@go-to-k/cdkd 0.317.0 → 0.318.0

package/dist/{provider-classes-DGFOKPO9.js → provider-classes-CbiecOol.js}

@@ -2,19 +2,19 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWp
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
 import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-BpB3iPvn.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-b0rYBotL.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-gTpDZhfz.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BZ-VVfXu.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-BnEvzfon.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-3w71Eu4a.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CKm1Nk6t.js";
 import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-CspmK57I.js";
-import { RDSProvider } from "./rds-provider-BUNLNluC.js";
-import { NeptuneProvider } from "./neptune-provider-BfzktOKC.js";
-import { ASGProvider } from "./asg-provider-WornuySB.js";
+import { RDSProvider } from "./rds-provider-bEeid6uI.js";
+import { NeptuneProvider } from "./neptune-provider-D8tkFP12.js";
+import { ASGProvider } from "./asg-provider-kV8DYFjT.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
-import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionConfigurationCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionScalingConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PublishVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutFunctionScalingConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
@@ -8334,6 +8334,26 @@ function withholdWaiterPayload(error, mask) {
 	};
 }
 const LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS = 3;
+const LATEST_PUBLISHED = "$LATEST.PUBLISHED";
+function capacityProviderConfigForUpdate(config) {
+	const managed = config?.LambdaManagedInstancesCapacityProviderConfig;
+	if (managed === void 0) return config;
+	return { LambdaManagedInstancesCapacityProviderConfig: {
+		...managed,
+		ExecutionEnvironmentMemoryGiBPerVCpu: managed.ExecutionEnvironmentMemoryGiBPerVCpu ?? 2
+	} };
+}
+function refuseManagedInstancesPropertiesWithoutCapacityProvider(logicalId, resourceType, properties, context, warn) {
+	if (properties["CapacityProviderConfig"] !== void 0) return;
+	const declared = [properties["PublishToLatestPublished"] !== void 0 ? "PublishToLatestPublished" : void 0, properties["FunctionScalingConfig"] !== void 0 ? "FunctionScalingConfig" : void 0].filter((key) => key !== void 0);
+	if (declared.length === 0) return;
+	const named = declared.join(" and ");
+	if (context.replayingState === true) {
+		warn(`Lambda function ${logicalId} records ${named} without CapacityProviderConfig; ignoring ${declared.length === 1 ? "it" : "them"} for this replay.`);
+		return;
+	}
+	throw markNonRetryable(new ProvisioningError(`Lambda function ${logicalId} declares ${named} without CapacityProviderConfig: AWS applies ${declared.length === 1 ? "it" : "them"} to Lambda Managed Instances functions only. Add a capacity provider, or remove ${named}.`, resourceType, logicalId, context.physicalId));
+}
 function refuseImageFunctionUnsupported(logicalId, resourceType, properties, physicalId) {
 	if (properties["PackageType"] !== "Image") return;
 	const declared = [properties["CodeSigningConfigArn"] !== void 0 ? "CodeSigningConfigArn" : void 0, properties["RuntimeManagementConfig"] !== void 0 ? "RuntimeManagementConfig" : void 0].filter((key) => key !== void 0);
@@ -8349,7 +8369,8 @@ const SEPARATELY_APPLIED_KEYS = /* @__PURE__ */ new Set([
 	"ReservedConcurrentExecutions",
 	"RecursiveLoop",
 	"CodeSigningConfigArn",
-	"RuntimeManagementConfig"
+	"RuntimeManagementConfig",
+	"FunctionScalingConfig"
 ]);
 var LambdaFunctionProvider = class {
 	lambdaClient;
@@ -8384,7 +8405,10 @@ var LambdaFunctionProvider = class {
 		"CodeSigningConfigArn",
 		"RuntimeManagementConfig",
 		"DurableConfig",
-		"TenancyConfig"
+		"TenancyConfig",
+		"CapacityProviderConfig",
+		"FunctionScalingConfig",
+		"PublishToLatestPublished"
 	])]]);
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Map([
 		["Timeout", 3],
@@ -8415,14 +8439,18 @@ var LambdaFunctionProvider = class {
 		"VpcConfig",
 		"ReservedConcurrentExecutions",
