts
+// src/provisioning/providers/firehose-provider.ts
 const ENCRYPTION_KEY = "DeliveryStreamEncryptionConfigurationInput";
 function readEncryptionInput(value, emptyIsAbsent) {
 	if (value === void 0 || value === null) return { kind: "absent" };
@@ -48106,7 +48240,8 @@ var FirehoseProvider = class {
 		"AmazonopensearchserviceDestinationConfiguration",
 		"SplunkDestinationConfiguration",
 		"AmazonOpenSearchServerlessDestinationConfiguration",
-		"DeliveryStreamEncryptionConfigurationInput"
+		"DeliveryStreamEncryptionConfigurationInput",
+		"IcebergDestinationConfiguration"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -48258,6 +48393,7 @@ var FirehoseProvider = class {
 					VpcConfiguration: aossConfig["VpcConfiguration"]
 				};
 			}
+			if (properties["IcebergDestinationConfiguration"]) input.IcebergDestinationConfiguration = this.mapIcebergDestinationConfiguration(properties["IcebergDestinationConfiguration"]);
 			if (properties["DeliveryStreamEncryptionConfigurationInput"]) {
 				const encConfig = properties["DeliveryStreamEncryptionConfigurationInput"];
 				input.DeliveryStreamEncryptionConfigurationInput = {
@@ -48837,6 +48973,15 @@ var FirehoseProvider = class {
 			IcebergDestinationUpdate: this.mapIcebergConfigToUpdate(nextConfig)
 		}));
 	}
+	mapIcebergDestinationConfiguration(config) {
+		const result = this.mapIcebergConfigToUpdate(config);
+		const catalog = config["CatalogConfiguration"];
+		if (catalog !== void 0) result.CatalogConfiguration = {
+			...catalog["CatalogArn"] !== void 0 && { CatalogARN: catalog["CatalogArn"] },
+			...catalog["WarehouseLocation"] !== void 0 && { WarehouseLocation: catalog["WarehouseLocation"] }
+		};
+		return result;
+	}
 	mapIcebergConfigToUpdate(config) {
 		const result = {};
 		if (config["DestinationTableConfigurationList"] !== void 0) result.DestinationTableConfigurationList = config["DestinationTableConfigurationList"];
@@ -48845,12 +48990,11 @@ var FirehoseProvider = class {
 		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
 		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
 		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
-		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
+		if (config["s3BackupMode"] !== void 0) result.S3BackupMode = config["s3BackupMode"];
 		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
 		const roleArn = config["RoleARN"] ?? config["RoleArn"];
 		if (roleArn !== void 0) result.RoleARN = roleArn;
 		if (config["AppendOnly"] !== void 0) result.AppendOnly = config["AppendOnly"];
-		if (config["CatalogConfiguration"] !== void 0) result.CatalogConfiguration = config["CatalogConfiguration"];
 		if (config["S3Configuration"] !== void 0) result.S3Configuration = this.mapS3DestinationConfiguration(config["S3Configuration"]);
 		return result;
 	}
@@ -48942,6 +49086,7 @@ var FirehoseProvider = class {
 		if (directPut?.ThroughputHintInMBs !== void 0) result["DirectPutSourceConfiguration"] = { ThroughputHintInMBs: directPut.ThroughputHintInMBs };
 		const dest = desc.Destinations?.[0];
 		if (dest?.ExtendedS3DestinationDescription) result["ExtendedS3DestinationConfiguration"] = mapExtendedS3DescriptionToCfn(dest.ExtendedS3DestinationDescription);
+		else if (dest?.IcebergDestinationDescription) result["IcebergDestinationConfiguration"] = mapIcebergDescriptionToCfn(dest.IcebergDestinationDescription);
 		else if (dest?.S3DestinationDescription) result["S3DestinationConfiguration"] = mapS3DescriptionToCfn(dest.S3DestinationDescription);
 		else if (dest?.RedshiftDestinationDescription) result["RedshiftDestinationConfiguration"] = mapRedshiftDescriptionToCfn(dest.RedshiftDestinationDescription);
 		else if (dest?.ElasticsearchDestinationDescription) result["ElasticsearchDestinationConfiguration"] = mapNonS3DestinationToCfn(dest.ElasticsearchDestinationDescription);
@@ -49104,6 +49249,31 @@ function mapRedshiftDescriptionToCfn(desc) {
 	if (desc["S3BackupDescription"]) out["S3BackupConfiguration"] = mapS3DescriptionToCfn(desc["S3BackupDescription"]);
 	return out;
