@go-to-k/cdkd 0.219.2 → 0.219.3

package/dist/cli.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
-import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-DWUnLza1.js";
-import { $ as CFN_TEMPLATE_URL_LIMIT, A as DagBuilder, B as getDockerCmd, C as CloudControlProvider, D as IntrinsicFunctionResolver, Dt as withErrorHandling, E as isTerminationProtectionPropagationError, Et as normalizeAwsError, F as AssetPublisher, Ft as generateResourceName, G as getLegacyStateBucketName, H as runDockerStreaming, I as stringifyValue, It as generateResourceNameWithFallback, J as resolveSkipPrefix, K as resolveApp, L as WorkGraph, Lt as withSkipPrefix, M as LockManager, Mt as getLiveRenderer, N as S3StateBackend, Nt as PATTERN_B_NAME_PROPERTIES, O as applyRoleArnIfSet, P as shouldRetainResource, Pt as PATTERN_B_RESOURCE_TYPES, Q as CFN_TEMPLATE_BODY_LIMIT, R as buildDockerImage, Rt as withStackName, S as findActionableSilentDrops, T as disableInstanceApiTermination, U as Synthesizer, V as runDockerForeground, W as getDefaultStateBucketName, X as resolveStateBucketWithDefaultAndSource, Y as resolveStateBucketWithDefault, Z as warnDeprecatedNoPrefixCliFlag, _ as CDK_PATH_TAG, _t as ProvisioningError, a as withRetry, at as resolveBucketRegion, b as resolveExplicitPhysicalId, bt as StackHasActiveImportsError, c as formatResourceLine, d as gray, dt as LocalMigrateError, et as MIGRATE_TMP_PREFIX, f as green, ft as LocalStartServiceError, g as collectInlinePolicyNamesManagedBySiblings, gt as PartialFailureError, h as IAMRoleProvider, ht as NestedStackChildDirectDestroyError, i as withResourceDeadline, j as TemplateParser, jt as runStackBuffered, k as DiffCalculator, kt as getLogger, l as bold, m as yellow, mt as MissingCdkCliError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as uploadCfnTemplate, o as isRetryableTransientError, p as red, q as resolveCaptureObservedState, r as DeployEngine, rt as AssemblyReader, s as IMPLICIT_DELETE_DEPENDENCIES, st as CdkdError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as findLargeInlineResources, u as cyan, ut as LocalInvokeBuildError$1, v as matchesCdkPath, vt as ResourceTimeoutError, w as assertRegionMatch, x as ProviderRegistry, xt as StackTerminationProtectionError, y as normalizeAwsTagsToCfn, yt as ResourceUpdateNotSupportedError, z as formatDockerLoginError } from "./deploy-engine-B6CuzOHi.js";
+import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
+import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
+import { A as WorkGraph, B as resolveCaptureObservedState, C as DagBuilder, D as shouldRetainResource, E as S3StateBackend, F as runDockerStreaming, G as CFN_TEMPLATE_BODY_LIMIT, H as resolveStateBucketWithDefault, I as Synthesizer, J as findLargeInlineResources, K as CFN_TEMPLATE_URL_LIMIT, L as getDefaultStateBucketName, M as formatDockerLoginError, N as getDockerCmd, O as AssetPublisher, P as runDockerForeground, Q as resolveBucketRegion, R as getLegacyStateBucketName, S as DiffCalculator, T as LockManager, U as resolveStateBucketWithDefaultAndSource, V as resolveSkipPrefix, W as warnDeprecatedNoPrefixCliFlag, X as AssemblyReader, Y as uploadCfnTemplate, _ as ProviderRegistry, a as withRetry, b as IntrinsicFunctionResolver, c as formatResourceLine, d as gray, f as green, g as collectInlinePolicyNamesManagedBySiblings, h as IAMRoleProvider, i as withResourceDeadline, j as buildDockerImage, k as stringifyValue, l as bold, m as yellow, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as red, q as MIGRATE_TMP_PREFIX, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as cyan, v as findActionableSilentDrops, w as TemplateParser, x as applyRoleArnIfSet, y as CloudControlProvider, z as resolveApp } from "./deploy-engine-Drw_e42s.js";
+import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -59,7 +61,6 @@ import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailComman
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$10, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3tables";
-import { AttachLoadBalancerTargetGroupsCommand, AttachLoadBalancersCommand, AttachTrafficSourcesCommand, AutoScalingClient, CreateAutoScalingGroupCommand, CreateOrUpdateTagsCommand, DeleteAutoScalingGroupCommand, DeleteLifecycleHookCommand, DeleteNotificationConfigurationCommand, DeleteTagsCommand as DeleteTagsCommand$1, DescribeAutoScalingGroupsCommand, DescribeLifecycleHooksCommand, DescribeNotificationConfigurationsCommand, DescribeTrafficSourcesCommand, DetachLoadBalancerTargetGroupsCommand, DetachLoadBalancersCommand, DetachTrafficSourcesCommand, DisableMetricsCollectionCommand, EnableMetricsCollectionCommand, PutLifecycleHookCommand, PutNotificationConfigurationCommand, UpdateAutoScalingGroupCommand } from "@aws-sdk/client-auto-scaling";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -33664,788 +33665,6 @@ var ECRProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/asg-provider.ts
-/**
-* AWS Auto Scaling Provider
-*
-* Implements resource provisioning for `AWS::AutoScaling::AutoScalingGroup`.
-*
-* WHY a dedicated SDK provider (instead of CC API fallback):
-*   1. Owns the `--remove-protection` flip-off: ASG protection has three
-*      levels (`none` / `prevent-force-deletion` / `prevent-all-deletion`)
-*      and the destroy path needs to (a) clear it via `UpdateAutoScalingGroup
-*      ({DeletionProtection: 'none'})` before the actual delete and (b) set
-*      `ForceDelete: true` on `DeleteAutoScalingGroup` so AWS terminates any
-*      running instances as part of the delete (matches the user's "I know
-*      what I'm doing" intent).
-*   2. Faster than CC API for the common case — direct Create/Update calls
-*      with no eventual-consistency polling beyond what `DescribeAutoScaling
-*      Groups` already provides.
