@go-to-k/cdkd 0.318.0 → 0.319.0

package/dist/{provider-classes-CbiecOol.js → provider-classes-DOr3JVGp.js}

@@ -2,13 +2,13 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWp
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
 import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-BpB3iPvn.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-BnEvzfon.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-3w71Eu4a.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CKm1Nk6t.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, B as deleteTableWithIndexBusyRetry, Ba as s3BucketArn, Bc as passedNoEchoParametersOf, Bi as isRefusedByName, C as planContributorInsightsOp, Cl as recordAttributeIdCopy, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reDisableInstanceApiTermination, Dc as lambdaFunctionNameForMask, E as reverseMapIndexContributorInsights, Ea as observeThenDisableInstanceApiTermination, Ec as canonicalLambdaFunctionName, El as carriesSecretMask, Eo as parseWebACLArn, F as resolveDynamoDbDeleteBudgetClock, Fd as displayAssemblyPath, G as readbackVectorIndexes, Gi as readTagList, Gn as isRedactedRecordedValue, H as relayedIndexBusyDelete, Ha as s3BucketDualStackDomainName, Hi as DBPROXY_TAGS_WHAT, Hn as getCurrentProducerRegions, I as resolveDynamoDbDeleteBudgetMs, Id as renderAssemblyPathEscape, Ii as acquireIdempotencyToken, Io as accountArgs, J as vectorIndexesShapeDetail, Jc as recordReferenceProvenanceEntry, Ji as tagPlanWarning, Js as withoutSilentDropProperties, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as markSameGenerationBag, Ki as refuseMalformedDesiredTags, Kn as redactedDeleteAddressFields, Ks as findSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, Ld as resolveAssemblyPath, M as beginDeleteWait, Mi as earliestDefined, N as compensateRemovedDeletionProtection, O as stripIndexContributorInsights, Oa as reEnableInstanceApiTermination, Oc as sameLambdaFunctionAddress, P as deleteBudgetKey, Pd as describeFileReadFailure, Pi as reserveStackCreateToken, Q as readTtlSpec, Qc as hasMaskableValues, R as INDEX_SETTLE_POLL_INTERVAL_MS, S as indexDeclaresContributorInsights, Sa as markWaitAbandoned, Sc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, Sl as physicalNameCopiesOf, T as readContributorInsightsSpec, Ta as isTerminationProtectionPropagationError, Tc as emrClusterInstancesReplaced, U as waitForIndexesSettled, Ua as s3BucketRegionalDomainName, Ui as DBPROXY_TAG_OPTIONS, Ur as replacedDeleteFailureVerdict, Us as withheldAccountClause, V as maskedLogger, Va as s3BucketDomainName, Vi as markDeleteStarted, Vr as getStackRecords, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wa as s3BucketWebsiteUrl, Wi as planTagDiff, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Xi as stringifyIfAssigned, Y as isTtlAlreadyDisabled, Ya as outputReferenceProvenanceOf, Yc as snapshotPassProvenance, Yi as definedAttributes, Yt as withNestedStackContext, Z as planTimeToLive, _ as streamMemberRefusals, _c as requireConfigString, _d as decodeListingKey, _t as renderNestedTemplateTreeDefect, ac as isWarmThroughputDecrease, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as withIndeterminateGuard, bd as canonicalizeRegion, c as DynamoDBGlobalTableProvider, cc as coerceCfnBoolean, cn as withApiLimit, d as declaredStreamPolicyMember, dc as configIntegerRefusal, ds as refuseMalformedNestedChildOutputs, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as slowCcOperationTimeoutMs, fc as configStringRefusal, fl as withoutPhysicalNameCopies, g as streamDeclaresTags, gc as requireConfigObject, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigArray, ho as getAccountInfo, ht as isAbsoluteAssetPath, ic as coerceWarmThroughput$1, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ja as isUsableAttemptedName, js as refuseMalformedResourcesForDestroy, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ko as passedParameterClassesOf, l as STREAM_POLICY_KEY, lc as coerceCfnInteger, m as reverseMapStreamPolicy, ma as unchangedBehindSecretReference, mc as replayWarn, ml as dynamicReferenceTokens, mt as findNestedTemplateTreeDefect, na as waitForLambdaFunctionActive, nt as hasCdkAutoDeleteTag, oa as getCurrentResourceSecrets, oc as toCfnInteger, on as isAccessDeniedError, p as planStreamMemberOps, pa