@go-to-k/cdkd 0.286.3 → 0.287.0

package/dist/{asg-provider-uaOnRUMe.js → asg-provider-D10GWdiA.js}

@@ -1,9 +1,143 @@
-import { Gr as ResourceUpdateNotSupportedError, K as clearOnUpdateRemoval, St as assertRegionMatch, Ur as ProvisioningError, bt as normalizeAwsTagsToCfn, lt as disableInstanceApiTermination, si as __exportAll } from "./deploy-engine--rkIGhow.js";
+import { Cr as displaySafe, Dt as assertRegionMatch, Tt as normalizeAwsTagsToCfn, X as clearOnUpdateRemoval, Yr as ProvisioningError, Zr as ResourceUpdateNotSupportedError, _n as shellQuote, mt as disableInstanceApiTermination, pi as __exportAll } from "./deploy-engine-B377YKBI.js";
 import { f as generateResourceName, n as getLogger } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
 import { EC2Client } from "@aws-sdk/client-ec2";
 import { AttachLoadBalancerTargetGroupsCommand, AttachLoadBalancersCommand, AttachTrafficSourcesCommand, AutoScalingClient, CreateAutoScalingGroupCommand, CreateOrUpdateTagsCommand, DeleteAutoScalingGroupCommand, DeleteLifecycleHookCommand, DeleteNotificationConfigurationCommand, DeleteTagsCommand as DeleteTagsCommand$1, DescribeAutoScalingGroupsCommand, DescribeLifecycleHooksCommand, DescribeNotificationConfigurationsCommand, DescribeTrafficSourcesCommand, DetachLoadBalancerTargetGroupsCommand, DetachLoadBalancersCommand, DetachTrafficSourcesCommand, DisableMetricsCollectionCommand, EnableMetricsCollectionCommand, PutLifecycleHookCommand, PutNotificationConfigurationCommand, UpdateAutoScalingGroupCommand } from "@aws-sdk/client-auto-scaling";
 
+//#region src/provisioning/replacement-protection-advice.ts
+/**
+* The sentence a provider's replacement advice must say instead of a bare
+* "re-deploy with `--replace`" when cdkd's own properties already say the
+* resource carries a deletion / termination protection flag.
+*
+* Issue [#2579](https://github.com/go-to-k/cdkd/issues/2579) established the
+* shape on `AWS::Logs::LogGroup`: the advised replacement runs its DELETE from
+* the deploy engine, which never sets `DeleteContext.removeProtection` — every
+* provider's flip-off is gated on that field and only the DESTROY paths
+* (`cdkd destroy`, `cdkd state destroy`) set it, because `cdkd deploy`
+* registers no `--remove-protection` Option at all (`deployOptions` in
+* `src/cli/options.ts`, fenced by
+* `tests/unit/cli/replacement-remedy-cli-facts.test.ts` against the real
+* Commander tree). So AWS refuses the delete and the command cdkd just told the
+* user to run dies on a SECOND wall with nothing named to do about it.
+*
+* Issue [#2610](https://github.com/go-to-k/cdkd/issues/2610) swept that shape
+* across the tree and found the same dead end on five more providers. This
+* module is the shared definition those five sites use, so the mechanism is
+* stated once rather than paraphrased five times — the reason
+* `lock-contention-message.ts` exists one directory over, and the reason
+* `display-safe.ts`'s header gives for not widening a rule by hand.
+*
+* `docs/cli-deploy-safety.md`'s "Deletion protection blocks a replacement"
+* section names all six types whose refusal says this explicitly (issue
+* [#2658](https://github.com/go-to-k/cdkd/issues/2658)), including the two
+* exceptions worth knowing before adding a seventh: ASG's arm is narrower than
+* its protection setting, and Cognito's fires after the desired bag is applied.
+*
+* `logs-loggroup-provider.ts` does NOT route through it and keeps its own text:
+* three review rounds on #2579 shaped clauses that are true only of that type
+* (`--force-stateful-recreation` has no per-resource granularity;
+* `LogGroupName` is the type's only replacement property, so a same-name
+* `Retain` replacement cannot complete at all), and a `suffix` parameter wide
+* enough to carry them would make the shared part the smaller half. Its message
+* is pinned by its own tests; this one by
+* `tests/unit/provisioning/replacement-remedy-preconditions.test.ts`.
+*
+* **Read that as a decision about the TEXT, never about the id rendering.**
+* That site hand-quotes its `physicalId` and does NOT get
+* {@link renderDisableCommand}'s sanitize / quote / suppress -- issue
+* [#2669](https://github.com/go-to-k/cdkd/issues/2669), deferred because
+* `tests/integration/loggroup-class-guard/verify.sh` REBUILDS the exact command
+* string to grep for it, so changing the rendering without re-running that
+* fixture leaves it green and blind.
+*
+* Two properties every caller owes, because only the caller can answer them:
+*
+* - **`evidence` must name the BAG it read.** Most read the RECORDED bag
+*   (`previousProperties`), which on the deploy path is
+*   `ResourceState.properties` — cdkd's best account of what AWS holds on the
+*   resource that is about to be deleted. A caller whose refusal fires AFTER
+*   the desired bag has been applied (`CognitoUserPoolProvider`'s schema guard
+*   runs after `UpdateUserPool`) must read the desired value first and say so.
+*   Protection enabled OUT OF BAND is in no bag at all, so such a resource
+*   still gets the short advice and still hits the wall — cdkd cannot see what
+*   it never recorded, and probing AWS from a refusal path would add a call to
+*   the failure route. Interpolate no unsanitized value into it: it is rendered
+*   to a terminal and captured into `deployments/*.jsonl`.
+* - **`disable.command` must change nothing but the flag.** Where a service's
+*   update API may take other members down with the flag, say so through
+*   `disable.caveat` — rendered OUTSIDE the backticks, so the pasteable span
+*   stays pasteable.
+*
+*   **State only what has been measured, per field.** This text used to assert
+*   that Cognito's `UpdateUserPool` "resets every member it is not sent" —
+*   AWS's own blanket wording, which `cognito-provider.ts`'s
+*   `readLiveMfaConfiguration` ledger shows holds FIELD BY FIELD and is FALSE
+*   for at least two (`MfaConfiguration` and both `Policies` sub-keys survive
+*   omission; `AutoVerifiedAttributes` does not). Issue
+*   [#2610](https://github.com/go-to-k/cdkd/issues/2610)'s review retired that
+*   universal from the user-facing caveat, and it survived HERE for a round —
+*   which is the failure mode worth naming, because this is the normative text
+*   a future caller copies. A blanket "resets to default" claim is per-field
+*   and needs a per-field measurement; `DeletionProtection`'s is issue
+*   [#2675](https://github.com/go-to-k/cdkd/issues/2675).
+*/
+/**
+* The doc section every caller points at. A single constant so a rename of the
+* heading cannot leave five providers pointing at a section that no longer
+* exists; `tests/unit/provisioning/replacement-remedy-preconditions.test.ts`
+* resolves it against `docs/cli-deploy-safety.md`'s actual headings.
+*/
+const DELETION_PROTECTION_DOC_POINTER = "\"Deletion protection blocks a replacement, and deploy cannot clear it\" in docs/cli-deploy-safety.md";
+/** What the message says when the resource id cannot be named on a command line. */
+const UNNAMEABLE_ID_CLAUSE = "Then disable protection out of band, via the console: the physical id cdkd recorded for this resource cannot be reproduced safely on a command line, so any command shown here would act on a different resource.";
+/**
+* Render `disable` as a pasteable command, or `''` when its id cannot be named.
