@go-to-k/cdkd 0.219.1 → 0.219.3

package/dist/asg-provider-B_hrCxRx.js

@@ -0,0 +1,790 @@
+import { t as __exportAll } from "./rolldown-runtime-CjeV3_4I.js";
+import { M as getLogger, S as ResourceUpdateNotSupportedError, a as assertRegionMatch, b as ProvisioningError, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
+import { EC2Client } from "@aws-sdk/client-ec2";
+import { AttachLoadBalancerTargetGroupsCommand, AttachLoadBalancersCommand, AttachTrafficSourcesCommand, AutoScalingClient, CreateAutoScalingGroupCommand, CreateOrUpdateTagsCommand, DeleteAutoScalingGroupCommand, DeleteLifecycleHookCommand, DeleteNotificationConfigurationCommand, DeleteTagsCommand as DeleteTagsCommand$1, DescribeAutoScalingGroupsCommand, DescribeLifecycleHooksCommand, DescribeNotificationConfigurationsCommand, DescribeTrafficSourcesCommand, DetachLoadBalancerTargetGroupsCommand, DetachLoadBalancersCommand, DetachTrafficSourcesCommand, DisableMetricsCollectionCommand, EnableMetricsCollectionCommand, PutLifecycleHookCommand, PutNotificationConfigurationCommand, UpdateAutoScalingGroupCommand } from "@aws-sdk/client-auto-scaling";
+
+//#region src/provisioning/providers/asg-provider.ts
+var asg_provider_exports = /* @__PURE__ */ __exportAll({ ASGProvider: () => ASGProvider });
+/**
+* AWS Auto Scaling Provider
+*
+* Implements resource provisioning for `AWS::AutoScaling::AutoScalingGroup`.
+*
+* WHY a dedicated SDK provider (instead of CC API fallback):
+*   1. Owns the `--remove-protection` flip-off: ASG protection has three
+*      levels (`none` / `prevent-force-deletion` / `prevent-all-deletion`)
+*      and the destroy path needs to (a) clear it via `UpdateAutoScalingGroup
+*      ({DeletionProtection: 'none'})` before the actual delete and (b) set
+*      `ForceDelete: true` on `DeleteAutoScalingGroup` so AWS terminates any
+*      running instances as part of the delete (matches the user's "I know
+*      what I'm doing" intent).
+*   2. Faster than CC API for the common case — direct Create/Update calls
+*      with no eventual-consistency polling beyond what `DescribeAutoScaling
+*      Groups` already provides.
+*
+* Update has narrower coverage than create: AWS does not support modifying
+* `AutoScalingGroupName` (immutable) — that diff still surfaces
+* `ResourceUpdateNotSupportedError` so the caller can `cdkd deploy
+* --replace`. The mutable fields handled in-place via
+* `UpdateAutoScalingGroup` include MinSize / MaxSize / DesiredCapacity /
+* VPCZoneIdentifier / HealthCheckType / HealthCheckGracePeriod /
+* DefaultCooldown / Cooldown / NewInstancesProtectedFromScaleIn /
+* MaxInstanceLifetime / TerminationPolicies / CapacityRebalance /
+* ServiceLinkedRoleARN / Context / DesiredCapacityType /
+* DefaultInstanceWarmup / AvailabilityZones / AvailabilityZoneDistribution
+* / AvailabilityZoneImpairmentPolicy / SkipZonalShiftValidation /
+* CapacityReservationSpecification / InstanceMaintenancePolicy /
+* DeletionProtection / MixedInstancesPolicy / LaunchTemplate.
+*
+* Sub-shape diffs are applied via dedicated AWS APIs before the main
+* `UpdateAutoScalingGroup` call:
+*   - `Tags` → `CreateOrUpdateTags` / `DeleteTags` (#475)
+*   - `LoadBalancerNames` → `AttachLoadBalancers` /
+*     `DetachLoadBalancers` (#476)
+*   - `TargetGroupARNs` → `AttachLoadBalancerTargetGroups` /
+*     `DetachLoadBalancerTargetGroups` (#476)
+*   - `MetricsCollection` → `EnableMetricsCollection` /
+*     `DisableMetricsCollection`
+*   - `LifecycleHookSpecificationList` → per-entry `PutLifecycleHook` /
+*     `DeleteLifecycleHook`
+*   - `TrafficSources` → `AttachTrafficSources` /
+*     `DetachTrafficSources`
+*   - `NotificationConfigurations` → per-topic
+*     `PutNotificationConfiguration` /
+*     `DeleteNotificationConfiguration`
+*
+* Each helper is a no-op when the before/after JSON is identical.