as onlySecretReferencesDiffer, pc as readConfigString, pu as stringifyValue, q as vectorIndexesSettled, qc as redactForState, qi as tagMapAsList, qn as redactedDeleteAddressSkip, rc as WARM_THROUGHPUT_MEMBERS, rt as isTruthyCfnBoolean, sc as toFiniteNumber, sn as lookupEachName, t as DeployEngine, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configBooleanRefusal, uu as timePhase, v as streamPolicyMatchesDeclared, vu as rewriteTemplateAssetReferences, w as planIndexContributorInsightsOps, wa as ec2InstanceProtectionSite, wc as ecsServiceLaunchTypeSetOrChanged, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as isWaitAbandonedError, xc as withRetry, xd as derivePartitionAndUrlSuffix, xl as recoverMaskedOutput, y as streamTagsMatchDeclared, ya as deleteSkipReason, yi as secretNamedAttributeNamesOf, z as TABLE_INDEX_NOUN, za as isSettledInstanceState, zr as awaitInFlightSibling } from "./deploy-engine-CVYhHEgq.js";
+import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-qTIqSmlf.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DyYTFxF-.js";
 import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-CspmK57I.js";
-import { RDSProvider } from "./rds-provider-bEeid6uI.js";
-import { NeptuneProvider } from "./neptune-provider-D8tkFP12.js";
-import { ASGProvider } from "./asg-provider-kV8DYFjT.js";
+import { RDSProvider } from "./rds-provider-CIjO2Do5.js";
+import { NeptuneProvider } from "./neptune-provider-BsA7jGiV.js";
+import { ASGProvider } from "./asg-provider-T9K-NVi8.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -650,17 +650,39 @@ var IAMManagedPolicyProvider = class {
 			if (properties["Description"]) createParams.Description = properties["Description"];
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (tags.length > 0) createParams.Tags = tags;
-			const response = await (await this.createClient.get()).send(new CreatePolicyCommand(createParams));
-			const policyArn = response.Policy?.Arn;
-			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
+			const createClient = await this.createClient.get();
+			let policy;
+			let adopted = false;
+			try {
+				policy = (await createClient.send(new CreatePolicyCommand(createParams))).Policy;
+			} catch (createError) {
+				const expectedArnTail = `:policy${createParams.Path ?? "/"}${policyName}`;
+				policy = await iamEntityLeftByThisCreate({
+					logicalId,
+					resourceType,
+					noun: "managed policy",
+					displayName: policyName,
+					createError,
+					namesThisEntity: (reported) => reported.endsWith(expectedArnTail),
+					read: async (reportedArn) => (await this.iamClient.send(new GetPolicyCommand({ PolicyArn: reportedArn }))).Policy,
+					identityOf: (live) => policyIdentityToken(live?.PolicyId),
+					log
+				});
+				if (policy === void 0) throw createError;
+				adopted = true;
+			}
+			const policyArn = policy?.Arn;
+			if (!policyArn) throw new ProvisioningError(`${adopted ? "GetPolicy" : "CreatePolicy"} succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
-			createdPolicyIdentity = policyIdentityToken(response.Policy?.PolicyId);
-			reportCreatedResource(logicalId, resourceType, policyArn, createdPolicyIdentity);
-			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
+			createdPolicyIdentity = policyIdentityToken(policy?.PolicyId);
+			if (!adopted) {
+				reportCreatedResource(logicalId, resourceType, policyArn, createdPolicyIdentity);
+				log.debug(`Created IAM managed policy: ${v(policyArn)}`);
+			}
 			try {
 				await this.attachToPrincipals(policyArn, principals.lists.Groups, principals.lists.Roles, principals.lists.Users, log);
 			} catch (innerError) {
-				try {
+				if (!adopted) try {
 					await this.detachAllPrincipals(policyArn);
 					await this.deleteAllNonDefaultVersions(policyArn);
 					await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: policyArn }));
@@ -1257,17 +1279,40 @@ var IAMInstanceProfileProvider = class {
 		let leftBehind = false;
 		let createdProfileIdentity;
 		try {
-			const response = await (await this.createClient.get()).send(new CreateInstanceProfileCommand({
-				InstanceProfileName: instanceProfileName,
-				Path: path
-			}));
+			const createClient = await this.createClient.get();
+			let profile;
+			let adopted = false;
+			try {