+*
+* The id reaching here is NOT an AWS-minted literal, which an earlier revision
+* of this module claimed and the review of issue [#2610] disproved: the deploy
+* engine passes `currentResource.physicalId` straight off `state.json`, and for
+* `AWS::DynamoDB::GlobalTable` and `AWS::AutoScaling::AutoScalingGroup` the
+* physical id is the TEMPLATE-chosen name. So it is exactly the class
+* `lock-contention-message.ts` handles, and it gets the identical treatment
+* rather than a second spelling of it:
+*
+*  - sanitize FIRST (`asciiOnly`, a positive allowlist — a control character
+*    has no legitimate place in an AWS physical id, and left in it forges lines
+*    on the operator's terminal and inside `deployments/*.jsonl`);
+*  - then `shellQuote`, the SAME predicate the force-unlock hint uses, so a
+*    value carrying a quote or a space cannot truncate when pasted;
+*  - and SUPPRESS the whole command when sanitizing CHANGED the value, because
+*    a command naming the sanitized id would act on a DIFFERENT resource — the
+*    wrong-target harm that module exists to prevent, and the reason emitting
+*    no command is the honest answer rather than a fallback.
+*/
+function renderDisableCommand(disable) {
+	const safeId = displaySafe(disable.identifier, { asciiOnly: true });
+	if (!safeId || safeId !== disable.identifier) return "";
+	const tail = disable.after ? ` ${disable.after}` : "";
+	return `${disable.before} ${shellQuote(safeId)}${tail}`;
+}
+/**
+* Build the "your advised replacement is blocked by a protection flag" advice.
+*
+* Deliberately STOPS at what a provider's `update()` can know. It sees neither
+* `UpdateReplacePolicy` nor what the replacement then does, and three review
+* rounds on issue [#2579] each proved a different sentence about that
+* downstream mechanism false — so the outcome of disabling is handed to the
+* doc, which has the policy in view. A shorter message that is TRUE beats a
+* complete one that is not.
+*/
+function protectedReplacementAdvice(args) {
+	const { evidence, replaceFlags } = args;
+	const disable = args.disable;
+	const command = renderDisableCommand(disable);
+	const head = `${evidence}, so ${replaceFlags} alone will NOT succeed while AWS still has protection on: the replacement DELETES the resource, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read ${DELETION_PROTECTION_DOC_POINTER} BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see.`;
+	if (!command) return `${head} ${UNNAMEABLE_ID_CLAUSE} Then re-run with ${replaceFlags}.`;
+	return `${head} Then disable protection out of band — \`${command}\`, or via the console.${disable.caveat ? ` ${disable.caveat}` : ""} Then re-run with ${replaceFlags}.`;
+}
+
+//#endregion
 //#region src/provisioning/providers/asg-provider.ts
 var asg_provider_exports = /* @__PURE__ */ __exportAll({ ASGProvider: () => ASGProvider });
 /**
@@ -203,7 +337,15 @@ var ASGProvider = class ASGProvider {
 		if (resourceType !== "AWS::AutoScaling::AutoScalingGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		this.logger.debug(`Updating AutoScalingGroup ${logicalId}: ${physicalId}`);
 		const stringEq = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-		if (!stringEq(properties["AutoScalingGroupName"], previousProperties["AutoScalingGroupName"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. Use cdkd deploy --replace to replace the group.");
+		if (!stringEq(properties["AutoScalingGroupName"], previousProperties["AutoScalingGroupName"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. " + (previousProperties["DeletionProtection"] === "prevent-all-deletion" ? protectedReplacementAdvice({
+			evidence: "cdkd's recorded properties for this group carry DeletionProtection: prevent-all-deletion",
+			replaceFlags: "cdkd deploy --replace",
+			disable: {
+				before: "aws autoscaling update-auto-scaling-group --auto-scaling-group-name",
+				identifier: physicalId,
+				after: "--deletion-protection none"
+			}
+		}) : "Use cdkd deploy --replace to replace the group."));
 		try {
 			await this.applyTagsDiff(physicalId, properties["Tags"], previousProperties["Tags"]);
 			await this.applyLoadBalancerNamesDiff(physicalId, properties["LoadBalancerNames"], previousProperties["LoadBalancerNames"]);
@@ -851,5 +993,5 @@ function mapNotificationsToCfn(configurations) {
 }
 
 //#endregion
-export { asg_provider_exports as n, ASGProvider as t };
-//# sourceMappingURL=asg-provider-uaOnRUMe.js.map
+export { asg_provider_exports as n, protectedReplacementAdvice as r, ASGProvider as t };
+//# sourceMappingURL=asg-provider-D10GWdiA.js.map

package/dist/asg-provider-D10GWdiA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asg-provider-D10GWdiA.js","names":["DeleteTagsCommand"],"sources":["../src/provisioning/replacement-protection-advice.ts","../src/provisioning/providers/asg-provider.ts"],"sourcesContent":["/**\n * The sentence a provider's replacement advice must say instead of a bare\n * \"re-deploy with `--replace`\" when cdkd's own properties already say the\n * resource carries a deletion / termination protection flag.\n *\n * Issue [#2579](https://github.com/go-to-k/cdkd/issues/2579) established the\n * shape on `AWS::Logs::LogGroup`: the advised replacement runs its DELETE from\n * the deploy engine, which never sets `DeleteContext.removeProtection` — every\n * provider's flip-off is gated on that field and only the DESTROY paths\n * (`cdkd destroy`, `cdkd state destroy`) set it, because `cdkd deploy`\n * registers no `--remove-protection` Option at all (`deployOptions` in\n * `src/cli/options.ts`, fenced by\n * `tests/unit/cli/replacement-remedy-cli-facts.test.ts` against the real\n * Commander tree). So AWS refuses the delete and the command cdkd just told the\n * user to run dies on a SECOND wall with nothing named to do about it.\n *\n * Issue [#2610](https://github.com/go-to-k/cdkd/issues/2610) swept that shape\n * across the tree and found the same dead end on five more providers. This\n * module is the shared definition those five sites use, so the mechanism is\n * stated once rather than paraphrased five times — the reason\n * `lock-contention-message.ts` exists one directory over, and the reason\n * `display-safe.ts`'s header gives for not widening a rule by hand.\n *\n * `docs/cli-deploy-safety.md`'s \"Deletion protection blocks a replacement\"\n * section names all six types whose refusal says this explicitly (issue\n * [#2658](https://github.com/go-to-k/cdkd/issues/2658)), including the two\n * exceptions worth knowing before adding a seventh: ASG's arm is narrower than\n * its protection setting, and Cognito's fires after the desired bag is applied.\n *\n * `logs-loggroup-provider.ts` does NOT route through it and keeps its own text:\n * three review rounds on #2579 shaped clauses that are true only of that type\n * (`--force-stateful-recreation` has no per-resource granularity;\n * `LogGroupName` is the type's only replacement property, so a same-name\n * `Retain` replacement cannot complete at all), and a `suffix` parameter wide\n * enough to carry them would make the shared part the smaller half. Its message\n * is pinned by its own tests; this one by\n * `tests/unit/provisioning/replacement-remedy-preconditions.test.ts`.\n *\n * **Read that as a decision about the TEXT, never about the id rendering.