 }
+function mapIcebergDescriptionToCfn(desc) {
+	const out = {};
+	for (const k of [
+		"DestinationTableConfigurationList",
+		"SchemaEvolutionConfiguration",
+		"TableCreationConfiguration",
+		"BufferingHints",
+		"CloudWatchLoggingOptions",
+		"ProcessingConfiguration",
+		"RetryOptions",
+		"RoleARN",
+		"AppendOnly"
+	]) {
+		const v = pickDefinedDeep(desc[k]);
+		if (v !== void 0) out[k] = v;
+	}
+	if (desc["S3BackupMode"] !== void 0) out["s3BackupMode"] = desc["S3BackupMode"];
+	const catalog = desc["CatalogConfiguration"];
+	if (catalog) out["CatalogConfiguration"] = {
+		...catalog["CatalogARN"] !== void 0 && { CatalogArn: catalog["CatalogARN"] },
+		...catalog["WarehouseLocation"] !== void 0 && { WarehouseLocation: catalog["WarehouseLocation"] }
+	};
+	if (desc["S3DestinationDescription"]) out["S3Configuration"] = mapS3DescriptionToCfn(desc["S3DestinationDescription"]);
+	return out;
+}
 function mapHttpEndpointDescriptionToCfn(desc) {
 	const out = {};
 	for (const k of [
@@ -49125,8 +49295,7 @@ function mapHttpEndpointDescriptionToCfn(desc) {
 	return out;
 }
 
-//#endregion
-//#region src/provisioning/providers/cloudtrail-provider.ts
+// src/provisioning/providers/cloudtrail-provider.ts
 const DEFAULT_EVENT_SELECTORS = Object.freeze([Object.freeze({
 	ReadWriteType: "All",
 	IncludeManagementEvents: true
@@ -49681,8 +49850,7 @@ var CloudTrailProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/codebuild-provider.ts
+// src/provisioning/providers/codebuild-provider.ts
 const DEFAULT_PROJECT_VISIBILITY = "PRIVATE";
 const DEFAULT_ENCRYPTION_KEY = "alias/aws/s3";
 function readVisibility(properties, mask) {
@@ -49700,6 +49868,89 @@ function readVisibility(properties, mask) {
 		...typeof role === "string" && role !== "" && { resourceAccessRole: role }
 	};
 }
+const DEFAULT_WEBHOOK_BUILD_TYPE = "BUILD";
+const NEW_PROJECT_WEBHOOK_ATTEMPTS = 4;
+const NEW_PROJECT_WEBHOOK_RETRY_BASE_MS = 2e3;
+const DEFAULT_WEBHOOK_SOURCE_LOCATION = "CODEBUILD_DEFAULT_WEBHOOK_SOURCE_LOCATION";
+const DEFAULT_WEBHOOK_SCOPE = "GITHUB_ORGANIZATION";
+function relayedConnectionRace(error, detail) {
+	if (!(error instanceof Error) || error.name !== "OAuthProviderException") return "";
+	if (detail.includes("security token included in the request is invalid")) return " (The security token included in the request is invalid. (Service: CodeBuild))";
+	if (detail.includes("not authorized to access connection")) return " (The service role is not authorized to perform access to the connection Source.Auth names)";
+	return "";
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readTriggers(properties, mask) {
+	const triggers = properties["Triggers"];
+	if (triggers == null) return { kind: "unmanaged" };
+	const refuse = (key, expected, value) => ({
+		kind: "unusable",
+		reason: `AWS::CodeBuild::Project ${key} must be ${expected}, got ${JSON.stringify(maskDeep(value, mask))}`
+	});
+	if (!isRecord$1(triggers)) return refuse("Triggers", "an object", triggers);
+	const declared = triggers["Webhook"];
+	const webhook = declared == null ? void 0 : coerceCfnBoolean(declared);
+	if (declared != null && webhook === void 0) return refuse("Triggers.Webhook", "a boolean", declared);
+	const groups = triggers["FilterGroups"];
+	const buildType = triggers["BuildType"];
+	if (webhook !== true) {
+		for (const [key, value, noun] of [[
+			"FilterGroups",
+			groups,
+			"filter groups"
+		], [
+			"BuildType",
+			buildType,
+			"build type"
+		]]) if (value != null) return {
+			kind: "unusable",
+			reason: `AWS::CodeBuild::Project Triggers.${key}: cannot specify ${noun} when webhook is disabled`
+		};
+		return { kind: webhook === false ? "disabled" : "unmanaged" };
+	}
+	if (buildType != null && typeof buildType !== "string") return refuse("Triggers.BuildType", "a string", buildType);
+	let filterGroups;
+	if (groups != null) {
+		if (!Array.isArray(groups) || !groups.every(Array.isArray)) return refuse("Triggers.FilterGroups", "a list of filter lists", groups);
+		const rows = groups;