-*
-* Update has narrower coverage than create: AWS does not support modifying
-* `AutoScalingGroupName` (immutable) — that diff still surfaces
-* `ResourceUpdateNotSupportedError` so the caller can `cdkd deploy
-* --replace`. The mutable fields handled in-place via
-* `UpdateAutoScalingGroup` include MinSize / MaxSize / DesiredCapacity /
-* VPCZoneIdentifier / HealthCheckType / HealthCheckGracePeriod /
-* DefaultCooldown / Cooldown / NewInstancesProtectedFromScaleIn /
-* MaxInstanceLifetime / TerminationPolicies / CapacityRebalance /
-* ServiceLinkedRoleARN / Context / DesiredCapacityType /
-* DefaultInstanceWarmup / AvailabilityZones / AvailabilityZoneDistribution
-* / AvailabilityZoneImpairmentPolicy / SkipZonalShiftValidation /
-* CapacityReservationSpecification / InstanceMaintenancePolicy /
-* DeletionProtection / MixedInstancesPolicy / LaunchTemplate.
-*
-* Sub-shape diffs are applied via dedicated AWS APIs before the main
-* `UpdateAutoScalingGroup` call:
-*   - `Tags` → `CreateOrUpdateTags` / `DeleteTags` (#475)
-*   - `LoadBalancerNames` → `AttachLoadBalancers` /
-*     `DetachLoadBalancers` (#476)
-*   - `TargetGroupARNs` → `AttachLoadBalancerTargetGroups` /
-*     `DetachLoadBalancerTargetGroups` (#476)
-*   - `MetricsCollection` → `EnableMetricsCollection` /
-*     `DisableMetricsCollection`
-*   - `LifecycleHookSpecificationList` → per-entry `PutLifecycleHook` /
-*     `DeleteLifecycleHook`
-*   - `TrafficSources` → `AttachTrafficSources` /
-*     `DetachTrafficSources`
-*   - `NotificationConfigurations` → per-topic
-*     `PutNotificationConfiguration` /
-*     `DeleteNotificationConfiguration`
-*
-* Each helper is a no-op when the before/after JSON is identical.
-*/
-var ASGProvider = class ASGProvider {
-	asgClient;
-	ec2Client;
-	providerRegion = process.env["AWS_REGION"];
-	logger = getLogger().child("ASGProvider");
-	handledProperties = new Map([["AWS::AutoScaling::AutoScalingGroup", new Set([
-		"AutoScalingGroupName",
-		"LaunchTemplate",
-		"MinSize",
-		"MaxSize",
-		"DesiredCapacity",
-		"VPCZoneIdentifier",
-		"AvailabilityZones",
-		"HealthCheckType",
-		"HealthCheckGracePeriod",
-		"Cooldown",
-		"DefaultCooldown",
-		"Tags",
-		"TerminationPolicies",
-		"NewInstancesProtectedFromScaleIn",
-		"CapacityRebalance",
-		"ServiceLinkedRoleARN",
-		"MaxInstanceLifetime",
-		"LoadBalancerNames",
-		"TargetGroupARNs",
-		"MetricsCollection",
-		"LifecycleHookSpecificationList",
-		"MixedInstancesPolicy",
-		"Context",
-		"DesiredCapacityType",
-		"DefaultInstanceWarmup",
-		"TrafficSources",
-		"NotificationConfigurations",
-		"AvailabilityZoneDistribution",
-		"AvailabilityZoneImpairmentPolicy",
-		"SkipZonalShiftValidation",
-		"CapacityReservationSpecification",
-		"InstanceMaintenancePolicy",
-		"DeletionProtection"
-	])]]);
-	unhandledByDesign = new Map([["AWS::AutoScaling::AutoScalingGroup", new Map([["LaunchConfigurationName", "AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead"], ["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"]])]]);
-	getClient() {
-		if (!this.asgClient) this.asgClient = new AutoScalingClient(this.providerRegion ? { region: this.providerRegion } : {});
-		return this.asgClient;
-	}
-	getEc2Client() {
-		if (!this.ec2Client) this.ec2Client = new EC2Client(this.providerRegion ? { region: this.providerRegion } : {});
-		return this.ec2Client;
-	}
-	async create(logicalId, resourceType, properties) {
-		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
-		const groupName = properties["AutoScalingGroupName"] || generateResourceName(logicalId, { maxLength: 255 });
-		this.logger.debug(`Creating AutoScalingGroup ${logicalId}: ${groupName}`);
-		try {
-			const launchTemplate = this.buildLaunchTemplate(properties);
-			const tags = this.buildTags(groupName, properties);
-			const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties["VPCZoneIdentifier"]);
-			const minSize = properties["MinSize"] != null ? Number(properties["MinSize"]) : 0;
-			const maxSize = properties["MaxSize"] != null ? Number(properties["MaxSize"]) : minSize;
-			await this.getClient().send(new CreateAutoScalingGroupCommand({
-				AutoScalingGroupName: groupName,
-				MinSize: minSize,
-				MaxSize: maxSize,
-				...properties["DesiredCapacity"] != null && { DesiredCapacity: Number(properties["DesiredCapacity"]) },
-				...launchTemplate && { LaunchTemplate: launchTemplate },
-				...properties["MixedInstancesPolicy"] !== void 0 && { MixedInstancesPolicy: properties["MixedInstancesPolicy"] },
-				...vpcZoneIdentifier !== void 0 && { VPCZoneIdentifier: vpcZoneIdentifier },
-				...properties["AvailabilityZones"] !== void 0 && { AvailabilityZones: properties["AvailabilityZones"] },
-				...properties["HealthCheckType"] !== void 0 && { HealthCheckType: properties["HealthCheckType"] },
-				...properties["HealthCheckGracePeriod"] != null && { HealthCheckGracePeriod: Number(properties["HealthCheckGracePeriod"]) },
-				...properties["Cooldown"] != null && { DefaultCooldown: Number(properties["Cooldown"]) },
-				...properties["DefaultCooldown"] != null && { DefaultCooldown: Number(properties["DefaultCooldown"]) },
-				...properties["TerminationPolicies"] !== void 0 && { TerminationPolicies: properties["TerminationPolicies"] },
-				...properties["NewInstancesProtectedFromScaleIn"] !== void 0 && { NewInstancesProtectedFromScaleIn: properties["NewInstancesProtectedFromScaleIn"] },
-				...properties["CapacityRebalance"] !== void 0 && { CapacityRebalance: properties["CapacityRebalance"] },
-				...properties["ServiceLinkedRoleARN"] !== void 0 && { ServiceLinkedRoleARN: properties["ServiceLinkedRoleARN"] },
-				...properties["MaxInstanceLifetime"] != null && { MaxInstanceLifetime: Number(properties["MaxInstanceLifetime"]) },
-				...properties["LoadBalancerNames"] !== void 0 && { LoadBalancerNames: properties["LoadBalancerNames"] },
