@cdkd/cli 0.0.0-stage → 0.323.0

package/dist/asg-provider-4rNFSmz9.js

@@ -0,0 +1,1277 @@
+import { $ as safeMsg, E as generatedNameFor, n as describeAwsFailure, s as getLogger } from "./aws-failure-text-DiHodi76.js";
+import { B as normalizeAwsTagsToCfn, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, G as PROTECTION_FLIP_REUSE_WINDOW_MS, Gt as markAuxiliaryFailure, It as withDerivedNameMasks, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Nn as ProvisioningError, Nr as wrapMaskedAwsError, P as markNotGone, Ut as isAuxiliaryFailure, Y as deleteWithProtectionCompensation, at as settleProtectionFlip, b as withRemovalDefaults, dt as pasteableAwsCommand, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, hr as relayedNameCollision, i as reportCreatedResource, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, lt as WITHHELD_AWS_COMMAND, nt as protectionFlipKey, o as retractCreatedResource, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry } from "./created-resource-sink-CmrPwGge.js";
+import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
+import { Aa as reEnableInstanceApiTermination, Ea as ec2InstanceProtectionSite, Oa as observeThenDisableInstanceApiTermination, Ta as disableInstanceApiTermination, _a as unchangedBehindSecretReference } from "./deploy-engine-dYZ0v6Kz.js";
+import { DescribeInstancesCommand, EC2Client } from "@aws-sdk/client-ec2";
+import { AttachLoadBalancerTargetGroupsCommand, AttachLoadBalancersCommand, AttachTrafficSourcesCommand, AutoScalingClient, CreateAutoScalingGroupCommand, CreateOrUpdateTagsCommand, DeleteAutoScalingGroupCommand, DeleteLifecycleHookCommand, DeleteNotificationConfigurationCommand, DeleteTagsCommand as DeleteTagsCommand$1, DescribeAutoScalingGroupsCommand, DescribeLifecycleHooksCommand, DescribeNotificationConfigurationsCommand, DescribeTrafficSourcesCommand, DetachLoadBalancerTargetGroupsCommand, DetachLoadBalancersCommand, DetachTrafficSourcesCommand, DisableMetricsCollectionCommand, EnableMetricsCollectionCommand, PutLifecycleHookCommand, PutNotificationConfigurationCommand, UpdateAutoScalingGroupCommand } from "@aws-sdk/client-auto-scaling";
+
+// src/provisioning/providers/asg-provider.ts
+const ATTACHMENT_MAX_LENGTH = {
+	LoadBalancerNames: 255,
+	TargetGroupARNs: 511
+};
+const ATTACHMENT_WHAT = {
+	LoadBalancerNames: "load balancer names",
+	TargetGroupARNs: "target group ARNs"
+};
+const ENTRY_SHAPE = {
+	Tags: {
+		identity: "Key",
+		what: "tags with a Key"
+	},
+	MetricsCollection: {
+		identity: "Granularity",
+		stringList: "Metrics",
+		what: "entries with a Granularity"
+	},
+	LifecycleHookSpecificationList: {
+		identity: "LifecycleHookName",
+		what: "entries with a LifecycleHookName"
+	},
+	TrafficSources: {
+		identity: "Identifier",
+		what: "entries with an Identifier"
+	},
+	NotificationConfigurations: {
+		identity: "TopicARN",
+		stringList: "NotificationTypes",
+		what: "entries with a TopicARN"
+	}
+};
+const LIST_KINDS = [
+	"Tags",
+	"LoadBalancerNames",
+	"TargetGroupARNs",
+	"MetricsCollection",
+	"LifecycleHookSpecificationList",
+	"TrafficSources",
+	"NotificationConfigurations"
+];
+function isAttachmentKind(kind) {
+	return kind === "LoadBalancerNames" || kind === "TargetGroupARNs";
+}
+function isWellFormedEntry(kind, entry, side, ignoreSecrets = false) {
+	if (isAttachmentKind(kind)) return typeof entry === "string" && entry.length > 0 && entry.length <= ATTACHMENT_MAX_LENGTH[kind] && !/\s/.test(entry) && (ignoreSecrets || !holdsSecretDerivedEntry(entry));
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return false;
+	const { identity, stringList } = ENTRY_SHAPE[kind];
+	const record = entry;
+	const id = record[identity];
+	if (typeof id !== "string" || id.length === 0) return false;
+	if (side === "desired" && !ignoreSecrets && holdsSecretDerivedEntry(id)) return false;
+	if (stringList !== void 0) {
+		const list = record[stringList];
+		if (list != null && !(Array.isArray(list) && list.every((v) => typeof v === "string"))) return false;
+		if (side === "desired" && !ignoreSecrets && Array.isArray(list) && list.some((v) => holdsSecretDerivedEntry(v))) return false;
+	}
+	return true;
+}
+function readList(kind, value, side) {
+	if (value === void 0 || value === null) return {
+		kind: "list",
+		items: []
+	};
+	if (Array.isArray(value) && value.every((entry) => isWellFormedEntry(kind, entry, side))) return {
+		kind: "list",
+		items: value
+	};
+	return {
+		kind: "malformed",
+		secretDerived: holdsSecretDerivedEntry(value),
+		onlySecret: Array.isArray(value) && value.every((entry) => isWellFormedEntry(kind, entry, side, true))
+	};
+}
+function secretDerivedCause(kinds, read) {
+	const secret = kinds.filter((k) => {
+		const r = read[k];
+		return r.kind === "malformed" && r.onlySecret;
+	});
+	return secret.length === 0 ? "" : ` (${secret.join(" / ")} holds a dynamic reference or its mask where a name belongs, which names nothing Auto Scaling accepts)`;
+}
+function listWhat(kind) {
+	return isAttachmentKind(kind) ? ATTACHMENT_WHAT[kind] : ENTRY_SHAPE[kind].what;
+}
+function readLists(values, side) {
+	const out = {};
+	for (const kind of LIST_KINDS) out[kind] = readList(kind, values[kind], side);
+	return out;
+}
+function malformedKinds(read) {
+	return LIST_KINDS.filter((k) => read[k].kind === "malformed");
+}
+function removableRecorded(kind, items) {
+	if (isAttachmentKind(kind)) return items;
+	const { identity, stringList } = ENTRY_SHAPE[kind];
+	return items.filter((e) => !holdsSecretDerivedEntry(e[identity])).flatMap((e) => {
+		if (stringList === void 0) return [e];
+		const record = e;
+		const list = record[stringList];
+		if (!Array.isArray(list) || !list.some((v) => holdsSecretDerivedEntry(v))) return [e];
+		const kept = list.filter((v) => !holdsSecretDerivedEntry(v));
+		if (kept.length === 0 && kind === "MetricsCollection") return [];
+		return [{
+			...record,
+			[stringList]: kept
+		}];
+	});
+}
+function itemsOf(read) {
+	return read.kind === "list" ? read.items : [];
+}
+function declaresSubnets(value) {
+	return Array.isArray(value) ? value.length > 0 : typeof value === "string" && value !== "";
+}
+function zoneMembers(properties, stateBorne, previousProperties) {
+	const names = properties["AvailabilityZones"];
+	const ids = properties["AvailabilityZoneIds"];
+	if (!stateBorne || names === void 0 || ids === void 0) return {
+		...names !== void 0 && { AvailabilityZones: names },
+		...ids !== void 0 && { AvailabilityZoneIds: ids }
+	};
+	if (declaresSubnets(properties["VPCZoneIdentifier"])) return {};
+	const changed = (key) => previousProperties === void 0 || JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
+	if (Array.isArray(ids) && ids.length > 0 && changed("AvailabilityZoneIds")) return { AvailabilityZoneIds: ids };
+	if (changed("AvailabilityZones")) return { AvailabilityZones: names };
+	return {};
+}
+function isFoldableMetricsEntry(entry) {
+	if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
+	const { Granularity, Metrics } = entry;
+	return typeof Granularity === "string" && Granularity.length > 0 && (Metrics == null || Array.isArray(Metrics) && Metrics.every((m) => typeof m === "string"));
+}
+const ALL_GROUP_METRICS = [
+	"GroupAndWarmPoolDesiredCapacity",
+	"GroupAndWarmPoolTotalCapacity",
+	"GroupDesiredCapacity",
+	"GroupInServiceCapacity",
+	"GroupInServiceInstances",
+	"GroupMaxSize",
+	"GroupMinSize",
+	"GroupPendingCapacity",
+	"GroupPendingInstances",
+	"GroupStandbyCapacity",
+	"GroupStandbyInstances",
+	"GroupTerminatingCapacity",
+	"GroupTerminatingInstances",
+	"GroupTerminatingRetainedCapacity",
+	"GroupTerminatingRetainedInstances",
+	"GroupTotalCapacity",
+	"GroupTotalInstances",
+	"WarmPoolDesiredCapacity",
+	"WarmPoolMinSize",
+	"WarmPoolPendingCapacity",
+	"WarmPoolPendingRetainedCapacity",
+	"WarmPoolTerminatingCapacity",
+	"WarmPoolTerminatingRetainedCapacity",
+	"WarmPoolTotalCapacity",
+	"WarmPoolWarmedCapacity"
+];
+function holdsAllKnownMetrics(metrics) {
+	return ALL_GROUP_METRICS.every((m) => metrics.includes(m));
+}
+function foldMetricsCollection(value) {
+	if (!Array.isArray(value)) return [];