+		if (!rows.every((group) => group.every(isRecord$1))) return refuse("Triggers.FilterGroups", "a list of filter lists", groups);
+		filterGroups = rows.map((group) => group.map((filter) => {
+			const excluded = filter["ExcludeMatchedPattern"];
+			return {
+				type: filter["Type"],
+				pattern: filter["Pattern"],
+				...excluded != null && { excludeMatchedPattern: coerceCfnBoolean(excluded) ?? excluded }
+			};
+		}));
+	}
+	const policy = triggers["PullRequestBuildPolicy"];
+	if (policy != null && !isRecord$1(policy)) return refuse("Triggers.PullRequestBuildPolicy", "an object", policy);
+	const scope = triggers["ScopeConfiguration"];
+	if (scope != null && !isRecord$1(scope)) return refuse("Triggers.ScopeConfiguration", "an object", scope);
+	if (scope != null) {
+		const source = properties["Source"];
+		if (!isRecord$1(source) || source["Location"] !== DEFAULT_WEBHOOK_SOURCE_LOCATION) return {
+			kind: "unusable",
+			reason: `AWS::CodeBuild::Project Triggers.ScopeConfiguration: cannot specify a scope when the project source location is not ${DEFAULT_WEBHOOK_SOURCE_LOCATION}`
+		};
+	}
+	return {
+		kind: "enabled",
+		...filterGroups !== void 0 && { filterGroups },
+		...buildType != null && { buildType },
+		...scope != null && { scopeConfiguration: {
+			name: scope["Name"],
+			scope: scope["Scope"] ?? DEFAULT_WEBHOOK_SCOPE,
+			...scope["Domain"] != null && { domain: scope["Domain"] }
+		} },
+		...policy != null && { pullRequestBuildPolicy: {
+			requiresCommentApproval: policy["RequiresCommentApproval"],
+			...policy["ApproverRoles"] != null && { approverRoles: policy["ApproverRoles"] }
+		} }
+	};
+}
 var CodeBuildProvider = class {
 	client;
 	createClient;
@@ -49730,7 +49981,8 @@ var CodeBuildProvider = class {
 		"SourceVersion",
 		"AutoRetryLimit",
 		"Visibility",
-		"ResourceAccessRole"
+		"ResourceAccessRole",
+		"Triggers"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -49928,6 +50180,11 @@ var CodeBuildProvider = class {
 			if (context?.replayingState !== true) throw new ProvisioningError(visibilityRead.reason, resourceType, logicalId);
 			this.logger.warn(mask(`${visibilityRead.reason}. Replaying a state record, so CodeBuild Project ${logicalId} is left ${DEFAULT_PROJECT_VISIBILITY} with no resource access role rather than refusing the restore`));
 		}
+		const triggersRead = readTriggers(properties, mask);
+		if (triggersRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(triggersRead.reason, resourceType, logicalId);
+			this.logger.warn(mask(`${triggersRead.reason}. Replaying a state record, so CodeBuild Project ${logicalId} gets no webhook rather than refusing the restore`));
+		}
 		let createdName;
 		try {
 			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
@@ -49936,6 +50193,7 @@ var CodeBuildProvider = class {
 			const projectArn = result.project.arn;
 			createdName = projectName;
 			reportCreatedResource(logicalId, resourceType, createdName);
+			if (triggersRead.kind === "enabled") await this.createWebhookOnNewProject(projectName, triggersRead);
 			if (visibilityRead.kind === "usable" && (visibilityRead.visibility !== DEFAULT_PROJECT_VISIBILITY || visibilityRead.resourceAccessRole !== void 0)) await this.applyVisibility(projectArn, visibilityRead);
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
 			return {
@@ -49945,11 +50203,67 @@ var CodeBuildProvider = class {
 		} catch (error) {
 			if (createdName !== void 0) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause), createdName === void 0);
 			if (createdName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdName);
 			throw thrown;
 		}
 	}
+	async createWebhook(projectName, read) {
+		await this.getCreateClient().send(new CreateWebhookCommand({
+			projectName,
+			...read.filterGroups !== void 0 && { filterGroups: read.filterGroups },
+			...read.buildType !== void 0 && { buildType: read.buildType },
+			...read.scopeConfiguration !== void 0 && { scopeConfiguration: read.scopeConfiguration },
+			...read.pullRequestBuildPolicy !== void 0 && { pullRequestBuildPolicy: read.pullRequestBuildPolicy }