+				profile = (await createClient.send(new CreateInstanceProfileCommand({
+					InstanceProfileName: instanceProfileName,
+					Path: path
+				}))).InstanceProfile;
+			} catch (createError) {
+				profile = await iamEntityLeftByThisCreate({
+					logicalId,
+					resourceType,
+					noun: "instance profile",
+					displayName: instanceProfileName,
+					createError,
+					namesThisEntity: (reported) => reported === instanceProfileName,
+					read: async () => (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: instanceProfileName }))).InstanceProfile,
+					identityOf: (live) => instanceProfileIdentityToken(live?.InstanceProfileId),
+					log
+				});
+				if (profile === void 0) throw createError;
+				adopted = true;
+			}
 			leftBehind = true;
-			createdProfileIdentity = instanceProfileIdentityToken(response.InstanceProfile?.InstanceProfileId);
-			reportCreatedResource(logicalId, resourceType, instanceProfileName, createdProfileIdentity);
-			log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
+			createdProfileIdentity = instanceProfileIdentityToken(profile?.InstanceProfileId);
+			if (!adopted) {
+				reportCreatedResource(logicalId, resourceType, instanceProfileName, createdProfileIdentity);
+				log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
+			}
 			const attachedRoles = [];
+			const heldRoles = new Set(profile?.Roles?.map((role) => role.RoleName?.toLowerCase()));
 			try {
 				if (roles && Array.isArray(roles)) for (const roleName of roles) {
+					if (heldRoles.has(roleName.toLowerCase())) continue;
 					await this.iamClient.send(new AddRoleToInstanceProfileCommand({
 						InstanceProfileName: instanceProfileName,
 						RoleName: roleName
@@ -1276,7 +1321,7 @@ var IAMInstanceProfileProvider = class {
 					log.debug(`Added role ${v(roleName)} to instance profile ${v(instanceProfileName)}`);
 				}
 			} catch (innerError) {
-				try {
+				if (!adopted) try {
 					for (const roleName of attachedRoles) try {
 						await this.iamClient.send(new RemoveRoleFromInstanceProfileCommand({
 							InstanceProfileName: instanceProfileName,
@@ -1301,7 +1346,7 @@ var IAMInstanceProfileProvider = class {
 			log.debug(`Successfully created IAM instance profile ${logicalId}: ${v(instanceProfileName)}`);
 			return {
 				physicalId: instanceProfileName,
-				attributes: { Arn: response.InstanceProfile?.Arn }
+				attributes: { Arn: profile?.Arn }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -1803,6 +1848,8 @@ function isUserOrGroupType(resourceType) {
 function userOrGroupIdentityToken(id) {
 	return typeof id === "string" && id !== "" ? id : void 0;
 }
+const PROFILE_SETTLING_ERROR = "EntityTemporarilyUnmodifiableException";
+const LOGIN_PROFILE_SETTLING_MESSAGE = "IAM cannot modify the login profile yet: a concurrent update operation has not settled";
 const MEMBERSHIP_NO_PROPERTIES_SKIP_REASON = "no properties in state — group membership not removed";
 const MEMBERSHIP_MISSING_FIELDS_SKIP_REASON = "GroupName/Users missing from state — membership not removed";
 const MEMBERSHIP_MALFORMED_USERS_SKIP_REASON = "malformed Users in state — membership not removed";
@@ -1938,10 +1985,29 @@ var IAMUserGroupProvider = class {
 			const createParams = { UserName: userName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (properties["Tags"] !== void 0 && properties["Tags"] !== null) createParams.Tags = desiredTags;
-			const response = await (await this.createClient.get()).send(new CreateUserCommand(createParams));
+			const createClient = await this.createClient.get();
+			let user;
+			let adopted = false;
+			try {
+				user = (await createClient.send(new CreateUserCommand(createParams))).User;
+			} catch (createError) {
+				user = await iamEntityLeftByThisCreate({
+					logicalId,
+					resourceType,
+					noun: "user",
+					displayName: userName,
+					createError,
+					namesThisEntity: (reported) => reported === userName,
+					read: async () => (await this.iamClient.send(new GetUserCommand({ UserName: userName }))).User,
+					identityOf: (live) => userOrGroupIdentityToken(live?.UserId),
+					log
+				});
+				if (user === void 0) throw createError;
+				adopted = true;
+			}
 			leftBehind = true;
-			createdUserIdentity = userOrGroupIdentityToken(response.User?.UserId);
-			reportCreatedResource(logicalId, resourceType, userName, createdUserIdentity);