+*/
+var ASGProvider = class ASGProvider {
+	asgClient;
+	ec2Client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("ASGProvider");
+	handledProperties = new Map([["AWS::AutoScaling::AutoScalingGroup", new Set([
+		"AutoScalingGroupName",
+		"LaunchTemplate",
+		"MinSize",
+		"MaxSize",
+		"DesiredCapacity",
+		"VPCZoneIdentifier",
+		"AvailabilityZones",
+		"HealthCheckType",
+		"HealthCheckGracePeriod",
+		"Cooldown",
+		"DefaultCooldown",
+		"Tags",
+		"TerminationPolicies",
+		"NewInstancesProtectedFromScaleIn",
+		"CapacityRebalance",
+		"ServiceLinkedRoleARN",
+		"MaxInstanceLifetime",
+		"LoadBalancerNames",
+		"TargetGroupARNs",
+		"MetricsCollection",
+		"LifecycleHookSpecificationList",
+		"MixedInstancesPolicy",
+		"Context",
+		"DesiredCapacityType",
+		"DefaultInstanceWarmup",
+		"TrafficSources",
+		"NotificationConfigurations",
+		"AvailabilityZoneDistribution",
+		"AvailabilityZoneImpairmentPolicy",
+		"SkipZonalShiftValidation",
+		"CapacityReservationSpecification",
+		"InstanceMaintenancePolicy",
+		"DeletionProtection"
+	])]]);
+	unhandledByDesign = new Map([["AWS::AutoScaling::AutoScalingGroup", new Map([["LaunchConfigurationName", "AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead"], ["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"]])]]);
+	getClient() {
+		if (!this.asgClient) this.asgClient = new AutoScalingClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.asgClient;
+	}
+	getEc2Client() {
+		if (!this.ec2Client) this.ec2Client = new EC2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.ec2Client;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const groupName = properties["AutoScalingGroupName"] || generateResourceName(logicalId, { maxLength: 255 });
+		this.logger.debug(`Creating AutoScalingGroup ${logicalId}: ${groupName}`);
+		try {
+			const launchTemplate = this.buildLaunchTemplate(properties);
+			const tags = this.buildTags(groupName, properties);
+			const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties["VPCZoneIdentifier"]);
+			const minSize = properties["MinSize"] != null ? Number(properties["MinSize"]) : 0;
+			const maxSize = properties["MaxSize"] != null ? Number(properties["MaxSize"]) : minSize;
+			await this.getClient().send(new CreateAutoScalingGroupCommand({
+				AutoScalingGroupName: groupName,
+				MinSize: minSize,
+				MaxSize: maxSize,
+				...properties["DesiredCapacity"] != null && { DesiredCapacity: Number(properties["DesiredCapacity"]) },
+				...launchTemplate && { LaunchTemplate: launchTemplate },
+				...properties["MixedInstancesPolicy"] !== void 0 && { MixedInstancesPolicy: properties["MixedInstancesPolicy"] },
+				...vpcZoneIdentifier !== void 0 && { VPCZoneIdentifier: vpcZoneIdentifier },
+				...properties["AvailabilityZones"] !== void 0 && { AvailabilityZones: properties["AvailabilityZones"] },
+				...properties["HealthCheckType"] !== void 0 && { HealthCheckType: properties["HealthCheckType"] },
+				...properties["HealthCheckGracePeriod"] != null && { HealthCheckGracePeriod: Number(properties["HealthCheckGracePeriod"]) },
+				...properties["Cooldown"] != null && { DefaultCooldown: Number(properties["Cooldown"]) },
+				...properties["DefaultCooldown"] != null && { DefaultCooldown: Number(properties["DefaultCooldown"]) },
+				...properties["TerminationPolicies"] !== void 0 && { TerminationPolicies: properties["TerminationPolicies"] },
+				...properties["NewInstancesProtectedFromScaleIn"] !== void 0 && { NewInstancesProtectedFromScaleIn: properties["NewInstancesProtectedFromScaleIn"] },
+				...properties["CapacityRebalance"] !== void 0 && { CapacityRebalance: properties["CapacityRebalance"] },
+				...properties["ServiceLinkedRoleARN"] !== void 0 && { ServiceLinkedRoleARN: properties["ServiceLinkedRoleARN"] },
+				...properties["MaxInstanceLifetime"] != null && { MaxInstanceLifetime: Number(properties["MaxInstanceLifetime"]) },
+				...properties["LoadBalancerNames"] !== void 0 && { LoadBalancerNames: properties["LoadBalancerNames"] },
+				...properties["TargetGroupARNs"] !== void 0 && { TargetGroupARNs: properties["TargetGroupARNs"] },
+				...properties["Context"] !== void 0 && { Context: properties["Context"] },
+				...properties["DesiredCapacityType"] !== void 0 && { DesiredCapacityType: properties["DesiredCapacityType"] },
+				...properties["DefaultInstanceWarmup"] != null && { DefaultInstanceWarmup: Number(properties["DefaultInstanceWarmup"]) },
+				...properties["LifecycleHookSpecificationList"] !== void 0 && { LifecycleHookSpecificationList: properties["LifecycleHookSpecificationList"] },
+				...properties["TrafficSources"] !== void 0 && { TrafficSources: properties["TrafficSources"] },
+				...properties["AvailabilityZoneDistribution"] !== void 0 && { AvailabilityZoneDistribution: properties["AvailabilityZoneDistribution"] },
+				...properties["AvailabilityZoneImpairmentPolicy"] !== void 0 && { AvailabilityZoneImpairmentPolicy: properties["AvailabilityZoneImpairmentPolicy"] },
+				...properties["SkipZonalShiftValidation"] !== void 0 && { SkipZonalShiftValidation: properties["SkipZonalShiftValidation"] },
+				...properties["CapacityReservationSpecification"] !== void 0 && { CapacityReservationSpecification: properties["CapacityReservationSpecification"] },
+				...properties["InstanceMaintenancePolicy"] !== void 0 && { InstanceMaintenancePolicy: properties["InstanceMaintenancePolicy"] },
+				...properties["DeletionProtection"] !== void 0 && { DeletionProtection: properties["DeletionProtection"] },
+				...tags.length > 0 && { Tags: tags }
+			}));
+			this.logger.debug(`Successfully created AutoScalingGroup ${logicalId}: ${groupName}`);
+			const arn = await this.fetchArn(groupName);
+			const attributes = {};
+			if (arn) attributes["Arn"] = arn;
+			if (launchTemplate?.LaunchTemplateId) attributes["LaunchTemplateID"] = launchTemplate.LaunchTemplateId;
+			return {
+				physicalId: groupName,
+				attributes
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, groupName, cause);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
+		this.logger.debug(`Updating AutoScalingGroup ${logicalId}: ${physicalId}`);
+		const stringEq = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+		if (!stringEq(properties["AutoScalingGroupName"], previousProperties["AutoScalingGroupName"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. Use cdkd deploy --replace to replace the group.");