+		}));
+	}
+	async createWebhookOnNewProject(projectName, read) {
+		const watch = startInterruptWatch(`The webhook of CodeBuild Project ${projectName}`);
+		let mayHaveLanded = false;
+		try {
+			for (let attempt = 1;; attempt++) try {
+				await this.createWebhook(projectName, read);
+				return;
+			} catch (error) {
+				if (!(error instanceof Error)) throw error;
+				if (mayHaveLanded && error.name === "ResourceAlreadyExistsException") return;
+				const ambiguous = isAmbiguousOutcomeError(error);
+				mayHaveLanded ||= ambiguous;
+				if (!(ambiguous || isRetryableTransientError(error, error.message)) || attempt === NEW_PROJECT_WEBHOOK_ATTEMPTS) throw markNonRetryable(error);
+				let remaining = NEW_PROJECT_WEBHOOK_RETRY_BASE_MS * 2 ** (attempt - 1);
+				while (remaining > 0) {
+					if (watch.isInterrupted()) throw watch.onInterrupted();
+					const chunk = Math.min(1e3, remaining);
+					await this.sleep(chunk);
+					remaining -= chunk;
+				}
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	async reconcileWebhook(projectName, read, liveWebhook) {
+		if (read.kind === "disabled" && liveWebhook) {
+			await this.getClient().send(new DeleteWebhookCommand({ projectName }));
+			return;
+		}
+		if (read.kind !== "enabled") return;
+		if (!liveWebhook) {
+			await this.createWebhook(projectName, read);
+			return;
+		}
+		await this.getClient().send(new UpdateWebhookCommand({
+			projectName,
+			filterGroups: read.filterGroups ?? [],
+			buildType: read.buildType ?? DEFAULT_WEBHOOK_BUILD_TYPE,
+			rotateSecret: false,
+			...read.pullRequestBuildPolicy !== void 0 && { pullRequestBuildPolicy: read.pullRequestBuildPolicy }
+		}));
+	}
 	async applyVisibility(projectArn, read) {
 		await this.getClient().send(new UpdateProjectVisibilityCommand({
 			projectArn,
@@ -49961,6 +50275,11 @@ var CodeBuildProvider = class {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		const triggersRead = readTriggers(properties, mask);
+		if (triggersRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(triggersRead.reason, resourceType, logicalId, physicalId);
+			this.logger.warn(mask(`${triggersRead.reason}. Replaying a state record, so the webhook of CodeBuild Project ${physicalId} is left unchanged`));
+		}
 		try {
 			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
@@ -49969,6 +50288,9 @@ var CodeBuildProvider = class {
 			if (!declaredKey(properties["EncryptionKey"]) && declaredKey(previousProperties["EncryptionKey"])) input.encryptionKey = DEFAULT_ENCRYPTION_KEY;
 			if (properties["Tags"] == null && previousProperties["Tags"] != null) input.tags = [];
 			const updated = await this.getClient().send(new UpdateProjectCommand(input));
+			const liveWebhook = updated.project?.webhook;
+			await this.reconcileWebhook(physicalId, triggersRead, liveWebhook != null);
+			if (triggersRead.kind === "enabled" && triggersRead.scopeConfiguration !== void 0 && liveWebhook != null && Object.entries(triggersRead.scopeConfiguration).some(([key, value]) => liveWebhook.scopeConfiguration?.[key] !== value)) this.logger.warn(mask(`The Triggers.ScopeConfiguration of CodeBuild Project ${physicalId} differs from its live webhook, which cannot change scope: the webhook keeps its scope. Delete it with Webhook: false, then deploy Webhook: true to apply the new one`));
 			const desiredVisibility = readVisibility(properties, mask);
 			const recorded = readVisibility(previousProperties, mask);
 			if (desiredVisibility.kind === "unusable") {
@@ -49986,14 +50308,14 @@ var CodeBuildProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause), true);
 		}
 	}
-	wrapCaughtError(mask, error, build) {
+	wrapCaughtError(mask, error, build, retryConnectionRace) {
 		const failure = describeAwsFailure(error);
 		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
 		this.logger.debug(mask(build(mask(failure.detail)).message));
