@go-to-k/cdkd 0.285.1 → 0.285.3

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Bn as Synthesizer, Br as normalizeAwsError, Dr as LockError, G as IAMRoleProvider, Ir as StateError, J as ProviderRegistry, Lr as SynthesisError, Rr as formatError, Ut as DagBuilder, Wt as TemplateParser, _r as AssetError, dr as clearBucketRegionCache, fr as resolveBucketRegion, gr as setAwsClients, hr as resetAwsClients, in as S3StateBackend, jr as ProvisioningError, lr as AssemblyReader, mr as getAwsClients, nn as LockManager, pr as AwsClients, r as DeployEngine, st as CloudControlProvider, un as AssetPublisher, vr as CdkdError, xr as DependencyError, yr as ConfigError, zr as isCdkdError, zt as DiffCalculator } from "./deploy-engine-CLglXV1z.js";
+import { Bn as Synthesizer, Br as normalizeAwsError, Dr as LockError, G as IAMRoleProvider, Ir as StateError, J as ProviderRegistry, Lr as SynthesisError, Rr as formatError, Ut as DagBuilder, Wt as TemplateParser, _r as AssetError, dr as clearBucketRegionCache, fr as resolveBucketRegion, gr as setAwsClients, hr as resetAwsClients, in as S3StateBackend, jr as ProvisioningError, lr as AssemblyReader, mr as getAwsClients, nn as LockManager, pr as AwsClients, r as DeployEngine, st as CloudControlProvider, un as AssetPublisher, vr as CdkdError, xr as DependencyError, yr as ConfigError, zr as isCdkdError, zt as DiffCalculator } from "./deploy-engine-3lJaFGjA.js";
 import { i as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dz3Le2Pw.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-BiugR6Z1.js → program-BU6F1UD2.js}

@@ -1,8 +1,8 @@
-import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInText, A as renderStatefulReason, An as describeAwsFailure, Ar as PartialFailureError, At as requireConfigString, B as exportAliasCollisionScrubWarning, Bn as Synthesizer, Br as normalizeAwsError, Bt as INTRINSIC_KEYS, C as isFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DynamicReferenceRegionAmbiguousError, Ct as coerceCfnBoolean, D as extractDeploymentEventError, Dn as validateAssetBucketName, Dt as replayWarn, E as makeCanonicalizePropertiesFn, En as readBootstrapMarkerBody, Er as LocalStartServiceError, Et as readConfigString, F as green, Fn as partitionSensitiveEnv, Fr as StackTerminationProtectionError, Ft as s3BucketDualStackDomainName, G as IAMRoleProvider, Gn as resolveAutoAssetStorage, Gr as markNonRetryable, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as secretBearingStateKeyWarning, Hn as getDefaultStateBucketName, Hr as isMarkedNonRetryable, Ht as withRetry, I as red, In as runDockerForeground, It as s3BucketRegionalDomainName, J as ProviderRegistry, Jn as resolveStateBucketWithDefault, Jt as createSecretMasker, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveCaptureObservedState, Kr as markRedactedCause, Kt as STATE_SOURCED_READBACK_RULES, L as yellow, Ln as runDockerStreaming, Lt as s3BucketWebsiteUrl, M as bold, Mn as dockerSpawnEnvWithSensitive, Mr as ResourceTimeoutError, Mt as producerRegionsFromState, N as cyan, Nn as formatDockerLoginError, Nr as ResourceUpdateNotSupportedError, Nt as s3BucketArn, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as validateContainerRepoName, Or as MissingCdkCliError, Ot as requireConfigArray, P as gray, Pn as getDockerCmd, Pr as StackHasActiveImportsError, Pt as s3BucketDomainName, Q as maskDeep, Qn as warnDeprecatedNoPrefixCliFlag, Qt as maskSecretsInError, R as collectDeclaredOutputNames, Rn as AssetManifestLoader, Rt as applyRoleArnIfSet, S as createPreDeleteFinalSnapshot, Sn as ensureAssetStorage, Sr as DeployCancelledError, St as assertRegionMatch, T as unsupportedFinalSnapshotError, Tn as parseBootstrapMarker, Tr as LocalMigrateError, Tt as configStringRefusal, U as stateKeySecretExposure, Un as getLegacyStateBucketName, Ur as isRetryableTransientError, Ut as DagBuilder, V as isExportAliasCollision, Vn as synthesisStatusMessage, Vr as withErrorHandling, Vt as describeTypeWithThrottleRetry, W as getCurrentResourceSecrets, Wn as resolveApp, Wr as isThrottlingError, Wt as TemplateParser, X as findSilentDropProperties, Xn as resolveUseCdkBootstrapAssets, Xt as