+		try {
+			await this.applyTagsDiff(physicalId, properties["Tags"], previousProperties["Tags"]);
+			await this.applyLoadBalancerNamesDiff(physicalId, properties["LoadBalancerNames"], previousProperties["LoadBalancerNames"]);
+			await this.applyTargetGroupArnsDiff(physicalId, properties["TargetGroupARNs"], previousProperties["TargetGroupARNs"]);
+			await this.applyMetricsCollectionDiff(physicalId, properties["MetricsCollection"], previousProperties["MetricsCollection"]);
+			await this.applyLifecycleHooksDiff(physicalId, properties["LifecycleHookSpecificationList"], previousProperties["LifecycleHookSpecificationList"]);
+			await this.applyTrafficSourcesDiff(physicalId, properties["TrafficSources"], previousProperties["TrafficSources"]);
+			await this.applyNotificationConfigurationsDiff(physicalId, properties["NotificationConfigurations"], previousProperties["NotificationConfigurations"]);
+			const launchTemplate = this.buildLaunchTemplate(properties);
+			const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties["VPCZoneIdentifier"]);
+			await this.getClient().send(new UpdateAutoScalingGroupCommand({
+				AutoScalingGroupName: physicalId,
+				...properties["MinSize"] != null && { MinSize: Number(properties["MinSize"]) },
+				...properties["MaxSize"] != null && { MaxSize: Number(properties["MaxSize"]) },
+				...properties["DesiredCapacity"] != null && { DesiredCapacity: Number(properties["DesiredCapacity"]) },
+				...launchTemplate && { LaunchTemplate: launchTemplate },
+				...properties["MixedInstancesPolicy"] !== void 0 && { MixedInstancesPolicy: properties["MixedInstancesPolicy"] },
+				...vpcZoneIdentifier !== void 0 && { VPCZoneIdentifier: vpcZoneIdentifier },
+				...properties["AvailabilityZones"] !== void 0 && { AvailabilityZones: properties["AvailabilityZones"] },
+				...properties["HealthCheckType"] !== void 0 && { HealthCheckType: properties["HealthCheckType"] },
+				...properties["HealthCheckGracePeriod"] != null && { HealthCheckGracePeriod: Number(properties["HealthCheckGracePeriod"]) },
+				...properties["Cooldown"] != null && { DefaultCooldown: Number(properties["Cooldown"]) },
+				...properties["DefaultCooldown"] != null && { DefaultCooldown: Number(properties["DefaultCooldown"]) },
+				...properties["TerminationPolicies"] !== void 0 && { TerminationPolicies: properties["TerminationPolicies"] },
+				...properties["NewInstancesProtectedFromScaleIn"] !== void 0 && { NewInstancesProtectedFromScaleIn: properties["NewInstancesProtectedFromScaleIn"] },
+				...properties["CapacityRebalance"] !== void 0 && { CapacityRebalance: properties["CapacityRebalance"] },
+				...properties["ServiceLinkedRoleARN"] !== void 0 && { ServiceLinkedRoleARN: properties["ServiceLinkedRoleARN"] },
+				...properties["MaxInstanceLifetime"] != null && { MaxInstanceLifetime: Number(properties["MaxInstanceLifetime"]) },
+				...properties["Context"] !== void 0 && { Context: properties["Context"] },
+				...properties["DesiredCapacityType"] !== void 0 && { DesiredCapacityType: properties["DesiredCapacityType"] },
+				...properties["DefaultInstanceWarmup"] != null && { DefaultInstanceWarmup: Number(properties["DefaultInstanceWarmup"]) },
+				...properties["AvailabilityZoneDistribution"] !== void 0 && { AvailabilityZoneDistribution: properties["AvailabilityZoneDistribution"] },
+				...properties["AvailabilityZoneImpairmentPolicy"] !== void 0 && { AvailabilityZoneImpairmentPolicy: properties["AvailabilityZoneImpairmentPolicy"] },
+				...properties["SkipZonalShiftValidation"] !== void 0 && { SkipZonalShiftValidation: properties["SkipZonalShiftValidation"] },
+				...properties["CapacityReservationSpecification"] !== void 0 && { CapacityReservationSpecification: properties["CapacityReservationSpecification"] },
+				...properties["InstanceMaintenancePolicy"] !== void 0 && { InstanceMaintenancePolicy: properties["InstanceMaintenancePolicy"] },
+				...properties["DeletionProtection"] !== void 0 && { DeletionProtection: properties["DeletionProtection"] }
+			}));
+			this.logger.debug(`Successfully updated AutoScalingGroup ${logicalId}`);
+			const arn = await this.fetchArn(physicalId);
+			const attributes = {};
+			if (arn) attributes["Arn"] = arn;
+			if (launchTemplate?.LaunchTemplateId) attributes["LaunchTemplateID"] = launchTemplate.LaunchTemplateId;
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes
+			};
+		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting AutoScalingGroup ${logicalId}: ${physicalId}`);
+		if (context?.removeProtection === true) {
+			try {
+				await this.getClient().send(new UpdateAutoScalingGroupCommand({
+					AutoScalingGroupName: physicalId,
+					DeletionProtection: "none"
+				}));
+				this.logger.debug(`Disabled DeletionProtection on AutoScalingGroup ${logicalId} before delete`);
+			} catch (flipError) {
+				this.logger.debug(`Could not disable DeletionProtection on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+			}
+			await this.removeInstanceTerminationProtection(physicalId, logicalId);
+		}
+		try {
+			await this.getClient().send(new DeleteAutoScalingGroupCommand({
+				AutoScalingGroupName: physicalId,
+				ForceDelete: context?.removeProtection === true
+			}));
+			this.logger.debug(`Successfully initiated deletion of AutoScalingGroup ${logicalId}`);
+			await this.waitForGroupDeleted(physicalId);
+		} catch (error) {
+			if (this.isNotFoundError(error)) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`AutoScalingGroup ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		const group = await this.describeGroup(physicalId);
+		if (!group) throw new ProvisioningError(`AutoScalingGroup ${physicalId} not found while resolving attribute ${attributeName}`, "AWS::AutoScaling::AutoScalingGroup", physicalId, physicalId);
+		switch (attributeName) {
+			case "Arn":
+			case "AutoScalingGroupARN": return group.AutoScalingGroupARN ?? "";
+			case "LaunchConfigurationName": return group.LaunchConfigurationName ?? "";
+			case "LaunchTemplateID":
+			case "LaunchTemplateId": return group.LaunchTemplate?.LaunchTemplateId ?? "";
+			default: return "";
+		}
+	}
+	/**
+	* Read the AWS-current AutoScalingGroup configuration in CFn-property shape.
