@go-to-k/cdkd 0.285.2 → 0.285.3

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Bn as Synthesizer, Br as normalizeAwsError, Dr as LockError, G as IAMRoleProvider, Ir as StateError, J as ProviderRegistry, Lr as SynthesisError, Rr as formatError, Ut as DagBuilder, Wt as TemplateParser, _r as AssetError, dr as clearBucketRegionCache, fr as resolveBucketRegion, gr as setAwsClients, hr as resetAwsClients, in as S3StateBackend, jr as ProvisioningError, lr as AssemblyReader, mr as getAwsClients, nn as LockManager, pr as AwsClients, r as DeployEngine, st as CloudControlProvider, un as AssetPublisher, vr as CdkdError, xr as DependencyError, yr as ConfigError, zr as isCdkdError, zt as DiffCalculator } from "./deploy-engine-Bci2hIDt.js";
+import { Bn as Synthesizer, Br as normalizeAwsError, Dr as LockError, G as IAMRoleProvider, Ir as StateError, J as ProviderRegistry, Lr as SynthesisError, Rr as formatError, Ut as DagBuilder, Wt as TemplateParser, _r as AssetError, dr as clearBucketRegionCache, fr as resolveBucketRegion, gr as setAwsClients, hr as resetAwsClients, in as S3StateBackend, jr as ProvisioningError, lr as AssemblyReader, mr as getAwsClients, nn as LockManager, pr as AwsClients, r as DeployEngine, st as CloudControlProvider, un as AssetPublisher, vr as CdkdError, xr as DependencyError, yr as ConfigError, zr as isCdkdError, zt as DiffCalculator } from "./deploy-engine-3lJaFGjA.js";
 import { i as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dz3Le2Pw.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-fntegUX1.js → program-BU6F1UD2.js}

@@ -1,8 +1,8 @@
-import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInText, A as renderStatefulReason, An as describeAwsFailure, Ar as PartialFailureError, At as requireConfigString, B as exportAliasCollisionScrubWarning, Bn as Synthesizer, Br as normalizeAwsError, Bt as INTRINSIC_KEYS, C as isFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DynamicReferenceRegionAmbiguousError, Ct as coerceCfnBoolean, D as extractDeploymentEventError, Dn as validateAssetBucketName, Dt as replayWarn, E as makeCanonicalizePropertiesFn, En as readBootstrapMarkerBody, Er as LocalStartServiceError, Et as readConfigString, F as green, Fn as partitionSensitiveEnv, Fr as StackTerminationProtectionError, Ft as s3BucketDualStackDomainName, G as IAMRoleProvider, Gn as resolveAutoAssetStorage, Gr as markNonRetryable, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as secretBearingStateKeyWarning, Hn as getDefaultStateBucketName, Hr as isMarkedNonRetryable, Ht as withRetry, I as red, In as runDockerForeground, It as s3BucketRegionalDomainName, J as ProviderRegistry, Jn as resolveStateBucketWithDefault, Jt as createSecretMasker, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveCaptureObservedState, Kr as markRedactedCause, Kt as STATE_SOURCED_READBACK_RULES, L as yellow, Ln as runDockerStreaming, Lt as s3BucketWebsiteUrl, M as bold, Mn as dockerSpawnEnvWithSensitive, Mr as ResourceTimeoutError, Mt as producerRegionsFromState, N as cyan, Nn as formatDockerLoginError, Nr as ResourceUpdateNotSupportedError, Nt as s3BucketArn, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as validateContainerRepoName, Or as MissingCdkCliError, Ot as requireConfigArray, P as gray, Pn as getDockerCmd, Pr as StackHasActiveImportsError, Pt as s3BucketDomainName, Q as maskDeep, Qn as warnDeprecatedNoPrefixCliFlag, Qt as maskSecretsInError, R as collectDeclaredOutputNames, Rn as AssetManifestLoader, Rt as applyRoleArnIfSet, S as createPreDeleteFinalSnapshot, Sn as ensureAssetStorage, Sr as DeployCancelledError, St as assertRegionMatch, T as unsupportedFinalSnapshotError, Tn as parseBootstrapMarker, Tr as LocalMigrateError, Tt as configStringRefusal, U as stateKeySecretExposure, Un as getLegacyStateBucketName, Ur as isRetryableTransientError, Ut as DagBuilder, V as isExportAliasCollision, Vn as synthesisStatusMessage, Vr as withErrorHandling, Vt as describeTypeWithThrottleRetry, W as getCurrentResourceSecrets, Wn as resolveApp, Wr as isThrottlingError, Wt as TemplateParser, X as findSilentDropProperties, Xn as resolveUseCdkBootstrapAssets, Xt