**\n * That site hand-quotes its `physicalId` and does NOT get\n * {@link renderDisableCommand}'s sanitize / quote / suppress -- issue\n * [#2669](https://github.com/go-to-k/cdkd/issues/2669), deferred because\n * `tests/integration/loggroup-class-guard/verify.sh` REBUILDS the exact command\n * string to grep for it, so changing the rendering without re-running that\n * fixture leaves it green and blind.\n *\n * Two properties every caller owes, because only the caller can answer them:\n *\n * - **`evidence` must name the BAG it read.** Most read the RECORDED bag\n *   (`previousProperties`), which on the deploy path is\n *   `ResourceState.properties` — cdkd's best account of what AWS holds on the\n *   resource that is about to be deleted. A caller whose refusal fires AFTER\n *   the desired bag has been applied (`CognitoUserPoolProvider`'s schema guard\n *   runs after `UpdateUserPool`) must read the desired value first and say so.\n *   Protection enabled OUT OF BAND is in no bag at all, so such a resource\n *   still gets the short advice and still hits the wall — cdkd cannot see what\n *   it never recorded, and probing AWS from a refusal path would add a call to\n *   the failure route. Interpolate no unsanitized value into it: it is rendered\n *   to a terminal and captured into `deployments/*.jsonl`.\n * - **`disable.command` must change nothing but the flag.** Where a service's\n *   update API may take other members down with the flag, say so through\n *   `disable.caveat` — rendered OUTSIDE the backticks, so the pasteable span\n *   stays pasteable.\n *\n *   **State only what has been measured, per field.** This text used to assert\n *   that Cognito's `UpdateUserPool` \"resets every member it is not sent\" —\n *   AWS's own blanket wording, which `cognito-provider.ts`'s\n *   `readLiveMfaConfiguration` ledger shows holds FIELD BY FIELD and is FALSE\n *   for at least two (`MfaConfiguration` and both `Policies` sub-keys survive\n *   omission; `AutoVerifiedAttributes` does not). Issue\n *   [#2610](https://github.com/go-to-k/cdkd/issues/2610)'s review retired that\n *   universal from the user-facing caveat, and it survived HERE for a round —\n *   which is the failure mode worth naming, because this is the normative text\n *   a future caller copies. A blanket \"resets to default\" claim is per-field\n *   and needs a per-field measurement; `DeletionProtection`'s is issue\n *   [#2675](https://github.com/go-to-k/cdkd/issues/2675).\n */\n\nimport { displaySafe } from '../utils/display-safe.js';\nimport { shellQuote } from '../state/lock-contention-message.js';\n\n/**\n * The doc section every caller points at. A single constant so a rename of the\n * heading cannot leave five providers pointing at a section that no longer\n * exists; `tests/unit/provisioning/replacement-remedy-preconditions.test.ts`\n * resolves it against `docs/cli-deploy-safety.md`'s actual headings.\n */\nexport const DELETION_PROTECTION_DOC_POINTER =\n  '\"Deletion protection blocks a replacement, and deploy cannot clear it\" in docs/cli-deploy-safety.md';\n\n/** What the message says when the resource id cannot be named on a command line. */\nexport const UNNAMEABLE_ID_CLAUSE =\n  'Then disable protection out of band, via the console: the physical id cdkd recorded for this ' +\n  'resource cannot be reproduced safely on a command line, so any command shown here would act on ' +\n  'a different resource.';\n\n/**\n * A string the COMPILER can prove is a literal.\n *\n * Two shapes are rejected, and the second is the one a plain\n * `string extends T` test misses:\n *\n *  - a WIDENED `string` -- what every non-literal expression produces:\n *    `'lit ' + String(x)`, a `const` declared `: string`, a value read out of a\n *    builder's return type, a spread of any of those, and (deliberately) a\n *    concatenation of two literals;\n *  - a TEMPLATE LITERAL TYPE carrying an interpolation. `` `aws x ${derived}` ``\n *    does NOT widen to `string` -- its type is `` `aws x ${string}` ``, so\n *    `string extends T` is FALSE and a one-line constraint accepts it, while\n *    the interpolated span is exactly the attacker-controlled text this module\n *    exists to keep out of a pasteable command. `HasInterpolation` walks the\n *    type one character at a time and reports any tail that IS `string`, which\n *    is what a `${...}` hole leaves behind. Measured on the longest literal in\n *    use (203 characters): no depth error, whole-project typecheck unchanged.\n *\n * Both resolve to `never` and fail to assign, at `vp run typecheck`.\n *\n * **Why a TYPE and not a test.** This constraint replaced a source-text sniff\n * over `src/` that was three spellings deep by the time issue [#2610]'s fifth\n * review round reached it: the first cut tested only a value's opening\n * character; the second joined continuation lines only until the value first\n * looked literal, so Prettier's operator-at-line-start layout walked through;\n * the third derived its population from field names near an `identifier`, which\n * a builder returning `{ before, after }` from another module simply exits.\n * Each hole was closed and the next one was found by the next probe. A grep\n * cannot see a type, so the honest fix is to stop grepping: a widened `string`\n * is now a COMPILE ERROR, which no refactor, spread, shorthand or far-away\n * `const` can walk out of. `tests/unit/cli/replacement-remedy-cli-facts.test.ts`\n * pins one `@ts-expect-error` per evasion shape instead.\n *\n * The one shape it also rejects is a concatenation of two LITERALS\n * (`'a' + 'b'` widens to `string` in TypeScript). That is a real cost, paid\n * deliberately: a single literal is what the fence can see, and the one caller\n * that concatenated was rewritten to use one.\n */\ntype HasInterpolation<T extends string> = string extends T\n  ? true\n  : T extends `${infer _Head}${infer Rest}`\n    ? string extends Rest\n      ? true\n      : HasInterpolation<Rest>\n    : false;\n\nexport type CdkdAuthoredLiteral<T extends string> = HasInterpolation<T> extends true ? never : T;\n\n/**\n * The out-of-band disable command, split so only the IDENTIFIER is untrusted.\n *\n * `before` / `after` / `caveat` are rendered VERBATIM (inside the backticks for\n * the first two, beside them for the third), so they must be cdkd-authored\n * literals — the compiler now enforces that. `identifier` is the opposite: it\n * is a `state.json` value, and {@link protectedReplacementAdvice} sanitizes,\n * shell-quotes and suppresses it.\n */\nexport interface ProtectedReplacementDisableCommand<\n  Before extends string = string,\n  After extends string = string,\n  Caveat extends string = string,\n> {\n  /**\n   * Everything before the resource id, e.g.\n   * `aws elbv2 modify-load-balancer-attributes --load-balancer-arn`.\n   */\n  before: CdkdAuthoredLiteral<Before>;\n  /**\n   * The resource's physical id. SANITIZED and SHELL-QUOTED here, and the whole\n   * command is SUPPRESSED when sanitizing changes it — see\n   * {@link protectedReplacementAdvice}.\n   */\n  identifier: string;\n  /**\n   * Everything after the id, e.g.\n   * `--attributes Key=deletion_protection.enabled,Value=false`.\n   */\n  after?: CdkdAuthoredLiteral<After>;\n  /**\n   * Rendered as a sentence AFTER the command, never inside its backticks — it\n   * reaches the terminal and the persisted events store like everything else\n   * here.