+			createdUserIdentity = userOrGroupIdentityToken(user?.UserId);
+			if (!adopted) reportCreatedResource(logicalId, resourceType, userName, createdUserIdentity);
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
 				if (permissionsBoundary) {
@@ -1953,12 +2019,24 @@ var IAMUserGroupProvider = class {
 				}
 				const loginProfile = properties["LoginProfile"];
 				if (loginProfile) {
-					await this.iamClient.send(new CreateLoginProfileCommand({
+					const profile = {
 						UserName: userName,
 						Password: loginProfile.Password,
 						PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
-					}));
-					log.debug(`Created login profile for user ${v(userName)}`);
+					};
+					try {
+						await this.iamClient.send(new CreateLoginProfileCommand(profile));
+						log.debug(`Created login profile for user ${v(userName)}`);
+					} catch (profileError) {
+						if (!adopted || !isEntityAlreadyExists(profileError)) throw profileError;
+						try {
+							await this.iamClient.send(new UpdateLoginProfileCommand(profile));
+						} catch (updateError) {
+							if (updateError?.name !== PROFILE_SETTLING_ERROR) throw updateError;
+							throw new Error(LOGIN_PROFILE_SETTLING_MESSAGE, { cause: updateError });
+						}
+						log.debug(`Updated login profile for user ${v(userName)}`);
+					}
 				}
 				const managedPolicyArns = properties["ManagedPolicyArns"];
 				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
@@ -1987,7 +2065,7 @@ var IAMUserGroupProvider = class {
 					log.debug(`Added inline policy ${v(policy.PolicyName)} to user ${v(userName)}`);
 				}
 			} catch (innerError) {
-				try {
+				if (!adopted) try {
 					await this.removeUserFromAllGroups(userName, log);
 					await this.detachAllUserPolicies(userName, log);
 					await this.deleteAllUserInlinePolicies(userName, log);
@@ -2015,7 +2093,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully created IAM user ${logicalId}: ${v(userName)}`);
 			return {
 				physicalId: userName,
-				attributes: { Arn: response.User?.Arn }
+				attributes: { Arn: user?.Arn }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -2342,10 +2420,32 @@ var IAMUserGroupProvider = class {
 		try {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
-			const response = await (await this.createClient.get()).send(new CreateGroupCommand(createParams));
+			const createClient = await this.createClient.get();
+			let group;
+			let adopted = false;
+			try {
+				group = (await createClient.send(new CreateGroupCommand(createParams))).Group;
+			} catch (createError) {
+				group = await iamEntityLeftByThisCreate({
+					logicalId,
+					resourceType,
+					noun: "group",
+					displayName: groupName,
+					createError,
+					namesThisEntity: (reported) => reported === groupName,
+					read: async () => (await this.iamClient.send(new GetGroupCommand({
+						GroupName: groupName,
+						MaxItems: 1
+					}))).Group,
+					identityOf: (live) => userOrGroupIdentityToken(live?.GroupId),
+					log
+				});
+				if (group === void 0) throw createError;
+				adopted = true;
+			}
 			leftBehind = true;
-			createdGroupIdentity = userOrGroupIdentityToken(response.Group?.GroupId);
-			reportCreatedResource(logicalId, resourceType, groupName, createdGroupIdentity);
+			createdGroupIdentity = userOrGroupIdentityToken(group?.GroupId);
+			if (!adopted) reportCreatedResource(logicalId, resourceType, groupName, createdGroupIdentity);
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
 				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
@@ -2366,7 +2466,7 @@ var IAMUserGroupProvider = class {
 					log.debug(`Added inline policy ${v(policy.PolicyName)} to group ${v(groupName)}`);
 				}
 			} catch (innerError) {
-				try {
+				if (!adopted) try {
 					await this.detachAllGroupPolicies(groupName, log);
 					await this.deleteAllGroupInlinePolicies(groupName, log);
 					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
@@ -2383,7 +2483,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully created IAM group ${logicalId}: ${v(groupName)}`);
 			return {
 				physicalId: groupName,
-				attributes: { Arn: response.Group?.Arn }
+				attributes: { Arn: group?.Arn }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -32854,6 +32954,10 @@ const VPCS_KEPT_ON_REMOVAL_NOTE = "A private hosted zone stays private and keeps