as errorCauseChain, Y as findActionableSilentDrops, Yn as resolveStateBucketWithDefaultAndSource, Yt as dynamicReferenceTokens, Z as createMaskedRetryLogger, Zn as stateBucketExistenceConfirmed, Zt as isSingleDynamicReferenceToken, _ as computeImplicitDeleteEdges, _n as escapeRegExp, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as expectedOwnerParam, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as BOOTSTRAP_MARKER_PREFIX, br as CrossAccountSecretRefusalError, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as importableOutputs, cr as derivePartitionAndUrlSuffix, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as stringifyValue, dt as IntrinsicFunctionResolver, en as redactSecretsForState, er as CFN_TEMPLATE_URL_LIMIT, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as WorkGraph, fr as resolveBucketRegion, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as rewriteTemplateAssetReferences, gr as setAwsClients, gt as isUnboundTemplateParameter, h as maskingRetryLogger, hn as loadPublishableAssetManifest, hr as resetAwsClients, ht as getAccountInfo, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as interruptWatchListenerCount, j as formatResourceLine, jn as buildDockerImage, jr as ProvisioningError, jt as classifyReplaySecretRegion, k as isStatefulRecreateTargetSync, kn as buildDenyExternalAccessPolicy, kr as NestedStackChildDirectDestroyError, kt as requireConfigObject, l as replayRollback, ln as shouldRetainResource, lr as AssemblyReader, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as createAssetRedirectResolver, mr as getAwsClients, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as LockManager, nr as findLargeInlineResources, nt as beginCommandInterruptScope, o as planFailedOps, on as exportNamesCarriedFrom, or as PARTITION_TABLE, ot as startInterruptWatch, p as deleteSkipReason, pn as buildAssetRedirectMap, pr as AwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveSkipPrefix, qr as retryClassificationText, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as displaySafe, rr as uploadCfnTemplate, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputKeys, sr as canonicalizeRegion, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as scrubResourceRecord, tr as MIGRATE_TMP_PREFIX, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as AssetPublisher, ur as processStackMessages, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as stripControlChars, vr as CdkdError, vt as refStateLookupFromResource, w as refusesFinalSnapshot, wn as isCrossRegionRedirect, wr as LocalInvokeBuildError$1, wt as configBooleanRefusal, x as ccRoutedFinalSnapshotError, xn as assertAssetBucketRegion, xt as resolveExplicitPhysicalId, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetModeResolver, yt as WAFv2WebACLProvider, z as collectPublishedOutputNames, zn as getDockerImageBySourceHash, zt as DiffCalculator } from "./deploy-engine-Bci2hIDt.js";
+import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInText, A as renderStatefulReason, An as describeAwsFailure, Ar as PartialFailureError, At as requireConfigString, B as exportAliasCollisionScrubWarning, Bn as Synthesizer, Br as normalizeAwsError, Bt as INTRINSIC_KEYS, C as isFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DynamicReferenceRegionAmbiguousError, Ct as coerceCfnBoolean, D as extractDeploymentEventError, Dn as validateAssetBucketName, Dt as replayWarn, E as makeCanonicalizePropertiesFn, En as readBootstrapMarkerBody, Er as LocalStartServiceError, Et as readConfigString, F as green, Fn as partitionSensitiveEnv, Fr as StackTerminationProtectionError, Ft as s3BucketDualStackDomainName, G as IAMRoleProvider, Gn as resolveAutoAssetStorage, Gr as isTransientServerError, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as secretBearingStateKeyWarning, Hn as getDefaultStateBucketName, Hr as isMarkedNonRetryable, Ht as withRetry, I as red, In as runDockerForeground, It as s3BucketRegionalDomainName, J as ProviderRegistry, Jn as resolveStateBucketWithDefault, Jr as retryClassificationText, Jt as createSecretMasker, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveCaptureObservedState, Kr