+	*
+	* Surfaces the user-controllable subset of `DescribeAutoScalingGroups`,
+	* with always-emit placeholders on user-controllable top-level keys per
+	* the cdkd PR #145 always-emit convention so that v3 `observedProperties`
+	* baseline catches console-side ADDs to fields a clean deploy did not
+	* template (e.g. a console-set `DeletionProtection: 'prevent-force-deletion'`
+	* on a group originally created without it).
+	*
+	* Sub-shapes (LifecycleHookSpecificationList / TrafficSources /
+	* NotificationConfigurations) are surfaced via three parallel Describe
+	* calls fired alongside the primary `DescribeAutoScalingGroups`. Each is
+	* best-effort: a per-call failure (e.g. permissions gap on
+	* `autoscaling:DescribeLifecycleHooks`) is logged at debug and the
+	* matching key falls back to its always-emit `[]` placeholder rather
+	* than aborting the whole drift read.
+	*
+	* `MetricsCollection` is reverse-mapped from `EnabledMetrics` (already
+	* present on the primary `DescribeAutoScalingGroups` response, so no
+	* extra call is needed).
+	*
+	* Returns `undefined` when the group is gone.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const groupPromise = (async () => {
+			try {
+				return await this.describeGroup(physicalId);
+			} catch (err) {
+				if (this.isNotFoundError(err)) return void 0;
+				throw err;
+			}
+		})();
+		const lifecycleHooksPromise = this.getClient().send(new DescribeLifecycleHooksCommand({ AutoScalingGroupName: physicalId })).then((r) => r.LifecycleHooks ?? []).catch((err) => {
+			this.logger.debug(`DescribeLifecycleHooks(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			return [];
+		});
+		const trafficSourcesPromise = this.getClient().send(new DescribeTrafficSourcesCommand({ AutoScalingGroupName: physicalId })).then((r) => r.TrafficSources ?? []).catch((err) => {
+			this.logger.debug(`DescribeTrafficSources(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			return [];
+		});
+		const notificationsPromise = this.getClient().send(new DescribeNotificationConfigurationsCommand({ AutoScalingGroupNames: [physicalId] })).then((r) => r.NotificationConfigurations ?? []).catch((err) => {
+			this.logger.debug(`DescribeNotificationConfigurations(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			return [];
+		});
+		const [group, lifecycleHooks, trafficSources, notifications] = await Promise.all([
+			groupPromise,
+			lifecycleHooksPromise,
+			trafficSourcesPromise,
+			notificationsPromise
+		]);
+		if (!group) return void 0;
+		const result = {};
+		if (group.AutoScalingGroupName !== void 0) result["AutoScalingGroupName"] = group.AutoScalingGroupName;
+		if (group.LaunchTemplate) {
+			const lt = {};
+			if (group.LaunchTemplate.LaunchTemplateId !== void 0) lt["LaunchTemplateId"] = group.LaunchTemplate.LaunchTemplateId;
+			if (group.LaunchTemplate.LaunchTemplateName !== void 0) lt["LaunchTemplateName"] = group.LaunchTemplate.LaunchTemplateName;
+			if (group.LaunchTemplate.Version !== void 0) lt["Version"] = group.LaunchTemplate.Version;
+			result["LaunchTemplate"] = lt;
+		}
+		result["MinSize"] = group.MinSize ?? 0;
+		result["MaxSize"] = group.MaxSize ?? 0;
+		if (group.DesiredCapacity !== void 0) result["DesiredCapacity"] = group.DesiredCapacity;
+		if (group.VPCZoneIdentifier !== void 0 && group.VPCZoneIdentifier !== "") result["VPCZoneIdentifier"] = group.VPCZoneIdentifier.split(",").map((s) => s.trim());
+		else result["VPCZoneIdentifier"] = [];
+		result["AvailabilityZones"] = group.AvailabilityZones ?? [];
+		if (group.HealthCheckType !== void 0) result["HealthCheckType"] = group.HealthCheckType;
+		if (group.HealthCheckGracePeriod !== void 0) result["HealthCheckGracePeriod"] = group.HealthCheckGracePeriod;
+		if (group.DefaultCooldown !== void 0) result["Cooldown"] = group.DefaultCooldown;
+		result["NewInstancesProtectedFromScaleIn"] = group.NewInstancesProtectedFromScaleIn ?? false;
+		result["TerminationPolicies"] = group.TerminationPolicies ?? [];
+		result["CapacityRebalance"] = group.CapacityRebalance ?? false;
+		if (group.ServiceLinkedRoleARN !== void 0) result["ServiceLinkedRoleARN"] = group.ServiceLinkedRoleARN;
+		if (group.MaxInstanceLifetime !== void 0) result["MaxInstanceLifetime"] = group.MaxInstanceLifetime;
+		result["LoadBalancerNames"] = group.LoadBalancerNames ?? [];
+		result["TargetGroupARNs"] = group.TargetGroupARNs ?? [];
+		if (group.Context !== void 0) result["Context"] = group.Context;
+		if (group.DesiredCapacityType !== void 0) result["DesiredCapacityType"] = group.DesiredCapacityType;
+		if (group.DefaultInstanceWarmup !== void 0) result["DefaultInstanceWarmup"] = group.DefaultInstanceWarmup;
+		if (group.MixedInstancesPolicy !== void 0) result["MixedInstancesPolicy"] = group.MixedInstancesPolicy;
+		if (group.AvailabilityZoneDistribution !== void 0) result["AvailabilityZoneDistribution"] = group.AvailabilityZoneDistribution;
+		if (group.AvailabilityZoneImpairmentPolicy !== void 0) result["AvailabilityZoneImpairmentPolicy"] = group.AvailabilityZoneImpairmentPolicy;
+		if (group.CapacityReservationSpecification !== void 0) result["CapacityReservationSpecification"] = group.CapacityReservationSpecification;
+		if (group.InstanceMaintenancePolicy !== void 0) result["InstanceMaintenancePolicy"] = group.InstanceMaintenancePolicy;
+		if (group.DeletionProtection !== void 0) result["DeletionProtection"] = group.DeletionProtection;
