@go-to-k/cdkd 0.316.0 → 0.317.0

package/dist/{provider-classes-ushrO6ri.js → provider-classes-DGFOKPO9.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-CGZAQ1gS.js";
+import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWpHZk2l.js";
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
-import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, X as isProceedDbStatus, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-B9OCHRr_.js";
+import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-BpB3iPvn.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-NYjdxQWe.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Ddo7WwEs.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DSq5150i.js";
-import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DQTozL4b.js";
-import { RDSProvider } from "./rds-provider-VigGKsxO.js";
-import { NeptuneProvider } from "./neptune-provider-CuZbMn9R.js";
-import { ASGProvider } from "./asg-provider-DOLuhiky.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-b0rYBotL.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-gTpDZhfz.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BZ-VVfXu.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-CspmK57I.js";
+import { RDSProvider } from "./rds-provider-BUNLNluC.js";
+import { NeptuneProvider } from "./neptune-provider-BfzktOKC.js";
+import { ASGProvider } from "./asg-provider-WornuySB.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -44,7 +44,7 @@ import * as zlib from "node:zlib";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DescribeGlobalClustersCommand as DescribeGlobalClustersCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveFromGlobalClusterCommand as RemoveFromGlobalClusterCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$18, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
@@ -59,7 +59,7 @@ import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFil
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventConfigurationCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventConfigurationCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, CreateWebhookCommand, DeleteProjectCommand, DeleteWebhookCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand, UpdateWebhookCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3VectorsClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3vectors";
@@ -11096,15 +11096,15 @@ function buildCommonImageInput(properties) {
 	return input;
 }
 function mapCodeArtifact(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	const uri = value["Uri"];
 	return typeof uri === "string" ? { uri } : void 0;
 }
 function mapLogging(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	if (value["Disabled"] === true) return { disabled: {} };
 	const cloudWatch = value["CloudWatch"];
-	if (isRecord$2(cloudWatch)) {
+	if (isRecord$3(cloudWatch)) {
 		const cw = {};
 		if (typeof cloudWatch["LogGroup"] === "string") cw.logGroup = cloudWatch["LogGroup"];
 		if (typeof cloudWatch["LogStream"] === "string") cw.logStream = cloudWatch["LogStream"];
@@ -11113,32 +11113,32 @@ function mapLogging(value) {
 }
 function mapCpuConfigurations(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$2).map((c) => ({ architecture: c["Architecture"] }));
+	return value.filter(isRecord$3).map((c) => ({ architecture: c["Architecture"] }));
 }
 function mapResources(value) {
 	if (!Array.isArray(value)) return void 0;
-	return value.filter(isRecord$2).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
+	return value.filter(isRecord$3).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
 }
 function mapHooks(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	return lowerFirstKeysDeep(value);
 }
 function mapKeyValueListToRecord(value) {
 	if (!Array.isArray(value)) return void 0;
 	const out = {};
-	for (const entry of value) if (isRecord$2(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
+	for (const entry of value) if (isRecord$3(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
 	return Object.keys(out).length > 0 ? out : void 0;
 }
 function lowerFirstKeysDeep(value) {
 	if (Array.isArray(value)) return value.map(lowerFirstKeysDeep);
-	if (isRecord$2(value)) {
+	if (isRecord$3(value)) {
 		const out = {};
 		for (const [k, v] of Object.entries(value)) out[k.charAt(0).toLowerCase() + k.slice(1)] = lowerFirstKeysDeep(v);
 		return out;
 	}
 	return value;
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -31330,6 +31330,45 @@ const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "reboo
 function numberOrUndefined(value) {
 	return value == null ? void 0 : Number(value);
 }
+function docdbGlobalClusterId(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function withRecordedGlobalCluster(bag, previousProperties) {
+	const { GlobalClusterIdentifier: _dropped, ...rest } = bag;
+	const previous = previousProperties["GlobalClusterIdentifier"];
+	return previous === void 0 ? rest : {
+		...rest,
+		GlobalClusterIdentifier: previous
+	};
+}
+function readableGlobalClusterId(value) {
+	return value == null || typeof value === "string";
+}
+const DETACH_MAX_WAIT_MS = 18e5;
+const GLOBAL_CLUSTER_BUSY_MAX_WAIT_MS = 6e5;
+const TRANSIENT_DETACH_FAULTS = /* @__PURE__ */ new Set([
+	"InvalidDBClusterStateFault",
+	"InvalidGlobalClusterStateFault",
+	"ThrottlingException",