errorCauseChain, Y as findActionableSilentDrops, Yn as resolveStateBucketWithDefaultAndSource, Yt as dynamicReferenceTokens, Z as createMaskedRetryLogger, Zn as stateBucketExistenceConfirmed, Zt as isSingleDynamicReferenceToken, _ as computeImplicitDeleteEdges, _n as escapeRegExp, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as expectedOwnerParam, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as BOOTSTRAP_MARKER_PREFIX, br as CrossAccountSecretRefusalError, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as importableOutputs, cr as derivePartitionAndUrlSuffix, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as stringifyValue, dt as IntrinsicFunctionResolver, en as redactSecretsForState, er as CFN_TEMPLATE_URL_LIMIT, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as WorkGraph, fr as resolveBucketRegion, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as rewriteTemplateAssetReferences, gr as setAwsClients, gt as isUnboundTemplateParameter, h as maskingRetryLogger, hn as loadPublishableAssetManifest, hr as resetAwsClients, ht as getAccountInfo, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as interruptWatchListenerCount, j as formatResourceLine, jn as buildDockerImage, jr as ProvisioningError, jt as classifyReplaySecretRegion, k as isStatefulRecreateTargetSync, kn as buildDenyExternalAccessPolicy, kr as NestedStackChildDirectDestroyError, kt as requireConfigObject, l as replayRollback, ln as shouldRetainResource, lr as AssemblyReader, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as createAssetRedirectResolver, mr as getAwsClients, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as LockManager, nr as findLargeInlineResources, nt as beginCommandInterruptScope, o as planFailedOps, on as exportNamesCarriedFrom, or as PARTITION_TABLE, ot as startInterruptWatch, p as deleteSkipReason, pn as buildAssetRedirectMap, pr as AwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveSkipPrefix, qr as retryClassificationText, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as displaySafe, rr as uploadCfnTemplate, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputKeys, sr as canonicalizeRegion, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as scrubResourceRecord, tr as MIGRATE_TMP_PREFIX, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as AssetPublisher, ur as processStackMessages, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as stripControlChars, vr as CdkdError, vt as refStateLookupFromResource, w as refusesFinalSnapshot, wn as isCrossRegionRedirect, wr as LocalInvokeBuildError$1, wt as configBooleanRefusal, x as ccRoutedFinalSnapshotError, xn as assertAssetBucketRegion, xt as resolveExplicitPhysicalId, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetModeResolver, yt as WAFv2WebACLProvider, z as collectPublishedOutputNames, zn as getDockerImageBySourceHash, zt as DiffCalculator } from "./deploy-engine-CLglXV1z.js";
+import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInText, A as renderStatefulReason, An as describeAwsFailure, Ar as PartialFailureError, At as requireConfigString, B as exportAliasCollisionScrubWarning, Bn as Synthesizer, Br as normalizeAwsError, Bt as INTRINSIC_KEYS, C as isFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DynamicReferenceRegionAmbiguousError, Ct as coerceCfnBoolean, D as extractDeploymentEventError, Dn as validateAssetBucketName, Dt as replayWarn, E as makeCanonicalizePropertiesFn, En as readBootstrapMarkerBody, Er as LocalStartServiceError, Et as readConfigString, F as green, Fn as partitionSensitiveEnv, Fr as StackTerminationProtectionError, Ft as s3BucketDualStackDomainName, G as IAMRoleProvider, Gn as resolveAutoAssetStorage, Gr as isTransientServerError, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as secretBearingStateKeyWarning, Hn as getDefaultStateBucketName, Hr as isMarkedNonRetryable, Ht as withRetry, I as red, In as runDockerForeground, It as s3BucketRegionalDomainName, J as ProviderRegistry, Jn as resolveStateBucketWithDefault, Jr as retryClassificationText, Jt as createSecretMasker, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveCaptureObservedState, Kr