+		else result["DeletionProtection"] = "none";
+		result["Tags"] = normalizeAwsTagsToCfn(group.Tags);
+		result["MetricsCollection"] = mapEnabledMetricsToCfn(group.EnabledMetrics);
+		result["LifecycleHookSpecificationList"] = mapLifecycleHooksToCfn(lifecycleHooks);
+		result["TrafficSources"] = mapTrafficSourcesToCfn(trafficSources.filter((t) => {
+			if (t.Identifier === void 0) return false;
+			if (t.Type === "elbv2" || t.Type === "elb") return false;
+			return true;
+		}));
+		result["NotificationConfigurations"] = mapNotificationsToCfn(notifications);
+		return result;
+	}
+	buildLaunchTemplate(properties) {
+		const lt = properties["LaunchTemplate"];
+		if (!lt) return void 0;
+		const out = {};
+		if (lt.LaunchTemplateId !== void 0) {
+			out.LaunchTemplateId = lt.LaunchTemplateId;
+			if (lt.LaunchTemplateName !== void 0) this.logger.debug(`buildLaunchTemplate: both LaunchTemplateId (${lt.LaunchTemplateId}) and LaunchTemplateName (${lt.LaunchTemplateName}) templated; dropping Name (#551)`);
+		} else if (lt.LaunchTemplateName !== void 0) out.LaunchTemplateName = lt.LaunchTemplateName;
+		if (lt.Version !== void 0) out.Version = String(lt.Version);
+		if (out.LaunchTemplateId === void 0 && out.LaunchTemplateName === void 0) return;
+		return out;
+	}
+	/**
+	* CFn `Tags` is `[{Key, Value, PropagateAtLaunch?}]`. AWS expects each
+	* tag to also carry `ResourceId: <groupName>` and `ResourceType:
+	* 'auto-scaling-group'`. We tack those on at create time so the SDK
+	* input shape matches without forcing the user to template them.
+	*/
+	buildTags(groupName, properties) {
+		const raw = properties["Tags"];
+		if (!raw) return [];
+		return raw.filter((t) => t.Key !== void 0).map((t) => ({
+			ResourceId: groupName,
+			ResourceType: "auto-scaling-group",
+			Key: t.Key,
+			Value: t.Value ?? "",
+			PropagateAtLaunch: t.PropagateAtLaunch ?? false
+		}));
+	}
+	/**
+	* CFn `VPCZoneIdentifier` is a list of subnet ids; the AWS SDK input
+	* field is a comma-joined string.
+	*/
+	joinVpcZoneIdentifier(value) {
+		if (value === void 0 || value === null) return void 0;
+		if (Array.isArray(value)) {
+			const cleaned = value.map((v) => String(v).trim()).filter((v) => v.length > 0);
+			if (cleaned.length === 0) return void 0;
+			return cleaned.join(",");
+		}
+		if (typeof value === "string") return value;
+	}
+	async describeGroup(groupName) {
+		return (await this.getClient().send(new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [groupName] }))).AutoScalingGroups?.[0];
+	}
+	/**
+	* Flip EC2-level termination protection (`DisableApiTermination`) off on
+	* every instance currently launched by the group, so the subsequent
+	* `DeleteAutoScalingGroup(ForceDelete: true)` can actually terminate them
+	* instead of orphaning the protected instances (issue #796). Best-effort:
+	* a Describe failure or a per-instance flip failure is logged at debug and
+	* does not block the delete (the modify WRITE lags the terminate READ, so
+	* the shared helper swallows propagation errors the same way the EC2 path
+	* does — the orphan, if any, surfaces as a leftover instance the caller
+	* can clean up rather than a hard delete failure).
+	*/
+	async removeInstanceTerminationProtection(groupName, logicalId) {
+		let instanceIds;
+		try {
+			instanceIds = ((await this.describeGroup(groupName))?.Instances ?? []).map((i) => i.InstanceId).filter((id) => typeof id === "string" && id.length > 0);
+		} catch (describeError) {
+			this.logger.debug(`Could not enumerate instances of AutoScalingGroup ${logicalId} for termination-protection removal: ${describeError instanceof Error ? describeError.message : String(describeError)}`);
+			return;
+		}
+		if (instanceIds.length === 0) return;
+		this.logger.debug(`Disabling EC2 termination protection on ${instanceIds.length} instance(s) of AutoScalingGroup ${logicalId} before force delete`);
+		for (const instanceId of instanceIds) await disableInstanceApiTermination(this.getEc2Client(), instanceId, this.logger);
+	}
+	async fetchArn(groupName) {
+		try {
+			return (await this.describeGroup(groupName))?.AutoScalingGroupARN;
+		} catch (err) {
+			this.logger.debug(`DescribeAutoScalingGroups(${groupName}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+	}
+	isNotFoundError(error) {
+		if (!(error instanceof Error)) return false;
+		const name = error.name ?? "";
+		const message = error.message.toLowerCase();
+		return name === "ValidationError" && (message.includes("autoscalinggroup name not found") || message.includes("not found") || message.includes("does not exist"));
+	}
+	async waitForGroupDeleted(groupName, maxWaitMs = 9e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			try {
+				if (!await this.describeGroup(groupName)) return;
+			} catch (error) {
+				if (this.isNotFoundError(error)) return;
+				throw error;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 3e4);
+		}
+		throw new Error(`Timed out waiting for AutoScalingGroup ${groupName} to be deleted (15 minute cap)`);
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	/**
+	* Diff and apply changes to the ASG's `Tags` property via the
+	* `CreateOrUpdateTags` / `DeleteTags` AWS APIs (#475). CFn Tags shape is
+	* `[{Key, Value, PropagateAtLaunch}]`; AWS Tag input adds `ResourceId`
+	* (= the ASG name) and `ResourceType: 'auto-scaling-group'`.