+	"Throttling",
+	"RequestLimitExceeded"
+]);
+function awsErrorName(error) {
+	return error?.name ?? "";
+}
+var GlobalClusterDetachError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "GlobalClusterDetachError";
+	}
+};
+function docdbEngineVersionToSend(properties, previousProperties, context) {
+	if (context?.replayingState === true) return void 0;
+	const desired = properties["EngineVersion"];
+	if (desired == null) return void 0;
+	const previous = previousProperties["EngineVersion"];
+	return previous != null && String(previous) === String(desired) ? void 0 : desired;
+}
 function clusterPortToSend(properties, previousProperties) {
 	if (properties["Port"] != null) return Number(properties["Port"]);
 	if (previousProperties["Port"] == null) return void 0;
@@ -31377,6 +31416,7 @@ var DocDBProvider = class {
 		"Tags",
 		"MasterUserPassword",
 		"RotateMasterUserPassword",
+		"GlobalClusterIdentifier",
 		...DOCDB_CLUSTER_KEPT_ON_REMOVAL,
 		...DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
@@ -31408,6 +31448,7 @@ var DocDBProvider = class {
 		"AvailabilityZones",
 		"CopyTagsToSnapshot",
 		"EnableCloudwatchLogsExports",
+		"GlobalClusterIdentifier",
 		"ManageMasterUserPassword",
 		"MasterUserSecretKmsKeyId",
 		"NetworkType",
@@ -31458,9 +31499,9 @@ var DocDBProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::DocDB::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, context);
+			case "AWS::DocDB::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, properties, context);
 			case "AWS::DocDB::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -31479,6 +31520,11 @@ var DocDBProvider = class {
 		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, true);
 		const managedPassword = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
 		const password = this.passwordBesideManaged(managedPassword, false, properties["MasterUserPassword"], resourceType, logicalId, origin);
+		if (!readableGlobalClusterId(properties["GlobalClusterIdentifier"])) {
+			if (!replayingState) this.refuseBlock(logicalId, resourceType, void 0, "GlobalClusterIdentifier is not a string");
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded GlobalClusterIdentifier is unusable, so it is not sent.`);
+		}
+		const globalClusterId = docdbGlobalClusterId(properties["GlobalClusterIdentifier"]);
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
@@ -31505,6 +31551,7 @@ var DocDBProvider = class {
 				MasterUserSecretKmsKeyId: properties["MasterUserSecretKmsKeyId"],
 				NetworkType: properties["NetworkType"],
 				StorageType: properties["StorageType"],
+				...globalClusterId !== void 0 && { GlobalClusterIdentifier: globalClusterId },
 				...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
 				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
 				...tags.length > 0 && { Tags: tags }
@@ -31533,7 +31580,9 @@ var DocDBProvider = class {
 			physicalId
 		};
 		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, false);
+		const globalClusterPlan = await this.planGlobalClusterUpdate(physicalId, properties, previousProperties, resourceType, logicalId, origin, context?.desiredFromAwsReadback === true);
 		const logExportConfig = logTypes === void 0 ? void 0 : docdbLogExportChange(logTypes, docdbStringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
+		let detachedFrom;
 		try {
 			const credentials = await this.planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin);
 			const vpcSgIds = properties["VpcSecurityGroupIds"];
@@ -31547,10 +31596,16 @@ var DocDBProvider = class {
 			const storageChange = declaredChange(storageType, previousProperties["StorageType"], live?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE);
 			const previousScaling = docdbServerlessScaling(previousProperties["ServerlessV2ScalingConfiguration"]);
 			const scalingChange = scaling != null && (scaling.MinCapacity !== previousScaling?.MinCapacity || scaling.MaxCapacity !== previousScaling?.MaxCapacity);
+			if (globalClusterPlan.kind === "detach") {
+				if (await this.detachFromGlobalCluster(logicalId, physicalId, globalClusterPlan.globalClusterId, {
+					beforeDelete: false,
+					removeProtection: false
+				}, { stripped: false }, maskerOrIdentity(context?.maskSecrets))) detachedFrom = globalClusterPlan.globalClusterId;
+			}
 			this.markChangedUnsettled(CLUSTER_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await this.getClient().send(new ModifyDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
-				EngineVersion: properties["EngineVersion"],
+				EngineVersion: docdbEngineVersionToSend(properties, previousProperties, context),
 				DeletionProtection: properties["DeletionProtection"],
 				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
 				PreferredBackupWindow: properties["PreferredBackupWindow"],
@@ -31611,19 +31666,21 @@ var DocDBProvider = class {
 					...described,
 					Port: portToSend
 				} : described),
-				...credentials.effectiveProperties !== void 0 && { effectiveProperties: credentials.effectiveProperties }
+				...(credentials.effectiveProperties !== void 0 || globalClusterPlan.kind === "keep") && { effectiveProperties: globalClusterPlan.kind === "keep" ? withRecordedGlobalCluster(credentials.effectiveProperties ?? properties, previousProperties) : credentials.effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