as markNonRetryable, Kt as STATE_SOURCED_READBACK_RULES, L as yellow, Ln as runDockerStreaming, Lt as s3BucketWebsiteUrl, M as bold, Mn as dockerSpawnEnvWithSensitive, Mr as ResourceTimeoutError, Mt as producerRegionsFromState, N as cyan, Nn as formatDockerLoginError, Nr as ResourceUpdateNotSupportedError, Nt as s3BucketArn, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as validateContainerRepoName, Or as MissingCdkCliError, Ot as requireConfigArray, P as gray, Pn as getDockerCmd, Pr as StackHasActiveImportsError, Pt as s3BucketDomainName, Q as maskDeep, Qn as warnDeprecatedNoPrefixCliFlag, Qt as maskSecretsInError, R as collectDeclaredOutputNames, Rn as AssetManifestLoader, Rt as applyRoleArnIfSet, S as createPreDeleteFinalSnapshot, Sn as ensureAssetStorage, Sr as DeployCancelledError, St as assertRegionMatch, T as unsupportedFinalSnapshotError, Tn as parseBootstrapMarker, Tr as LocalMigrateError, Tt as configStringRefusal, U as stateKeySecretExposure, Un as getLegacyStateBucketName, Ur as isRetryableTransientError, Ut as DagBuilder, V as isExportAliasCollision, Vn as synthesisStatusMessage, Vr as withErrorHandling, Vt as describeTypeWithThrottleRetry, W as getCurrentResourceSecrets, Wn as resolveApp, Wr as isThrottlingError, Wt as TemplateParser, X as findSilentDropProperties, Xn as resolveUseCdkBootstrapAssets, Xt as errorCauseChain, Y as findActionableSilentDrops, Yn as resolveStateBucketWithDefaultAndSource, Yt as dynamicReferenceTokens, Z as createMaskedRetryLogger, Zn as stateBucketExistenceConfirmed, Zt as isSingleDynamicReferenceToken, _ as computeImplicitDeleteEdges, _n as escapeRegExp, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as expectedOwnerParam, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as BOOTSTRAP_MARKER_PREFIX, br as CrossAccountSecretRefusalError, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as importableOutputs, cr as derivePartitionAndUrlSuffix, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as stringifyValue, dt as IntrinsicFunctionResolver, en as redactSecretsForState, er as CFN_TEMPLATE_URL_LIMIT, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as WorkGraph, fr as resolveBucketRegion, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as rewriteTemplateAssetReferences, gr as setAwsClients, gt as isUnboundTemplateParameter, h as maskingRetryLogger, hn as loadPublishableAssetManifest, hr as resetAwsClients, ht as getAccountInfo, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as interruptWatchListenerCount, j as formatResourceLine, jn as buildDockerImage, jr as ProvisioningError, jt as classifyReplaySecretRegion, k as isStatefulRecreateTargetSync, kn as buildDenyExternalAccessPolicy, kr as NestedStackChildDirectDestroyError, kt as requireConfigObject, l as replayRollback, ln as shouldRetainResource, lr as AssemblyReader, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as createAssetRedirectResolver, mr as getAwsClients, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as LockManager, nr as findLargeInlineResources, nt as beginCommandInterruptScope, o as planFailedOps, on as exportNamesCarriedFrom, or as PARTITION_TABLE, ot as startInterruptWatch, p as deleteSkipReason, pn as buildAssetRedirectMap, pr as AwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveSkipPrefix, qr as markRedactedCause, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as displaySafe, rr as uploadCfnTemplate, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputKeys, sr as canonicalizeRegion, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as scrubResourceRecord, tr as MIGRATE_TMP_PREFIX, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as AssetPublisher, ur as processStackMessages, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as stripControlChars, vr as CdkdError, vt as refStateLookupFromResource, w as refusesFinalSnapshot, wn as isCrossRegionRedirect, wr as LocalInvokeBuildError$1, wt as configBooleanRefusal, x as ccRoutedFinalSnapshotError, xn as assertAssetBucketRegion, xt as resolveExplicitPhysicalId, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetModeResolver, yt as WAFv2WebACLProvider, z as collectPublishedOutputNames, zn as getDockerImageBySourceHash, zt as DiffCalculator } from "./deploy-engine-3lJaFGjA.js";