 function declaresNoVpcs(vpcs) {
 	return vpcs == null || Array.isArray(vpcs) && vpcs.length === 0;
 }
+function declaredVpcIds(vpcs) {
+	if (!Array.isArray(vpcs)) return [];
+	return vpcs.map((vpc) => vpc?.["VPCId"]);
+}
 function sentence$1(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -33020,7 +33124,7 @@ var Route53Provider = class {
 				}));
 			}
 			await this.applyHostedZoneTags(zoneId, properties, logicalId, void 0, mask);
-			await this.applyQueryLoggingConfig(zoneId, properties, logicalId);
+			await this.applyQueryLoggingConfig(zoneId, properties, logicalId, void 0, mask);
 			if (declaresAcceleratedRecovery(properties)) {
 				try {
 					await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
@@ -33120,8 +33224,8 @@ var Route53Provider = class {
 				Comment: comment
 			}));
 			await this.applyHostedZoneTags(physicalId, properties, logicalId, previousProperties, mask);
-			await this.applyQueryLoggingConfig(physicalId, properties, logicalId, previousProperties);
-			await this.syncVPCAssociations(physicalId, properties, logicalId);
+			await this.applyQueryLoggingConfig(physicalId, properties, logicalId, previousProperties, mask, context?.markUnsettled);
+			await this.syncVPCAssociations(physicalId, properties, logicalId, previousProperties, mask, context);
 			const prevEnabled = declaresAcceleratedRecovery(previousProperties, true);
 			const nextEnabled = declaresAcceleratedRecovery(properties, context?.desiredFromAwsReadback === true);
 			if (prevEnabled !== nextEnabled) {
@@ -33133,7 +33237,7 @@ var Route53Provider = class {
 			}
 			const nameServers = (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully updated hosted zone ${logicalId}`);
-			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
+			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && (Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0 || context?.unsettledProperties?.has("VPCs") === true)) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -33539,7 +33643,7 @@ var Route53Provider = class {
 			return typeof entry.Key === "string" && typeof entry.Value === "string";
 		});
 	}
-	async applyQueryLoggingConfig(zoneId, properties, logicalId, previousProperties) {
+	async applyQueryLoggingConfig(zoneId, properties, logicalId, previousProperties, mask, markUnsettled) {
 		const cloudWatchLogsLogGroupArn = this.readQueryLogGroupArn(properties);
 		const desiredBlock = properties["QueryLoggingConfig"];
 		const desiredBlockIsObject = typeof desiredBlock === "object" && desiredBlock !== null && !Array.isArray(desiredBlock);
@@ -33551,13 +33655,16 @@ var Route53Provider = class {
 		if (cloudWatchLogsLogGroupArn === void 0) {
 			if (previousProperties !== void 0 && this.readQueryLogGroupArn(previousProperties)) {
 				this.logger.debug(`QueryLoggingConfig removed from template for hosted zone ${logicalId}; deleting the live config`);
+				markUnsettled?.("QueryLoggingConfig");
 				await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 				const remaining = await this.listQueryLoggingConfigIds(zoneId);
 				if (remaining.length > 0) throw new ProvisioningError(`QueryLoggingConfig was removed from the template for hosted zone ${logicalId} but the live config (${remaining.join(", ")}) is still present. The removal will NOT be retried on the next deploy (state no longer records the property), so it is reported instead of ignored.`, "AWS::Route53::HostedZone", logicalId, zoneId);
 			}
 			return;
 		}
+		if (previousProperties !== void 0 && this.readQueryLogGroupArn(previousProperties) === cloudWatchLogsLogGroupArn) return;
 		try {
+			markUnsettled?.("QueryLoggingConfig");
 			await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 			await this.getClient().send(new CreateQueryLoggingConfigCommand({
 				HostedZoneId: zoneId,
@@ -33565,11 +33672,12 @@ var Route53Provider = class {
 			}));
 			this.logger.debug(`Applied query logging config to hosted zone ${logicalId}`);
 		} catch (error) {
-			if (error instanceof Error && error.name === "QueryLoggingConfigAlreadyExists") {
+			if (previousProperties === void 0 && error instanceof Error && error.name === "QueryLoggingConfigAlreadyExists") {