 		"CodeSigningConfigArn",
-		"RuntimeManagementConfig"
+		"RuntimeManagementConfig",
+		"CapacityProviderConfig",
+		"FunctionScalingConfig",
+		"PublishToLatestPublished"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Map([["PublishToLatestPublished", "CloudFormation-only version-publishing directive with no AWS SDK equivalent"]])]]);
 	cleanupDeleteRetryDelayMs = 2e3;
 	eniWaitTimeoutMs = 6e5;
 	eniWaitInitialDelayMs = 1e4;
 	eniWaitMaxDelayMs = 1e4;
 	functionUpdateMaxWaitSeconds = 600;
+	latestPublishedPollMs = 3e3;
+	latestPublishedDeadlineMarginMs = 15e3;
 	eniInitialSleepMs = 1e4;
 	eniDeleteRetryBudgetMs = 18e5;
 	eniDeleteRetryIntervalMs = 15e3;
@@ -8442,12 +8470,14 @@ var LambdaFunctionProvider = class {
 		if (!code) throw new ProvisioningError(`Code is required for Lambda function ${logicalId}`, resourceType, logicalId);
 		if (!role) throw new ProvisioningError(`Role is required for Lambda function ${logicalId}`, resourceType, logicalId);
 		refuseImageFunctionUnsupported(logicalId, resourceType, properties);
+		refuseManagedInstancesPropertiesWithoutCapacityProvider(logicalId, resourceType, properties, { replayingState: context?.replayingState }, log.warn);
 		let functionCreated = false;
 		let createdFunctionName;
 		let createdFunctionIdentity;
 		const postCreateCleanup = { deleted: false };
 		try {
 			const tags = properties["Tags"] ? Object.fromEntries(desiredTags.map((tag) => [tag.Key, tag.Value])) : void 0;
+			const capacityProviderConfig = properties["CapacityProviderConfig"];
 			const createParams = {
 				FunctionName: functionName,
 				Role: role,
@@ -8473,13 +8503,48 @@ var LambdaFunctionProvider = class {
 				DurableConfig: properties["DurableConfig"],
 				TenancyConfig: properties["TenancyConfig"],
 				CodeSigningConfigArn: properties["CodeSigningConfigArn"],
-				Tags: tags
+				Tags: tags,
+				...capacityProviderConfig !== void 0 && {
+					CapacityProviderConfig: capacityProviderConfig,
+					Publish: true,
+					PublishTo: "LATEST_PUBLISHED"
+				}
 			};
 			const response = await (await this.createClient.get()).send(new CreateFunctionCommand(createParams));
 			functionCreated = true;
 			createdFunctionName = response.FunctionName || functionName;
 			createdFunctionIdentity = functionIdentityToken(response.FunctionArn, response.LastModified);
 			reportCreatedResource(logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
+			if (capacityProviderConfig !== void 0) {
+				createdFunctionIdentity = void 0;
+				reportCreatedResource(logicalId, resourceType, createdFunctionName);
+				const target = {
+					logicalId,
+					resourceType,
+					functionName
+				};
+				await this.applyPostCreateConfig(() => this.waitForLatestPublishedSettled(target, log, "after"), {
+					apiName: "GetFunctionConfiguration",
+					propertyName: "CapacityProviderConfig",
+					logicalId,
+					resourceType,
+					functionName,
+					log,
+					cleanup: postCreateCleanup,
+					awaitGone: capacityProviderConfig !== void 0
+				});
+				const functionScalingConfig = properties["FunctionScalingConfig"];
+				if (functionScalingConfig !== void 0) await this.applyPostCreateConfig(() => this.putFunctionScalingConfig(target, log, functionScalingConfig), {
+					apiName: "PutFunctionScalingConfig",
+					propertyName: "FunctionScalingConfig",
+					logicalId,
+					resourceType,
+					functionName,
+					log,
+					cleanup: postCreateCleanup,
+					awaitGone: capacityProviderConfig !== void 0
+				});
+			}
 			const recursiveLoop = properties["RecursiveLoop"];
 			if (recursiveLoop !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 				FunctionName: functionName,
@@ -8491,7 +8556,8 @@ var LambdaFunctionProvider = class {
 				resourceType,
 				functionName,
 				log,
-				cleanup: postCreateCleanup
+				cleanup: postCreateCleanup,
+				awaitGone: capacityProviderConfig !== void 0
 			});
 			const reservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
 			if (reservedConcurrentExecutions !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionConcurrencyCommand({
@@ -8504,11 +8570,12 @@ var LambdaFunctionProvider = class {
 				resourceType,