+			if (error instanceof GlobalClusterDetachError) throw markNonRetryable(new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${error.message}`, resourceType, logicalId, physicalId, error));
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const detachedNote = detachedFrom !== void 0 ? " (it was already detached from its global cluster, and stays a standalone cluster)" : "";
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}${detachedNote}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async deleteDBCluster(logicalId, physicalId, resourceType, context) {
+	async deleteDBCluster(logicalId, physicalId, resourceType, properties, context) {
 		await deleteWithProtectionCompensation({
 			registry: this.protectionFlips,
 			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
-			run: (flip) => this.deleteDBClusterOnce(logicalId, physicalId, resourceType, context, flip),
+			run: (flip) => this.deleteDBClusterOnce(logicalId, physicalId, resourceType, properties, context, flip),
 			compensation: {
 				logicalId,
 				physicalId,
@@ -31647,8 +31704,10 @@ var DocDBProvider = class {
 			}
 		});
 	}
-	async deleteDBClusterOnce(logicalId, physicalId, resourceType, context, flip) {
+	async deleteDBClusterOnce(logicalId, physicalId, resourceType, properties, context, flip) {
 		this.logger.debug(`Deleting DocDB DBCluster ${logicalId}`);
+		let detachedFrom;
+		const progress = { stripped: false };
 		try {
 			if (context?.removeProtection === true) try {
 				await observeThenDisableProtection({
@@ -31670,6 +31729,11 @@ var DocDBProvider = class {
 			} catch (disableError) {
 				if (!isDocDBNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DocDB DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
 			}
+			const globalClusterId = docdbGlobalClusterId(properties?.["GlobalClusterIdentifier"]);
+			if (globalClusterId !== void 0) detachedFrom = await this.detachFromGlobalCluster(logicalId, physicalId, globalClusterId, {
+				beforeDelete: true,
+				removeProtection: context?.removeProtection === true
+			}, progress, maskerOrIdentity(context?.maskSecrets)) ? globalClusterId : void 0;
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
 			const sendDelete = () => this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
@@ -31685,6 +31749,10 @@ var DocDBProvider = class {
 			this.logger.debug(`Successfully initiated deletion of DocDB DBCluster ${logicalId}`);
 			await this.waitForClusterDeleted(logicalId, physicalId);
 		} catch (error) {
+			if (error instanceof GlobalClusterDetachError) {
+				const detachFailure = markNotGone(markNonRetryable(new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${error.message}`, resourceType, logicalId, physicalId, error)));
+				throw progress.stripped ? markDeleteStarted(detachFailure) : detachFailure;
+			}
 			if (isDocDBNotFoundError(error, "DBClusterNotFoundFault")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
@@ -31693,7 +31761,95 @@ var DocDBProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const detachedNote = detachedFrom !== void 0 ? " (it was already detached from its global cluster, and stays a standalone cluster)" : "";
+			const failure = this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}${detachedNote}`, resourceType, logicalId, physicalId, cause));
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
+		}
+	}
+	wrapGlobalClusterDetachError(error, mask, build) {
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(build(mask(failure.detail))));
+		return new GlobalClusterDetachError(build(mask(failure.summary)));
+	}
+	async detachFromGlobalCluster(logicalId, physicalId, globalClusterId, { beforeDelete, removeProtection }, progress, mask) {
+		let cluster = await this.describeDBCluster(physicalId);
+		for (let i = 0; removeProtection && cluster?.DeletionProtection === true && i < 6; i++) {
+			await this.sleep(5e3);
+			cluster = await this.describeDBCluster(physicalId);
+		}
+		if (cluster === void 0) return false;
+		if (beforeDelete && cluster.DeletionProtection === true) throw new GlobalClusterDetachError(safeMsg`${physicalId} has deletion protection on, so cdkd did not detach it from global cluster ${globalClusterId}; turn it off (cdkd destroy --remove-protection does) and re-run`);
+		const clusterArn = cluster.DBClusterArn;
+		if (typeof clusterArn !== "string" || clusterArn === "") throw new GlobalClusterDetachError(safeMsg`could not read the ARN of ${physicalId} to detach it from global cluster ${globalClusterId}`);
+		const startTime = Date.now();
+		let delay = 5e3;
+		const backOff = async () => {
+			if (Date.now() - startTime >= DETACH_MAX_WAIT_MS) throw new GlobalClusterDetachError(safeMsg`timed out waiting for ${physicalId} to leave global cluster ${globalClusterId}`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		};
+		const readMembers = async (build) => {
+			try {
+				return (await this.getClient().send(new DescribeGlobalClustersCommand$1({ GlobalClusterIdentifier: globalClusterId }))).GlobalClusters?.[0]?.GlobalClusterMembers ?? [];
+			} catch (error) {
+				const name = awsErrorName(error);
+				if (name === "GlobalClusterNotFoundFault") return [];
+				if (TRANSIENT_DETACH_FAULTS.has(name)) return void 0;