 				this.logger.debug(`Query logging config already exists for hosted zone ${logicalId}`);
 				return;
 			}
-			this.logger.warn(`Failed to apply query logging config to hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`);
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to apply query logging config to hosted zone ${logicalId}: ${text}`, "AWS::Route53::HostedZone", logicalId, zoneId, cause));
 		}
 	}
 	readQueryLogGroupArn(properties) {
@@ -33605,7 +33713,7 @@ var Route53Provider = class {
 			this.logger.warn(`Failed to delete query logging config for hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`);
 		}
 	}
-	async syncVPCAssociations(zoneId, properties, logicalId) {
+	async syncVPCAssociations(zoneId, properties, logicalId, previousProperties, mask, marks) {
 		const desiredVpcs = properties["VPCs"];
 		if (!desiredVpcs || desiredVpcs.length === 0) return;
 		try {
@@ -33616,6 +33724,7 @@ var Route53Provider = class {
 				const vpcId = vpc["VPCId"];
 				if (!currentVpcIds.has(vpcId)) {
 					this.logger.debug(`Associating VPC ${vpcId} with hosted zone ${zoneId}`);
+					marks?.markUnsettled?.("VPCs");
 					await this.getClient().send(new AssociateVPCWithHostedZoneCommand({
 						HostedZoneId: zoneId,
 						VPC: {
@@ -33623,14 +33732,14 @@ var Route53Provider = class {
 							VPCRegion: vpc["VPCRegion"]
 						}
 					}));
+					marks?.markAttempted?.("VPCs", [vpcId]);
+					currentVpcIds.add(vpcId);
 				}
 			}
-			for (const vpc of currentVpcs) if (vpc.VPCId && !desiredVpcIds.has(vpc.VPCId)) {
-				if (currentVpcs.length <= 1) {
-					this.logger.warn(`Cannot disassociate last VPC ${vpc.VPCId} from hosted zone ${logicalId}`);
-					continue;
-				}
+			const previousVpcIds = new Set(declaredVpcIds(previousProperties["VPCs"]));
+			for (const vpc of currentVpcs) if (vpc.VPCId && previousVpcIds.has(vpc.VPCId) && !desiredVpcIds.has(vpc.VPCId)) {
 				this.logger.debug(`Disassociating VPC ${vpc.VPCId} from hosted zone ${zoneId}`);
+				marks?.markUnsettled?.("VPCs");
 				await this.getClient().send(new DisassociateVPCFromHostedZoneCommand({
 					HostedZoneId: zoneId,
 					VPC: {
@@ -33640,7 +33749,8 @@ var Route53Provider = class {
 				}));
 			}
 		} catch (error) {
-			this.logger.warn(`Failed to sync VPC associations for hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`);
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to sync VPC associations for hosted zone ${logicalId}: ${text}`, "AWS::Route53::HostedZone", logicalId, zoneId, cause));
 		}
 	}
 	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId, options) {
@@ -33718,7 +33828,27 @@ var Route53Provider = class {
 			default: return;
 		}
 	}
-	async readHostedZone(physicalId, properties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
+		if (resourceType !== "AWS::Route53::HostedZone") return this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
+		const live = await this.readHostedZone(physicalId, recordedProperties, names.has("QueryLoggingConfig"));
+		if (live === void 0 || live === RESOURCE_NOT_FOUND) return live;
+		if (!names.has("VPCs") || !Array.isArray(live["VPCs"])) return live;
+		const { VPCs: liveVpcs, ...rest } = live;
+		if (declaresNoVpcs(desiredProperties?.["VPCs"])) return rest;
+		const named = /* @__PURE__ */ new Set([
+			...declaredVpcIds(recordedProperties?.["VPCs"]),
+			...declaredVpcIds(desiredProperties?.["VPCs"]),
+			...[...attemptedItems?.get("VPCs") ?? []].filter(isUsableAttemptedName)
+		]);
+		return {
+			...rest,
+			VPCs: liveVpcs.filter((vpc) => named.has(vpc["VPCId"]))
+		};
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::Route53::HostedZone" ? ["VPCs"] : [];
+	}
+	async readHostedZone(physicalId, properties, throwOnFailedQueryLoggingRead = false) {
 		let resp;
 		try {
 			resp = await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }));
@@ -33762,6 +33892,7 @@ var Route53Provider = class {
 			else result["QueryLoggingConfig"] = {};
 		} catch (err) {
 			this.logger.debug(`Route53 ListQueryLoggingConfigs(${idTail}) failed: ${describeAwsFailure(err).detail}`);
+			if (throwOnFailedQueryLoggingRead) throw err;
 			result["QueryLoggingConfig"] = {};
 		}
 		return result;
@@ -54914,4 +55045,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CbiecOol.js.map
+//# sourceMappingURL=provider-classes-DOr3JVGp.js.map