+	const byGranularity = /* @__PURE__ */ new Map();
+	for (const raw of value) {
+		if (raw === null || typeof raw !== "object") continue;
+		const entry = raw;
+		if (typeof entry.Granularity !== "string" || entry.Granularity.length === 0) continue;
+		const metrics = Array.isArray(entry.Metrics) ? entry.Metrics.filter((m) => typeof m === "string") : [];
+		const current = byGranularity.get(entry.Granularity);
+		if (metrics.length === 0 || current === "ALL") {
+			byGranularity.set(entry.Granularity, "ALL");
+			continue;
+		}
+		const set = current ?? /* @__PURE__ */ new Set();
+		for (const m of metrics) set.add(m);
+		byGranularity.set(entry.Granularity, set);
+	}
+	return [...byGranularity.keys()].sort().map((granularity) => {
+		const metrics = byGranularity.get(granularity);
+		return metrics === "ALL" ? { Granularity: granularity } : {
+			Granularity: granularity,
+			Metrics: [...metrics].sort()
+		};
+	});
+}
+function autoScalingGroupProtectionSite(groupName, region, removedLevel) {
+	return {
+		subject: "AutoScalingGroup",
+		guardName: "DeletionProtection",
+		noun: "group",
+		isNotFound: (error) => {
+			if (typeof error !== "object" || error === null) return false;
+			const { name, message } = error;
+			return name === "ValidationError" && typeof message === "string" && /not found|does not exist/i.test(message);
+		},
+		notFoundMeaning: "Auto Scaling answered that the group was not found. That most commonly means the group is gone, and it can also mean it is not in this region or account.",
+		commands: () => {
+			const aws = pasteableAwsCommand();
+			const regionArg = region ? aws` --region ${region}` : aws``;
+			const level = removedLevel();
+			const restore = level === void 0 ? WITHHELD_AWS_COMMAND : aws`aws autoscaling update-auto-scaling-group --auto-scaling-group-name ${groupName}${regionArg} --deletion-protection ${level}`.render();
+			return {
+				check: aws`aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names ${groupName}${regionArg}`.render(),
+				restoreAfterNotFound: restore,
+				restoreLive: restore
+			};
+		}
+	};
+}
+var LaunchedInstanceGoneError = class extends Error {
+	name = "LaunchedInstanceGone";
+	constructor(instanceId, state) {
+		super(`instance ${instanceId} is ${state}`);
+	}
+};
+const GONE_INSTANCE_STATES = /* @__PURE__ */ new Set(["shutting-down", "terminated"]);
+function autoScalingGroupInstanceProtectionSite(instanceId, region) {
+	const ec2Site = ec2InstanceProtectionSite(instanceId, region);
+	return {
+		...ec2Site,
+		subject: "EC2 Instance launched by AutoScalingGroup",
+		isNotFound: (error) => ec2Site.isNotFound(error) || typeof error === "object" && error !== null && error.name === "LaunchedInstanceGone",
+		notFoundMeaning: "EC2 answered that the instance was not found, or reports it shutting-down or terminated (the group may have replaced it). That most commonly means the instance is gone, and a not-found answer can also mean it is not in this region or account."
+	};
+}
+const EC2_INSTANCE_TYPE = "AWS::EC2::Instance";
+var ASGProvider = class ASGProvider {
+	asgClient;
+	createClient;
+	ec2Client;
+	providerRegion = ambientRegion();
+	logger = getLogger().child("ASGProvider");
+	protectionFlips = new ProtectionFlipRegistry();
+	removedProtection = /* @__PURE__ */ new WeakMap();
+	instanceProtectionFlips = new ProtectionFlipRegistry();
+	groupInstanceFlips = /* @__PURE__ */ new WeakMap();
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::AutoScaling::AutoScalingGroup", /* @__PURE__ */ new Map([
+		["InstanceMaintenancePolicy", {
+			MinHealthyPercentage: -1,
+			MaxHealthyPercentage: -1
+		}],
+		["CapacityReservationSpecification", { CapacityReservationPreference: "default" }],
+		["AvailabilityZoneDistribution", { CapacityDistributionStrategy: "balanced-best-effort" }]
+	])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::AutoScaling::AutoScalingGroup", /* @__PURE__ */ new Set([
+		"AutoScalingGroupName",
+		"LaunchTemplate",
+		"MinSize",
+		"MaxSize",
+		"DesiredCapacity",
+		"VPCZoneIdentifier",
+		"AvailabilityZones",
+		"AvailabilityZoneIds",
+		"PlacementGroup",
+		"InstanceLifecyclePolicy",
+		"HealthCheckType",
+		"HealthCheckGracePeriod",
+		"Cooldown",
+		"DefaultCooldown",
+		"Tags",
+		"TerminationPolicies",
+		"NewInstancesProtectedFromScaleIn",
+		"CapacityRebalance",
+		"ServiceLinkedRoleARN",
+		"MaxInstanceLifetime",
+		"LoadBalancerNames",
+		"TargetGroupARNs",
+		"MetricsCollection",
+		"LifecycleHookSpecificationList",
+		"MixedInstancesPolicy",
+		"Context",
+		"DesiredCapacityType",
+		"DefaultInstanceWarmup",
+		"TrafficSources",
+		"NotificationConfigurations",
+		"AvailabilityZoneDistribution",
+		"AvailabilityZoneImpairmentPolicy",
+		"SkipZonalShiftValidation",
+		"CapacityReservationSpecification",
+		"InstanceMaintenancePolicy",
+		"DeletionProtection"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::AutoScaling::AutoScalingGroup", /* @__PURE__ */ new Map([
+		["LaunchConfigurationName", "AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead"],
+		["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"],
+		["InstanceId", "CreateAutoScalingGroup derives a new launch configuration from the instance, and AWS Launch Configurations are end-of-life 2024-10 like LaunchConfigurationName; use LaunchTemplate instead"]
+	])]]);
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") return properties;
+		const key = "MetricsCollection";
+		const metrics = properties[key];
+		if (!Array.isArray(metrics) || !metrics.every(isFoldableMetricsEntry)) return properties;
+		const folded = foldMetricsCollection(metrics);
+		if (JSON.stringify(folded) === JSON.stringify(metrics)) return properties;
+		return {
+			...properties,
+			[key]: folded
+		};
+	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		const key = "MetricsCollection";
+		const unchanged = {
+			baseline,
+			aws
+		};
+		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") return unchanged;
+		const recorded = baseline[key];
+		if (!Array.isArray(recorded) || !recorded.every(isFoldableMetricsEntry)) return unchanged;
+		const folded = foldMetricsCollection(recorded);
+		if (folded.every((e) => e.Metrics !== void 0)) return unchanged;
+		const live = aws[key];
+		const liveBy = /* @__PURE__ */ new Map();
+		if (Array.isArray(live) && live.every(isFoldableMetricsEntry)) for (const e of foldMetricsCollection(live)) liveBy.set(e.Granularity, e.Metrics ?? []);
+		const expanded = folded.map((e) => e.Metrics !== void 0 ? e : {
+			Granularity: e.Granularity,
+			Metrics: [.../* @__PURE__ */ new Set([...ALL_GROUP_METRICS, ...liveBy.get(e.Granularity) ?? []])].sort()
+		});
+		return {
+			baseline: {
+				...baseline,
+				[key]: expanded
+			},
+			aws
+		};
+	}
+	getClient() {
+		if (!this.asgClient) {
+			this.asgClient = new AutoScalingClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new AutoScalingClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
+		return this.asgClient;
+	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
+	getEc2Client() {
+		if (!this.ec2Client) this.ec2Client = new EC2Client({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
+		return this.ec2Client;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const groupName = properties["AutoScalingGroupName"] || generatedNameFor("AWS::AutoScaling::AutoScalingGroup", logicalId);
+		const maskSecrets = context?.maskSecrets ?? ((text) => text);
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		debug(`Creating AutoScalingGroup ${logicalId}: ${maskSecrets(groupName)}`);
+		const lists = readLists({
+			Tags: properties["Tags"],
+			LoadBalancerNames: properties["LoadBalancerNames"],
+			TargetGroupARNs: properties["TargetGroupARNs"],
+			MetricsCollection: properties["MetricsCollection"],
+			LifecycleHookSpecificationList: properties["LifecycleHookSpecificationList"],
+			TrafficSources: properties["TrafficSources"],
+			NotificationConfigurations: properties["NotificationConfigurations"]
+		}, "desired");
+		const malformedOnCreate = malformedKinds(lists);