-				...properties["TargetGroupARNs"] !== void 0 && { TargetGroupARNs: properties["TargetGroupARNs"] },
-				...properties["Context"] !== void 0 && { Context: properties["Context"] },
-				...properties["DesiredCapacityType"] !== void 0 && { DesiredCapacityType: properties["DesiredCapacityType"] },
-				...properties["DefaultInstanceWarmup"] != null && { DefaultInstanceWarmup: Number(properties["DefaultInstanceWarmup"]) },
-				...properties["LifecycleHookSpecificationList"] !== void 0 && { LifecycleHookSpecificationList: properties["LifecycleHookSpecificationList"] },
-				...properties["TrafficSources"] !== void 0 && { TrafficSources: properties["TrafficSources"] },
-				...properties["AvailabilityZoneDistribution"] !== void 0 && { AvailabilityZoneDistribution: properties["AvailabilityZoneDistribution"] },
-				...properties["AvailabilityZoneImpairmentPolicy"] !== void 0 && { AvailabilityZoneImpairmentPolicy: properties["AvailabilityZoneImpairmentPolicy"] },
-				...properties["SkipZonalShiftValidation"] !== void 0 && { SkipZonalShiftValidation: properties["SkipZonalShiftValidation"] },
-				...properties["CapacityReservationSpecification"] !== void 0 && { CapacityReservationSpecification: properties["CapacityReservationSpecification"] },
-				...properties["InstanceMaintenancePolicy"] !== void 0 && { InstanceMaintenancePolicy: properties["InstanceMaintenancePolicy"] },
-				...properties["DeletionProtection"] !== void 0 && { DeletionProtection: properties["DeletionProtection"] },
-				...tags.length > 0 && { Tags: tags }
-			}));
-			this.logger.debug(`Successfully created AutoScalingGroup ${logicalId}: ${groupName}`);
-			const arn = await this.fetchArn(groupName);
-			const attributes = {};
-			if (arn) attributes["Arn"] = arn;
-			if (launchTemplate?.LaunchTemplateId) attributes["LaunchTemplateID"] = launchTemplate.LaunchTemplateId;
-			return {
-				physicalId: groupName,
-				attributes
-			};
-		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, groupName, cause);
-		}
-	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
-		this.logger.debug(`Updating AutoScalingGroup ${logicalId}: ${physicalId}`);
-		const stringEq = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-		if (!stringEq(properties["AutoScalingGroupName"], previousProperties["AutoScalingGroupName"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. Use cdkd deploy --replace to replace the group.");
-		try {
-			await this.applyTagsDiff(physicalId, properties["Tags"], previousProperties["Tags"]);
-			await this.applyLoadBalancerNamesDiff(physicalId, properties["LoadBalancerNames"], previousProperties["LoadBalancerNames"]);
-			await this.applyTargetGroupArnsDiff(physicalId, properties["TargetGroupARNs"], previousProperties["TargetGroupARNs"]);
-			await this.applyMetricsCollectionDiff(physicalId, properties["MetricsCollection"], previousProperties["MetricsCollection"]);
-			await this.applyLifecycleHooksDiff(physicalId, properties["LifecycleHookSpecificationList"], previousProperties["LifecycleHookSpecificationList"]);
-			await this.applyTrafficSourcesDiff(physicalId, properties["TrafficSources"], previousProperties["TrafficSources"]);
-			await this.applyNotificationConfigurationsDiff(physicalId, properties["NotificationConfigurations"], previousProperties["NotificationConfigurations"]);
-			const launchTemplate = this.buildLaunchTemplate(properties);
-			const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties["VPCZoneIdentifier"]);
-			await this.getClient().send(new UpdateAutoScalingGroupCommand({
-				AutoScalingGroupName: physicalId,
-				...properties["MinSize"] != null && { MinSize: Number(properties["MinSize"]) },
-				...properties["MaxSize"] != null && { MaxSize: Number(properties["MaxSize"]) },
-				...properties["DesiredCapacity"] != null && { DesiredCapacity: Number(properties["DesiredCapacity"]) },
-				...launchTemplate && { LaunchTemplate: launchTemplate },
-				...properties["MixedInstancesPolicy"] !== void 0 && { MixedInstancesPolicy: properties["MixedInstancesPolicy"] },
-				...vpcZoneIdentifier !== void 0 && { VPCZoneIdentifier: vpcZoneIdentifier },
-				...properties["AvailabilityZones"] !== void 0 && { AvailabilityZones: properties["AvailabilityZones"] },
-				...properties["HealthCheckType"] !== void 0 && { HealthCheckType: properties["HealthCheckType"] },
-				...properties["HealthCheckGracePeriod"] != null && { HealthCheckGracePeriod: Number(properties["HealthCheckGracePeriod"]) },
-				...properties["Cooldown"] != null && { DefaultCooldown: Number(properties["Cooldown"]) },
-				...properties["DefaultCooldown"] != null && { DefaultCooldown: Number(properties["DefaultCooldown"]) },
-				...properties["TerminationPolicies"] !== void 0 && { TerminationPolicies: properties["TerminationPolicies"] },
-				...properties["NewInstancesProtectedFromScaleIn"] !== void 0 && { NewInstancesProtectedFromScaleIn: properties["NewInstancesProtectedFromScaleIn"] },
-				...properties["CapacityRebalance"] !== void 0 && { CapacityRebalance: properties["CapacityRebalance"] },
-				...properties["ServiceLinkedRoleARN"] !== void 0 && { ServiceLinkedRoleARN: properties["ServiceLinkedRoleARN"] },
-				...properties["MaxInstanceLifetime"] != null && { MaxInstanceLifetime: Number(properties["MaxInstanceLifetime"]) },
-				...properties["Context"] !== void 0 && { Context: properties["Context"] },
-				...properties["DesiredCapacityType"] !== void 0 && { DesiredCapacityType: properties["DesiredCapacityType"] },
-				...properties["DefaultInstanceWarmup"] != null && { DefaultInstanceWarmup: Number(properties["DefaultInstanceWarmup"]) },
-				...properties["AvailabilityZoneDistribution"] !== void 0 && { AvailabilityZoneDistribution: properties["AvailabilityZoneDistribution"] },