+				throw this.wrapGlobalClusterDetachError(error, mask, build);
+			}
+		};
+		const isMember = async (build) => {
+			return (await readMembers(build))?.some((member) => member.DBClusterArn === clusterArn);
+		};
+		for (;;) {
+			const members = await readMembers((text) => safeMsg`could not read whether ${physicalId} is a member of global cluster ${globalClusterId} (${text})`);
+			if (members !== void 0) {
+				const own = members.find((member) => member.DBClusterArn === clusterArn);
+				if (own === void 0) return false;
+				const others = members.filter((member) => member.DBClusterArn !== clusterArn).map((member) => /^arn:[^:]*:rds:[^:]*:[^:]*:cluster:(.+)$/.exec(member.DBClusterArn ?? "")?.[1] ?? "(unnamed)");
+				if (own.IsWriter === true && others.length > 0) throw new GlobalClusterDetachError(safeMsg`${physicalId} is the primary of global cluster ${globalClusterId}, which still has other members (${others.join(", ")}); detach or delete them first, then re-run`);
+				break;
+			}
+			await backOff();
+		}
+		let globalBusySince;
+		for (;;) try {
+			await this.getClient().send(new RemoveFromGlobalClusterCommand$1({
+				GlobalClusterIdentifier: globalClusterId,
+				DbClusterIdentifier: clusterArn
+			}));
+			progress.stripped = true;
+			this.logger.info(beforeDelete ? safeMsg`Detaching DocDB DBCluster ${logicalId} from global cluster ${globalClusterId} before the delete` : safeMsg`Detaching DocDB DBCluster ${logicalId} from global cluster ${globalClusterId}: GlobalClusterIdentifier was removed`);
+			break;
+		} catch (error) {
+			const name = awsErrorName(error);
+			if (name === "GlobalClusterNotFoundFault") return false;
+			if (name === "DBClusterNotFoundFault") {
+				progress.stripped = true;
+				break;
+			}
+			if (name === "InvalidGlobalClusterStateFault") {
+				globalBusySince ??= Date.now();
+				if (Date.now() - globalBusySince >= GLOBAL_CLUSTER_BUSY_MAX_WAIT_MS) throw this.wrapGlobalClusterDetachError(error, mask, (text) => safeMsg`detaching ${physicalId} from global cluster ${globalClusterId} failed (${text})`);
+			}
+			if (!TRANSIENT_DETACH_FAULTS.has(name)) throw this.wrapGlobalClusterDetachError(error, mask, (text) => safeMsg`detaching ${physicalId} from global cluster ${globalClusterId} failed (${text})`);
+			await backOff();
+		}
+		for (;;) {
+			if (await isMember((text) => safeMsg`could not confirm ${physicalId} left global cluster ${globalClusterId} (${text})`) === false) {
+				let after;
+				try {
+					after = await this.describeDBCluster(physicalId);
+				} catch (error) {
+					if (!TRANSIENT_DETACH_FAULTS.has(awsErrorName(error))) throw error;
+					await backOff();
+					continue;
+				}
+				if (after === void 0) return true;
+				this.logger.debug(safeMsg`DocDB DBCluster ${physicalId} status after the detach: ${after.Status}`);
+				if (after.Status === "available") return true;
+			}
+			await backOff();
 		}
 	}
 	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
@@ -31809,6 +31965,53 @@ var DocDBProvider = class {
 	refuseBlock(logicalId, resourceType, physicalId, text) {
 		throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType === "AWS::DocDB::DBInstance" ? "DocDB DBInstance" : "DocDB DBCluster"} ${logicalId}: ${text}; nothing was changed.`, resourceType, logicalId, physicalId));
 	}
+	async planGlobalClusterUpdate(physicalId, properties, previousProperties, resourceType, logicalId, origin, fromReadback) {
+		const desired = properties["GlobalClusterIdentifier"];
+		if (fromReadback && desired === void 0) return previousProperties["GlobalClusterIdentifier"] !== void 0 ? { kind: "keep" } : { kind: "none" };
+		const readable = readableGlobalClusterId(desired);
+		const desiredId = docdbGlobalClusterId(desired);
+		const previousId = docdbGlobalClusterId(previousProperties["GlobalClusterIdentifier"]);
+		if (readable && desiredId === previousId) return { kind: "none" };
+		if (readable && desiredId === void 0 && previousId !== void 0) {
+			if (origin.stateBorne) {
+				const member = await this.liveGlobalClusterMatches(physicalId, previousId);
+				if (member === void 0) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the cluster's membership of global cluster ${previousId} could not be read, so the record treats it as absent; if it is still a member, a later destroy may need aws docdb remove-from-global-cluster first.`);
+				if (member !== true) return { kind: "none" };
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): the restored state has no GlobalClusterIdentifier, but cdkd did not add the cluster to global cluster ${previousId} (it was already a member), so it leaves it there.`);
+				return { kind: "keep" };
+			}
+			return {
+				kind: "detach",
+				globalClusterId: previousId
+			};
+		}
+		if (readable && await this.liveGlobalClusterMatches(physicalId, desiredId) === true) return { kind: "none" };
+		const text = readable ? "Changing GlobalClusterIdentifier to a different global cluster is not supported unless the cluster is already part of the target global cluster (CloudFormation refuses it too). To join a different global cluster, replace the cluster, for example with a new DBClusterIdentifier" : "GlobalClusterIdentifier is not a string";
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, physicalId, text);