 import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-Dz3Le2Pw.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CnT0aZUb.js";
-import { t as ASGProvider } from "./asg-provider-BOx_2OWi.js";
+import { t as getCdkdVersion } from "./version-B4YqJKXh.js";
+import { t as ASGProvider } from "./asg-provider-D3bSjRiw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -57,7 +57,7 @@ import { ConcurrentModificationException, CrawlerRunningException, CreateConnect
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
-import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
@@ -18553,9 +18553,9 @@ var DynamoDBTableProvider = class {
 	* `observedProperties` baseline, a later AWS-side increase surfaces as drift
 	* on a property the user never declared and `--revert` would issue a
 	* decrease AWS rejects. `readCurrentState` therefore emits it only when the
-	* DESIRED bag declares it (the fix issue #1742 PROPOSES for the per-index
-	* sibling — still open and unlanded at the time of writing, so this is the
-	* first site to carry the shape), never as a blanket drop:
+	* DESIRED bag declares it (the same shape issue #1742 proposed for the
+	* per-index sibling, which landed in #1859 — this site carried it first),
+	* never as a blanket drop:
 	* `AWS::DynamoDB::Table` accepts an explicit `WarmThroughput` and a real
 	* change to one must stay visible. Known residual on that declared arm
 	* (issue #1768): AWS may GROW a declared value, which is reported as drift —
@@ -42409,6 +42409,48 @@ function readAllowedFirstAuthFactors(properties) {
 	return factors.filter((factor) => typeof factor === "string");
 }
 /**
+* The two sub-keys of the CFn `Policies` blob — exactly the members
+* `UserPoolPolicyType` declares, and exactly the keys `toSdkUserPoolPolicies`
+* forwards. Iterated by the #1979 removal announcement so a sub-key AWS adds
+* later joins BOTH the forwarding and the announcement in one edit here.
+*/
+const POLICIES_SUB_KEYS = ["PasswordPolicy", "SignInPolicy"];
+/**
+* Would this property bag put `Policies.<subKey>` on the wire?
+*
+* MIRRORS the wire's own two truthiness gates rather than re-deriving a
+* "present" notion of its own: `create()` / `update()` gate on
+* `if (properties['Policies'])` and `toSdkUserPoolPolicies` gates each sub-key
+* on `if (policies['SignInPolicy'])`. The #1979 removal announcement must fire
+* exactly when the wire STOPS carrying a sub-key it previously carried, so a
+* hand-written presence test here (`in`, `!== undefined`, a plain-object
+* guard) would disagree with the wire on `null` / `''` / `0` / `false` — the
+* config-shape.ts share-the-predicate rule, applied to a truthiness gate.
+* Agreement is pinned by a unit table that drives every value shape through
+* the PUBLIC `update()` and asserts warn-iff-not-sent.
+*/
+function sendsPoliciesSubKey(bag, subKey) {
+	const policies = bag["Policies"];
+	if (!policies) return false;
+	return Boolean(policies[subKey]);
+}
+/**
+* What the removal announcement tells the user about each sub-key: a short
+* label for the live value the pool keeps, and the AWS default the user must
+* DECLARE explicitly to get reset behavior (there is no removal path on the
+* wire, so an explicit declaration is the only way to change the live value).
+*/
+const POLICIES_SUB_KEY_ANNOUNCEMENT = {
+	PasswordPolicy: {
+		label: "password policy",
+		reset: "the AWS default is MinimumLength: 8 with every character-class requirement enabled and TemporaryPasswordValidityDays: 7"
+	},
+	SignInPolicy: {
+		label: "sign-in policy",
+		reset: "the AWS default is AllowedFirstAuthFactors: [PASSWORD]"
+	}
+};
+/**
 * The PRE-FLIGHT: the reason this user-pool configuration cannot be applied at
 * all, or `undefined` when nothing is known to refuse it.
 *
@@ -42747,17 +42789,47 @@ var CognitoUserPoolProvider = class {
 	* `readLiveMfaConfiguration`'s docstring, which carries the one ledger of
 	* which fields were measured to reset and which were not.