+	*
+	* Diff semantics:
+	*   - Removed keys → `DeleteTags`.
+	*   - Added keys → `CreateOrUpdateTags`.
+	*   - Modified value or `PropagateAtLaunch` flag → `CreateOrUpdateTags`
+	*     (the AWS API upserts by `(ResourceId, ResourceType, Key)` tuple, so
+	*     a single upsert call replaces the old value).
+	*
+	* No-op when before/after JSON is identical.
+	*/
+	async applyTagsDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextEntries = Array.isArray(next) ? next : [];
+		const prevEntries = Array.isArray(prev) ? prev : [];
+		const nextByKey = /* @__PURE__ */ new Map();
+		for (const t of nextEntries) if (t.Key) nextByKey.set(t.Key, t);
+		const prevByKey = /* @__PURE__ */ new Map();
+		for (const t of prevEntries) if (t.Key) prevByKey.set(t.Key, t);
+		const toDelete = [];
+		for (const [key, tag] of prevByKey) if (!nextByKey.has(key)) toDelete.push(tag);
+		if (toDelete.length > 0) await this.getClient().send(new DeleteTagsCommand$1({ Tags: toDelete.map((t) => ({
+			ResourceId: physicalId,
+			ResourceType: "auto-scaling-group",
+			Key: t.Key
+		})) }));
+		const toUpsert = [];
+		for (const [key, tag] of nextByKey) {
+			const before = prevByKey.get(key);
+			if (JSON.stringify(before) === JSON.stringify(tag)) continue;
+			toUpsert.push(tag);
+		}
+		if (toUpsert.length > 0) await this.getClient().send(new CreateOrUpdateTagsCommand({ Tags: toUpsert.map((t) => ({
+			ResourceId: physicalId,
+			ResourceType: "auto-scaling-group",
+			Key: t.Key,
+			...t.Value !== void 0 && { Value: t.Value },
+			...t.PropagateAtLaunch !== void 0 && { PropagateAtLaunch: t.PropagateAtLaunch }
+		})) }));
+	}
+	/**
+	* Diff `LoadBalancerNames` (Classic Load Balancers) and issue
+	* `AttachLoadBalancers` / `DetachLoadBalancers` for the delta (#476).
+	* Names are opaque strings; AWS allows N attached LBs per ASG so this
+	* helper batches every add into one Attach call and every remove into
+	* one Detach call. No-op when before/after JSON is identical.
+	*/
+	async applyLoadBalancerNamesDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextNames = (Array.isArray(next) ? next : []).filter((n) => typeof n === "string");
+		const prevNames = (Array.isArray(prev) ? prev : []).filter((n) => typeof n === "string");
+		const nextSet = new Set(nextNames);
+		const prevSet = new Set(prevNames);
+		const toAttach = nextNames.filter((n) => !prevSet.has(n));
+		const toDetach = prevNames.filter((n) => !nextSet.has(n));
+		if (toDetach.length > 0) await this.getClient().send(new DetachLoadBalancersCommand({
+			AutoScalingGroupName: physicalId,
+			LoadBalancerNames: toDetach
+		}));
+		if (toAttach.length > 0) await this.getClient().send(new AttachLoadBalancersCommand({
+			AutoScalingGroupName: physicalId,
+			LoadBalancerNames: toAttach
+		}));
+	}
+	/**
+	* Diff `TargetGroupARNs` (ALB / NLB target groups) and issue
+	* `AttachLoadBalancerTargetGroups` /
+	* `DetachLoadBalancerTargetGroups` for the delta (#476). Target-group
+	* ARNs are opaque strings; same per-call batching pattern as
+	* `applyLoadBalancerNamesDiff`. No-op when before/after JSON is
+	* identical.