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${text}; the cluster keeps its current global cluster membership.`);
+		return { kind: "keep" };
+	}
+	async liveGlobalClusterMatches(physicalId, desiredId) {
+		try {
+			const arn = (await this.describeDBCluster(physicalId))?.DBClusterArn;
+			if (typeof arn !== "string" || arn === "") return void 0;
+			let liveId;
+			let marker;
+			do {
+				const page = await this.getClient().send(new DescribeGlobalClustersCommand$1({ ...marker !== void 0 && { Marker: marker } }));
+				const holder = (page.GlobalClusters ?? []).find((global) => (global.GlobalClusterMembers ?? []).some((member) => member.DBClusterArn === arn));
+				if (holder !== void 0) {
+					liveId = holder.GlobalClusterIdentifier;
+					break;
+				}
+				marker = page.Marker;
+			} while (marker);
+			return liveId === desiredId;
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not read a DocDB cluster's global cluster membership: ${describeAwsFailure(error).summary}`);
+			return;
+		}
+	}
 	readClusterBlocks(properties, resourceType, logicalId, origin, creating) {
 		const leaveOut = (key) => {
 			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
@@ -32094,6 +32297,7 @@ var DocDBProvider = class {
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::DocDB::DBCluster") return [
 			"AvailabilityZones",
+			"GlobalClusterIdentifier",
 			"MasterUserSecretKmsKeyId",
 			"RotateMasterUserPassword"
 		];
@@ -35161,6 +35365,7 @@ var CognitoUserPoolProvider = class {
 const CACHE_DELETE_WAIT_MS = Math.max(6e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "DELETE"));
 const NODE_TYPE_MODIFY_WAIT_MS = Math.max(36e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "UPDATE"));
 const MODIFY_DROPPED_AFTER_MS = 12e4;
+const TERMINAL_CLUSTER_STATUSES = /* @__PURE__ */ new Set(["restore-failed", "incompatible-network"]);
 function availabilityZonesNotCovered(a, b) {
 	const remaining = [...b];
 	const out = [];
@@ -35265,6 +35470,7 @@ var ElastiCacheProvider = class {
 		"Tags",
 		"NotificationTopicArn",
 		"SnapshotName",
+		"SnapshotArns",
 		"LogDeliveryConfigurations",
 		"NetworkType",
 		"IpDiscovery",
@@ -35416,6 +35622,7 @@ var ElastiCacheProvider = class {
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				NotificationTopicArn: properties["NotificationTopicArn"],
 				SnapshotName: properties["SnapshotName"],
+				SnapshotArns: properties["SnapshotArns"],
 				LogDeliveryConfigurations: properties["LogDeliveryConfigurations"],
 				NetworkType: properties["NetworkType"],
 				IpDiscovery: properties["IpDiscovery"],
@@ -35665,6 +35872,7 @@ var ElastiCacheProvider = class {
 			const cluster = await this.describeCacheCluster(cacheClusterId);
 			const status = cluster?.CacheClusterStatus;
 			this.logger.debug(`CacheCluster ${cacheClusterId} status: ${status}`);
+			if (status !== void 0 && TERMINAL_CLUSTER_STATUSES.has(status)) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is ${status} and will not become available. Check the cluster's events (aws elasticache describe-events --source-type cache-cluster --source-identifier ${cacheClusterId}) for the reason.`);
 			const liveNodeType = cluster?.CacheNodeType;
 			const removalDone = removedNodeIds.length === 0 || cluster?.CacheNodes !== void 0 && !cluster.CacheNodes.some((n) => n.CacheNodeId !== void 0 && removedNodeIds.includes(n.CacheNodeId));
 			if (status === "available" && removalDone && (expectedNodeType === void 0 || liveNodeType === expectedNodeType)) return;
@@ -35696,6 +35904,9 @@ var ElastiCacheProvider = class {
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
+	getDriftUnknownPaths(resourceType) {
+		return resourceType === "AWS::ElastiCache::CacheCluster" ? ["SnapshotArns", "SnapshotName"] : [];
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
 			case "AWS::ElastiCache::CacheCluster": return this.readCacheCluster(physicalId);
@@ -46166,11 +46377,11 @@ var FSxFileSystemProvider = class {
 };
 
 // src/provisioning/emr-configuration.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toSdkConfiguration(raw) {
-	if (!isRecord$1(raw)) return raw;
+	if (!isRecord$2(raw)) return raw;
 	const { ConfigurationProperties, Configurations, ...rest } = raw;
 	return {
 		...rest,
@@ -46187,9 +46398,9 @@ function toSdkStepConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((step) => {
-		if (!isRecord$1(step)) return step;
+		if (!isRecord$2(step)) return step;
 		const hadoopJarStep = step["HadoopJarStep"];
-		if (!isRecord$1(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
+		if (!isRecord$2(hadoopJarStep) || hadoopJarStep["StepProperties"] === void 0) return step;
 		const { StepProperties, ...restHadoopJarStep } = hadoopJarStep;
 		return {
 			...step,
@@ -46204,7 +46415,7 @@ function toSdkInstanceTypeConfigs(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value)) return value;
 	return value.map((instanceTypeConfig) => {
-		if (!isRecord$1(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
+		if (!isRecord$2(instanceTypeConfig) || instanceTypeConfig["Configurations"] === void 0) return instanceTypeConfig;
 		return {
 			...instanceTypeConfig,
 			Configurations: toSdkConfigurations(instanceTypeConfig["Configurations"])
@@ -48029,7 +48240,8 @@ var FirehoseProvider = class {
 		"AmazonopensearchserviceDestinationConfiguration",