+		if (malformedOnCreate.length > 0) throw markNonRetryable(new ProvisioningError(`${malformedOnCreate.join(" / ")} of AutoScalingGroup ${logicalId} is not a list of ${malformedOnCreate.map(listWhat).join(" / ")}${secretDerivedCause(malformedOnCreate, lists)} — the group was not created`, resourceType, logicalId));
+		let survivorNote;
+		try {
+			const launchTemplate = this.buildLaunchTemplate(properties);
+			const tags = this.buildTags(groupName, properties);
+			const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties["VPCZoneIdentifier"]);
+			const createZones = zoneMembers(properties, context?.replayingState === true);
+			const minSize = properties["MinSize"] != null ? Number(properties["MinSize"]) : 0;
+			const maxSize = properties["MaxSize"] != null ? Number(properties["MaxSize"]) : minSize;
+			await this.getCreateClient().send(new CreateAutoScalingGroupCommand({
+				AutoScalingGroupName: groupName,
+				MinSize: minSize,
+				MaxSize: maxSize,
+				...properties["DesiredCapacity"] != null && { DesiredCapacity: Number(properties["DesiredCapacity"]) },
+				...launchTemplate && { LaunchTemplate: launchTemplate },
+				...properties["MixedInstancesPolicy"] !== void 0 && { MixedInstancesPolicy: properties["MixedInstancesPolicy"] },
+				...vpcZoneIdentifier !== void 0 && { VPCZoneIdentifier: vpcZoneIdentifier },
+				...createZones.AvailabilityZones !== void 0 && { AvailabilityZones: createZones.AvailabilityZones },
+				...createZones.AvailabilityZoneIds !== void 0 && { AvailabilityZoneIds: createZones.AvailabilityZoneIds },
+				...properties["PlacementGroup"] !== void 0 && { PlacementGroup: properties["PlacementGroup"] },
+				...properties["InstanceLifecyclePolicy"] !== void 0 && { InstanceLifecyclePolicy: properties["InstanceLifecyclePolicy"] },
+				...properties["HealthCheckType"] !== void 0 && { HealthCheckType: properties["HealthCheckType"] },
+				...properties["HealthCheckGracePeriod"] != null && { HealthCheckGracePeriod: Number(properties["HealthCheckGracePeriod"]) },
+				...properties["Cooldown"] != null && { DefaultCooldown: Number(properties["Cooldown"]) },
+				...properties["DefaultCooldown"] != null && { DefaultCooldown: Number(properties["DefaultCooldown"]) },
+				...properties["TerminationPolicies"] !== void 0 && { TerminationPolicies: properties["TerminationPolicies"] },
+				...properties["NewInstancesProtectedFromScaleIn"] !== void 0 && { NewInstancesProtectedFromScaleIn: properties["NewInstancesProtectedFromScaleIn"] },
+				...properties["CapacityRebalance"] !== void 0 && { CapacityRebalance: properties["CapacityRebalance"] },
+				...properties["ServiceLinkedRoleARN"] !== void 0 && { ServiceLinkedRoleARN: properties["ServiceLinkedRoleARN"] },
+				...properties["MaxInstanceLifetime"] != null && { MaxInstanceLifetime: Number(properties["MaxInstanceLifetime"]) },
+				...properties["LoadBalancerNames"] != null && { LoadBalancerNames: itemsOf(lists.LoadBalancerNames) },
+				...properties["TargetGroupARNs"] != null && { TargetGroupARNs: itemsOf(lists.TargetGroupARNs) },
+				...properties["Context"] !== void 0 && { Context: properties["Context"] },
+				...properties["DesiredCapacityType"] !== void 0 && { DesiredCapacityType: properties["DesiredCapacityType"] },
+				...properties["DefaultInstanceWarmup"] != null && { DefaultInstanceWarmup: Number(properties["DefaultInstanceWarmup"]) },
+				...properties["LifecycleHookSpecificationList"] != null && { LifecycleHookSpecificationList: properties["LifecycleHookSpecificationList"] },
+				...properties["TrafficSources"] != null && { TrafficSources: properties["TrafficSources"] },
+				...properties["AvailabilityZoneDistribution"] !== void 0 && { AvailabilityZoneDistribution: properties["AvailabilityZoneDistribution"] },
+				...properties["AvailabilityZoneImpairmentPolicy"] !== void 0 && { AvailabilityZoneImpairmentPolicy: properties["AvailabilityZoneImpairmentPolicy"] },
+				...properties["SkipZonalShiftValidation"] !== void 0 && { SkipZonalShiftValidation: properties["SkipZonalShiftValidation"] },
+				...properties["CapacityReservationSpecification"] !== void 0 && { CapacityReservationSpecification: properties["CapacityReservationSpecification"] },
+				...properties["InstanceMaintenancePolicy"] !== void 0 && { InstanceMaintenancePolicy: properties["InstanceMaintenancePolicy"] },
+				...properties["DeletionProtection"] !== void 0 && { DeletionProtection: properties["DeletionProtection"] },
+				...tags.length > 0 && { Tags: tags }
+			}));
+			reportCreatedResource(logicalId, resourceType, groupName);
+			try {
+				for (const entry of itemsOf(lists.MetricsCollection)) await this.getClient().send(new EnableMetricsCollectionCommand({
+					AutoScalingGroupName: groupName,
+					Granularity: entry.Granularity,
+					...entry.Metrics && entry.Metrics.length > 0 && !holdsAllKnownMetrics(entry.Metrics) ? { Metrics: entry.Metrics } : {}
+				}));
+				for (const entry of itemsOf(lists.NotificationConfigurations)) await this.getClient().send(new PutNotificationConfigurationCommand({
+					AutoScalingGroupName: groupName,
+					TopicARN: entry.TopicARN,
+					NotificationTypes: entry.NotificationTypes ?? []
+				}));
+			} catch (wiringError) {
+				survivorNote = await this.retireFailedCreate(groupName, logicalId, properties, maskSecrets);
+				if (survivorNote === void 0) retractCreatedResource(logicalId, resourceType, groupName);
+				throw markAuxiliaryFailure(wiringError, logicalId);
+			}
+			debug(`Successfully created AutoScalingGroup ${logicalId}: ${maskSecrets(groupName)}`);
+			const arn = await this.fetchArn(groupName, maskSecrets);
+			const attributes = {};
+			if (arn) attributes["Arn"] = arn;
+			if (launchTemplate?.LaunchTemplateId) attributes["LaunchTemplateID"] = launchTemplate.LaunchTemplateId;
+			return {
+				physicalId: groupName,
+				attributes
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			const failure = this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to create AutoScalingGroup ${logicalId}: ${text}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, groupName, cause));
+			if (survivorNote === void 0) throw failure;
+			markCreatedBeforeFailure(markNonRetryable(failure), logicalId, resourceType, groupName);
+			throw failure;
+		}
+	}
+	async retireFailedCreate(groupName, logicalId, properties, maskSecrets) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		let deleteAccepted = false;
+		try {
+			const protection = properties["DeletionProtection"];
+			try {
+				await this.getClient().send(new UpdateAutoScalingGroupCommand({
+					AutoScalingGroupName: groupName,
+					MinSize: 0,
+					MaxSize: 0,
+					DesiredCapacity: 0,
+					...protection != null && protection !== "none" && { DeletionProtection: "none" }
+				}));
+			} catch (scaleError) {
+				debug(`Could not scale AutoScalingGroup ${logicalId} to zero before retiring it: ` + describeAwsFailure(scaleError).detail);
+				if (protection != null && protection !== "none") try {
+					await this.getClient().send(new UpdateAutoScalingGroupCommand({
+						AutoScalingGroupName: groupName,
+						DeletionProtection: "none"
+					}));
+				} catch (liftError) {
+					debug(`Could not clear DeletionProtection on AutoScalingGroup ${logicalId} before retiring it: ${describeAwsFailure(liftError).detail}`);
+				}
+			}
+			const flipped = /* @__PURE__ */ new Set();
+			await this.removeInstanceTerminationProtection(groupName, logicalId, maskSecrets, flipped);
+			await this.removeInstanceTerminationProtection(groupName, logicalId, maskSecrets, flipped);
+			await this.getClient().send(new DeleteAutoScalingGroupCommand({
+				AutoScalingGroupName: groupName,
+				ForceDelete: true
+			}));
+			deleteAccepted = true;
+			await this.waitForGroupDeleted(groupName);
+			debug(`Retired AutoScalingGroup ${logicalId} after its create-time wiring failed`);
+			return;
+		} catch (cleanupError) {
+			const outcome = deleteAccepted ? `cdkd started deleting it but could not confirm it is gone` : `cdkd could not delete it`;
+			const cleanupFailure = describeAwsFailure(cleanupError);
+			if (cleanupFailure.redacted) debug(`Retiring AutoScalingGroup ${logicalId} after its create-time wiring failed did not finish: ${cleanupFailure.detail}`);