 	*
-	* **Consequence of that measurement, NOT fixed here: there is no removal
-	* path.** This builder forwards only what the template DECLARES, so deleting
-	* `SignInPolicy` from a template sends nothing for it -- and nothing sent
-	* means nothing changed. A user tightening their auth by removing a
-	* passwordless first-auth factor therefore leaves it live on the pool
-	* indefinitely, and `readCurrentState` keeps reporting a drift that
-	* `cdkd drift --revert` cannot clear, since the revert routes through this
-	* same builder. Clearing it needs an explicit reset value on the wire, which
-	* is a behavior change with its own integ and is out of this lane's scope.
-	* Whether CloudFormation removes it on the same template edit is UNMEASURED
-	* -- do not assume parity in either direction.
+	* **Consequence of that measurement: there is no removal path, and that is
+	* PARITY, not a gap to close with a reset** (issue #1979). This builder
+	* forwards only what the template DECLARES, so deleting `SignInPolicy` from
+	* a template sends nothing for it -- and nothing sent means nothing changed.
+	* Whether that no-op should become an explicit reset was settled by a real
+	* CloudFormation A/B rather than assumed. MEASURED us-east-1 2026-09-02
+	* (issue #1979), on a CFn stack whose pool declared
+	* `PasswordPolicy: {MinimumLength: 12, RequireSymbols: false}` +
+	* `SignInPolicy: {AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]}`
+	* (ESSENTIALS tier), three template edits, each reaching UPDATE_COMPLETE:
+	*
+	* - removing the `SignInPolicy` sub-key alone left the live value at
+	*   `[PASSWORD, EMAIL_OTP]`;
+	* - removing the `PasswordPolicy` sub-key alone left the live value at
+	*   `MinimumLength: 12` / `RequireSymbols: false` -- NOT reset to the
+	*   documented defaults (8, every requirement on);
+	* - removing the whole `Policies` container left BOTH sub-keys intact.
+	*
+	* So CloudFormation performs the SAME silent no-op, and a cdkd-side reset
+	* would be a DIVERGENCE from its stated template compatibility, not parity.
+	* What was wrong was only the SILENCE: `update()` announces the
+	* inexpressible removal via `warnOnUnremovablePoliciesSubKeys`, naming the
+	* sub-key, saying the live value is unchanged, and pointing at the
+	* explicit-declaration remedy. It fires on `cdkd deploy`; the other three
+	* `update()` call sites reach it only under conditions each of which is
+	* spelled out at that method, because the obvious reading of two of them is
+	* wrong.
+	*
+	* **The announcement is the ONLY signal, which is why silence was the whole
+	* defect.** The issue predicted that the removal would also leave a
+	* permanent `cdkd drift` difference; MEASURED us-east-1 2026-09-02 on a live
+	* pool (stack `Cdkd1979LiveVerify`), it does not, and the prediction is
+	* withdrawn here rather than repeated. `update()` refreshes
+	* `observedProperties` from the POST-update `readCurrentState`, so the
+	* retained sub-key lands in the drift BASELINE (`observedProperties ??
+	* properties`, `drift.ts`) as well as on the pool: the announcing deploy
+	* converges, the next identical deploy is an honest NO_CHANGE, and both
+	* `cdkd drift` and `cdkd diff` report nothing. Nothing downstream of the
+	* deploy tells the operator that the tightening did not land -- so the warn
+	* is not a supplement to a visible drift, it is the only place the fact
+	* appears at all.
 	*/
 	toSdkUserPoolPolicies(policies) {
 		const result = {};
@@ -42939,7 +43011,10 @@ var CognitoUserPoolProvider = class {
 	*   container sent without `PasswordPolicy` left `PasswordPolicy` intact,
 	*   and omitting the container outright left both. Forwarding is still
 	*   REQUIRED to APPLY a changed sub-key — preservation is not application —
-	*   and no omission can express a REMOVAL.
+	*   and no omission can express a REMOVAL. CloudFormation measured the same
+	*   way on all three removal edits (2026-09-02, issue #1979; transcript at
+	*   `toSdkUserPoolPolicies`), so the update path ANNOUNCES the removal via
+	*   `warnOnUnremovablePoliciesSubKeys` instead of resetting.