\n   */\n  caveat?: CdkdAuthoredLiteral<Caveat>;\n}\n\n/** The same shape with the literal constraint discharged, for internal use. */\ninterface ResolvedDisableCommand {\n  before: string;\n  identifier: string;\n  after?: string;\n  caveat?: string;\n}\n\nexport interface ProtectedReplacementAdviceArgs<\n  Before extends string = string,\n  After extends string = string,\n  Caveat extends string = string,\n> {\n  /**\n   * A complete clause naming WHAT cdkd read and WHERE, with no trailing\n   * punctuation — e.g. `\"cdkd's recorded properties for this cluster carry\n   * Instances.TerminationProtected: true\"`. It is the first half of the\n   * returned sentence, so it must read as a subject + verb.\n   */\n  evidence: string;\n  /**\n   * The flags the SHORT advice at this site names, spelled exactly as the user\n   * would type them (e.g. `'cdkd deploy --replace --force-stateful-recreation'`).\n   * Named twice in the output — once in the refusal and once in the re-run — so\n   * the two can never drift.\n   */\n  replaceFlags: string;\n  /** A concrete out-of-band way to turn protection off. */\n  disable: ProtectedReplacementDisableCommand<Before, After, Caveat>;\n}\n\n/**\n * Render `disable` as a pasteable command, or `''` when its id cannot be named.\n *\n * The id reaching here is NOT an AWS-minted literal, which an earlier revision\n * of this module claimed and the review of issue [#2610] disproved: the deploy\n * engine passes `currentResource.physicalId` straight off `state.json`, and for\n * `AWS::DynamoDB::GlobalTable` and `AWS::AutoScaling::AutoScalingGroup` the\n * physical id is the TEMPLATE-chosen name. So it is exactly the class\n * `lock-contention-message.ts` handles, and it gets the identical treatment\n * rather than a second spelling of it:\n *\n *  - sanitize FIRST (`asciiOnly`, a positive allowlist — a control character\n *    has no legitimate place in an AWS physical id, and left in it forges lines\n *    on the operator's terminal and inside `deployments/*.jsonl`);\n *  - then `shellQuote`, the SAME predicate the force-unlock hint uses, so a\n *    value carrying a quote or a space cannot truncate when pasted;\n *  - and SUPPRESS the whole command when sanitizing CHANGED the value, because\n *    a command naming the sanitized id would act on a DIFFERENT resource — the\n *    wrong-target harm that module exists to prevent, and the reason emitting\n *    no command is the honest answer rather than a fallback.\n */\nfunction renderDisableCommand(disable: ResolvedDisableCommand): string {\n  const safeId = displaySafe(disable.identifier, { asciiOnly: true });\n  if (!safeId || safeId !== disable.identifier) return '';\n  const tail = disable.after ? ` ${disable.after}` : '';\n  return `${disable.before} ${shellQuote(safeId)}${tail}`;\n}\n\n/**\n * Build the \"your advised replacement is blocked by a protection flag\" advice.\n *\n * Deliberately STOPS at what a provider's `update()` can know. It sees neither\n * `UpdateReplacePolicy` nor what the replacement then does, and three review\n * rounds on issue [#2579] each proved a different sentence about that\n * downstream mechanism false — so the outcome of disabling is handed to the\n * doc, which has the policy in view. A shorter message that is TRUE beats a\n * complete one that is not.\n */\nexport function protectedReplacementAdvice<\n  Before extends string,\n  After extends string = string,\n  Caveat extends string = string,\n>(args: ProtectedReplacementAdviceArgs<Before, After, Caveat>): string {\n  const { evidence, replaceFlags } = args;\n  // The literal constraint has done its work at the call site; inside, these\n  // are ordinary strings.\n  const disable = args.disable as ResolvedDisableCommand;\n  const command = renderDisableCommand(disable);\n  const head =\n    `${evidence}, so ${replaceFlags} alone will NOT succeed while AWS still has protection on: ` +\n    `the replacement DELETES the resource, AWS refuses that delete while protection is on, and ` +\n    `cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and ` +\n    `cdkd state destroy act on one). Read ${DELETION_PROTECTION_DOC_POINTER} BEFORE you disable ` +\n    `anything: whether disabling helps at all, and what the flag ends up as, depend on your ` +\n    `UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can ` +\n    `see.`;\n  if (!command) return `${head} ${UNNAMEABLE_ID_CLAUSE} Then re-run with ${replaceFlags}.`;\n  const caveat = disable.caveat ? ` ${disable.caveat}` : '';\n  return (\n    `${head} Then disable protection out of band — \\`${command}\\`, or via the console.${caveat} ` +\n    `Then re-run with ${replaceFlags}.`\n  );\n}\n","import {\n  AutoScalingClient,\n  CreateAutoScalingGroupCommand,\n  UpdateAutoScalingGroupCommand,\n  DeleteAutoScalingGroupCommand,\n  DescribeAutoScalingGroupsCommand,\n  type DescribeAutoScalingGroupsCommandOutput,\n  DescribeLifecycleHooksCommand,\n  DescribeTrafficSourcesCommand,\n  DescribeNotificationConfigurationsCommand,\n  EnableMetricsCollectionCommand,\n  DisableMetricsCollectionCommand,\n  PutLifecycleHookCommand,\n  DeleteLifecycleHookCommand,\n  AttachTrafficSourcesCommand,\n  DetachTrafficSourcesCommand,\n  PutNotificationConfigurationCommand,\n  DeleteNotificationConfigurationCommand,\n  CreateOrUpdateTagsCommand,\n  DeleteTagsCommand,\n  AttachLoadBalancersCommand,\n  DetachLoadBalancersCommand,\n  AttachLoadBalancerTargetGroupsCommand,\n  DetachLoadBalancerTargetGroupsCommand,\n  type Tag as ASGTag,\n  type LaunchTemplateSpecification,\n  type AvailabilityZoneDistribution,\n  type CapacityReservationSpecification,\n  type DeletionProtection,\n  type InstanceMaintenancePolicy,\n} from '@aws-sdk/client-auto-scaling';\nimport { EC2Client } from '@aws-sdk/client-ec2';\nimport { getLogger } from '../../utils/logger.js';\nimport { ProvisioningError, ResourceUpdateNotSupportedError } from '../../utils/error-handler.js';\nimport { assertRegionMatch, type DeleteContext } from '../region-check.js';\nimport { disableInstanceApiTermination } from '../ec2-termination-protection.js';\nimport { generateResourceName } from '../resource-name.js';\nimport { normalizeAwsTagsToCfn } from '../import-helpers.js';\nimport type {\n  ResourceProvider,\n  ResourceCreateResult,\n  ResourceUpdateResult,\n  CreateContext,\n  UpdateContext,\n  SecretMasker,\n} from '../../types/resource.js';\nimport { clearOnUpdateRemoval } from '../update-removal.js';\nimport { protectedReplacementAdvice } from '../replacement-protection-advice.js';\nimport { awsClientDefaults } from '../../utils/aws-client-defaults.js';\n\n/**\n * AWS Auto Scaling Provider\n *\n * Implements resource provisioning for `AWS::AutoScaling::AutoScalingGroup`.\n *\n * WHY a dedicated SDK provider (instead of CC API fallback):\n *   1. Owns the `--remove-protection` flip-off: ASG protection has three\n *      levels (`none` / `prevent-force-deletion` / `prevent-all-deletion`)\n *      and the destroy path needs to (a) clear it via `UpdateAutoScalingGroup\n *      ({DeletionProtection: 'none'})` before the actual delete and (b) set\n *      `ForceDelete: true` on `DeleteAutoScalingGroup` so AWS terminates any\n *      running instances as part of the delete (matches the user's \"I know\n *      what I'm doing\" intent).