+	*/
+	async applyTargetGroupArnsDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextArns = (Array.isArray(next) ? next : []).filter((a) => typeof a === "string");
+		const prevArns = (Array.isArray(prev) ? prev : []).filter((a) => typeof a === "string");
+		const nextSet = new Set(nextArns);
+		const prevSet = new Set(prevArns);
+		const toAttach = nextArns.filter((a) => !prevSet.has(a));
+		const toDetach = prevArns.filter((a) => !nextSet.has(a));
+		if (toDetach.length > 0) await this.getClient().send(new DetachLoadBalancerTargetGroupsCommand({
+			AutoScalingGroupName: physicalId,
+			TargetGroupARNs: toDetach
+		}));
+		if (toAttach.length > 0) await this.getClient().send(new AttachLoadBalancerTargetGroupsCommand({
+			AutoScalingGroupName: physicalId,
+			TargetGroupARNs: toAttach
+		}));
+		if (toDetach.length > 0 || toAttach.length > 0) await this.waitForTargetGroupArnsConvergence(physicalId, new Set(nextArns));
+	}
+	static TG_CONVERGENCE_TIMEOUT_MS = 3e4;
+	static TG_CONVERGENCE_POLL_INTERVAL_MS = 1e3;
+	async waitForTargetGroupArnsConvergence(physicalId, expected) {
+		const deadlineMs = Date.now() + ASGProvider.TG_CONVERGENCE_TIMEOUT_MS;
+		let lastObserved = /* @__PURE__ */ new Set();
+		while (Date.now() < deadlineMs) {
+			let resp;
+			try {
+				resp = await this.getClient().send(new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [physicalId] }));
+			} catch (err) {
+				this.logger.debug(`applyTargetGroupArnsDiff convergence poll: transient error, retrying — ${err instanceof Error ? err.message : String(err)}`);
+				await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));
+				continue;
+			}
+			lastObserved = new Set(resp.AutoScalingGroups?.[0]?.TargetGroupARNs ?? []);
+			if (lastObserved.size === expected.size && [...expected].every((a) => lastObserved.has(a))) return;
+			await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));
+		}
+		const expectedSorted = [...expected].sort();
+		const observedSorted = [...lastObserved].sort();
+		this.logger.warn(`applyTargetGroupArnsDiff: TG set did not converge within ${ASGProvider.TG_CONVERGENCE_TIMEOUT_MS}ms for ASG ${physicalId}. expected=${JSON.stringify(expectedSorted)} observed=${JSON.stringify(observedSorted)}`);
+	}
+	async applyMetricsCollectionDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextEntries = Array.isArray(next) ? next : [];
+		const prevEntries = Array.isArray(prev) ? prev : [];
+		const prevByGranularity = /* @__PURE__ */ new Map();
+		for (const e of prevEntries) if (e.Granularity) prevByGranularity.set(e.Granularity, e.Metrics);
+		const nextByGranularity = /* @__PURE__ */ new Map();
+		for (const e of nextEntries) if (e.Granularity) nextByGranularity.set(e.Granularity, e.Metrics);
+		for (const [granularity, metrics] of prevByGranularity) if (!nextByGranularity.has(granularity)) await this.getClient().send(new DisableMetricsCollectionCommand({
+			AutoScalingGroupName: physicalId,
+			...metrics && metrics.length > 0 ? { Metrics: metrics } : {}
+		}));
+		for (const [granularity, metrics] of nextByGranularity) {
+			const before = prevByGranularity.get(granularity);
+			if (JSON.stringify(before ?? null) === JSON.stringify(metrics ?? null)) continue;
+			if (before && before.length > 0) {
+				const removed = metrics ? before.filter((m) => !metrics.includes(m)) : [];
+				if (removed.length > 0) await this.getClient().send(new DisableMetricsCollectionCommand({
+					AutoScalingGroupName: physicalId,
+					Metrics: removed
+				}));
+			}
+			await this.getClient().send(new EnableMetricsCollectionCommand({
+				AutoScalingGroupName: physicalId,
+				Granularity: granularity,
+				...metrics && metrics.length > 0 ? { Metrics: metrics } : {}
+			}));
+		}
+	}
+	async applyLifecycleHooksDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextEntries = Array.isArray(next) ? next : [];
+		const prevEntries = Array.isArray(prev) ? prev : [];
+		const nextNames = new Set(nextEntries.map((e) => e.LifecycleHookName).filter((n) => !!n));
+		for (const e of prevEntries) if (e.LifecycleHookName && !nextNames.has(e.LifecycleHookName)) await this.getClient().send(new DeleteLifecycleHookCommand({
+			AutoScalingGroupName: physicalId,
+			LifecycleHookName: e.LifecycleHookName
+		}));
+		const prevByName = /* @__PURE__ */ new Map();
+		for (const e of prevEntries) if (e.LifecycleHookName) prevByName.set(e.LifecycleHookName, e);
+		for (const e of nextEntries) {
+			if (!e.LifecycleHookName) continue;
+			const prevHook = prevByName.get(e.LifecycleHookName);
+			if (JSON.stringify(prevHook) === JSON.stringify(e)) continue;
+			await this.getClient().send(new PutLifecycleHookCommand({
+				AutoScalingGroupName: physicalId,
+				LifecycleHookName: e.LifecycleHookName,
+				...e.LifecycleTransition !== void 0 && { LifecycleTransition: e.LifecycleTransition },
+				...e.RoleARN !== void 0 && { RoleARN: e.RoleARN },
+				...e.NotificationTargetARN !== void 0 && { NotificationTargetARN: e.NotificationTargetARN },
+				...e.NotificationMetadata !== void 0 && { NotificationMetadata: e.NotificationMetadata },
+				...e.HeartbeatTimeout !== void 0 && { HeartbeatTimeout: e.HeartbeatTimeout },
+				...e.DefaultResult !== void 0 && { DefaultResult: e.DefaultResult }
+			}));
+		}
+	}
+	async applyTrafficSourcesDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextEntries = Array.isArray(next) ? next : [];
+		const prevEntries = Array.isArray(prev) ? prev : [];
+		const nextIds = new Set(nextEntries.map((e) => e.Identifier).filter((i) => !!i));
+		const prevIds = new Set(prevEntries.map((e) => e.Identifier).filter((i) => !!i));
+		const toDetach = prevEntries.filter((e) => e.Identifier && !nextIds.has(e.Identifier));
+		const toAttach = nextEntries.filter((e) => e.Identifier && !prevIds.has(e.Identifier));
+		if (toDetach.length > 0) await this.getClient().send(new DetachTrafficSourcesCommand({
+			AutoScalingGroupName: physicalId,
+			TrafficSources: toDetach.map((e) => ({
+				Identifier: e.Identifier,
+				...e.Type !== void 0 && { Type: e.Type }
+			}))
+		}));
+		if (toAttach.length > 0) await this.getClient().send(new AttachTrafficSourcesCommand({
+			AutoScalingGroupName: physicalId,
+			TrafficSources: toAttach.map((e) => ({
+				Identifier: e.Identifier,
+				...e.Type !== void 0 && { Type: e.Type }
+			}))
+		}));
+	}
+	async applyNotificationConfigurationsDiff(physicalId, next, prev) {
+		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
+		const nextEntries = Array.isArray(next) ? next : [];
+		const prevEntries = Array.isArray(prev) ? prev : [];
+		const nextByTopic = /* @__PURE__ */ new Map();
+		for (const e of nextEntries) if (e.TopicARN) nextByTopic.set(e.TopicARN, e.NotificationTypes);
+		const prevByTopic = /* @__PURE__ */ new Map();
+		for (const e of prevEntries) if (e.TopicARN) prevByTopic.set(e.TopicARN, e.NotificationTypes);
+		for (const topic of prevByTopic.keys()) if (!nextByTopic.has(topic)) await this.getClient().send(new DeleteNotificationConfigurationCommand({
+			AutoScalingGroupName: physicalId,
+			TopicARN: topic
+		}));
+		for (const [topic, types] of nextByTopic) {
+			const before = prevByTopic.get(topic);
+			if (JSON.stringify(before ?? null) === JSON.stringify(types ?? null)) continue;
+			await this.getClient().send(new PutNotificationConfigurationCommand({
+				AutoScalingGroupName: physicalId,
+				TopicARN: topic,
+				NotificationTypes: types ?? []
+			}));
+		}
+	}
+};
+/**
+* Reverse-map AWS `EnabledMetrics: [{Metric, Granularity}]` (flat list,
+* one row per enabled metric) back to the CFn array shape
+* `[{Granularity, Metrics?[]}]`. Metrics with the same Granularity are
+* grouped together; the resulting Metrics list is sorted alphabetically
+* for stable positional compare in the drift comparator.