+			return maskSecrets(`The group was created, and ${outcome} (${cleanupFailure.summary}); outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ` + pasteableAwsCommand(maskSecrets)`aws autoscaling delete-auto-scaling-group --auto-scaling-group-name ${groupName} --force-delete`.render());
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
+		const { mask } = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["AutoScalingGroupName"], physicalId]]);
+		this.logger.debug(`Updating AutoScalingGroup ${logicalId}: ${mask(physicalId)}`);
+		const stringEq = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+		if (!stringEq(properties["AutoScalingGroupName"], previousProperties["AutoScalingGroupName"]) && !await unchangedBehindSecretReference({
+			resourceType,
+			key: "AutoScalingGroupName",
+			desired: properties["AutoScalingGroupName"],
+			previous: previousProperties["AutoScalingGroupName"],
+			physicalName: physicalId
+		})) {
+			const remedy = previousProperties["DeletionProtection"] === "prevent-all-deletion" ? protectedReplacementAdvice({
+				evidence: "cdkd's recorded properties for this group carry DeletionProtection: prevent-all-deletion",
+				replaceFlags: "cdkd deploy --replace",
+				disable: {
+					before: "aws autoscaling update-auto-scaling-group --auto-scaling-group-name",
+					identifier: physicalId,
+					after: "--deletion-protection none",
+					maskSecrets: mask
+				}
+			}) : "Use cdkd deploy --replace to replace the group.";
+			throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. " + remedy);
+		}
+		const { next, prev, retained } = await this.readUpdateLists(logicalId, physicalId, resourceType, {
+			Tags: properties["Tags"],
+			LoadBalancerNames: properties["LoadBalancerNames"],
+			TargetGroupARNs: properties["TargetGroupARNs"],
+			MetricsCollection: properties["MetricsCollection"],
+			LifecycleHookSpecificationList: properties["LifecycleHookSpecificationList"],
+			TrafficSources: properties["TrafficSources"],
+			NotificationConfigurations: properties["NotificationConfigurations"]
+		}, {
+			Tags: previousProperties["Tags"],
+			LoadBalancerNames: previousProperties["LoadBalancerNames"],
+			TargetGroupARNs: previousProperties["TargetGroupARNs"],
+			MetricsCollection: previousProperties["MetricsCollection"],
+			LifecycleHookSpecificationList: previousProperties["LifecycleHookSpecificationList"],
+			TrafficSources: previousProperties["TrafficSources"],
+			NotificationConfigurations: previousProperties["NotificationConfigurations"]
+		});
+		try {
+			await this.applyTagsDiff(physicalId, next.Tags, prev.Tags);
+			await this.applyLoadBalancerNamesDiff(physicalId, next.LoadBalancerNames, prev.LoadBalancerNames);
+			await this.applyTargetGroupArnsDiff(physicalId, next.TargetGroupARNs, prev.TargetGroupARNs, mask, retained.TargetGroupARNs);
+			await this.applyMetricsCollectionDiff(physicalId, next.MetricsCollection, prev.MetricsCollection);
+			await this.applyLifecycleHooksDiff(physicalId, next.LifecycleHookSpecificationList, prev.LifecycleHookSpecificationList);
+			await this.applyTrafficSourcesDiff(physicalId, next.TrafficSources, prev.TrafficSources);
+			await this.applyNotificationConfigurationsDiff(physicalId, next.NotificationConfigurations, prev.NotificationConfigurations);
+			const launchTemplate = this.buildLaunchTemplate(properties);
+			const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties["VPCZoneIdentifier"]);
+			const healthCheckTypeInput = properties["HealthCheckType"];
+			const healthCheckGracePeriodInput = properties["HealthCheckGracePeriod"] != null ? Number(properties["HealthCheckGracePeriod"]) : void 0;
+			const cooldownRaw = properties["Cooldown"] ?? properties["DefaultCooldown"];
+			const defaultCooldownInput = cooldownRaw != null ? Number(cooldownRaw) : void 0;
+			const terminationPoliciesInput = properties["TerminationPolicies"];
+			const newInstancesProtectedInput = properties["NewInstancesProtectedFromScaleIn"];
+			const capacityRebalanceInput = properties["CapacityRebalance"];
+			const maxInstanceLifetimeInput = clearOnUpdateRemoval(properties["MaxInstanceLifetime"] != null ? Number(properties["MaxInstanceLifetime"]) : void 0, previousProperties["MaxInstanceLifetime"] != null ? Number(previousProperties["MaxInstanceLifetime"]) : void 0, 0);
+			const desiredCapacityTypeInput = properties["DesiredCapacityType"];
+			const defaultInstanceWarmupInput = properties["DefaultInstanceWarmup"] != null ? Number(properties["DefaultInstanceWarmup"]) : void 0;
+			const instanceMaintenancePolicyInput = properties["InstanceMaintenancePolicy"];
+			const capacityReservationSpecInput = properties["CapacityReservationSpecification"];
+			const availabilityZoneDistributionInput = properties["AvailabilityZoneDistribution"];
+			const deletionProtectionInput = properties["DeletionProtection"];
+			const placementGroupInput = clearOnUpdateRemoval(properties["PlacementGroup"], previousProperties["PlacementGroup"], "");
+			const instanceLifecyclePolicyInput = properties["InstanceLifecyclePolicy"];
+			const zones = zoneMembers(properties, context?.desiredFromAwsReadback === true || context?.replayingState === true, previousProperties);
+			const previousImpairmentPolicy = previousProperties["AvailabilityZoneImpairmentPolicy"];
+			const previousImpairedBehavior = typeof previousImpairmentPolicy === "object" && previousImpairmentPolicy !== null ? previousImpairmentPolicy["ImpairedZoneHealthCheckBehavior"] : void 0;
+			const availabilityZoneImpairmentPolicyInput = clearOnUpdateRemoval(properties["AvailabilityZoneImpairmentPolicy"], previousImpairmentPolicy, {
+				ZonalShiftEnabled: false,
+				...typeof previousImpairedBehavior === "string" && { ImpairedZoneHealthCheckBehavior: previousImpairedBehavior }
+			});
+			await this.getClient().send(new UpdateAutoScalingGroupCommand({
+				AutoScalingGroupName: physicalId,
+				...properties["MinSize"] != null && { MinSize: Number(properties["MinSize"]) },
+				...properties["MaxSize"] != null && { MaxSize: Number(properties["MaxSize"]) },
+				...properties["DesiredCapacity"] != null && { DesiredCapacity: Number(properties["DesiredCapacity"]) },
+				...launchTemplate && { LaunchTemplate: launchTemplate },
+				...properties["MixedInstancesPolicy"] !== void 0 && { MixedInstancesPolicy: properties["MixedInstancesPolicy"] },
+				...vpcZoneIdentifier !== void 0 && { VPCZoneIdentifier: vpcZoneIdentifier },
+				...zones.AvailabilityZones !== void 0 && { AvailabilityZones: zones.AvailabilityZones },
+				...zones.AvailabilityZoneIds !== void 0 && { AvailabilityZoneIds: zones.AvailabilityZoneIds },
+				...placementGroupInput !== void 0 && { PlacementGroup: placementGroupInput },
+				...instanceLifecyclePolicyInput !== void 0 && { InstanceLifecyclePolicy: instanceLifecyclePolicyInput },
+				...healthCheckTypeInput !== void 0 && { HealthCheckType: healthCheckTypeInput },
+				...healthCheckGracePeriodInput !== void 0 && { HealthCheckGracePeriod: healthCheckGracePeriodInput },
+				...defaultCooldownInput !== void 0 && { DefaultCooldown: defaultCooldownInput },
+				...terminationPoliciesInput !== void 0 && { TerminationPolicies: terminationPoliciesInput },
+				...newInstancesProtectedInput !== void 0 && { NewInstancesProtectedFromScaleIn: newInstancesProtectedInput },
+				...capacityRebalanceInput !== void 0 && { CapacityRebalance: capacityRebalanceInput },
+				...properties["ServiceLinkedRoleARN"] !== void 0 && { ServiceLinkedRoleARN: properties["ServiceLinkedRoleARN"] },
+				...maxInstanceLifetimeInput !== void 0 && { MaxInstanceLifetime: maxInstanceLifetimeInput },
+				...properties["Context"] !== void 0 && { Context: properties["Context"] },
+				...desiredCapacityTypeInput !== void 0 && { DesiredCapacityType: desiredCapacityTypeInput },
+				...defaultInstanceWarmupInput !== void 0 && { DefaultInstanceWarmup: defaultInstanceWarmupInput },
+				...availabilityZoneDistributionInput !== void 0 && { AvailabilityZoneDistribution: availabilityZoneDistributionInput },
+				...availabilityZoneImpairmentPolicyInput !== void 0 && { AvailabilityZoneImpairmentPolicy: availabilityZoneImpairmentPolicyInput },