\n *   2. Faster than CC API for the common case — direct Create/Update calls\n *      with no eventual-consistency polling beyond what `DescribeAutoScaling\n *      Groups` already provides.\n *\n * Update has narrower coverage than create: AWS does not support modifying\n * `AutoScalingGroupName` (immutable) — that diff still surfaces\n * `ResourceUpdateNotSupportedError` so the caller can `cdkd deploy\n * --replace`. The mutable fields handled in-place via\n * `UpdateAutoScalingGroup` include MinSize / MaxSize / DesiredCapacity /\n * VPCZoneIdentifier / HealthCheckType / HealthCheckGracePeriod /\n * DefaultCooldown / Cooldown / NewInstancesProtectedFromScaleIn /\n * MaxInstanceLifetime / TerminationPolicies / CapacityRebalance /\n * ServiceLinkedRoleARN / Context / DesiredCapacityType /\n * DefaultInstanceWarmup / AvailabilityZones / AvailabilityZoneDistribution\n * / AvailabilityZoneImpairmentPolicy / SkipZonalShiftValidation /\n * CapacityReservationSpecification / InstanceMaintenancePolicy /\n * DeletionProtection / MixedInstancesPolicy / LaunchTemplate.\n *\n * `UpdateAutoScalingGroup` has merge semantics (absent input field = \"no\n * change\"), so update() routes every optional mutable field through\n * `clearOnUpdateRemoval` — a property REMOVED from the template is reset to\n * its CFn default / SDK-documented clear sentinel, matching CloudFormation\n * (issue #1160).\n *\n * Sub-shape diffs are applied via dedicated AWS APIs before the main\n * `UpdateAutoScalingGroup` call:\n *   - `Tags` → `CreateOrUpdateTags` / `DeleteTags` (#475)\n *   - `LoadBalancerNames` → `AttachLoadBalancers` /\n *     `DetachLoadBalancers` (#476)\n *   - `TargetGroupARNs` → `AttachLoadBalancerTargetGroups` /\n *     `DetachLoadBalancerTargetGroups` (#476)\n *   - `MetricsCollection` → `EnableMetricsCollection` /\n *     `DisableMetricsCollection`\n *   - `LifecycleHookSpecificationList` → per-entry `PutLifecycleHook` /\n *     `DeleteLifecycleHook`\n *   - `TrafficSources` → `AttachTrafficSources` /\n *     `DetachTrafficSources`\n *   - `NotificationConfigurations` → per-topic\n *     `PutNotificationConfiguration` /\n *     `DeleteNotificationConfiguration`\n *\n * Each helper is a no-op when the before/after JSON is identical.\n */\nexport class ASGProvider implements ResourceProvider {\n  private asgClient?: AutoScalingClient;\n  private ec2Client?: EC2Client;\n  private readonly providerRegion = process.env['AWS_REGION'];\n  private logger = getLogger().child('ASGProvider');\n\n  handledProperties = new Map<string, ReadonlySet<string>>([\n    [\n      'AWS::AutoScaling::AutoScalingGroup',\n      new Set([\n        'AutoScalingGroupName',\n        'LaunchTemplate',\n        'MinSize',\n        'MaxSize',\n        'DesiredCapacity',\n        'VPCZoneIdentifier',\n        'AvailabilityZones',\n        'HealthCheckType',\n        'HealthCheckGracePeriod',\n        'Cooldown',\n        'DefaultCooldown',\n        'Tags',\n        'TerminationPolicies',\n        'NewInstancesProtectedFromScaleIn',\n        'CapacityRebalance',\n        'ServiceLinkedRoleARN',\n        'MaxInstanceLifetime',\n        'LoadBalancerNames',\n        'TargetGroupARNs',\n        'MetricsCollection',\n        'LifecycleHookSpecificationList',\n        'MixedInstancesPolicy',\n        'Context',\n        'DesiredCapacityType',\n        'DefaultInstanceWarmup',\n        'TrafficSources',\n        'NotificationConfigurations',\n        'AvailabilityZoneDistribution',\n        'AvailabilityZoneImpairmentPolicy',\n        'SkipZonalShiftValidation',\n        'CapacityReservationSpecification',\n        'InstanceMaintenancePolicy',\n        'DeletionProtection',\n      ]),\n    ],\n  ]);\n\n  unhandledByDesign = new Map<string, ReadonlyMap<string, string>>([\n    [\n      'AWS::AutoScaling::AutoScalingGroup',\n      new Map<string, string>([\n        [\n          'LaunchConfigurationName',\n          'AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead',\n        ],\n        [\n          'NotificationConfiguration',\n          'Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires',\n        ],\n      ]),\n    ],\n  ]);\n\n  private getClient(): AutoScalingClient {\n    if (!this.asgClient) {\n      this.asgClient = new AutoScalingClient({\n        ...awsClientDefaults(),\n        ...(this.providerRegion ? { region: this.providerRegion } : {}),\n      });\n    }\n    return this.asgClient;\n  }\n\n  private getEc2Client(): EC2Client {\n    if (!this.ec2Client) {\n      this.ec2Client = new EC2Client({\n        ...awsClientDefaults(),\n        ...(this.providerRegion ? { region: this.providerRegion } : {}),\n      });\n    }\n    return this.ec2Client;\n  }\n\n  // ─── Dispatch ─────────────────────────────────────────────────────\n\n  /**\n   * The `context` parameter is read for ONE thing: `maskSecrets` (issue #1932\n   * item 3, adopted here by issue #1997).\n   *\n   * An earlier revision of this comment claimed the create path had no site to\n   * mask, on the grounds that it names \"only the logical id and the generated\n   * group name\". Both halves were wrong: `groupName` falls back to a generated\n   * name only when `AutoScalingGroupName` is ABSENT, so when the template\n   * DECLARES it the value is a resolved property value — and it IS logged, on\n   * the line below. Debug level is not an exemption; the contract's rule is any\n   * log line that interpolates a value from the `properties` bag, and this\n   * provider already masks its convergence-poll debug line for that reason.\n   */\n  async create(\n    logicalId: string,\n    resourceType: string,\n    properties: Record<string, unknown>,\n    context?: CreateContext\n  ): Promise<ResourceCreateResult> {\n    if (resourceType !== 'AWS::AutoScaling::AutoScalingGroup') {\n      throw new ProvisioningError(\n        `Unsupported resource type: ${resourceType}`,\n        resourceType,\n        logicalId\n      );\n    }\n\n    const groupName =\n      (properties['AutoScalingGroupName'] as string | undefined) ||\n      generateResourceName(logicalId, { maxLength: 255 });\n\n    // ONE masked sink for this method's own lines (issue #1997).\n    const maskSecrets: SecretMasker = context?.maskSecrets ?? ((text) => text);\n    const debug = (message: string): void => this.logger.debug(maskSecrets(message));\n    debug(`Creating AutoScalingGroup ${logicalId}: ${maskSecrets(groupName)}`);\n\n    try {\n      const launchTemplate = this.buildLaunchTemplate(properties);\n      const tags = this.buildTags(groupName, properties);\n      const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties['VPCZoneIdentifier']);\n\n      const minSize = properties['MinSize'] != null ? Number(properties['MinSize']) : 0;\n      const maxSize = properties['MaxSize'] != null ? Number(properties['MaxSize']) : minSize;\n\n      await this.getClient().send(\n        new CreateAutoScalingGroupCommand({\n          AutoScalingGroupName: groupName,\n          MinSize: minSize,\n          MaxSize: maxSize,\n          ...(properties['DesiredCapacity'] != null && {\n            DesiredCapacity: Number(properties['DesiredCapacity']),\n          }),\n          ...(launchTemplate && { LaunchTemplate: launchTemplate }),\n          ...(properties['MixedInstancesPolicy'] !== undefined && {\n            MixedInstancesPolicy: properties['MixedInstancesPolicy'] as never,\n          }),\n          ...