-				...properties["AvailabilityZoneImpairmentPolicy"] !== void 0 && { AvailabilityZoneImpairmentPolicy: properties["AvailabilityZoneImpairmentPolicy"] },
-				...properties["SkipZonalShiftValidation"] !== void 0 && { SkipZonalShiftValidation: properties["SkipZonalShiftValidation"] },
-				...properties["CapacityReservationSpecification"] !== void 0 && { CapacityReservationSpecification: properties["CapacityReservationSpecification"] },
-				...properties["InstanceMaintenancePolicy"] !== void 0 && { InstanceMaintenancePolicy: properties["InstanceMaintenancePolicy"] },
-				...properties["DeletionProtection"] !== void 0 && { DeletionProtection: properties["DeletionProtection"] }
-			}));
-			this.logger.debug(`Successfully updated AutoScalingGroup ${logicalId}`);
-			const arn = await this.fetchArn(physicalId);
-			const attributes = {};
-			if (arn) attributes["Arn"] = arn;
-			if (launchTemplate?.LaunchTemplateId) attributes["LaunchTemplateID"] = launchTemplate.LaunchTemplateId;
-			return {
-				physicalId,
-				wasReplaced: false,
-				attributes
-			};
-		} catch (error) {
-			if (error instanceof ResourceUpdateNotSupportedError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
-	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting AutoScalingGroup ${logicalId}: ${physicalId}`);
-		if (context?.removeProtection === true) {
-			try {
-				await this.getClient().send(new UpdateAutoScalingGroupCommand({
-					AutoScalingGroupName: physicalId,
-					DeletionProtection: "none"
-				}));
-				this.logger.debug(`Disabled DeletionProtection on AutoScalingGroup ${logicalId} before delete`);
-			} catch (flipError) {
-				this.logger.debug(`Could not disable DeletionProtection on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
-			}
-			await this.removeInstanceTerminationProtection(physicalId, logicalId);
-		}
-		try {
-			await this.getClient().send(new DeleteAutoScalingGroupCommand({
-				AutoScalingGroupName: physicalId,
-				ForceDelete: context?.removeProtection === true
-			}));
-			this.logger.debug(`Successfully initiated deletion of AutoScalingGroup ${logicalId}`);
-			await this.waitForGroupDeleted(physicalId);
-		} catch (error) {
-			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`AutoScalingGroup ${physicalId} does not exist, skipping deletion`);
-				return;
-			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
-	}
-	async getAttribute(physicalId, _resourceType, attributeName) {
-		const group = await this.describeGroup(physicalId);
-		if (!group) throw new ProvisioningError(`AutoScalingGroup ${physicalId} not found while resolving attribute ${attributeName}`, "AWS::AutoScaling::AutoScalingGroup", physicalId, physicalId);
-		switch (attributeName) {
-			case "Arn":
-			case "AutoScalingGroupARN": return group.AutoScalingGroupARN ?? "";
-			case "LaunchConfigurationName": return group.LaunchConfigurationName ?? "";
-			case "LaunchTemplateID":
-			case "LaunchTemplateId": return group.LaunchTemplate?.LaunchTemplateId ?? "";
-			default: return "";
-		}
-	}
-	/**
-	* Read the AWS-current AutoScalingGroup configuration in CFn-property shape.
-	*
-	* Surfaces the user-controllable subset of `DescribeAutoScalingGroups`,
-	* with always-emit placeholders on user-controllable top-level keys per
-	* the cdkd PR #145 always-emit convention so that v3 `observedProperties`
-	* baseline catches console-side ADDs to fields a clean deploy did not
-	* template (e.g. a console-set `DeletionProtection: 'prevent-force-deletion'`
-	* on a group originally created without it).
-	*
-	* Sub-shapes (LifecycleHookSpecificationList / TrafficSources /
-	* NotificationConfigurations) are surfaced via three parallel Describe
-	* calls fired alongside the primary `DescribeAutoScalingGroups`. Each is
-	* best-effort: a per-call failure (e.g. permissions gap on
-	* `autoscaling:DescribeLifecycleHooks`) is logged at debug and the
-	* matching key falls back to its always-emit `[]` placeholder rather
-	* than aborting the whole drift read.
-	*
-	* `MetricsCollection` is reverse-mapped from `EnabledMetrics` (already
-	* present on the primary `DescribeAutoScalingGroups` response, so no
-	* extra call is needed).
-	*
-	* Returns `undefined` when the group is gone.
-	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		const groupPromise = (async () => {
-			try {
-				return await this.describeGroup(physicalId);
-			} catch (err) {
-				if (this.isNotFoundError(err)) return void 0;
-				throw err;
-			}
-		})();
-		const lifecycleHooksPromise = this.getClient().send(new DescribeLifecycleHooksCommand({ AutoScalingGroupName: physicalId })).then((r) => r.LifecycleHooks ?? []).catch((err) => {
-			this.logger.debug(`DescribeLifecycleHooks(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
-			return [];
-		});
-		const trafficSourcesPromise = this.getClient().send(new DescribeTrafficSourcesCommand({ AutoScalingGroupName: physicalId })).then((r) => r.TrafficSources ?? []).catch((err) => {
-			this.logger.debug(`DescribeTrafficSources(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
-			return [];
-		});
-		const notificationsPromise = this.getClient().send(new DescribeNotificationConfigurationsCommand({ AutoScalingGroupNames: [physicalId] })).then((r) => r.NotificationConfigurations ?? []).catch((err) => {
-			this.logger.debug(`DescribeNotificationConfigurations(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
-			return [];
-		});
-		const [group, lifecycleHooks, trafficSources, notifications] = await Promise.all([
-			groupPromise,
-			lifecycleHooksPromise,
-			trafficSourcesPromise,
-			notificationsPromise
-		]);
-		if (!group) return void 0;
-		const result = {};
-		if (group.AutoScalingGroupName !== void 0) result["AutoScalingGroupName"] = group.AutoScalingGroupName;
-		if (group.LaunchTemplate) {
-			const lt = {};