+				...properties["SkipZonalShiftValidation"] !== void 0 && { SkipZonalShiftValidation: properties["SkipZonalShiftValidation"] },
+				...capacityReservationSpecInput !== void 0 && { CapacityReservationSpecification: capacityReservationSpecInput },
+				...instanceMaintenancePolicyInput !== void 0 && { InstanceMaintenancePolicy: instanceMaintenancePolicyInput },
+				...deletionProtectionInput !== void 0 && { DeletionProtection: deletionProtectionInput }
+			}));
+			this.logger.debug(`Successfully updated AutoScalingGroup ${logicalId}`);
+			const arn = await this.fetchArn(physicalId, mask);
+			const attributes = {};
+			if (arn) attributes["Arn"] = arn;
+			if (launchTemplate?.LaunchTemplateId) attributes["LaunchTemplateID"] = launchTemplate.LaunchTemplateId;
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes
+			};
+		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError) throw error;
+			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, mask);
+		}
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
+		const wrapped = build(`${mask(failure.summary)}${relay}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
+	wrapUpdateError(error, resourceType, logicalId, physicalId, maskSecrets) {
+		const cause = error instanceof Error ? error : void 0;
+		return this.wrapCaughtError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to update AutoScalingGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		let current;
+		const removedValue = () => current ? this.removedProtection.get(current) : void 0;
+		try {
+			await this.deleteGroupUnderCompensation(logicalId, physicalId, resourceType, context, removedValue, (flip) => {
+				current = flip;
+			});
+		} catch (error) {
+			if (current) await this.settleInstanceFlips(logicalId, current, error, context?.expectedRegion, context?.maskSecrets);
+			throw error;
+		}
+		if (current) this.releaseInstanceFlips(current, context?.expectedRegion);
+	}
+	async settleInstanceFlips(logicalId, groupFlip, error, region, mask) {
+		const instances = this.groupInstanceFlips.get(groupFlip);
+		if (!instances) return;
+		for (const [instanceId, flip] of instances) {
+			if (groupFlip.deleteAccepted) flip.deleteAccepted = true;
+			if (await settleProtectionFlip({
+				registry: this.instanceProtectionFlips,
+				key: protectionFlipKey(EC2_INSTANCE_TYPE, instanceId, region),
+				flip,
+				error,
+				compensation: {
+					logicalId,
+					physicalId: instanceId,
+					logger: this.logger,
+					mask,
+					site: autoScalingGroupInstanceProtectionSite(instanceId, region),
+					reEnable: () => this.reEnableLaunchedInstance(instanceId)
+				}
+			})) instances.delete(instanceId);
+		}
+	}
+	async reEnableLaunchedInstance(instanceId) {
+		try {
+			await reEnableInstanceApiTermination(this.getEc2Client(), instanceId);
+		} catch (writeError) {
+			let state;
+			try {
+				state = (await this.getEc2Client().send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0]?.State?.Name;
+			} catch {}
+			if (state !== void 0 && GONE_INSTANCE_STATES.has(state)) throw new LaunchedInstanceGoneError(instanceId, state);
+			throw writeError;
+		}
+	}
+	releaseInstanceFlips(groupFlip, region) {
+		for (const instanceId of this.groupInstanceFlips.get(groupFlip)?.keys() ?? []) this.instanceProtectionFlips.release(protectionFlipKey(EC2_INSTANCE_TYPE, instanceId, region));
+		this.groupInstanceFlips.delete(groupFlip);
+	}
+	async deleteGroupUnderCompensation(logicalId, physicalId, resourceType, context, removedValue, onFlip) {
+		await deleteWithProtectionCompensation({
+			registry: this.protectionFlips,
+			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
+			run: (flip) => {
+				onFlip(flip);
+				return this.deleteOnce(logicalId, physicalId, resourceType, context, flip);
+			},
+			compensation: {
+				logicalId,
+				physicalId,
+				logger: this.logger,
+				mask: context?.maskSecrets,
+				site: autoScalingGroupProtectionSite(physicalId, context?.expectedRegion, removedValue),
+				reEnable: async () => {
+					const value = removedValue();
+					if (value === void 0) throw new Error("the DeletionProtection value removed by this run was not recorded");
+					await this.getClient().send(new UpdateAutoScalingGroupCommand({
+						AutoScalingGroupName: physicalId,
+						DeletionProtection: value
+					}));
+				}
+			}
+		});
+	}
+	async deleteOnce(logicalId, physicalId, resourceType, context, flip) {
+		this.logger.debug(`Deleting AutoScalingGroup ${logicalId}: ${physicalId}`);
+		if (context?.removeProtection === true) {
+			try {
+				let observed;
+				await observeThenDisableProtection({
+					flip,
+					logger: this.logger,
+					physicalId,
+					mask: context?.maskSecrets,
+					guardName: "DeletionProtection",
+					observe: async () => {
+						const value = (await this.describeGroup(physicalId))?.DeletionProtection;
+						observed = typeof value === "string" && value !== "none" ? value : void 0;
+						return observed !== void 0;
+					},
+					disable: async () => {
+						await this.getClient().send(new UpdateAutoScalingGroupCommand({
+							AutoScalingGroupName: physicalId,
+							DeletionProtection: "none"
+						}));
+					}
+				});
+				if (observed !== void 0) this.removedProtection.set(flip, observed);
+				this.logger.debug(`Disabled DeletionProtection on AutoScalingGroup ${logicalId} before delete`);
+			} catch (flipError) {
+				this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable DeletionProtection on ${physicalId}: ${describeAwsFailure(flipError).detail}`));
+			}
+			await this.removeInstanceTerminationProtectionForDelete(physicalId, logicalId, flip, context.expectedRegion);
+		}
+		try {
+			await this.getClient().send(new DeleteAutoScalingGroupCommand({
+				AutoScalingGroupName: physicalId,
+				ForceDelete: context?.removeProtection === true
+			}));
+			flip.deleteAccepted = true;
+			this.logger.debug(`Successfully initiated deletion of AutoScalingGroup ${logicalId}`);
+			await this.waitForGroupDeleted(physicalId);
+		} catch (error) {
+			if (this.isNotFoundError(error)) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`AutoScalingGroup ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete AutoScalingGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName, logicalId) {
+		const group = await this.describeGroup(physicalId);
+		if (!group) throw new ProvisioningError(`AutoScalingGroup ${physicalId} not found while resolving attribute ${attributeName}`, "AWS::AutoScaling::AutoScalingGroup", logicalId, physicalId);
+		switch (attributeName) {
+			case "Arn":
+			case "AutoScalingGroupARN": return group.AutoScalingGroupARN ?? "";
+			case "LaunchConfigurationName": return group.LaunchConfigurationName ?? "";
+			case "LaunchTemplateID":
+			case "LaunchTemplateId": return group.LaunchTemplate?.LaunchTemplateId ?? "";
+			default: return "";
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const groupPromise = (async () => {
+			try {
+				return await this.describeGroup(physicalId);
+			} catch (err) {
+				if (this.isNotFoundError(err)) return null;
+				throw err;
+			}
+		})();
+		const lifecycleHooksPromise = this.getClient().send(new DescribeLifecycleHooksCommand({ AutoScalingGroupName: physicalId })).then((r) => r.LifecycleHooks ?? []).catch((err) => {
+			this.logger.debug(`DescribeLifecycleHooks(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
+			return [];
+		});
+		const trafficSourcesPromise = this.getClient().send(new DescribeTrafficSourcesCommand({ AutoScalingGroupName: physicalId })).then((r) => r.TrafficSources ?? []).catch((err) => {
+			this.logger.debug(`DescribeTrafficSources(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
+			return [];
+		});
+		const notificationsPromise = this.getClient().send(new DescribeNotificationConfigurationsCommand({ AutoScalingGroupNames: [physicalId] })).then((r) => r.NotificationConfigurations ?? []).catch((err) => {
+			this.logger.debug(`DescribeNotificationConfigurations(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
+			return [];
+		});