 		"SplunkDestinationConfiguration",
 		"AmazonOpenSearchServerlessDestinationConfiguration",
-		"DeliveryStreamEncryptionConfigurationInput"
+		"DeliveryStreamEncryptionConfigurationInput",
+		"IcebergDestinationConfiguration"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -48181,6 +48393,7 @@ var FirehoseProvider = class {
 					VpcConfiguration: aossConfig["VpcConfiguration"]
 				};
 			}
+			if (properties["IcebergDestinationConfiguration"]) input.IcebergDestinationConfiguration = this.mapIcebergDestinationConfiguration(properties["IcebergDestinationConfiguration"]);
 			if (properties["DeliveryStreamEncryptionConfigurationInput"]) {
 				const encConfig = properties["DeliveryStreamEncryptionConfigurationInput"];
 				input.DeliveryStreamEncryptionConfigurationInput = {
@@ -48760,6 +48973,15 @@ var FirehoseProvider = class {
 			IcebergDestinationUpdate: this.mapIcebergConfigToUpdate(nextConfig)
 		}));
 	}
+	mapIcebergDestinationConfiguration(config) {
+		const result = this.mapIcebergConfigToUpdate(config);
+		const catalog = config["CatalogConfiguration"];
+		if (catalog !== void 0) result.CatalogConfiguration = {
+			...catalog["CatalogArn"] !== void 0 && { CatalogARN: catalog["CatalogArn"] },
+			...catalog["WarehouseLocation"] !== void 0 && { WarehouseLocation: catalog["WarehouseLocation"] }
+		};
+		return result;
+	}
 	mapIcebergConfigToUpdate(config) {
 		const result = {};
 		if (config["DestinationTableConfigurationList"] !== void 0) result.DestinationTableConfigurationList = config["DestinationTableConfigurationList"];
@@ -48768,12 +48990,11 @@ var FirehoseProvider = class {
 		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
 		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
 		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
-		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
+		if (config["s3BackupMode"] !== void 0) result.S3BackupMode = config["s3BackupMode"];
 		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
 		const roleArn = config["RoleARN"] ?? config["RoleArn"];
 		if (roleArn !== void 0) result.RoleARN = roleArn;
 		if (config["AppendOnly"] !== void 0) result.AppendOnly = config["AppendOnly"];
-		if (config["CatalogConfiguration"] !== void 0) result.CatalogConfiguration = config["CatalogConfiguration"];
 		if (config["S3Configuration"] !== void 0) result.S3Configuration = this.mapS3DestinationConfiguration(config["S3Configuration"]);
 		return result;
 	}
@@ -48865,6 +49086,7 @@ var FirehoseProvider = class {
 		if (directPut?.ThroughputHintInMBs !== void 0) result["DirectPutSourceConfiguration"] = { ThroughputHintInMBs: directPut.ThroughputHintInMBs };
 		const dest = desc.Destinations?.[0];
 		if (dest?.ExtendedS3DestinationDescription) result["ExtendedS3DestinationConfiguration"] = mapExtendedS3DescriptionToCfn(dest.ExtendedS3DestinationDescription);
+		else if (dest?.IcebergDestinationDescription) result["IcebergDestinationConfiguration"] = mapIcebergDescriptionToCfn(dest.IcebergDestinationDescription);
 		else if (dest?.S3DestinationDescription) result["S3DestinationConfiguration"] = mapS3DescriptionToCfn(dest.S3DestinationDescription);
 		else if (dest?.RedshiftDestinationDescription) result["RedshiftDestinationConfiguration"] = mapRedshiftDescriptionToCfn(dest.RedshiftDestinationDescription);
 		else if (dest?.ElasticsearchDestinationDescription) result["ElasticsearchDestinationConfiguration"] = mapNonS3DestinationToCfn(dest.ElasticsearchDestinationDescription);
@@ -49027,6 +49249,31 @@ function mapRedshiftDescriptionToCfn(desc) {
 	if (desc["S3BackupDescription"]) out["S3BackupConfiguration"] = mapS3DescriptionToCfn(desc["S3BackupDescription"]);
 	return out;
 }
+function mapIcebergDescriptionToCfn(desc) {
+	const out = {};
+	for (const k of [
+		"DestinationTableConfigurationList",
+		"SchemaEvolutionConfiguration",
+		"TableCreationConfiguration",
+		"BufferingHints",
+		"CloudWatchLoggingOptions",
+		"ProcessingConfiguration",
+		"RetryOptions",
+		"RoleARN",
+		"AppendOnly"
+	]) {
+		const v = pickDefinedDeep(desc[k]);
+		if (v !== void 0) out[k] = v;
+	}
+	if (desc["S3BackupMode"] !== void 0) out["s3BackupMode"] = desc["S3BackupMode"];
+	const catalog = desc["CatalogConfiguration"];
+	if (catalog) out["CatalogConfiguration"] = {
+		...catalog["CatalogARN"] !== void 0 && { CatalogArn: catalog["CatalogARN"] },
+		...catalog["WarehouseLocation"] !== void 0 && { WarehouseLocation: catalog["WarehouseLocation"] }
+	};
+	if (desc["S3DestinationDescription"]) out["S3Configuration"] = mapS3DescriptionToCfn(desc["S3DestinationDescription"]);
+	return out;
+}
 function mapHttpEndpointDescriptionToCfn(desc) {
 	const out = {};
 	for (const k of [
@@ -49621,6 +49868,89 @@ function readVisibility(properties, mask) {
 		...typeof role === "string" && role !== "" && { resourceAccessRole: role }
 	};
 }
+const DEFAULT_WEBHOOK_BUILD_TYPE = "BUILD";
+const NEW_PROJECT_WEBHOOK_ATTEMPTS = 4;
+const NEW_PROJECT_WEBHOOK_RETRY_BASE_MS = 2e3;
+const DEFAULT_WEBHOOK_SOURCE_LOCATION = "CODEBUILD_DEFAULT_WEBHOOK_SOURCE_LOCATION";
+const DEFAULT_WEBHOOK_SCOPE = "GITHUB_ORGANIZATION";
+function relayedConnectionRace(error, detail) {
+	if (!(error instanceof Error) || error.name !== "OAuthProviderException") return "";