(vpcZoneIdentifier !== undefined && { VPCZoneIdentifier: vpcZoneIdentifier }),\n          ...(properties['AvailabilityZones'] !== undefined && {\n            AvailabilityZones: properties['AvailabilityZones'] as string[],\n          }),\n          ...(properties['HealthCheckType'] !== undefined && {\n            HealthCheckType: properties['HealthCheckType'] as string,\n          }),\n          ...(properties['HealthCheckGracePeriod'] != null && {\n            HealthCheckGracePeriod: Number(properties['HealthCheckGracePeriod']),\n          }),\n          ...(properties['Cooldown'] != null && {\n            DefaultCooldown: Number(properties['Cooldown']),\n          }),\n          ...(properties['DefaultCooldown'] != null && {\n            DefaultCooldown: Number(properties['DefaultCooldown']),\n          }),\n          ...(properties['TerminationPolicies'] !== undefined && {\n            TerminationPolicies: properties['TerminationPolicies'] as string[],\n          }),\n          ...(properties['NewInstancesProtectedFromScaleIn'] !== undefined && {\n            NewInstancesProtectedFromScaleIn: properties[\n              'NewInstancesProtectedFromScaleIn'\n            ] as boolean,\n          }),\n          ...(properties['CapacityRebalance'] !== undefined && {\n            CapacityRebalance: properties['CapacityRebalance'] as boolean,\n          }),\n          ...(properties['ServiceLinkedRoleARN'] !== undefined && {\n            ServiceLinkedRoleARN: properties['ServiceLinkedRoleARN'] as string,\n          }),\n          ...(properties['MaxInstanceLifetime'] != null && {\n            MaxInstanceLifetime: Number(properties['MaxInstanceLifetime']),\n          }),\n          ...(properties['LoadBalancerNames'] !== undefined && {\n            LoadBalancerNames: properties['LoadBalancerNames'] as string[],\n          }),\n          ...(properties['TargetGroupARNs'] !== undefined && {\n            TargetGroupARNs: properties['TargetGroupARNs'] as string[],\n          }),\n          ...(properties['Context'] !== undefined && {\n            Context: properties['Context'] as string,\n          }),\n          ...(properties['DesiredCapacityType'] !== undefined && {\n            DesiredCapacityType: properties['DesiredCapacityType'] as string,\n          }),\n          ...(properties['DefaultInstanceWarmup'] != null && {\n            DefaultInstanceWarmup: Number(properties['DefaultInstanceWarmup']),\n          }),\n          ...(properties['LifecycleHookSpecificationList'] !== undefined && {\n            LifecycleHookSpecificationList: properties['LifecycleHookSpecificationList'] as never,\n          }),\n          ...(properties['TrafficSources'] !== undefined && {\n            TrafficSources: properties['TrafficSources'] as never,\n          }),\n          ...(properties['AvailabilityZoneDistribution'] !== undefined && {\n            AvailabilityZoneDistribution: properties['AvailabilityZoneDistribution'] as never,\n          }),\n          ...(properties['AvailabilityZoneImpairmentPolicy'] !== undefined && {\n            AvailabilityZoneImpairmentPolicy: properties[\n              'AvailabilityZoneImpairmentPolicy'\n            ] as never,\n          }),\n          ...(properties['SkipZonalShiftValidation'] !== undefined && {\n            SkipZonalShiftValidation: properties['SkipZonalShiftValidation'] as boolean,\n          }),\n          ...(properties['CapacityReservationSpecification'] !== undefined && {\n            CapacityReservationSpecification: properties[\n              'CapacityReservationSpecification'\n            ] as never,\n          }),\n          ...(properties['InstanceMaintenancePolicy'] !== undefined && {\n            InstanceMaintenancePolicy: properties['InstanceMaintenancePolicy'] as never,\n          }),\n          ...(properties['DeletionProtection'] !== undefined && {\n            DeletionProtection: properties['DeletionProtection'] as never,\n          }),\n          ...(tags.length > 0 && { Tags: tags }),\n        })\n      );\n\n      debug(`Successfully created AutoScalingGroup ${logicalId}: ${maskSecrets(groupName)}`);\n\n      const arn = await this.fetchArn(groupName);\n      const attributes: Record<string, unknown> = {};\n      if (arn) attributes['Arn'] = arn;\n      if (launchTemplate?.LaunchTemplateId) {\n        attributes['LaunchTemplateID'] = launchTemplate.LaunchTemplateId;\n      }\n      return { physicalId: groupName, attributes };\n    } catch (error) {\n      const cause = error instanceof Error ? error : undefined;\n      throw new ProvisioningError(\n        `Failed to create AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,\n        resourceType,\n        logicalId,\n        groupName,\n        cause\n      );\n    }\n  }\n\n  /**\n   * The `context` parameter is read for ONE thing today: `maskSecrets` (issue\n   * #1932 item 3, adopted here by issue #1997). `applyTargetGroupArnsDiff` is\n   * the only path in this provider that interpolates a RESOLVED property value\n   * into a log line — its convergence timeout names the expected\n   * `TargetGroupARNs` set — so it is the only one the masker is threaded into.\n   *\n   * `create()` takes the masker too — see its own doc for why the original\n   * \"nothing to mask there\" reading was wrong.\n   */\n  async update(\n    logicalId: string,\n    physicalId: string,\n    resourceType: string,\n    properties: Record<string, unknown>,\n    previousProperties: Record<string, unknown>,\n    context?: UpdateContext\n  ): Promise<ResourceUpdateResult> {\n    if (resourceType !== 'AWS::AutoScaling::AutoScalingGroup') {\n      throw new ProvisioningError(\n        `Unsupported resource type: ${resourceType}`,\n        resourceType,\n        logicalId,\n        physicalId\n      );\n    }\n    this.logger.debug(`Updating AutoScalingGroup ${logicalId}: ${physicalId}`);\n\n    // Reject diffs on fields AWS does not support modifying via\n    // UpdateAutoScalingGroup. The replacement-detection layer typically\n    // catches AutoScalingGroupName changes earlier; this is defense-in-\n    // depth + the only place to surface the equivalent error for\n    // sub-resource fields the caller may reasonably expect to round-trip.\n    const stringEq = (a: unknown, b: unknown): boolean => JSON.stringify(a) === JSON.stringify(b);\n    if (!stringEq(properties['AutoScalingGroupName'], previousProperties['AutoScalingGroupName'])) {\n      // Issue [#2610] site 8. `--replace` alone cannot succeed on a group whose\n      // recorded `DeletionProtection` is `'prevent-all-deletion'` (see the\n      // level analysis below for why that is the ONLY blocking level): the\n      // replacement's DELETE runs from the deploy engine, which never sets\n      // `DeleteContext.removeProtection` — `delete()` below gates BOTH its\n      // flip-off and its `ForceDelete: true` on exactly that field. See\n      // `../replacement-protection-advice.ts`.\n      //\n      // Read the RECORDED bag: this guard fires before any\n      // `UpdateAutoScalingGroup` in this method, so AWS still holds what\n      // `previousProperties` records.