 	*
 	* `SetUserPoolMfaConfig` — a DIFFERENT API with a DIFFERENT rule, kept in
 	* its own section so neither list is read as evidence for the other:
@@ -43005,6 +43080,76 @@ var CognitoUserPoolProvider = class {
 		}
 	}
 	/**
+	* Announce a `Policies` sub-key removal the wire cannot express (issue
+	* #1979). Fires once per removed sub-key when the previous side would have
+	* put it on the wire and the desired side no longer does — the same
+	* truthiness gates the forwarding itself uses (`sendsPoliciesSubKey`).
+	*
+	* WARN, not a reset, and not silence. `UpdateUserPool` preserves an omitted
+	* sub-key (measured 2026-08-19, issue #1968) and CloudFormation performs the
+	* SAME no-op on the identical template edit (measured 2026-09-02, issue
+	* #1979; both transcripts at `toSdkUserPoolPolicies`) — so sending a reset
+	* would diverge from cdkd's stated template compatibility, while silence
+	* leaves an operator believing a TIGHTENING landed (the motivating shape:
+	* deleting `SignInPolicy` to revoke a passwordless first-auth factor
+	* deploys green while AWS keeps allowing it). The announcement names the
+	* sub-key, states that the live value is unchanged, and gives the only
+	* remedy that exists on the wire: declaring the sub-key explicitly with the
+	* intended (e.g. default) configuration.
+	*
+	* Reached by four `update()` call sites, and each one needs its own reading
+	* of what "previous" MEANS there:
+	*
+	* - **`cdkd deploy`** (previous = the last-deployed template's record) warns
+	*   on the deploy that carries the removal. Later deploys compare template ==
+	*   record and are honest NO_CHANGEs, matching CloudFormation's own converged
+	*   stack (measured live, transcript at `toSdkUserPoolPolicies`).
+	* - **`cdkd drift --revert`** (previous = the full live readback) is NARROWER
+	*   than it looks, and the obvious reading of it is backwards. The revert's
+	*   DESIRED side is not the drift baseline: `buildRevertNewProperties`
+	*   (`drift.ts`) starts from `{ ...awsProperties }` and overwrites only the
+	*   top-level keys that actually DRIFTED, so an undrifted `Policies` carries
+	*   the LIVE blob and no removal is visible at all. And on a record with no
+	*   `observedProperties` — the case that looks most reachable — the revert
+	*   sets `preserveUntemplated`, whose `mergeUntemplatedValue` merges AWS's
+	*   untemplated sub-keys straight back in, so the sub-key is present on the
+	*   desired side and this warning does not fire -- unless the baseline's own
+	*   `Policies` is not a plain record (a `null`, a string, an unresolved
+	*   intrinsic), the one shape that merge declines: it returns the baseline
+	*   whole and drops the live sub-keys with it. What else reaches it is the
+	*   opposite shape: a record WITH `observedProperties`, plus a sub-key added
+	*   out-of-band after that capture, so `Policies` drifts and the baseline
+	*   written over it lacks the sub-key. The warning is then exactly right —
+	*   the revert cannot take that sub-key back off the pool.
+	* - **The rollback executor's `revert` arm** (previous = the newer state
+	*   record) warns when rolling back to a record that lacked the sub-key; the
+	*   rollback cannot restore that absence either.
+	* - **The rollback executor's `revert-failed-update` arm** passes
+	*   `attemptedProps` as the previous side, which is
+	*   `op.attemptedProperties ?? current.properties` — so a journal segment
+	*   that recorded no attempted properties degrades to the newer state record
+	*   and behaves exactly as the `revert` arm above. With a real attempted bag
+	*   it is the bag of an update that FAILED: if `UpdateUserPool` itself was
+	*   rejected, the attempted sub-key may never have reached AWS, and the
+	*   announcement then names a removal that had nothing to remove. Its literal
+	*   claim (the pool keeps whatever policy it currently has) stays true, and
+	*   the arm is not gated because a failure
+	*   AFTER a successful `UpdateUserPool` is the same-shaped case where the
+	*   sub-key DID land and the warning is fully earned; the two are not
+	*   distinguishable from `attemptedProps` alone.
+	*
+	* The message interpolates NO property values (sub-key names and the
+	* physical id only), so it needs no `maskSecrets` routing.