+	if (detail.includes("security token included in the request is invalid")) return " (The security token included in the request is invalid. (Service: CodeBuild))";
+	if (detail.includes("not authorized to access connection")) return " (The service role is not authorized to perform access to the connection Source.Auth names)";
+	return "";
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readTriggers(properties, mask) {
+	const triggers = properties["Triggers"];
+	if (triggers == null) return { kind: "unmanaged" };
+	const refuse = (key, expected, value) => ({
+		kind: "unusable",
+		reason: `AWS::CodeBuild::Project ${key} must be ${expected}, got ${JSON.stringify(maskDeep(value, mask))}`
+	});
+	if (!isRecord$1(triggers)) return refuse("Triggers", "an object", triggers);
+	const declared = triggers["Webhook"];
+	const webhook = declared == null ? void 0 : coerceCfnBoolean(declared);
+	if (declared != null && webhook === void 0) return refuse("Triggers.Webhook", "a boolean", declared);
+	const groups = triggers["FilterGroups"];
+	const buildType = triggers["BuildType"];
+	if (webhook !== true) {
+		for (const [key, value, noun] of [[
+			"FilterGroups",
+			groups,
+			"filter groups"
+		], [
+			"BuildType",
+			buildType,
+			"build type"
+		]]) if (value != null) return {
+			kind: "unusable",
+			reason: `AWS::CodeBuild::Project Triggers.${key}: cannot specify ${noun} when webhook is disabled`
+		};
+		return { kind: webhook === false ? "disabled" : "unmanaged" };
+	}
+	if (buildType != null && typeof buildType !== "string") return refuse("Triggers.BuildType", "a string", buildType);
+	let filterGroups;
+	if (groups != null) {
+		if (!Array.isArray(groups) || !groups.every(Array.isArray)) return refuse("Triggers.FilterGroups", "a list of filter lists", groups);
+		const rows = groups;
+		if (!rows.every((group) => group.every(isRecord$1))) return refuse("Triggers.FilterGroups", "a list of filter lists", groups);
+		filterGroups = rows.map((group) => group.map((filter) => {
+			const excluded = filter["ExcludeMatchedPattern"];
+			return {
+				type: filter["Type"],
+				pattern: filter["Pattern"],
+				...excluded != null && { excludeMatchedPattern: coerceCfnBoolean(excluded) ?? excluded }
+			};
+		}));
+	}
+	const policy = triggers["PullRequestBuildPolicy"];
+	if (policy != null && !isRecord$1(policy)) return refuse("Triggers.PullRequestBuildPolicy", "an object", policy);
+	const scope = triggers["ScopeConfiguration"];
+	if (scope != null && !isRecord$1(scope)) return refuse("Triggers.ScopeConfiguration", "an object", scope);
+	if (scope != null) {
+		const source = properties["Source"];
+		if (!isRecord$1(source) || source["Location"] !== DEFAULT_WEBHOOK_SOURCE_LOCATION) return {
+			kind: "unusable",
+			reason: `AWS::CodeBuild::Project Triggers.ScopeConfiguration: cannot specify a scope when the project source location is not ${DEFAULT_WEBHOOK_SOURCE_LOCATION}`
+		};
+	}
+	return {
+		kind: "enabled",
+		...filterGroups !== void 0 && { filterGroups },
+		...buildType != null && { buildType },
+		...scope != null && { scopeConfiguration: {
+			name: scope["Name"],
+			scope: scope["Scope"] ?? DEFAULT_WEBHOOK_SCOPE,
+			...scope["Domain"] != null && { domain: scope["Domain"] }
+		} },
+		...policy != null && { pullRequestBuildPolicy: {
+			requiresCommentApproval: policy["RequiresCommentApproval"],
+			...policy["ApproverRoles"] != null && { approverRoles: policy["ApproverRoles"] }
+		} }
+	};
+}
 var CodeBuildProvider = class {
 	client;
 	createClient;
@@ -49651,7 +49981,8 @@ var CodeBuildProvider = class {
 		"SourceVersion",
 		"AutoRetryLimit",
 		"Visibility",
-		"ResourceAccessRole"
+		"ResourceAccessRole",
+		"Triggers"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -49849,6 +50180,11 @@ var CodeBuildProvider = class {
 			if (context?.replayingState !== true) throw new ProvisioningError(visibilityRead.reason, resourceType, logicalId);
 			this.logger.warn(mask(`${visibilityRead.reason}. Replaying a state record, so CodeBuild Project ${logicalId} is left ${DEFAULT_PROJECT_VISIBILITY} with no resource access role rather than refusing the restore`));
 		}
+		const triggersRead = readTriggers(properties, mask);
+		if (triggersRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(triggersRead.reason, resourceType, logicalId);
+			this.logger.warn(mask(`${triggersRead.reason}. Replaying a state record, so CodeBuild Project ${logicalId} gets no webhook rather than refusing the restore`));
+		}
 		let createdName;
 		try {
 			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
@@ -49857,6 +50193,7 @@ var CodeBuildProvider = class {
 			const projectArn = result.project.arn;
 			createdName = projectName;
 			reportCreatedResource(logicalId, resourceType, createdName);
+			if (triggersRead.kind === "enabled") await this.createWebhookOnNewProject(projectName, triggersRead);
 			if (visibilityRead.kind === "usable" && (visibilityRead.visibility !== DEFAULT_PROJECT_VISIBILITY || visibilityRead.resourceAccessRole !== void 0)) await this.applyVisibility(projectArn, visibilityRead);
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
 			return {
@@ -49866,11 +50203,67 @@ var CodeBuildProvider = class {
 		} catch (error) {
 			if (createdName !== void 0) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause), createdName === void 0);