\n      //\n      // The value is a THREE-level string enum, and only the strictest level\n      // blocks a deploy-side replacement. AWS's own wording: the setting\n      // controls whether `DeleteAutoScalingGroup` is allowed \"according to the\n      // specified protection level\" -- `prevent-force-deletion` withholds only\n      // the FORCE delete, and the deploy engine's replacement issues\n      // `ForceDelete: false` (see `delete()` below, where the flag rides\n      // `context?.removeProtection`). So on `prevent-force-deletion` the delete\n      // is not refused BECAUSE of protection, and telling the user to clear it\n      // would name a remedy that fixes nothing -- the exact defect issue\n      // [#2610] is about, reintroduced by an over-wide predicate. An ABSENT\n      // value is the AWS-side default, which `readCurrentState` writes back as\n      // the explicit `'none'` placeholder.\n      const recordedProtection = previousProperties['DeletionProtection'];\n      const remedy =\n        recordedProtection === 'prevent-all-deletion'\n          ? protectedReplacementAdvice({\n              evidence:\n                \"cdkd's recorded properties for this group carry \" +\n                'DeletionProtection: prevent-all-deletion',\n              replaceFlags: 'cdkd deploy --replace',\n              disable: {\n                before: 'aws autoscaling update-auto-scaling-group --auto-scaling-group-name',\n                identifier: physicalId,\n                after: '--deletion-protection none',\n              },\n            })\n          : 'Use cdkd deploy --replace to replace the group.';\n      throw new ResourceUpdateNotSupportedError(\n        resourceType,\n        logicalId,\n        'AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. ' +\n          remedy\n      );\n    }\n    try {\n      // Sub-shape diffs are applied via separate per-shape SDK calls\n      // BEFORE the main UpdateAutoScalingGroup. AWS does not expose these\n      // fields on UpdateAutoScalingGroup, so each one rides its own\n      // dedicated API. Each per-shape helper is a no-op when the\n      // before/after JSON is identical.\n      await this.applyTagsDiff(physicalId, properties['Tags'], previousProperties['Tags']);\n      await this.applyLoadBalancerNamesDiff(\n        physicalId,\n        properties['LoadBalancerNames'],\n        previousProperties['LoadBalancerNames']\n      );\n      await this.applyTargetGroupArnsDiff(\n        physicalId,\n        properties['TargetGroupARNs'],\n        previousProperties['TargetGroupARNs'],\n        context?.maskSecrets\n      );\n      await this.applyMetricsCollectionDiff(\n        physicalId,\n        properties['MetricsCollection'],\n        previousProperties['MetricsCollection']\n      );\n      await this.applyLifecycleHooksDiff(\n        physicalId,\n        properties['LifecycleHookSpecificationList'],\n        previousProperties['LifecycleHookSpecificationList']\n      );\n      await this.applyTrafficSourcesDiff(\n        physicalId,\n        properties['TrafficSources'],\n        previousProperties['TrafficSources']\n      );\n      await this.applyNotificationConfigurationsDiff(\n        physicalId,\n        properties['NotificationConfigurations'],\n        previousProperties['NotificationConfigurations']\n      );\n\n      const launchTemplate = this.buildLaunchTemplate(properties);\n      const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties['VPCZoneIdentifier']);\n\n      // issue #1160: `UpdateAutoScalingGroup` has merge semantics — an absent\n      // input field means \"no change\" — while CloudFormation resets a property\n      // REMOVED from the template to its default. Resolve every optional\n      // mutable field through `clearOnUpdateRemoval` so a removal sends the\n      // explicit CFn default (or the SDK-documented clear sentinel) instead of\n      // silently keeping the old live value. Each reset value's doc basis is\n      // noted inline (models_0.d.ts = the AWS SDK command/model doc).\n      //\n      // Deliberately NOT reset on removal:\n      //   - DesiredCapacity: CFn leaves current capacity unmanaged when the\n      //     property is absent (scaling policies own it) — leaving it\n      //     unchanged IS the CFn-parity behavior.\n      //   - MinSize / MaxSize: required properties, never removable.\n      //   - LaunchTemplate vs MixedInstancesPolicy, VPCZoneIdentifier vs\n      //     AvailabilityZones: mutually-exclusive pairs — a \"removal\" is\n      //     really a switch to the other member, which the API applies by\n      //     presence; pure removal of both is an invalid template.\n      //   - ServiceLinkedRoleARN: no documented clear sentinel; the default\n      //     is an account-specific service-linked-role ARN — leave unchanged.\n      //   - Context: SDK doc says \"Reserved.\" — leave unchanged.\n      //   - SkipZonalShiftValidation: transient per-request validation flag,\n      //     not persisted group config — nothing to reset.\n      //   - AvailabilityZoneImpairmentPolicy: DEFERRED — the SDK model\n      //     documents no default for `ImpairedZoneHealthCheckBehavior` (and\n      //     none for `ZonalShiftEnabled`), so a reset shape cannot be derived\n      //     without guessing; removal currently keeps the live value.\n      //\n      // Sub-field removal inside a KEPT config object (issue #1225 — the\n      // #1160 bug class one level down) is deliberately passed through\n      // verbatim here:\n      //   - InstanceMaintenancePolicy: a kept-but-partial object (one of the\n      //     two percentages dropped) is REJECTED by AWS — the SDK doc requires\n      //     \"Both MinHealthyPercentage and MaxHealthyPercentage must be\n      //     specified\". CloudFormation submits the same partial object, so the\n      //     loud failure IS the CFn-parity behavior; there is no silent drop\n      //     to normalize away.\n      //   - CapacityReservationSpecification: whether AWS keeps or clears a\n      //     previously-set CapacityReservationTarget when only the preference\n      //     is re-sent is UNPROBED (a live probe needs a billed Capacity\n      //     Reservation); the kept-partial object passes through unchanged.\n      //   - AvailabilityZoneDistribution: single sub-field — no partial shape\n      //     exists.\n      const healthCheckTypeInput = clearOnUpdateRemoval(\n        properties['HealthCheckType'] as string | undefined,\n        previousProperties['HealthCheckType'] as string | undefined,\n        // SDK doc: \"EC2 is the default health check and cannot be disabled.\n        // ... Only specify EC2 if you must clear a value that was previously\n        // set.\"\n        'EC2'\n      );\n      const healthCheckGracePeriodInput = clearOnUpdateRemoval(\n        properties['HealthCheckGracePeriod'] != null\n          ? Number(properties['HealthCheckGracePeriod'])\n          : undefined,\n        previousProperties['HealthCheckGracePeriod'] != null\n          ? Number(previousProperties['HealthCheckGracePeriod'])\n          : undefined,\n        // CFn default: 0 seconds.\n        0\n      );\n      // CFn's template key is `Cooldown`; cdkd also accepts the SDK-side\n      // spelling `DefaultCooldown`. Treat the two keys as ONE logical field on\n      // both sides so switching spellings is never misread as a removal.\n      const cooldownRaw = properties['Cooldown'] ?? properties['DefaultCooldown'];\n      const prevCooldownRaw =\n        previousProperties['Cooldown'] ?? previousProperties['DefaultCooldown'];\n      const defaultCooldownInput = clearOnUpdateRemoval(\n        cooldownRaw != null ? Number(cooldownRaw) : undefined,\n        prevCooldownRaw != null ? Number(prevCooldownRaw) : undefined,\n        // CFn default: 300 seconds.