as markNonRetryable, Kt as STATE_SOURCED_READBACK_RULES, L as yellow, Ln as runDockerStreaming, Lt as s3BucketWebsiteUrl, M as bold, Mn as dockerSpawnEnvWithSensitive, Mr as ResourceTimeoutError, Mt as producerRegionsFromState, N as cyan, Nn as formatDockerLoginError, Nr as ResourceUpdateNotSupportedError, Nt as s3BucketArn, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as validateContainerRepoName, Or as MissingCdkCliError, Ot as requireConfigArray, P as gray, Pn as getDockerCmd, Pr as StackHasActiveImportsError, Pt as s3BucketDomainName, Q as maskDeep, Qn as warnDeprecatedNoPrefixCliFlag, Qt as maskSecretsInError, R as collectDeclaredOutputNames, Rn as AssetManifestLoader, Rt as applyRoleArnIfSet, S as createPreDeleteFinalSnapshot, Sn as ensureAssetStorage, Sr as DeployCancelledError, St as assertRegionMatch, T as unsupportedFinalSnapshotError, Tn as parseBootstrapMarker, Tr as LocalMigrateError, Tt as configStringRefusal, U as stateKeySecretExposure, Un as getLegacyStateBucketName, Ur as isRetryableTransientError, Ut as DagBuilder, V as isExportAliasCollision, Vn as synthesisStatusMessage, Vr as withErrorHandling, Vt as describeTypeWithThrottleRetry, W as getCurrentResourceSecrets, Wn as resolveApp, Wr as isThrottlingError, Wt as TemplateParser, X as findSilentDropProperties, Xn as resolveUseCdkBootstrapAssets, Xt as errorCauseChain, Y as findActionableSilentDrops, Yn as resolveStateBucketWithDefaultAndSource, Yt as dynamicReferenceTokens, Z as createMaskedRetryLogger, Zn as stateBucketExistenceConfirmed, Zt as isSingleDynamicReferenceToken, _ as computeImplicitDeleteEdges, _n as escapeRegExp, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as expectedOwnerParam, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as BOOTSTRAP_MARKER_PREFIX, br as CrossAccountSecretRefusalError, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as importableOutputs, cr as derivePartitionAndUrlSuffix, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as stringifyValue, dt as IntrinsicFunctionResolver, en as redactSecretsForState, er as CFN_TEMPLATE_URL_LIMIT, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as WorkGraph, fr as resolveBucketRegion, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as rewriteTemplateAssetReferences, gr as setAwsClients, gt as isUnboundTemplateParameter, h as maskingRetryLogger, hn as loadPublishableAssetManifest, hr as resetAwsClients, ht as getAccountInfo, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as interruptWatchListenerCount, j as formatResourceLine, jn as buildDockerImage, jr as ProvisioningError, jt as classifyReplaySecretRegion, k as isStatefulRecreateTargetSync, kn as buildDenyExternalAccessPolicy, kr as NestedStackChildDirectDestroyError, kt as requireConfigObject, l as replayRollback, ln as shouldRetainResource, lr as AssemblyReader, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as createAssetRedirectResolver, mr as getAwsClients, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as LockManager, nr as findLargeInlineResources, nt as beginCommandInterruptScope, o as planFailedOps, on as exportNamesCarriedFrom, or as PARTITION_TABLE, ot as startInterruptWatch, p as deleteSkipReason, pn as buildAssetRedirectMap, pr as AwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveSkipPrefix, qr as markRedactedCause, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as displaySafe, rr as uploadCfnTemplate, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputKeys, sr as canonicalizeRegion, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as scrubResourceRecord, tr as MIGRATE_TMP_PREFIX, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as AssetPublisher, ur as processStackMessages, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as stripControlChars, vr as CdkdError, vt as refStateLookupFromResource, w as refusesFinalSnapshot, wn as isCrossRegionRedirect, wr as LocalInvokeBuildError$1, wt as configBooleanRefusal, x as ccRoutedFinalSnapshotError, xn as assertAssetBucketRegion, xt as resolveExplicitPhysicalId, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetModeResolver, yt as WAFv2WebACLProvider, z as collectPublishedOutputNames, zn as getDockerImageBySourceHash, zt as DiffCalculator } from "./deploy-engine-3lJaFGjA.js";