 				functionName,
 				log,
-				cleanup: postCreateCleanup
+				cleanup: postCreateCleanup,
+				awaitGone: capacityProviderConfig !== void 0
 			});
 			const runtimeManagementConfig = properties["RuntimeManagementConfig"];
 			if (runtimeManagementConfig !== void 0) await this.applyPostCreateConfig(async () => {
-				await waitUntilFunctionActiveV2({
+				if (capacityProviderConfig === void 0) await waitUntilFunctionActiveV2({
 					client: this.lambdaClient,
 					maxWaitTime: this.functionUpdateMaxWaitSeconds,
 					minDelay: 1,
@@ -8524,7 +8591,8 @@ var LambdaFunctionProvider = class {
 				resourceType,
 				functionName,
 				log,
-				cleanup: postCreateCleanup
+				cleanup: postCreateCleanup,
+				awaitGone: capacityProviderConfig !== void 0
 			});
 			log.debug(`Successfully created Lambda function ${logicalId}: ${log.value(functionName)}`);
 			return {
@@ -8579,7 +8647,12 @@ var LambdaFunctionProvider = class {
 				if (!/currently in the following state|ResourceConflict/i.test(deleteMessage)) break;
 				if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
 			}
-			if (cleanupFailure === void 0) ctx.cleanup.deleted = true;
+			if (cleanupFailure === void 0) {
+				ctx.cleanup.deleted = true;
+				if (ctx.awaitGone) await this.waitForFunctionGone(ctx, log).catch((goneError) => {
+					log.warn(describeAwsFailure(goneError).summary);
+				});
+			}
 			if (cleanupFailure !== void 0) {
 				const cleanupHead = `Cleanup DeleteFunction failed for ${ctx.logicalId} after ${ctx.apiName} failure — function may be orphaned: `;
 				if (cleanupFailure.redacted) this.logger.debug(log.mask(`${cleanupHead}${cleanupFailure.detail}`));
@@ -8597,6 +8670,42 @@ var LambdaFunctionProvider = class {
 			RuntimeVersionArn: config["RuntimeVersionArn"]
 		}));
 	}
+	async waitForLatestPublishedSettled(target, log, phase) {
+		const { logicalId, resourceType, functionName } = target;
+		const budgetMs = Math.min(this.functionUpdateMaxWaitSeconds * 1e3, enclosingDeadlineRemainingMs() - this.latestPublishedDeadlineMarginMs);
+		const deadline = Date.now() + budgetMs;
+		for (;;) {
+			const cfg = await this.lambdaClient.send(new GetFunctionConfigurationCommand({
+				FunctionName: functionName,
+				Qualifier: LATEST_PUBLISHED
+			}));
+			if (phase === "after" && (cfg.State === "Failed" || cfg.LastUpdateStatus === "Failed")) throw this.wrapStatusReasonError(target, log, cfg);
+			if (!(cfg.State === "Pending" || cfg.State === "Deactivating" || cfg.LastUpdateStatus === "InProgress")) return;
+			if (Date.now() >= deadline) throw new ProvisioningError(`Lambda function ${logicalId}: ${LATEST_PUBLISHED} did not settle within ${Math.max(0, Math.round(budgetMs / 1e3))}s (State ${cfg.State}, LastUpdateStatus ${cfg.LastUpdateStatus})`, resourceType, logicalId, functionName);
+			await new Promise((resolve) => setTimeout(resolve, this.latestPublishedPollMs));
+		}
+	}
+	wrapStatusReasonError(target, log, cfg) {
+		const { logicalId, resourceType, functionName } = target;
+		const head = `Lambda function ${logicalId}: ${LATEST_PUBLISHED} failed: `;
+		const text = describeAwsStatusReason({
+			code: cfg.StateReasonCode ?? cfg.LastUpdateStatusReasonCode,
+			message: cfg.StateReason ?? cfg.LastUpdateStatusReason
+		}, "no reason given");
+		const build = (detail, cause) => new ProvisioningError(`${head}${log.mask(detail)}`, resourceType, logicalId, functionName, cause);
+		if (!text.redacted) return build(text.summary);
+		log.debug(log.mask(`${head}${text.detail}`));
+		return markRedactedCause(build(text.summary, new Error(text.detail)));
+	}
+	async putFunctionScalingConfig(target, log, config) {
+		await this.waitForLatestPublishedSettled(target, log, "before");
+		await this.lambdaClient.send(new PutFunctionScalingConfigCommand({
+			FunctionName: target.functionName,
+			Qualifier: LATEST_PUBLISHED,
+			FunctionScalingConfig: config ?? {}
+		}));
+		await this.waitForLatestPublishedSettled(target, log, "after");
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
@@ -8605,7 +8714,17 @@ var LambdaFunctionProvider = class {