-			if (group.LaunchTemplate.LaunchTemplateId !== void 0) lt["LaunchTemplateId"] = group.LaunchTemplate.LaunchTemplateId;
-			if (group.LaunchTemplate.LaunchTemplateName !== void 0) lt["LaunchTemplateName"] = group.LaunchTemplate.LaunchTemplateName;
-			if (group.LaunchTemplate.Version !== void 0) lt["Version"] = group.LaunchTemplate.Version;
-			result["LaunchTemplate"] = lt;
-		}
-		result["MinSize"] = group.MinSize ?? 0;
-		result["MaxSize"] = group.MaxSize ?? 0;
-		if (group.DesiredCapacity !== void 0) result["DesiredCapacity"] = group.DesiredCapacity;
-		if (group.VPCZoneIdentifier !== void 0 && group.VPCZoneIdentifier !== "") result["VPCZoneIdentifier"] = group.VPCZoneIdentifier.split(",").map((s) => s.trim());
-		else result["VPCZoneIdentifier"] = [];
-		result["AvailabilityZones"] = group.AvailabilityZones ?? [];
-		if (group.HealthCheckType !== void 0) result["HealthCheckType"] = group.HealthCheckType;
-		if (group.HealthCheckGracePeriod !== void 0) result["HealthCheckGracePeriod"] = group.HealthCheckGracePeriod;
-		if (group.DefaultCooldown !== void 0) result["Cooldown"] = group.DefaultCooldown;
-		result["NewInstancesProtectedFromScaleIn"] = group.NewInstancesProtectedFromScaleIn ?? false;
-		result["TerminationPolicies"] = group.TerminationPolicies ?? [];
-		result["CapacityRebalance"] = group.CapacityRebalance ?? false;
-		if (group.ServiceLinkedRoleARN !== void 0) result["ServiceLinkedRoleARN"] = group.ServiceLinkedRoleARN;
-		if (group.MaxInstanceLifetime !== void 0) result["MaxInstanceLifetime"] = group.MaxInstanceLifetime;
-		result["LoadBalancerNames"] = group.LoadBalancerNames ?? [];
-		result["TargetGroupARNs"] = group.TargetGroupARNs ?? [];
-		if (group.Context !== void 0) result["Context"] = group.Context;
-		if (group.DesiredCapacityType !== void 0) result["DesiredCapacityType"] = group.DesiredCapacityType;
-		if (group.DefaultInstanceWarmup !== void 0) result["DefaultInstanceWarmup"] = group.DefaultInstanceWarmup;
-		if (group.MixedInstancesPolicy !== void 0) result["MixedInstancesPolicy"] = group.MixedInstancesPolicy;
-		if (group.AvailabilityZoneDistribution !== void 0) result["AvailabilityZoneDistribution"] = group.AvailabilityZoneDistribution;
-		if (group.AvailabilityZoneImpairmentPolicy !== void 0) result["AvailabilityZoneImpairmentPolicy"] = group.AvailabilityZoneImpairmentPolicy;
-		if (group.CapacityReservationSpecification !== void 0) result["CapacityReservationSpecification"] = group.CapacityReservationSpecification;
-		if (group.InstanceMaintenancePolicy !== void 0) result["InstanceMaintenancePolicy"] = group.InstanceMaintenancePolicy;
-		if (group.DeletionProtection !== void 0) result["DeletionProtection"] = group.DeletionProtection;
-		else result["DeletionProtection"] = "none";
-		result["Tags"] = normalizeAwsTagsToCfn(group.Tags);
-		result["MetricsCollection"] = mapEnabledMetricsToCfn(group.EnabledMetrics);
-		result["LifecycleHookSpecificationList"] = mapLifecycleHooksToCfn(lifecycleHooks);
-		result["TrafficSources"] = mapTrafficSourcesToCfn(trafficSources.filter((t) => {
-			if (t.Identifier === void 0) return false;
-			if (t.Type === "elbv2" || t.Type === "elb") return false;
-			return true;
-		}));
-		result["NotificationConfigurations"] = mapNotificationsToCfn(notifications);
-		return result;
-	}
-	buildLaunchTemplate(properties) {
-		const lt = properties["LaunchTemplate"];
-		if (!lt) return void 0;
-		const out = {};
-		if (lt.LaunchTemplateId !== void 0) {
-			out.LaunchTemplateId = lt.LaunchTemplateId;
-			if (lt.LaunchTemplateName !== void 0) this.logger.debug(`buildLaunchTemplate: both LaunchTemplateId (${lt.LaunchTemplateId}) and LaunchTemplateName (${lt.LaunchTemplateName}) templated; dropping Name (#551)`);
-		} else if (lt.LaunchTemplateName !== void 0) out.LaunchTemplateName = lt.LaunchTemplateName;
-		if (lt.Version !== void 0) out.Version = String(lt.Version);
-		if (out.LaunchTemplateId === void 0 && out.LaunchTemplateName === void 0) return;
-		return out;
-	}
-	/**
-	* CFn `Tags` is `[{Key, Value, PropagateAtLaunch?}]`. AWS expects each
-	* tag to also carry `ResourceId: <groupName>` and `ResourceType:
-	* 'auto-scaling-group'`. We tack those on at create time so the SDK
-	* input shape matches without forcing the user to template them.
-	*/
-	buildTags(groupName, properties) {
-		const raw = properties["Tags"];
-		if (!raw) return [];
-		return raw.filter((t) => t.Key !== void 0).map((t) => ({
-			ResourceId: groupName,
-			ResourceType: "auto-scaling-group",
-			Key: t.Key,
-			Value: t.Value ?? "",
-			PropagateAtLaunch: t.PropagateAtLaunch ?? false
-		}));
-	}
-	/**
-	* CFn `VPCZoneIdentifier` is a list of subnet ids; the AWS SDK input
-	* field is a comma-joined string.
-	*/
-	joinVpcZoneIdentifier(value) {
-		if (value === void 0 || value === null) return void 0;
-		if (Array.isArray(value)) {
-			const cleaned = value.map((v) => String(v).trim()).filter((v) => v.length > 0);
-			if (cleaned.length === 0) return void 0;
-			return cleaned.join(",");
-		}
-		if (typeof value === "string") return value;
-	}
-	async describeGroup(groupName) {
-		return (await this.getClient().send(new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [groupName] }))).AutoScalingGroups?.[0];
-	}
-	/**
-	* Flip EC2-level termination protection (`DisableApiTermination`) off on
-	* every instance currently launched by the group, so the subsequent
-	* `DeleteAutoScalingGroup(ForceDelete: true)` can actually terminate them
-	* instead of orphaning the protected instances (issue #796). Best-effort:
-	* a Describe failure or a per-instance flip failure is logged at debug and
-	* does not block the delete (the modify WRITE lags the terminate READ, so
-	* the shared helper swallows propagation errors the same way the EC2 path
-	* does — the orphan, if any, surfaces as a leftover instance the caller
-	* can clean up rather than a hard delete failure).