 import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-Dz3Le2Pw.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CPBCBoA5.js";
-import { t as ASGProvider } from "./asg-provider-DEG5QGu2.js";
+import { t as getCdkdVersion } from "./version-B4YqJKXh.js";
+import { t as ASGProvider } from "./asg-provider-D3bSjRiw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -57,7 +57,7 @@ import { ConcurrentModificationException, CrawlerRunningException, CreateConnect
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
-import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
@@ -51420,7 +51420,7 @@ var EFSProvider = class {
 			"AccessPointTags"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
 		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -51782,8 +51782,14 @@ var EFSProvider = class {
 		const posixUser = properties["PosixUser"];
 		const rootDirectory = properties["RootDirectory"];
 		const tags = properties["AccessPointTags"];
+		const clientToken = acquireIdempotencyToken({
+			scope: "CreateAccessPoint",
+			logicalId,
+			maxLength: 64
+		});
 		try {
-			const response = await this.getClient().send(new CreateAccessPointCommand({
+			const response = await this.createOrAdoptAccessPoint(logicalId, resourceType, {
+				ClientToken: clientToken.value,
 				FileSystemId: fileSystemId,
 				PosixUser: posixUser ? {
 					Uid: Number(posixUser.Uid),
@@ -51802,10 +51808,11 @@ var EFSProvider = class {
 					Key: t.Key,
 					Value: t.Value
 				}))
-			}));
+			});
 			const accessPointId = response.AccessPointId;
 			const arn = response.AccessPointArn;
 			this.logger.debug(`Successfully created EFS AccessPoint ${logicalId}: ${accessPointId}`);
+			clientToken.release();
 			return {
 				physicalId: accessPointId,
 				attributes: {
@@ -51814,10 +51821,100 @@ var EFSProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create EFS AccessPoint ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* `CreateAccessPoint`, with the retry-replay case ADOPTED rather than failed
+	* (issue [#2080](https://github.com/go-to-k/cdkd/issues/2080)).
+	*
+	* When EFS REPLAYS a seen token it answers with the access point the lost
+	* response described and this method returns it like any other success. When
+	* it instead REFUSES the repeat -- `AccessPointAlreadyExists`, which the
+	* `CreateAccessPoint` reference documents with no window attached -- the
+	* first attempt's access point is live AND absent from state, which is the
+	* orphan the token exists to prevent, now with a failed deploy on top. How
+	* often each happens is not something EFS documents for this call (see the
+	* DERIVATION note in `createAccessPoint`), so this arm is written as the
+	* ORDINARY recovery path rather than a rare one.
+	* `route53-provider.ts`'s `createOrAdoptHostedZone` is the same pattern for
+	* the same issue family.
+	*
+	* Adoption is CONFIRMED rather than assumed, on two axes: the token (cdkd
+	* mints a per-process value, so only an attempt of THIS create can hold it --
+	* the parameter type requires one, so there is no "both undefined" way to
+	* satisfy the comparison vacuously) and the file system (structural rather
+	* than contingent on the engine resolving properties once per create, which
+	* is true today and is not this method's to rely on).
+	*
+	* Every way the confirmation can fail -- no id on the error, a read-back that
+	* throws, a token or file system that does not match, a description with no
+	* ARN -- DECLINES the adoption, says so at `warn`, and rethrows carrying the
+	* AWS error as `cause`. A conflict cdkd cannot attribute to itself is not
+	* something to paper over, and a lookup failure must never REPLACE the
+	* diagnosis: a missing `elasticfilesystem:DescribeAccessPoints` permission
+	* would otherwise surface as `AccessDenied` and send the next reader after a
+	* permissions problem instead of the token collision that actually happened.