-		const wrapped = build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		const wrapped = build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}` + (retryConnectionRace ? relayedConnectionRace(error, failure.detail) : ""));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -50009,7 +50331,7 @@ var CodeBuildProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause), false);
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
@@ -50189,7 +50511,7 @@ var CodeBuildProvider = class {
 		return result;
 	}
 	getDriftUnknownPaths() {
-		return ["Source.Auth"];
+		return ["Source.Auth", "Triggers"];
 	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -50206,8 +50528,7 @@ var CodeBuildProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/codecommit-repository-provider.ts
+// src/provisioning/providers/codecommit-repository-provider.ts
 function toSdkTagMap(tags) {
 	if (!tags || tags.length === 0) return void 0;
 	const out = {};
@@ -50742,8 +51063,7 @@ var CodeCommitRepositoryProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+// src/provisioning/providers/dlm-lifecycle-policy-provider.ts
 const KEPT_ON_REMOVAL = [
 	"Description",
 	"ExecutionRoleArn",
@@ -51030,8 +51350,7 @@ var DLMLifecyclePolicyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-vectors-provider.ts
+// src/provisioning/providers/s3-vectors-provider.ts
 var S3VectorsProvider = class {
 	client;
 	createClient;
@@ -51251,8 +51570,7 @@ var S3VectorsProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-directory-bucket-provider.ts
+// src/provisioning/providers/s3-directory-bucket-provider.ts
 function notEmptyRefusalMessage(bucketName, maskSecrets) {
 	const mask = maskerOrIdentity(maskSecrets);
 	const secretDerived = mask(bucketName) !== bucketName;
@@ -52077,8 +52395,7 @@ var S3DirectoryBucketProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-tables-provider.ts
+// src/provisioning/providers/s3-tables-provider.ts
 const S3_TABLES_NAMESPACE_ID_FORMAT = {
 	label: "S3 Tables Namespace",
 	segments: ["tableBucketARN", "namespace"]
@@ -53295,8 +53612,7 @@ var S3TablesProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ecr-provider.ts
+// src/provisioning/providers/ecr-provider.ts
 var ECRProvider = class {
 	client;
 	createClient;
@@ -53589,8 +53905,7 @@ var ECRProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/nested-stack-messages.ts
+// src/provisioning/nested-stack-messages.ts
 function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted, inspectCommand, holeNote = "") {
 	const extra = [];
 	if (alsoSkippedCount > 0) extra.push(`${alsoSkippedCount} resource(s) were also skipped`);
@@ -53598,8 +53913,7 @@ function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedC
 	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + ". The child's state is PRESERVED and still lists them — inspect it, resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable." + holeNote + `\nInspect it with: ${inspectCommand}`;
 }
 
-//#endregion
-//#region src/provisioning/providers/nested-stack-provider.ts
+// src/provisioning/providers/nested-stack-provider.ts
 function isAbsoluteCrossPlatform(p) {
 	return isAbsoluteAssetPath(p);
 }
@@ -53968,8 +54282,7 @@ function inheritedPhysicalNameCopiesOf(bag) {
 	return copies === void 0 || copies.size === 0 ? void 0 : new Set(copies);
 }
 
-//#endregion
-//#region src/provisioning/providers/wait-condition-handle-provider.ts
+// src/provisioning/providers/wait-condition-handle-provider.ts
 var WaitConditionHandleProvider = class {
 	logger = getLogger().child("WaitConditionHandleProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFormation::WaitConditionHandle", /* @__PURE__ */ new Set([])]]);
@@ -54006,8 +54319,7 @@ var WaitConditionHandleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/acm-certificate-provider.ts
+// src/provisioning/providers/acm-certificate-provider.ts
 function certificateInUseByName(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
@@ -54405,6 +54717,5 @@ var ACMCertificateProvider = class {
 	}
 };
 
-//#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-B8kkAZqJ.js.map
+//# sourceMappingURL=provider-classes-DGFOKPO9.js.map