+	*/
+	warnOnUnremovablePoliciesSubKeys(physicalId, properties, previousProperties) {
+		for (const subKey of POLICIES_SUB_KEYS) {
+			if (!sendsPoliciesSubKey(previousProperties, subKey)) continue;
+			if (sendsPoliciesSubKey(properties, subKey)) continue;
+			const { label, reset } = POLICIES_SUB_KEY_ANNOUNCEMENT[subKey];
+			this.logger.warn(`UserPool ${physicalId}: the desired configuration no longer declares Policies.${subKey}, and no UpdateUserPool input can express that removal — omitting the sub-key PRESERVES the live value (measured us-east-1 2026-08-19, issue #1968), so the pool keeps its current ${label}. CloudFormation is the same no-op on the identical template edit (measured us-east-1 2026-09-02, issue #1979), so cdkd deliberately sends no reset. To change the live value, declare Policies.${subKey} explicitly with the intended configuration (${reset}).`);
+		}
+	}
+	/**
 	* Update a Cognito User Pool
 	*
 	* Note: PoolName (UserPoolName) is immutable and cannot be changed after
@@ -43029,6 +43174,7 @@ var CognitoUserPoolProvider = class {
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
 		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
+		this.warnOnUnremovablePoliciesSubKeys(physicalId, properties, previousProperties);
 		try {
 			const updateParams = { UserPoolId: physicalId };
 			if (properties["Policies"]) {
@@ -51274,7 +51420,7 @@ var EFSProvider = class {
 			"AccessPointTags"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
 		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -51636,8 +51782,14 @@ var EFSProvider = class {
 		const posixUser = properties["PosixUser"];
 		const rootDirectory = properties["RootDirectory"];
 		const tags = properties["AccessPointTags"];
+		const clientToken = acquireIdempotencyToken({
+			scope: "CreateAccessPoint",
+			logicalId,
+			maxLength: 64
+		});
 		try {
-			const response = await this.getClient().send(new CreateAccessPointCommand({
+			const response = await this.createOrAdoptAccessPoint(logicalId, resourceType, {
+				ClientToken: clientToken.value,
 				FileSystemId: fileSystemId,
 				PosixUser: posixUser ? {
 					Uid: Number(posixUser.Uid),
@@ -51656,10 +51808,11 @@ var EFSProvider = class {
 					Key: t.Key,
 					Value: t.Value
 				}))
-			}));
+			});
 			const accessPointId = response.AccessPointId;
 			const arn = response.AccessPointArn;
 			this.logger.debug(`Successfully created EFS AccessPoint ${logicalId}: ${accessPointId}`);
+			clientToken.release();
 			return {
 				physicalId: accessPointId,
 				attributes: {
@@ -51668,10 +51821,100 @@ var EFSProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create EFS AccessPoint ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* `CreateAccessPoint`, with the retry-replay case ADOPTED rather than failed
+	* (issue [#2080](https://github.com/go-to-k/cdkd/issues/2080)).
+	*
+	* When EFS REPLAYS a seen token it answers with the access point the lost
+	* response described and this method returns it like any other success. When
+	* it instead REFUSES the repeat -- `AccessPointAlreadyExists`, which the
+	* `CreateAccessPoint` reference documents with no window attached -- the
+	* first attempt's access point is live AND absent from state, which is the
+	* orphan the token exists to prevent, now with a failed deploy on top. How
+	* often each happens is not something EFS documents for this call (see the
+	* DERIVATION note in `createAccessPoint`), so this arm is written as the
+	* ORDINARY recovery path rather than a rare one.
+	* `route53-provider.ts`'s `createOrAdoptHostedZone` is the same pattern for
+	* the same issue family.
+	*
+	* Adoption is CONFIRMED rather than assumed, on two axes: the token (cdkd
+	* mints a per-process value, so only an attempt of THIS create can hold it --
+	* the parameter type requires one, so there is no "both undefined" way to
+	* satisfy the comparison vacuously) and the file system (structural rather
+	* than contingent on the engine resolving properties once per create, which
+	* is true today and is not this method's to rely on).
+	*
+	* Every way the confirmation can fail -- no id on the error, a read-back that
+	* throws, a token or file system that does not match, a description with no
+	* ARN -- DECLINES the adoption, says so at `warn`, and rethrows carrying the
+	* AWS error as `cause`. A conflict cdkd cannot attribute to itself is not
+	* something to paper over, and a lookup failure must never REPLACE the
+	* diagnosis: a missing `elasticfilesystem:DescribeAccessPoints` permission
+	* would otherwise surface as `AccessDenied` and send the next reader after a
+	* permissions problem instead of the token collision that actually happened.