+	*
+	* The rethrow is WRAPPED rather than bare, and that is load-bearing rather
+	* than cosmetic. `DeployEngine`'s replacement path classifies a failed
+	* create-first attempt with `isNameCollisionError`, which tests the
+	* TOP-LEVEL message for `already exists` / `AlreadyExists` -- both of which
+	* the raw AWS conflict carries. A token collision misread as a physical-NAME
+	* collision is not a cosmetic mistake: under `UpdateReplacePolicy: Retain` it
+	* produces advice about renaming a resource that has no name, and under
+	* `--replace` it falls back to delete-first, which DELETES the old access
+	* point and then re-creates with the same still-unreleased token -- colliding
+	* again, against the orphan rather than the old resource. Before this change
+	* the create path could not raise an already-exists shape at all, so the
+	* exposure arrives with the token. The AWS error is preserved as `cause`, so
+	* nothing is lost; only the string the engine classifies on changes.
+	*/
+	async createOrAdoptAccessPoint(logicalId, resourceType, input) {
+		try {
+			return await this.getClient().send(new CreateAccessPointCommand(input));
+		} catch (error) {
+			if (!(error instanceof AccessPointAlreadyExists || error?.name === "AccessPointAlreadyExists")) throw error;
+			const decline = (reason) => {
+				this.logger.warn(`CreateAccessPoint for ${logicalId} was refused because the idempotency token cdkd sent is already bound to an access point, and cdkd declined to adopt it: ${reason}.`);
+				throw markNonRetryable(new ProvisioningError(`EFS refused CreateAccessPoint for ${logicalId}: the idempotency token cdkd sent is already bound to an access point, and cdkd could not confirm that access point is the one this deploy created (${reason}). That access point is NOT recorded in cdkd state -- find it with: aws efs describe-access-points --query "AccessPoints[?ClientToken=='${input.ClientToken}']"`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
+			};
+			const existingId = error?.AccessPointId;
+			if (!existingId) return decline("the conflict named no AccessPointId to read back");
+			let existing;
+			try {
+				const watch = startInterruptWatch(`EFS AccessPoint ${logicalId} (adoption read-back)`);
+				let described;
+				try {
+					described = await withRetry(() => this.getClient().send(new DescribeAccessPointsCommand({ AccessPointId: existingId })), logicalId, {
+						maxRetries: 3,
+						isRetryable: (_text, err) => isThrottlingError(err) || isTransientServerError(err),
+						logger: this.logger,
+						isInterrupted: watch.isInterrupted,
+						onInterrupted: watch.onInterrupted
+					});
+				} finally {
+					watch.dispose();
+				}
+				existing = described.AccessPoints?.[0];
+			} catch (lookupError) {
+				if (isInterruptedWaitError(lookupError)) throw lookupError;
+				const failure = describeAwsFailure(lookupError);
+				this.logger.debug(`Read-back of access point ${existingId} failed with: ${failure.detail}`);
+				return decline(`reading access point ${existingId} back failed: ${failure.summary}`);
+			}
+			if (existing === void 0) return decline(`access point ${existingId} could not be read back`);
+			if (existing.ClientToken !== input.ClientToken) return decline(`access point ${existingId} carries a different ClientToken`);
+			if (existing.FileSystemId !== input.FileSystemId) return decline(`access point ${existingId} belongs to a different file system`);
+			if (!existing.AccessPointId) return decline(`access point ${existingId} was read back without an id`);
+			if (!existing.AccessPointArn) return decline(`access point ${existingId} was read back without an ARN`);
+			if (existing.LifeCycleState === "deleting" || existing.LifeCycleState === "deleted" || existing.LifeCycleState === "error") return decline(`access point ${existingId} is ${existing.LifeCycleState} rather than usable`);
+			this.logger.warn(`CreateAccessPoint was replayed after a lost response; adopting the access point ${existing.AccessPointId} the previous attempt already created instead of creating a second one`);
+			return existing;
+		}
+	}
 	async deleteAccessPoint(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting EFS AccessPoint ${logicalId}: ${physicalId}`);
 		try {
@@ -88901,4 +88998,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-fntegUX1.js.map
+//# sourceMappingURL=program-BU6F1UD2.js.map