-	*/
-	async removeInstanceTerminationProtection(groupName, logicalId) {
-		let instanceIds;
-		try {
-			instanceIds = ((await this.describeGroup(groupName))?.Instances ?? []).map((i) => i.InstanceId).filter((id) => typeof id === "string" && id.length > 0);
-		} catch (describeError) {
-			this.logger.debug(`Could not enumerate instances of AutoScalingGroup ${logicalId} for termination-protection removal: ${describeError instanceof Error ? describeError.message : String(describeError)}`);
-			return;
-		}
-		if (instanceIds.length === 0) return;
-		this.logger.debug(`Disabling EC2 termination protection on ${instanceIds.length} instance(s) of AutoScalingGroup ${logicalId} before force delete`);
-		for (const instanceId of instanceIds) await disableInstanceApiTermination(this.getEc2Client(), instanceId, this.logger);
-	}
-	async fetchArn(groupName) {
-		try {
-			return (await this.describeGroup(groupName))?.AutoScalingGroupARN;
-		} catch (err) {
-			this.logger.debug(`DescribeAutoScalingGroups(${groupName}) failed: ${err instanceof Error ? err.message : String(err)}`);
-			return;
-		}
-	}
-	isNotFoundError(error) {
-		if (!(error instanceof Error)) return false;
-		const name = error.name ?? "";
-		const message = error.message.toLowerCase();
-		return name === "ValidationError" && (message.includes("autoscalinggroup name not found") || message.includes("not found") || message.includes("does not exist"));
-	}
-	async waitForGroupDeleted(groupName, maxWaitMs = 9e5) {
-		const startTime = Date.now();
-		let delay = 5e3;
-		while (Date.now() - startTime < maxWaitMs) {
-			try {
-				if (!await this.describeGroup(groupName)) return;
-			} catch (error) {
-				if (this.isNotFoundError(error)) return;
-				throw error;
-			}
-			await this.sleep(delay);
-			delay = Math.min(delay * 2, 3e4);
-		}
-		throw new Error(`Timed out waiting for AutoScalingGroup ${groupName} to be deleted (15 minute cap)`);
-	}
-	sleep(ms) {
-		return new Promise((resolve) => setTimeout(resolve, ms));
-	}
-	/**
-	* Diff and apply changes to the ASG's `Tags` property via the
-	* `CreateOrUpdateTags` / `DeleteTags` AWS APIs (#475). CFn Tags shape is
-	* `[{Key, Value, PropagateAtLaunch}]`; AWS Tag input adds `ResourceId`
-	* (= the ASG name) and `ResourceType: 'auto-scaling-group'`.
-	*
-	* Diff semantics:
-	*   - Removed keys → `DeleteTags`.
-	*   - Added keys → `CreateOrUpdateTags`.
-	*   - Modified value or `PropagateAtLaunch` flag → `CreateOrUpdateTags`
-	*     (the AWS API upserts by `(ResourceId, ResourceType, Key)` tuple, so
-	*     a single upsert call replaces the old value).
-	*
-	* No-op when before/after JSON is identical.
-	*/
-	async applyTagsDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextEntries = Array.isArray(next) ? next : [];
-		const prevEntries = Array.isArray(prev) ? prev : [];
-		const nextByKey = /* @__PURE__ */ new Map();
-		for (const t of nextEntries) if (t.Key) nextByKey.set(t.Key, t);
-		const prevByKey = /* @__PURE__ */ new Map();
-		for (const t of prevEntries) if (t.Key) prevByKey.set(t.Key, t);
-		const toDelete = [];
-		for (const [key, tag] of prevByKey) if (!nextByKey.has(key)) toDelete.push(tag);
-		if (toDelete.length > 0) await this.getClient().send(new DeleteTagsCommand$1({ Tags: toDelete.map((t) => ({
-			ResourceId: physicalId,
-			ResourceType: "auto-scaling-group",
-			Key: t.Key
-		})) }));
-		const toUpsert = [];
-		for (const [key, tag] of nextByKey) {
-			const before = prevByKey.get(key);
-			if (JSON.stringify(before) === JSON.stringify(tag)) continue;
-			toUpsert.push(tag);
-		}
-		if (toUpsert.length > 0) await this.getClient().send(new CreateOrUpdateTagsCommand({ Tags: toUpsert.map((t) => ({
-			ResourceId: physicalId,
-			ResourceType: "auto-scaling-group",
-			Key: t.Key,
-			...t.Value !== void 0 && { Value: t.Value },
-			...t.PropagateAtLaunch !== void 0 && { PropagateAtLaunch: t.PropagateAtLaunch }
-		})) }));
-	}
-	/**
-	* Diff `LoadBalancerNames` (Classic Load Balancers) and issue
-	* `AttachLoadBalancers` / `DetachLoadBalancers` for the delta (#476).
-	* Names are opaque strings; AWS allows N attached LBs per ASG so this
-	* helper batches every add into one Attach call and every remove into
-	* one Detach call. No-op when before/after JSON is identical.
-	*/
-	async applyLoadBalancerNamesDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextNames = (Array.isArray(next) ? next : []).filter((n) => typeof n === "string");
-		const prevNames = (Array.isArray(prev) ? prev : []).filter((n) => typeof n === "string");
-		const nextSet = new Set(nextNames);
-		const prevSet = new Set(prevNames);
-		const toAttach = nextNames.filter((n) => !prevSet.has(n));
-		const toDetach = prevNames.filter((n) => !nextSet.has(n));
-		if (toDetach.length > 0) await this.getClient().send(new DetachLoadBalancersCommand({
-			AutoScalingGroupName: physicalId,
-			LoadBalancerNames: toDetach
-		}));
-		if (toAttach.length > 0) await this.getClient().send(new AttachLoadBalancersCommand({
-			AutoScalingGroupName: physicalId,
-			LoadBalancerNames: toAttach
-		}));
-	}
-	/**
-	* Diff `TargetGroupARNs` (ALB / NLB target groups) and issue
-	* `AttachLoadBalancerTargetGroups` /
-	* `DetachLoadBalancerTargetGroups` for the delta (#476). Target-group
-	* ARNs are opaque strings; same per-call batching pattern as
-	* `applyLoadBalancerNamesDiff`. No-op when before/after JSON is
-	* identical.