+		const [group, lifecycleHooks, trafficSources, notifications] = await Promise.all([
+			groupPromise,
+			lifecycleHooksPromise,
+			trafficSourcesPromise,
+			notificationsPromise
+		]);
+		if (group === null) return void 0;
+		if (!group) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (group.AutoScalingGroupName !== void 0) result["AutoScalingGroupName"] = group.AutoScalingGroupName;
+		if (group.LaunchTemplate) {
+			const lt = {};
+			if (group.LaunchTemplate.LaunchTemplateId !== void 0) lt["LaunchTemplateId"] = group.LaunchTemplate.LaunchTemplateId;
+			if (group.LaunchTemplate.LaunchTemplateName !== void 0) lt["LaunchTemplateName"] = group.LaunchTemplate.LaunchTemplateName;
+			if (group.LaunchTemplate.Version !== void 0) lt["Version"] = group.LaunchTemplate.Version;
+			result["LaunchTemplate"] = lt;
+		}
+		result["MinSize"] = group.MinSize ?? 0;
+		result["MaxSize"] = group.MaxSize ?? 0;
+		if (group.DesiredCapacity !== void 0) result["DesiredCapacity"] = group.DesiredCapacity;
+		if (group.VPCZoneIdentifier !== void 0 && group.VPCZoneIdentifier !== "") result["VPCZoneIdentifier"] = group.VPCZoneIdentifier.split(",").map((s) => s.trim());
+		else result["VPCZoneIdentifier"] = [];
+		result["AvailabilityZones"] = group.AvailabilityZones ?? [];
+		result["AvailabilityZoneIds"] = group.AvailabilityZoneIds ?? [];
+		if (group.PlacementGroup !== void 0 && group.PlacementGroup !== "") result["PlacementGroup"] = group.PlacementGroup;
+		if (group.InstanceLifecyclePolicy !== void 0) result["InstanceLifecyclePolicy"] = group.InstanceLifecyclePolicy;
+		if (group.HealthCheckType !== void 0) result["HealthCheckType"] = group.HealthCheckType;
+		if (group.HealthCheckGracePeriod !== void 0) result["HealthCheckGracePeriod"] = group.HealthCheckGracePeriod;
+		if (group.DefaultCooldown !== void 0) result["Cooldown"] = group.DefaultCooldown;
+		result["NewInstancesProtectedFromScaleIn"] = group.NewInstancesProtectedFromScaleIn ?? false;
+		result["TerminationPolicies"] = group.TerminationPolicies ?? [];
+		result["CapacityRebalance"] = group.CapacityRebalance ?? false;
+		if (group.ServiceLinkedRoleARN !== void 0) result["ServiceLinkedRoleARN"] = group.ServiceLinkedRoleARN;
+		if (group.MaxInstanceLifetime !== void 0) result["MaxInstanceLifetime"] = group.MaxInstanceLifetime;
+		result["LoadBalancerNames"] = group.LoadBalancerNames ?? [];
+		result["TargetGroupARNs"] = group.TargetGroupARNs ?? [];
+		if (group.Context !== void 0) result["Context"] = group.Context;
+		if (group.DesiredCapacityType !== void 0) result["DesiredCapacityType"] = group.DesiredCapacityType;
+		if (group.DefaultInstanceWarmup !== void 0) result["DefaultInstanceWarmup"] = group.DefaultInstanceWarmup;
+		if (group.MixedInstancesPolicy !== void 0) result["MixedInstancesPolicy"] = group.MixedInstancesPolicy;
+		if (group.AvailabilityZoneDistribution !== void 0) result["AvailabilityZoneDistribution"] = group.AvailabilityZoneDistribution;
+		if (group.AvailabilityZoneImpairmentPolicy !== void 0) result["AvailabilityZoneImpairmentPolicy"] = group.AvailabilityZoneImpairmentPolicy;
+		if (group.CapacityReservationSpecification !== void 0) result["CapacityReservationSpecification"] = group.CapacityReservationSpecification;
+		if (group.InstanceMaintenancePolicy !== void 0) result["InstanceMaintenancePolicy"] = group.InstanceMaintenancePolicy;
+		if (group.DeletionProtection !== void 0) result["DeletionProtection"] = group.DeletionProtection;
+		else result["DeletionProtection"] = "none";
+		result["Tags"] = normalizeAwsTagsToCfn(group.Tags);
+		result["MetricsCollection"] = mapEnabledMetricsToCfn(group.EnabledMetrics);
+		result["LifecycleHookSpecificationList"] = mapLifecycleHooksToCfn(lifecycleHooks);
+		result["TrafficSources"] = mapTrafficSourcesToCfn(trafficSources.filter((t) => {
+			if (t.Identifier === void 0) return false;
+			if (t.Type === "elbv2" || t.Type === "elb") return false;
+			return true;
+		}));
+		result["NotificationConfigurations"] = mapNotificationsToCfn(notifications);
+		return result;
+	}
+	buildLaunchTemplate(properties) {
+		const lt = properties["LaunchTemplate"];
+		if (!lt) return void 0;
+		const out = {};
+		if (lt.LaunchTemplateId !== void 0) {
+			out.LaunchTemplateId = lt.LaunchTemplateId;
+			if (lt.LaunchTemplateName !== void 0) this.logger.debug(`buildLaunchTemplate: both LaunchTemplateId (${lt.LaunchTemplateId}) and LaunchTemplateName (${lt.LaunchTemplateName}) templated; dropping Name`);
+		} else if (lt.LaunchTemplateName !== void 0) out.LaunchTemplateName = lt.LaunchTemplateName;
+		if (lt.Version !== void 0) out.Version = String(lt.Version);
+		if (out.LaunchTemplateId === void 0 && out.LaunchTemplateName === void 0) return;
+		return out;
+	}
+	buildTags(groupName, properties) {
+		const raw = properties["Tags"];
+		if (!raw) return [];
+		return raw.filter((t) => t.Key !== void 0).map((t) => ({
+			ResourceId: groupName,
+			ResourceType: "auto-scaling-group",
+			Key: t.Key,
+			Value: t.Value ?? "",
+			PropagateAtLaunch: t.PropagateAtLaunch ?? false
+		}));
+	}
+	joinVpcZoneIdentifier(value) {
+		if (value === void 0 || value === null) return void 0;
+		if (Array.isArray(value)) {
+			const cleaned = value.map((v) => String(v).trim()).filter((v) => v.length > 0);
+			if (cleaned.length === 0) return void 0;
+			return cleaned.join(",");
+		}
+		if (typeof value === "string") return value;
+	}
+	async describeGroup(groupName) {
+		return (await this.getClient().send(new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [groupName] }))).AutoScalingGroups?.[0];
+	}
+	async removeInstanceTerminationProtection(groupName, logicalId, maskSecrets, alreadyFlipped) {
+		const instanceIds = (await this.listGroupInstanceIds(groupName, logicalId, maskSecrets))?.filter((id) => !alreadyFlipped.has(id));
+		if (!instanceIds || instanceIds.length === 0) return;
+		this.logger.debug(`Disabling EC2 termination protection on ${instanceIds.length} instance(s) of AutoScalingGroup ${logicalId} before force delete`);
+		for (const instanceId of instanceIds) if (await disableInstanceApiTermination(this.getEc2Client(), instanceId, this.logger)) alreadyFlipped.add(instanceId);
+	}
+	async removeInstanceTerminationProtectionForDelete(groupName, logicalId, groupFlip, region) {
+		const instanceIds = await this.listGroupInstanceIds(groupName, logicalId, (text) => text);
+		if (!instanceIds || instanceIds.length === 0) return;
+		let flips = this.groupInstanceFlips.get(groupFlip);
+		if (!flips) {
+			flips = /* @__PURE__ */ new Map();
+			this.groupInstanceFlips.set(groupFlip, flips);
+		}
+		this.logger.debug(`Disabling EC2 termination protection on ${instanceIds.length} instance(s) of AutoScalingGroup ${logicalId} before force delete`);
+		for (const instanceId of instanceIds) {
+			const flip = this.instanceProtectionFlips.acquire(protectionFlipKey(EC2_INSTANCE_TYPE, instanceId, region), PROTECTION_FLIP_REUSE_WINDOW_MS);
+			flips.set(instanceId, flip);
+			await observeThenDisableInstanceApiTermination(this.getEc2Client(), instanceId, flip, this.logger);
+		}
+	}
+	async listGroupInstanceIds(groupName, logicalId, maskSecrets) {
+		try {
+			return ((await this.describeGroup(groupName))?.Instances ?? []).map((i) => i.InstanceId).filter((id) => typeof id === "string" && id.length > 0);
+		} catch (describeError) {
+			this.logger.debug(maskSecrets(`Could not enumerate instances of AutoScalingGroup ${logicalId} for termination-protection removal: ${describeAwsFailure(describeError).detail}`));
+			return;
+		}
+	}
+	async fetchArn(groupName, maskSecrets = (text) => text) {
+		try {
+			return (await this.describeGroup(groupName))?.AutoScalingGroupARN;
+		} catch (err) {
+			this.logger.debug(maskSecrets(`DescribeAutoScalingGroups(${groupName}) failed: ${describeAwsFailure(err).detail}`));
+			return;
+		}
+	}
+	isNotFoundError(error) {
+		if (!(error instanceof Error)) return false;
+		const name = error.name ?? "";
+		const message = error.message.toLowerCase();
+		return name === "ValidationError" && (message.includes("autoscalinggroup name not found") || message.includes("not found") || message.includes("does not exist"));
+	}