 		log.debug(`Updating Lambda function ${logicalId}: ${log.value(physicalId)}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		refuseImageFunctionUnsupported(logicalId, resourceType, properties, physicalId);
-		try {
+		refuseManagedInstancesPropertiesWithoutCapacityProvider(logicalId, resourceType, properties, {
+			replayingState: context?.replayingState,
+			physicalId
+		}, log.warn);
+		try {
+			const desiredCapacity = properties["CapacityProviderConfig"];
+			const recordedCapacity = previousProperties["CapacityProviderConfig"];
+			const liveManaged = desiredCapacity !== void 0 || recordedCapacity !== void 0 ? (await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }))).Configuration?.CapacityProviderConfig !== void 0 : false;
+			if (liveManaged && desiredCapacity === void 0) throw markNonRetryable(new ProvisioningError(`Lambda function ${logicalId} cannot lose its CapacityProviderConfig: AWS does not support removing it from a function. Keep the property, or replace the function under a new logical id.`, resourceType, logicalId, physicalId));
+			const capacityNeverApplied = !liveManaged && desiredCapacity !== void 0 && recordedCapacity !== void 0;
+			if (capacityNeverApplied) log.warn(`Lambda function ${logicalId} is not a Managed Instances function on AWS, so its CapacityProviderConfig and FunctionScalingConfig are not applied. Replace the function to apply them.`);
 			const configFields = [
 				"Role",
 				"Handler",
@@ -8624,10 +8743,14 @@ var LambdaFunctionProvider = class {
 				"ImageConfig",
 				"SnapStart",
 				"LoggingConfig",
-				"DurableConfig"
+				"DurableConfig",
+				"CapacityProviderConfig"
 			];
 			const changedConfigFields = [];
-			for (const field of configFields) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) changedConfigFields.push(field);
+			for (const field of configFields) {
+				if (field === "CapacityProviderConfig" && capacityNeverApplied) continue;
+				if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) changedConfigFields.push(field);
+			}
 			if (changedConfigFields.length > 0) {
 				const configParams = {
 					FunctionName: physicalId,
@@ -8648,7 +8771,8 @@ var LambdaFunctionProvider = class {
 					ImageConfig: properties["ImageConfig"],
 					SnapStart: properties["SnapStart"],
 					LoggingConfig: properties["LoggingConfig"],
-					DurableConfig: properties["DurableConfig"]
+					DurableConfig: properties["DurableConfig"],
+					CapacityProviderConfig: capacityProviderConfigForUpdate(capacityNeverApplied ? void 0 : desiredCapacity)
 				};
 				for (const field of changedConfigFields) markUnsettled(field);
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand(configParams));
@@ -8724,6 +8848,31 @@ var LambdaFunctionProvider = class {
 				await this.putRuntimeManagementConfig(physicalId, newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" });
 				log.debug(`Updated RuntimeManagementConfig for Lambda function ${log.value(physicalId)} to ${JSON.stringify(maskDeep(newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" }, operationMask))}`);
 			}
+			if (liveManaged && desiredCapacity !== void 0) {
+				const target = {
+					logicalId,
+					resourceType,
+					functionName: physicalId
+				};
+				const newScaling = properties["FunctionScalingConfig"];
+				const prevScaling = previousProperties["FunctionScalingConfig"];
+				const applyScaling = newScaling?.MinExecutionEnvironments !== prevScaling?.MinExecutionEnvironments || newScaling?.MaxExecutionEnvironments !== prevScaling?.MaxExecutionEnvironments || context?.unsettledProperties?.has("FunctionScalingConfig") === true;
+				if (properties["PublishToLatestPublished"] !== false) {
+					await this.waitForLatestPublishedSettled(target, log, "before");
+					await this.lambdaClient.send(new PublishVersionCommand({
+						FunctionName: physicalId,
+						Description: properties["Description"],
+						PublishTo: "LATEST_PUBLISHED"
+					}));
+					await this.waitForLatestPublishedSettled(target, log, "after");
+					log.debug(`Published ${LATEST_PUBLISHED} of ${log.value(physicalId)}`);
+				}
+				if (applyScaling) {
+					markUnsettled("FunctionScalingConfig");
+					await this.putFunctionScalingConfig(target, log, newScaling);