-	*/
-	async applyTargetGroupArnsDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextArns = (Array.isArray(next) ? next : []).filter((a) => typeof a === "string");
-		const prevArns = (Array.isArray(prev) ? prev : []).filter((a) => typeof a === "string");
-		const nextSet = new Set(nextArns);
-		const prevSet = new Set(prevArns);
-		const toAttach = nextArns.filter((a) => !prevSet.has(a));
-		const toDetach = prevArns.filter((a) => !nextSet.has(a));
-		if (toDetach.length > 0) await this.getClient().send(new DetachLoadBalancerTargetGroupsCommand({
-			AutoScalingGroupName: physicalId,
-			TargetGroupARNs: toDetach
-		}));
-		if (toAttach.length > 0) await this.getClient().send(new AttachLoadBalancerTargetGroupsCommand({
-			AutoScalingGroupName: physicalId,
-			TargetGroupARNs: toAttach
-		}));
-		if (toDetach.length > 0 || toAttach.length > 0) await this.waitForTargetGroupArnsConvergence(physicalId, new Set(nextArns));
-	}
-	static TG_CONVERGENCE_TIMEOUT_MS = 3e4;
-	static TG_CONVERGENCE_POLL_INTERVAL_MS = 1e3;
-	async waitForTargetGroupArnsConvergence(physicalId, expected) {
-		const deadlineMs = Date.now() + ASGProvider.TG_CONVERGENCE_TIMEOUT_MS;
-		let lastObserved = /* @__PURE__ */ new Set();
-		while (Date.now() < deadlineMs) {
-			let resp;
-			try {
-				resp = await this.getClient().send(new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [physicalId] }));
-			} catch (err) {
-				this.logger.debug(`applyTargetGroupArnsDiff convergence poll: transient error, retrying — ${err instanceof Error ? err.message : String(err)}`);
-				await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));
-				continue;
-			}
-			lastObserved = new Set(resp.AutoScalingGroups?.[0]?.TargetGroupARNs ?? []);
-			if (lastObserved.size === expected.size && [...expected].every((a) => lastObserved.has(a))) return;
-			await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));
-		}
-		const expectedSorted = [...expected].sort();
-		const observedSorted = [...lastObserved].sort();
-		this.logger.warn(`applyTargetGroupArnsDiff: TG set did not converge within ${ASGProvider.TG_CONVERGENCE_TIMEOUT_MS}ms for ASG ${physicalId}. expected=${JSON.stringify(expectedSorted)} observed=${JSON.stringify(observedSorted)}`);
-	}
-	async applyMetricsCollectionDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextEntries = Array.isArray(next) ? next : [];
-		const prevEntries = Array.isArray(prev) ? prev : [];
-		const prevByGranularity = /* @__PURE__ */ new Map();
-		for (const e of prevEntries) if (e.Granularity) prevByGranularity.set(e.Granularity, e.Metrics);
-		const nextByGranularity = /* @__PURE__ */ new Map();
-		for (const e of nextEntries) if (e.Granularity) nextByGranularity.set(e.Granularity, e.Metrics);
-		for (const [granularity, metrics] of prevByGranularity) if (!nextByGranularity.has(granularity)) await this.getClient().send(new DisableMetricsCollectionCommand({
-			AutoScalingGroupName: physicalId,
-			...metrics && metrics.length > 0 ? { Metrics: metrics } : {}
-		}));
-		for (const [granularity, metrics] of nextByGranularity) {
-			const before = prevByGranularity.get(granularity);
-			if (JSON.stringify(before ?? null) === JSON.stringify(metrics ?? null)) continue;
-			if (before && before.length > 0) {
-				const removed = metrics ? before.filter((m) => !metrics.includes(m)) : [];
-				if (removed.length > 0) await this.getClient().send(new DisableMetricsCollectionCommand({
-					AutoScalingGroupName: physicalId,
-					Metrics: removed
-				}));
-			}
-			await this.getClient().send(new EnableMetricsCollectionCommand({
-				AutoScalingGroupName: physicalId,
-				Granularity: granularity,
-				...metrics && metrics.length > 0 ? { Metrics: metrics } : {}
-			}));
-		}
-	}
-	async applyLifecycleHooksDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextEntries = Array.isArray(next) ? next : [];
-		const prevEntries = Array.isArray(prev) ? prev : [];
-		const nextNames = new Set(nextEntries.map((e) => e.LifecycleHookName).filter((n) => !!n));
-		for (const e of prevEntries) if (e.LifecycleHookName && !nextNames.has(e.LifecycleHookName)) await this.getClient().send(new DeleteLifecycleHookCommand({
-			AutoScalingGroupName: physicalId,
-			LifecycleHookName: e.LifecycleHookName
-		}));
-		const prevByName = /* @__PURE__ */ new Map();
-		for (const e of prevEntries) if (e.LifecycleHookName) prevByName.set(e.LifecycleHookName, e);
-		for (const e of nextEntries) {
-			if (!e.LifecycleHookName) continue;
-			const prevHook = prevByName.get(e.LifecycleHookName);
-			if (JSON.stringify(prevHook) === JSON.stringify(e)) continue;
-			await this.getClient().send(new PutLifecycleHookCommand({
-				AutoScalingGroupName: physicalId,
-				LifecycleHookName: e.LifecycleHookName,
-				...e.LifecycleTransition !== void 0 && { LifecycleTransition: e.LifecycleTransition },
-				...e.RoleARN !== void 0 && { RoleARN: e.RoleARN },
-				...e.NotificationTargetARN !== void 0 && { NotificationTargetARN: e.NotificationTargetARN },
-				...e.NotificationMetadata !== void 0 && { NotificationMetadata: e.NotificationMetadata },
-				...e.HeartbeatTimeout !== void 0 && { HeartbeatTimeout: e.HeartbeatTimeout },
-				...e.DefaultResult !== void 0 && { DefaultResult: e.DefaultResult }
-			}));
-		}
-	}
-	async applyTrafficSourcesDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextEntries = Array.isArray(next) ? next : [];
-		const prevEntries = Array.isArray(prev) ? prev : [];
-		const nextIds = new Set(nextEntries.map((e) => e.Identifier).filter((i) => !!i));
-		const prevIds = new Set(prevEntries.map((e) => e.Identifier).filter((i) => !!i));
-		const toDetach = prevEntries.filter((e) => e.Identifier && !nextIds.has(e.Identifier));
-		const toAttach = nextEntries.filter((e) => e.Identifier && !prevIds.has(e.Identifier));
-		if (toDetach.length > 0) await this.getClient().send(new DetachTrafficSourcesCommand({
-			AutoScalingGroupName: physicalId,
-			TrafficSources: toDetach.map((e) => ({
-				Identifier: e.Identifier,
-				...e.Type !== void 0 && { Type: e.Type }
-			}))
-		}));
-		if (toAttach.length > 0) await this.getClient().send(new AttachTrafficSourcesCommand({
-			AutoScalingGroupName: physicalId,
-			TrafficSources: toAttach.map((e) => ({
-				Identifier: e.Identifier,
-				...e.Type !== void 0 && { Type: e.Type }
-			}))
-		}));
-	}
-	async applyNotificationConfigurationsDiff(physicalId, next, prev) {
-		if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;
-		const nextEntries = Array.isArray(next) ? next : [];
-		const prevEntries = Array.isArray(prev) ? prev : [];
-		const nextByTopic = /* @__PURE__ */ new Map();
-		for (const e of nextEntries) if (e.TopicARN) nextByTopic.set(e.TopicARN, e.NotificationTypes);
-		const prevByTopic = /* @__PURE__ */ new Map();
-		for (const e of prevEntries) if (e.TopicARN) prevByTopic.set(e.TopicARN, e.NotificationTypes);
-		for (const topic of prevByTopic.keys()) if (!nextByTopic.has(topic)) await this.getClient().send(new DeleteNotificationConfigurationCommand({
-			AutoScalingGroupName: physicalId,
-			TopicARN: topic
-		}));
-		for (const [topic, types] of nextByTopic) {
-			const before = prevByTopic.get(topic);
-			if (JSON.stringify(before ?? null) === JSON.stringify(types ?? null)) continue;
-			await this.getClient().send(new PutNotificationConfigurationCommand({
-				AutoScalingGroupName: physicalId,
-				TopicARN: topic,
-				NotificationTypes: types ?? []
-			}));
-		}
-	}
-};
-/**
-* Reverse-map AWS `EnabledMetrics: [{Metric, Granularity}]` (flat list,
-* one row per enabled metric) back to the CFn array shape
-* `[{Granularity, Metrics?[]}]`. Metrics with the same Granularity are
-* grouped together; the resulting Metrics list is sorted alphabetically
-* for stable positional compare in the drift comparator.