 			if (createdName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdName);
 			throw thrown;
 		}
 	}
+	async createWebhook(projectName, read) {
+		await this.getCreateClient().send(new CreateWebhookCommand({
+			projectName,
+			...read.filterGroups !== void 0 && { filterGroups: read.filterGroups },
+			...read.buildType !== void 0 && { buildType: read.buildType },
+			...read.scopeConfiguration !== void 0 && { scopeConfiguration: read.scopeConfiguration },
+			...read.pullRequestBuildPolicy !== void 0 && { pullRequestBuildPolicy: read.pullRequestBuildPolicy }
+		}));
+	}
+	async createWebhookOnNewProject(projectName, read) {
+		const watch = startInterruptWatch(`The webhook of CodeBuild Project ${projectName}`);
+		let mayHaveLanded = false;
+		try {
+			for (let attempt = 1;; attempt++) try {
+				await this.createWebhook(projectName, read);
+				return;
+			} catch (error) {
+				if (!(error instanceof Error)) throw error;
+				if (mayHaveLanded && error.name === "ResourceAlreadyExistsException") return;
+				const ambiguous = isAmbiguousOutcomeError(error);
+				mayHaveLanded ||= ambiguous;
+				if (!(ambiguous || isRetryableTransientError(error, error.message)) || attempt === NEW_PROJECT_WEBHOOK_ATTEMPTS) throw markNonRetryable(error);
+				let remaining = NEW_PROJECT_WEBHOOK_RETRY_BASE_MS * 2 ** (attempt - 1);
+				while (remaining > 0) {
+					if (watch.isInterrupted()) throw watch.onInterrupted();
+					const chunk = Math.min(1e3, remaining);
+					await this.sleep(chunk);
+					remaining -= chunk;
+				}
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	async reconcileWebhook(projectName, read, liveWebhook) {
+		if (read.kind === "disabled" && liveWebhook) {
+			await this.getClient().send(new DeleteWebhookCommand({ projectName }));
+			return;
+		}
+		if (read.kind !== "enabled") return;
+		if (!liveWebhook) {
+			await this.createWebhook(projectName, read);
+			return;
+		}
+		await this.getClient().send(new UpdateWebhookCommand({
+			projectName,
+			filterGroups: read.filterGroups ?? [],
+			buildType: read.buildType ?? DEFAULT_WEBHOOK_BUILD_TYPE,
+			rotateSecret: false,
+			...read.pullRequestBuildPolicy !== void 0 && { pullRequestBuildPolicy: read.pullRequestBuildPolicy }
+		}));
+	}
 	async applyVisibility(projectArn, read) {
 		await this.getClient().send(new UpdateProjectVisibilityCommand({
 			projectArn,
@@ -49882,6 +50275,11 @@ var CodeBuildProvider = class {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
+		const triggersRead = readTriggers(properties, mask);
+		if (triggersRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(triggersRead.reason, resourceType, logicalId, physicalId);
+			this.logger.warn(mask(`${triggersRead.reason}. Replaying a state record, so the webhook of CodeBuild Project ${physicalId} is left unchanged`));
+		}
 		try {
 			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
@@ -49890,6 +50288,9 @@ var CodeBuildProvider = class {
 			if (!declaredKey(properties["EncryptionKey"]) && declaredKey(previousProperties["EncryptionKey"])) input.encryptionKey = DEFAULT_ENCRYPTION_KEY;
 			if (properties["Tags"] == null && previousProperties["Tags"] != null) input.tags = [];
 			const updated = await this.getClient().send(new UpdateProjectCommand(input));
+			const liveWebhook = updated.project?.webhook;
+			await this.reconcileWebhook(physicalId, triggersRead, liveWebhook != null);
+			if (triggersRead.kind === "enabled" && triggersRead.scopeConfiguration !== void 0 && liveWebhook != null && Object.entries(triggersRead.scopeConfiguration).some(([key, value]) => liveWebhook.scopeConfiguration?.[key] !== value)) this.logger.warn(mask(`The Triggers.ScopeConfiguration of CodeBuild Project ${physicalId} differs from its live webhook, which cannot change scope: the webhook keeps its scope. Delete it with Webhook: false, then deploy Webhook: true to apply the new one`));
 			const desiredVisibility = readVisibility(properties, mask);
 			const recorded = readVisibility(previousProperties, mask);
 			if (desiredVisibility.kind === "unusable") {
@@ -49907,14 +50308,14 @@ var CodeBuildProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause), true);
 		}
 	}
-	wrapCaughtError(mask, error, build) {
+	wrapCaughtError(mask, error, build, retryConnectionRace) {
 		const failure = describeAwsFailure(error);
 		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
 		this.logger.debug(mask(build(mask(failure.detail)).message));
-		const wrapped = build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		const wrapped = build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}` + (retryConnectionRace ? relayedConnectionRace(error, failure.detail) : ""));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -49930,7 +50331,7 @@ var CodeBuildProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete CodeBuild Project ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause), false);
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
@@ -50110,7 +50511,7 @@ var CodeBuildProvider = class {
 		return result;
 	}
 	getDriftUnknownPaths() {
-		return ["Source.Auth"];
+		return ["Source.Auth", "Triggers"];
 	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -54317,4 +54718,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-ushrO6ri.js.map
+//# sourceMappingURL=provider-classes-DGFOKPO9.js.map