+*
+* Always returns a placeholder `[]` per the cdkd PR #145 always-emit
+* convention so a console-side EnableMetricsCollection on a previously-
+* empty group surfaces as drift on the v3 `observedProperties` baseline.
+*/
+function mapEnabledMetricsToCfn(enabledMetrics) {
+	if (!enabledMetrics || enabledMetrics.length === 0) return [];
+	const byGranularity = /* @__PURE__ */ new Map();
+	for (const e of enabledMetrics) {
+		const g = e.Granularity;
+		if (!g) continue;
+		let set = byGranularity.get(g);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			byGranularity.set(g, set);
+		}
+		if (e.Metric) set.add(e.Metric);
+	}
+	const result = [];
+	for (const granularity of Array.from(byGranularity.keys()).sort()) {
+		const metrics = Array.from(byGranularity.get(granularity) ?? []).sort();
+		result.push(metrics.length > 0 ? {
+			Granularity: granularity,
+			Metrics: metrics
+		} : { Granularity: granularity });
+	}
+	return result;
+}
+/**
+* Reverse-map AWS `DescribeLifecycleHooks` response to the CFn
+* `LifecycleHookSpecificationList` shape. Each hook is surfaced under the
+* exact CFn property name. AWS-side fields cdkd state never carried
+* (`AutoScalingGroupName` — duplicated on every hook by AWS,
+* `GlobalTimeout` — AWS-derived) are filtered out. Sorted by
+* LifecycleHookName for stable positional compare.
+*/
+function mapLifecycleHooksToCfn(hooks) {
+	if (!hooks || hooks.length === 0) return [];
+	const result = [];
+	for (const h of hooks) {
+		if (!h.LifecycleHookName) continue;
+		const entry = { LifecycleHookName: h.LifecycleHookName };
+		if (h.LifecycleTransition !== void 0) entry["LifecycleTransition"] = h.LifecycleTransition;
+		if (h.RoleARN !== void 0) entry["RoleARN"] = h.RoleARN;
+		if (h.NotificationTargetARN !== void 0) entry["NotificationTargetARN"] = h.NotificationTargetARN;
+		if (h.NotificationMetadata !== void 0) entry["NotificationMetadata"] = h.NotificationMetadata;
+		if (h.HeartbeatTimeout !== void 0) entry["HeartbeatTimeout"] = h.HeartbeatTimeout;
+		if (h.DefaultResult !== void 0) entry["DefaultResult"] = h.DefaultResult;
+		result.push(entry);
+	}
+	result.sort((a, b) => String(a["LifecycleHookName"]).localeCompare(String(b["LifecycleHookName"])));
+	return result;
+}
+/**
+* Reverse-map AWS `DescribeTrafficSources` response to the CFn
+* `TrafficSources` shape `[{Identifier, Type?}]`. AWS-side runtime fields
+* (`State`, the deprecated `TrafficSource` alias) are filtered out.
+* Sorted by Identifier for stable positional compare.
+*/
+function mapTrafficSourcesToCfn(trafficSources) {
+	if (!trafficSources || trafficSources.length === 0) return [];
+	const result = [];
+	for (const t of trafficSources) {
+		if (!t.Identifier) continue;
+		const entry = { Identifier: t.Identifier };
+		if (t.Type !== void 0) entry["Type"] = t.Type;
+		result.push(entry);
+	}
+	result.sort((a, b) => String(a["Identifier"]).localeCompare(String(b["Identifier"])));
+	return result;
+}
+/**
+* Reverse-map AWS `DescribeNotificationConfigurations` (a flat list, one
+* row per `(topicArn, notificationType)`) into the CFn shape
+* `[{TopicARN, NotificationTypes[]}]`. NotificationTypes are grouped per
+* TopicARN and sorted alphabetically for stable positional compare.
+*/
+function mapNotificationsToCfn(configurations) {
+	if (!configurations || configurations.length === 0) return [];
+	const byTopic = /* @__PURE__ */ new Map();
+	for (const c of configurations) {
+		if (!c.TopicARN) continue;
+		let set = byTopic.get(c.TopicARN);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			byTopic.set(c.TopicARN, set);
+		}
+		if (c.NotificationType) set.add(c.NotificationType);
+	}
+	const result = [];
+	for (const topic of Array.from(byTopic.keys()).sort()) {
+		const types = Array.from(byTopic.get(topic) ?? []).sort();
+		result.push({
+			TopicARN: topic,
+			NotificationTypes: types
+		});
+	}
+	return result;
+}
+
+//#endregion
+export { asg_provider_exports as n, ASGProvider as t };
+//# sourceMappingURL=asg-provider-B_hrCxRx.js.map