-*
-* Always returns a placeholder `[]` per the cdkd PR #145 always-emit
-* convention so a console-side EnableMetricsCollection on a previously-
-* empty group surfaces as drift on the v3 `observedProperties` baseline.
-*/
-function mapEnabledMetricsToCfn(enabledMetrics) {
-	if (!enabledMetrics || enabledMetrics.length === 0) return [];
-	const byGranularity = /* @__PURE__ */ new Map();
-	for (const e of enabledMetrics) {
-		const g = e.Granularity;
-		if (!g) continue;
-		let set = byGranularity.get(g);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			byGranularity.set(g, set);
-		}
-		if (e.Metric) set.add(e.Metric);
-	}
-	const result = [];
-	for (const granularity of Array.from(byGranularity.keys()).sort()) {
-		const metrics = Array.from(byGranularity.get(granularity) ?? []).sort();
-		result.push(metrics.length > 0 ? {
-			Granularity: granularity,
-			Metrics: metrics
-		} : { Granularity: granularity });
-	}
-	return result;
-}
-/**
-* Reverse-map AWS `DescribeLifecycleHooks` response to the CFn
-* `LifecycleHookSpecificationList` shape. Each hook is surfaced under the
-* exact CFn property name. AWS-side fields cdkd state never carried
-* (`AutoScalingGroupName` — duplicated on every hook by AWS,
-* `GlobalTimeout` — AWS-derived) are filtered out. Sorted by
-* LifecycleHookName for stable positional compare.
-*/
-function mapLifecycleHooksToCfn(hooks) {
-	if (!hooks || hooks.length === 0) return [];
-	const result = [];
-	for (const h of hooks) {
-		if (!h.LifecycleHookName) continue;
-		const entry = { LifecycleHookName: h.LifecycleHookName };
-		if (h.LifecycleTransition !== void 0) entry["LifecycleTransition"] = h.LifecycleTransition;
-		if (h.RoleARN !== void 0) entry["RoleARN"] = h.RoleARN;
-		if (h.NotificationTargetARN !== void 0) entry["NotificationTargetARN"] = h.NotificationTargetARN;
-		if (h.NotificationMetadata !== void 0) entry["NotificationMetadata"] = h.NotificationMetadata;
-		if (h.HeartbeatTimeout !== void 0) entry["HeartbeatTimeout"] = h.HeartbeatTimeout;
-		if (h.DefaultResult !== void 0) entry["DefaultResult"] = h.DefaultResult;
-		result.push(entry);
-	}
-	result.sort((a, b) => String(a["LifecycleHookName"]).localeCompare(String(b["LifecycleHookName"])));
-	return result;
-}
-/**
-* Reverse-map AWS `DescribeTrafficSources` response to the CFn
-* `TrafficSources` shape `[{Identifier, Type?}]`. AWS-side runtime fields
-* (`State`, the deprecated `TrafficSource` alias) are filtered out.
-* Sorted by Identifier for stable positional compare.
-*/
-function mapTrafficSourcesToCfn(trafficSources) {
-	if (!trafficSources || trafficSources.length === 0) return [];
-	const result = [];
-	for (const t of trafficSources) {
-		if (!t.Identifier) continue;
-		const entry = { Identifier: t.Identifier };
-		if (t.Type !== void 0) entry["Type"] = t.Type;
-		result.push(entry);
-	}
-	result.sort((a, b) => String(a["Identifier"]).localeCompare(String(b["Identifier"])));
-	return result;
-}
-/**
-* Reverse-map AWS `DescribeNotificationConfigurations` (a flat list, one
-* row per `(topicArn, notificationType)`) into the CFn shape
-* `[{TopicARN, NotificationTypes[]}]`. NotificationTypes are grouped per
-* TopicARN and sorted alphabetically for stable positional compare.
-*/
-function mapNotificationsToCfn(configurations) {
-	if (!configurations || configurations.length === 0) return [];
-	const byTopic = /* @__PURE__ */ new Map();
-	for (const c of configurations) {
-		if (!c.TopicARN) continue;
-		let set = byTopic.get(c.TopicARN);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			byTopic.set(c.TopicARN, set);
-		}
-		if (c.NotificationType) set.add(c.NotificationType);
-	}
-	const result = [];
-	for (const topic of Array.from(byTopic.keys()).sort()) {
-		const types = Array.from(byTopic.get(topic) ?? []).sort();
-		result.push({
-			TopicARN: topic,
-			NotificationTypes: types
-		});
-	}
-	return result;
-}
-
 //#endregion
 //#region src/cli/commands/destroy-runner.ts
 /**
@@ -53553,7 +52772,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.219.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.219.3");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());