+	*
+	* The rethrow is WRAPPED rather than bare, and that is load-bearing rather
+	* than cosmetic. `DeployEngine`'s replacement path classifies a failed
+	* create-first attempt with `isNameCollisionError`, which tests the
+	* TOP-LEVEL message for `already exists` / `AlreadyExists` -- both of which
+	* the raw AWS conflict carries. A token collision misread as a physical-NAME
+	* collision is not a cosmetic mistake: under `UpdateReplacePolicy: Retain` it
+	* produces advice about renaming a resource that has no name, and under
+	* `--replace` it falls back to delete-first, which DELETES the old access
+	* point and then re-creates with the same still-unreleased token -- colliding
+	* again, against the orphan rather than the old resource. Before this change
+	* the create path could not raise an already-exists shape at all, so the
+	* exposure arrives with the token. The AWS error is preserved as `cause`, so
+	* nothing is lost; only the string the engine classifies on changes.
+	*/
+	async createOrAdoptAccessPoint(logicalId, resourceType, input) {
+		try {
+			return await this.getClient().send(new CreateAccessPointCommand(input));
+		} catch (error) {
+			if (!(error instanceof AccessPointAlreadyExists || error?.name === "AccessPointAlreadyExists")) throw error;
+			const decline = (reason) => {
+				this.logger.warn(`CreateAccessPoint for ${logicalId} was refused because the idempotency token cdkd sent is already bound to an access point, and cdkd declined to adopt it: ${reason}.`);
+				throw markNonRetryable(new ProvisioningError(`EFS refused CreateAccessPoint for ${logicalId}: the idempotency token cdkd sent is already bound to an access point, and cdkd could not confirm that access point is the one this deploy created (${reason}). That access point is NOT recorded in cdkd state -- find it with: aws efs describe-access-points --query "AccessPoints[?ClientToken=='${input.ClientToken}']"`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
+			};
+			const existingId = error?.AccessPointId;
+			if (!existingId) return decline("the conflict named no AccessPointId to read back");
+			let existing;
+			try {
+				const watch = startInterruptWatch(`EFS AccessPoint ${logicalId} (adoption read-back)`);
+				let described;
+				try {
+					described = await withRetry(() => this.getClient().send(new DescribeAccessPointsCommand({ AccessPointId: existingId })), logicalId, {
+						maxRetries: 3,
+						isRetryable: (_text, err) => isThrottlingError(err) || isTransientServerError(err),
+						logger: this.logger,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
+				existing = described.AccessPoints?.[0];
+			} catch (lookupError) {
+				if (isInterruptedWaitError(lookupError)) throw lookupError;
+				const failure = describeAwsFailure(lookupError);
+				this.logger.debug(`Read-back of access point ${existingId} failed with: ${failure.detail}`);
+				return decline(`reading access point ${existingId} back failed: ${failure.summary}`);
+			}
+			if (existing === void 0) return decline(`access point ${existingId} could not be read back`);
+			if (existing.ClientToken !== input.ClientToken) return decline(`access point ${existingId} carries a different ClientToken`);
+			if (existing.FileSystemId !== input.FileSystemId) return decline(`access point ${existingId} belongs to a different file system`);
+			if (!existing.AccessPointId) return decline(`access point ${existingId} was read back without an id`);
+			if (!existing.AccessPointArn) return decline(`access point ${existingId} was read back without an ARN`);
+			if (existing.LifeCycleState === "deleting" || existing.LifeCycleState === "deleted" || existing.LifeCycleState === "error") return decline(`access point ${existingId} is ${existing.LifeCycleState} rather than usable`);
+			this.logger.warn(`CreateAccessPoint was replayed after a lost response; adopting the access point ${existing.AccessPointId} the previous attempt already created instead of creating a second one`);
+			return existing;
+		}
+	}
 	async deleteAccessPoint(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting EFS AccessPoint ${logicalId}: ${physicalId}`);
 		try {
@@ -88755,4 +88998,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BiugR6Z1.js.map
+//# sourceMappingURL=program-BU6F1UD2.js.map