+					log.debug(`Updated FunctionScalingConfig of ${log.value(physicalId)}`);
+				}
+			}
 			const getResponse = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
 			const functionArn = getResponse.Configuration?.FunctionArn;
 			await this.applyTagDiff(functionArn, physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log, {
@@ -8787,6 +8936,32 @@ var LambdaFunctionProvider = class {
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 		if (hasVpcConfig) await this.cleanupLambdaEnis(physicalId, Date.now() + enclosingDeadlineRemainingMs() - this.eniDeadlineMarginMs);
+		if (properties?.["CapacityProviderConfig"] !== void 0) await this.waitForFunctionGone({
+			logicalId,
+			resourceType,
+			functionName: physicalId
+		}, createMaskedLogSinks(this.logger, context?.maskSecrets));
+	}
+	async waitForFunctionGone(target, log) {
+		const { logicalId, resourceType, functionName } = target;
+		const deadline = Date.now() + Math.min(this.functionUpdateMaxWaitSeconds * 1e3, enclosingDeadlineRemainingMs() - this.latestPublishedDeadlineMarginMs);
+		for (;;) {
+			try {
+				await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: functionName }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException) return;
+				const failure = describeAwsFailure(error);
+				log.debug(log.mask(`Waiting for Lambda function ${logicalId} to go: ${failure.detail}`));
+				log.warn(`Waiting for Lambda function ${logicalId} to go failed: ${failure.summary}`);
+				return;
+			}
+			if (Date.now() >= deadline) {
+				const stillDeleting = new ProvisioningError(`Lambda function ${logicalId} is still being deleted`, resourceType, logicalId, functionName);
+				markDeleteStarted(stillDeleting);
+				throw stillDeleting;
+			}
+			await new Promise((resolve) => setTimeout(resolve, this.latestPublishedPollMs));
+		}
 	}
 	buildVpcConfig(raw) {
 		if (raw === void 0 || raw === null) return;
@@ -9092,6 +9267,13 @@ var LambdaFunctionProvider = class {
 			});
 		}
 		if (names.has("CodeSigningConfigArn")) set("CodeSigningConfigArn", (await strict(() => this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }))))?.CodeSigningConfigArn);
+		if (names.has("FunctionScalingConfig")) {
+			const r = await strict(() => this.lambdaClient.send(new GetFunctionScalingConfigCommand({
+				FunctionName: physicalId,
+				Qualifier: LATEST_PUBLISHED
+			})));
+			set("FunctionScalingConfig", r?.RequestedFunctionScalingConfig ?? r?.AppliedFunctionScalingConfig);
+		}
 		return out;
 	}
 	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
@@ -9157,6 +9339,19 @@ var LambdaFunctionProvider = class {
 				if (Object.keys(dc).length > 0) result["DurableConfig"] = dc;
 			}
 			if (cfg.TenancyConfig?.TenantIsolationMode !== void 0) result["TenancyConfig"] = { TenantIsolationMode: cfg.TenancyConfig.TenantIsolationMode };
+			if (cfg.CapacityProviderConfig !== void 0) {
+				result["CapacityProviderConfig"] = cfg.CapacityProviderConfig;
+				try {
+					const scaling = await this.lambdaClient.send(new GetFunctionScalingConfigCommand({
+						FunctionName: physicalId,
+						Qualifier: LATEST_PUBLISHED
+					}));
+					const live = scaling.RequestedFunctionScalingConfig ?? scaling.AppliedFunctionScalingConfig;
+					if (live !== void 0) result["FunctionScalingConfig"] = live;
+				} catch (scalingErr) {
+					if (!(scalingErr instanceof ResourceNotFoundException)) this.logger.warn(safeMsg`GetFunctionScalingConfig failed for ${physicalId} — FunctionScalingConfig omitted from the drift snapshot (may surface as a false removal): ${describeAwsFailure(scalingErr).summary}`);
+				}
+			}
 			result["Tags"] = normalizeAwsTagsToCfn(resp.Tags);
 			try {
 				const rlResp = await this.lambdaClient.send(new GetFunctionRecursionConfigCommand({ FunctionName: physicalId }));
@@ -9201,7 +9396,8 @@ var LambdaFunctionProvider = class {
 			"Code.S3ObjectVersion",
 			"Code.S3ObjectStorageMode",
 			"Code.ZipFile",
-			"Code.SourceKMSKeyArn"
+			"Code.SourceKMSKeyArn",
+			"PublishToLatestPublished"
 		];
 	}
 	async import(input) {
@@ -54718,4 +54914,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DGFOKPO9.js.map
+//# sourceMappingURL=provider-classes-CbiecOol.js.map