+	async waitForGroupDeleted(groupName, maxWaitMs = 9e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			try {
+				if (!await this.describeGroup(groupName)) return;
+			} catch (error) {
+				if (this.isNotFoundError(error)) return;
+				throw error;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for AutoScalingGroup ${groupName} to be deleted (15 minute cap)`);
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	async readUpdateLists(logicalId, physicalId, resourceType, desired, recorded) {
+		const nextRead = readLists(desired, "desired");
+		const prevRead = readLists(recorded, "recorded");
+		const badNext = malformedKinds(nextRead);
+		let badPrev = malformedKinds(prevRead);
+		const retained = {
+			LoadBalancerNames: [],
+			TargetGroupARNs: []
+		};
+		const readLive = (k) => {
+			const read = prevRead[k];
+			return isAttachmentKind(k) && read.kind === "malformed";
+		};
+		if (badNext.length === 0 && badPrev.length > 0 && badPrev.every(readLive)) {
+			const kinds = badPrev.join(" / ");
+			let group;
+			try {
+				group = await this.describeGroup(physicalId);
+			} catch (error) {
+				throw new ProvisioningError(`the recorded ${kinds} of AutoScalingGroup ${logicalId} is not a list cdkd can read, and the live group could not be read from Auto Scaling instead — nothing was attached or detached`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+			}
+			for (const kind of badPrev) {
+				const live = (group?.[kind] ?? []).filter((v) => typeof v === "string");
+				const wanted = itemsOf(nextRead[kind]);
+				prevRead[kind] = {
+					kind: "list",
+					items: live.filter((v) => wanted.includes(v))
+				};
+				retained[kind] = live.filter((v) => !wanted.includes(v));
+				if (retained[kind].length > 0) this.logger.warn(safeMsg`The recorded ${kind} of AutoScalingGroup ${logicalId} is not a list cdkd can read, so cdkd read it from Auto Scaling; the group holds ${kind} entries the desired list does not name, and cdkd left them attached. Detach them yourself if they are no longer wanted.`);
+			}
+			badPrev = [];
+		}
+		if (badNext.length > 0 || badPrev.length > 0) {
+			const which = [...badNext.map((k) => `desired ${k}`), ...badPrev.map((k) => `recorded ${k}`)];
+			const what = [...new Set([...badNext, ...badPrev].map(listWhat))];
+			throw markNonRetryable(new ProvisioningError(`${which.join(" / ")} of AutoScalingGroup ${logicalId} is not a list of ${what.join(" / ")}${secretDerivedCause(badNext, nextRead)} — nothing was attached, detached or removed` + (badPrev.length > 0 ? `: ${this.recordedListRepair(badPrev, prevRead)}` : ""), resourceType, logicalId, physicalId));
+		}
+		const next = {};
+		const prev = {};
+		for (const kind of LIST_KINDS) {
+			next[kind] = itemsOf(nextRead[kind]);
+			prev[kind] = removableRecorded(kind, itemsOf(prevRead[kind]));
+		}
+		return {
+			next,
+			prev,
+			retained
+		};
+	}
+	recordedListRepair(kinds, read) {
+		const live = kinds.filter(isAttachmentKind);
+		const entry = kinds.filter((k) => !isAttachmentKind(k));
+		const secret = entry.filter((k) => {
+			const r = read[k];
+			return r.kind === "malformed" && r.secretDerived;
+		});
+		const plain = entry.filter((k) => !secret.includes(k));
+		const parts = [];
+		if (plain.length > 0) parts.push(`repair the recorded ${plain.join(" / ")} in state.json to a list of ${[...new Set(plain.map(listWhat))].join(" / ")} and re-run`);
+		if (secret.length > 0) parts.push(`the recorded ${secret.join(" / ")} is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the value into state.json; set it to [] in state.json and re-run, which removes nothing`);
+		if (live.length > 0) parts.push(`the recorded ${live.join(" / ")} needs no repair: cdkd reads it from Auto Scaling instead once every desired list and every other recorded list is well-formed`);
+		return parts.join("; ");
+	}
+	async applyTagsDiff(physicalId, next, prev) {
+		if (JSON.stringify(next) === JSON.stringify(prev)) return;
+		const nextEntries = next;
+		const prevEntries = prev;
+		const nextByKey = /* @__PURE__ */ new Map();
+		for (const t of nextEntries) if (t.Key) nextByKey.set(t.Key, t);
+		const prevByKey = /* @__PURE__ */ new Map();
+		for (const t of prevEntries) if (t.Key) prevByKey.set(t.Key, t);
+		const toDelete = [];
+		for (const [key, tag] of prevByKey) if (!nextByKey.has(key)) toDelete.push(tag);
+		if (toDelete.length > 0) await this.getClient().send(new DeleteTagsCommand$1({ Tags: toDelete.map((t) => ({
+			ResourceId: physicalId,
+			ResourceType: "auto-scaling-group",
+			Key: t.Key
+		})) }));
+		const toUpsert = [];
+		for (const [key, tag] of nextByKey) {
+			const before = prevByKey.get(key);
+			if (JSON.stringify(before) === JSON.stringify(tag)) continue;
+			toUpsert.push(tag);
+		}
+		if (toUpsert.length > 0) await this.getClient().send(new CreateOrUpdateTagsCommand({ Tags: toUpsert.map((t) => ({
+			ResourceId: physicalId,
+			ResourceType: "auto-scaling-group",
+			Key: t.Key,
+			...t.Value !== void 0 && { Value: t.Value },
+			...t.PropagateAtLaunch !== void 0 && { PropagateAtLaunch: t.PropagateAtLaunch }
+		})) }));
+	}
+	async applyLoadBalancerNamesDiff(physicalId, nextNames, prevNames) {
+		if (JSON.stringify(nextNames) === JSON.stringify(prevNames)) return;
+		const nextSet = new Set(nextNames);
+		const prevSet = new Set(prevNames);
+		const toAttach = nextNames.filter((n) => !prevSet.has(n));
+		const toDetach = prevNames.filter((n) => !nextSet.has(n));
+		if (toDetach.length > 0) await this.getClient().send(new DetachLoadBalancersCommand({
+			AutoScalingGroupName: physicalId,
+			LoadBalancerNames: toDetach
+		}));
+		if (toAttach.length > 0) await this.getClient().send(new AttachLoadBalancersCommand({
+			AutoScalingGroupName: physicalId,
+			LoadBalancerNames: toAttach
+		}));
+	}
+	async applyTargetGroupArnsDiff(physicalId, nextArns, prevArns, maskSecrets, retainedArns = []) {
+		if (JSON.stringify(nextArns) === JSON.stringify(prevArns)) return;
+		const nextSet = new Set(nextArns);
+		const prevSet = new Set(prevArns);
+		const toAttach = nextArns.filter((a) => !prevSet.has(a));
+		const toDetach = prevArns.filter((a) => !nextSet.has(a));
+		if (toDetach.length > 0) await this.getClient().send(new DetachLoadBalancerTargetGroupsCommand({
+			AutoScalingGroupName: physicalId,
+			TargetGroupARNs: toDetach
+		}));
+		if (toAttach.length > 0) await this.getClient().send(new AttachLoadBalancerTargetGroupsCommand({
+			AutoScalingGroupName: physicalId,
+			TargetGroupARNs: toAttach
+		}));
+		if (toDetach.length > 0 || toAttach.length > 0) await this.waitForTargetGroupArnsConvergence(physicalId, /* @__PURE__ */ new Set([...nextArns, ...retainedArns]), maskSecrets);
+	}
+	static TG_CONVERGENCE_TIMEOUT_MS = 3e4;
+	static TG_CONVERGENCE_POLL_INTERVAL_MS = 1e3;
+	async waitForTargetGroupArnsConvergence(physicalId, expected, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const deadlineMs = Date.now() + ASGProvider.TG_CONVERGENCE_TIMEOUT_MS;
+		let lastObserved = /* @__PURE__ */ new Set();
+		while (Date.now() < deadlineMs) {
+			let resp;
+			try {
+				resp = await this.getClient().send(new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [physicalId] }));
+			} catch (err) {
+				debug(`applyTargetGroupArnsDiff convergence poll: transient error, retrying — ${describeAwsFailure(err).detail}`);
+				await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));
+				continue;
+			}
+			lastObserved = new Set(resp.AutoScalingGroups?.[0]?.TargetGroupARNs ?? []);
+			if (lastObserved.size === expected.size && [...expected].every((a) => lastObserved.has(a))) return;
+			await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));
+		}
+		const expectedSorted = [...expected].sort().map((a) => maskSecrets(a));
+		const observedSorted = [...lastObserved].sort().map((a) => maskSecrets(a));
+		warn(`applyTargetGroupArnsDiff: TG set did not converge within ${ASGProvider.TG_CONVERGENCE_TIMEOUT_MS}ms for ASG ${physicalId}. expected=${JSON.stringify(expectedSorted)} observed=${JSON.stringify(observedSorted)}`);
+	}
+	async applyMetricsCollectionDiff(physicalId, next, prev) {
+		const nextFold = foldMetricsCollection(next);
+		const prevFold = foldMetricsCollection(prev);
+		if (JSON.stringify(nextFold) === JSON.stringify(prevFold)) return;
+		const toMap = (fold) => new Map(fold.map((e) => [e.Granularity, e.Metrics]));
+		const prevBy = toMap(prevFold);
+		const nextBy = toMap(nextFold);
+		const disable = async (metrics) => {
+			await this.getClient().send(new DisableMetricsCollectionCommand({
+				AutoScalingGroupName: physicalId,
+				...metrics !== void 0 ? { Metrics: metrics } : {}
+			}));
+		};
+		const enable = async (granularity, metrics) => {
+			const asAll = metrics === void 0 || disables.length === 0 && holdsAllKnownMetrics(metrics);
+			await this.getClient().send(new EnableMetricsCollectionCommand({
+				AutoScalingGroupName: physicalId,
+				Granularity: granularity,
+				...asAll ? {} : { Metrics: metrics }
+			}));
+		};
+		const disables = [];
+		const changed = /* @__PURE__ */ new Set();
+		for (const [granularity, metrics] of prevBy) if (!nextBy.has(granularity)) disables.push(metrics);
+		for (const [granularity, metrics] of nextBy) {
+			const had = prevBy.has(granularity);
+			const before = prevBy.get(granularity);
+			if (had && JSON.stringify(before ?? null) === JSON.stringify(metrics ?? null)) continue;
+			changed.add(granularity);
+			if (metrics !== void 0 && had) {
+				if (before === void 0) disables.push(void 0);
+				else {
+					const removed = before.filter((m) => !metrics.includes(m));
+					if (removed.length > 0) disables.push(removed);
+				}
+			}
+		}
+		for (const metrics of disables) await disable(metrics);
+		for (const [granularity, metrics] of nextBy) if (disables.length > 0 || changed.has(granularity)) await enable(granularity, metrics);
+	}
+	async applyLifecycleHooksDiff(physicalId, next, prev) {
+		if (JSON.stringify(next) === JSON.stringify(prev)) return;
+		const nextEntries = next;
+		const prevEntries = prev;
+		const nextNames = new Set(nextEntries.map((e) => e.LifecycleHookName).filter((n) => !!n));
+		for (const e of prevEntries) if (e.LifecycleHookName && !nextNames.has(e.LifecycleHookName)) await this.getClient().send(new DeleteLifecycleHookCommand({
+			AutoScalingGroupName: physicalId,
+			LifecycleHookName: e.LifecycleHookName
+		}));
+		const prevByName = /* @__PURE__ */ new Map();
+		for (const e of prevEntries) if (e.LifecycleHookName) prevByName.set(e.LifecycleHookName, e);
+		for (const e of nextEntries) {
+			if (!e.LifecycleHookName) continue;
+			const prevHook = prevByName.get(e.LifecycleHookName);
+			if (JSON.stringify(prevHook) === JSON.stringify(e)) continue;
+			await this.getClient().send(new PutLifecycleHookCommand({
+				AutoScalingGroupName: physicalId,
+				LifecycleHookName: e.LifecycleHookName,
+				...e.LifecycleTransition !== void 0 && { LifecycleTransition: e.LifecycleTransition },
+				...e.RoleARN !== void 0 && { RoleARN: e.RoleARN },
+				...e.NotificationTargetARN !== void 0 && { NotificationTargetARN: e.NotificationTargetARN },
+				...e.NotificationMetadata !== void 0 && { NotificationMetadata: e.NotificationMetadata },
+				...e.HeartbeatTimeout !== void 0 && { HeartbeatTimeout: e.HeartbeatTimeout },
+				...e.DefaultResult !== void 0 && { DefaultResult: e.DefaultResult }
+			}));
+		}
+	}
+	async applyTrafficSourcesDiff(physicalId, next, prev) {
+		if (JSON.stringify(next) === JSON.stringify(prev)) return;
+		const nextEntries = next;
+		const prevEntries = prev;
+		const nextIds = new Set(nextEntries.map((e) => e.Identifier).filter((i) => !!i));
+		const prevIds = new Set(prevEntries.map((e) => e.Identifier).filter((i) => !!i));
+		const toDetach = prevEntries.filter((e) => e.Identifier && !nextIds.has(e.Identifier));
+		const toAttach = nextEntries.filter((e) => e.Identifier && !prevIds.has(e.Identifier));
+		if (toDetach.length > 0) await this.getClient().send(new DetachTrafficSourcesCommand({
+			AutoScalingGroupName: physicalId,
+			TrafficSources: toDetach.map((e) => ({
+				Identifier: e.Identifier,
+				...e.Type !== void 0 && { Type: e.Type }
+			}))
+		}));
+		if (toAttach.length > 0) await this.getClient().send(new AttachTrafficSourcesCommand({
+			AutoScalingGroupName: physicalId,
+			TrafficSources: toAttach.map((e) => ({
+				Identifier: e.Identifier,
+				...e.Type !== void 0 && { Type: e.Type }
+			}))
+		}));
+	}
+	async applyNotificationConfigurationsDiff(physicalId, next, prev) {
+		if (JSON.stringify(next) === JSON.stringify(prev)) return;
+		const nextEntries = next;
+		const prevEntries = prev;
+		const nextByTopic = /* @__PURE__ */ new Map();
+		for (const e of nextEntries) if (e.TopicARN) nextByTopic.set(e.TopicARN, e.NotificationTypes);
+		const prevByTopic = /* @__PURE__ */ new Map();
+		for (const e of prevEntries) if (e.TopicARN) prevByTopic.set(e.TopicARN, e.NotificationTypes);
+		for (const topic of prevByTopic.keys()) if (!nextByTopic.has(topic)) await this.getClient().send(new DeleteNotificationConfigurationCommand({
+			AutoScalingGroupName: physicalId,
+			TopicARN: topic
+		}));
+		for (const [topic, types] of nextByTopic) {
+			const before = prevByTopic.get(topic);
+			if (JSON.stringify(before ?? null) === JSON.stringify(types ?? null)) continue;
+			await this.getClient().send(new PutNotificationConfigurationCommand({
+				AutoScalingGroupName: physicalId,
+				TopicARN: topic,
+				NotificationTypes: types ?? []
+			}));
+		}
+	}
+};
+function mapEnabledMetricsToCfn(enabledMetrics) {
+	if (!enabledMetrics || enabledMetrics.length === 0) return [];
+	const byGranularity = /* @__PURE__ */ new Map();
+	for (const e of enabledMetrics) {
+		const g = e.Granularity;
+		if (!g) continue;
+		let set = byGranularity.get(g);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			byGranularity.set(g, set);
+		}
+		if (e.Metric) set.add(e.Metric);
+	}
+	const result = [];
+	for (const granularity of Array.from(byGranularity.keys()).sort()) {
+		const metrics = Array.from(byGranularity.get(granularity) ?? []).sort();
+		result.push(metrics.length > 0 ? {
+			Granularity: granularity,
+			Metrics: metrics
+		} : { Granularity: granularity });
+	}
+	return result;
+}
+function mapLifecycleHooksToCfn(hooks) {
+	if (!hooks || hooks.length === 0) return [];
+	const result = [];
+	for (const h of hooks) {
+		if (!h.LifecycleHookName) continue;
+		const entry = { LifecycleHookName: h.LifecycleHookName };
+		if (h.LifecycleTransition !== void 0) entry["LifecycleTransition"] = h.LifecycleTransition;
+		if (h.RoleARN !== void 0) entry["RoleARN"] = h.RoleARN;
+		if (h.NotificationTargetARN !== void 0) entry["NotificationTargetARN"] = h.NotificationTargetARN;
+		if (h.NotificationMetadata !== void 0) entry["NotificationMetadata"] = h.NotificationMetadata;
+		if (h.HeartbeatTimeout !== void 0) entry["HeartbeatTimeout"] = h.HeartbeatTimeout;
+		if (h.DefaultResult !== void 0) entry["DefaultResult"] = h.DefaultResult;
+		result.push(entry);
+	}
+	result.sort((a, b) => String(a["LifecycleHookName"]).localeCompare(String(b["LifecycleHookName"])));
+	return result;
+}
+function mapTrafficSourcesToCfn(trafficSources) {
+	if (!trafficSources || trafficSources.length === 0) return [];
+	const result = [];
+	for (const t of trafficSources) {
+		if (!t.Identifier) continue;
+		const entry = { Identifier: t.Identifier };
+		if (t.Type !== void 0) entry["Type"] = t.Type;
+		result.push(entry);
+	}
+	result.sort((a, b) => String(a["Identifier"]).localeCompare(String(b["Identifier"])));
+	return result;
+}
+function mapNotificationsToCfn(configurations) {
+	if (!configurations || configurations.length === 0) return [];
+	const byTopic = /* @__PURE__ */ new Map();
+	for (const c of configurations) {
+		if (!c.TopicARN) continue;
+		let set = byTopic.get(c.TopicARN);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			byTopic.set(c.TopicARN, set);
+		}
+		if (c.NotificationType) set.add(c.NotificationType);
+	}
+	const result = [];
+	for (const topic of Array.from(byTopic.keys()).sort()) {
+		const types = Array.from(byTopic.get(topic) ?? []).sort();
+		result.push({
+			TopicARN: topic,
+			NotificationTypes: types
+		});
+	}
+	return result;
+}
+
+export { ASGProvider };
+//# sourceMappingURL=asg-provider-4rNFSmz9.js.map