\n        300\n      );\n      const terminationPoliciesInput = clearOnUpdateRemoval(\n        properties['TerminationPolicies'] as string[] | undefined,\n        previousProperties['TerminationPolicies'] as string[] | undefined,\n        // CFn/API default termination policy.\n        ['Default']\n      );\n      const newInstancesProtectedInput = clearOnUpdateRemoval(\n        properties['NewInstancesProtectedFromScaleIn'] as boolean | undefined,\n        previousProperties['NewInstancesProtectedFromScaleIn'] as boolean | undefined,\n        false\n      );\n      const capacityRebalanceInput = clearOnUpdateRemoval(\n        properties['CapacityRebalance'] as boolean | undefined,\n        previousProperties['CapacityRebalance'] as boolean | undefined,\n        false\n      );\n      const maxInstanceLifetimeInput = clearOnUpdateRemoval(\n        properties['MaxInstanceLifetime'] != null\n          ? Number(properties['MaxInstanceLifetime'])\n          : undefined,\n        previousProperties['MaxInstanceLifetime'] != null\n          ? Number(previousProperties['MaxInstanceLifetime'])\n          : undefined,\n        // SDK doc: \"To clear a previously set value, specify a new value of 0.\"\n        0\n      );\n      const desiredCapacityTypeInput = clearOnUpdateRemoval(\n        properties['DesiredCapacityType'] as string | undefined,\n        previousProperties['DesiredCapacityType'] as string | undefined,\n        // SDK doc: \"By default, Amazon EC2 Auto Scaling specifies units\".\n        'units'\n      );\n      const defaultInstanceWarmupInput = clearOnUpdateRemoval(\n        properties['DefaultInstanceWarmup'] != null\n          ? Number(properties['DefaultInstanceWarmup'])\n          : undefined,\n        previousProperties['DefaultInstanceWarmup'] != null\n          ? Number(previousProperties['DefaultInstanceWarmup'])\n          : undefined,\n        // SDK doc: \"To remove a value that you previously set, include the\n        // property but specify -1 for the value.\"\n        -1\n      );\n      const instanceMaintenancePolicyInput = clearOnUpdateRemoval(\n        properties['InstanceMaintenancePolicy'] as InstanceMaintenancePolicy | undefined,\n        previousProperties['InstanceMaintenancePolicy'] as InstanceMaintenancePolicy | undefined,\n        // SDK doc (both sub-fields): \"To clear a previously set value,\n        // specify a value of -1.\"\n        { MinHealthyPercentage: -1, MaxHealthyPercentage: -1 }\n      );\n      const capacityReservationSpecInput = clearOnUpdateRemoval(\n        properties['CapacityReservationSpecification'] as\n          | CapacityReservationSpecification\n          | undefined,\n        previousProperties['CapacityReservationSpecification'] as\n          | CapacityReservationSpecification\n          | undefined,\n        // SDK doc: \"default - Auto Scaling uses the Capacity Reservation\n        // preference from your launch template or an open Capacity\n        // Reservation.\" — the behavior of a group that never set the field.\n        { CapacityReservationPreference: 'default' }\n      );\n      const availabilityZoneDistributionInput = clearOnUpdateRemoval(\n        properties['AvailabilityZoneDistribution'] as AvailabilityZoneDistribution | undefined,\n        previousProperties['AvailabilityZoneDistribution'] as\n          | AvailabilityZoneDistribution\n          | undefined,\n        // SDK doc: \"The default is balanced-best-effort.\"\n        { CapacityDistributionStrategy: 'balanced-best-effort' }\n      );\n      const deletionProtectionInput = clearOnUpdateRemoval(\n        properties['DeletionProtection'] as DeletionProtection | undefined,\n        previousProperties['DeletionProtection'] as DeletionProtection | undefined,\n        // SDK doc: \"Default: none\" — also the flip-off value delete() uses.\n        'none'\n      );\n\n      await this.getClient().send(\n        new UpdateAutoScalingGroupCommand({\n          AutoScalingGroupName: physicalId,\n          ...(properties['MinSize'] != null && { MinSize: Number(properties['MinSize']) }),\n          ...(properties['MaxSize'] != null && { MaxSize: Number(properties['MaxSize']) }),\n          ...(properties['DesiredCapacity'] != null && {\n            DesiredCapacity: Number(properties['DesiredCapacity']),\n          }),\n          ...(launchTemplate && { LaunchTemplate: launchTemplate }),\n          ...(properties['MixedInstancesPolicy'] !== undefined && {\n            MixedInstancesPolicy: properties['MixedInstancesPolicy'] as never,\n          }),\n          ...(vpcZoneIdentifier !== undefined && { VPCZoneIdentifier: vpcZoneIdentifier }),\n          ...(properties['AvailabilityZones'] !== undefined && {\n            AvailabilityZones: properties['AvailabilityZones'] as string[],\n          }),\n          ...(healthCheckTypeInput !== undefined && {\n            HealthCheckType: healthCheckTypeInput,\n          }),\n          ...(healthCheckGracePeriodInput !== undefined && {\n            HealthCheckGracePeriod: healthCheckGracePeriodInput,\n          }),\n          ...(defaultCooldownInput !== undefined && {\n            DefaultCooldown: defaultCooldownInput,\n          }),\n          ...(terminationPoliciesInput !== undefined && {\n            TerminationPolicies: terminationPoliciesInput,\n          }),\n          ...(newInstancesProtectedInput !== undefined && {\n            NewInstancesProtectedFromScaleIn: newInstancesProtectedInput,\n          }),\n          ...(capacityRebalanceInput !== undefined && {\n            CapacityRebalance: capacityRebalanceInput,\n          }),\n          ...(properties['ServiceLinkedRoleARN'] !== undefined && {\n            ServiceLinkedRoleARN: properties['ServiceLinkedRoleARN'] as string,\n          }),\n          ...(maxInstanceLifetimeInput !== undefined && {\n            MaxInstanceLifetime: maxInstanceLifetimeInput,\n          }),\n          ...(properties['Context'] !== undefined && {\n            Context: properties['Context'] as string,\n          }),\n          ...(desiredCapacityTypeInput !== undefined && {\n            DesiredCapacityType: desiredCapacityTypeInput,\n          }),\n          ...(defaultInstanceWarmupInput !== undefined && {\n            DefaultInstanceWarmup: defaultInstanceWarmupInput,\n          }),\n          ...(availabilityZoneDistributionInput !== undefined && {\n            AvailabilityZoneDistribution: availabilityZoneDistributionInput,\n          }),\n          // Removal reset DEFERRED (no SDK-documented default for the\n          // sub-fields) — see the comment block above.\n          ...(properties['AvailabilityZoneImpairmentPolicy'] !== undefined && {\n            AvailabilityZoneImpairmentPolicy: properties[\n              'AvailabilityZoneImpairmentPolicy'\n            ] as never,\n          }),\n          ...(properties['SkipZonalShiftValidation'] !== undefined && {\n            SkipZonalShiftValidation: properties['SkipZonalShiftValidation'] as boolean,\n          }),\n          ...(capacityReservationSpecInput !== undefined && {\n            CapacityReservationSpecification: capacityReservationSpecInput,\n          }),\n          ...(instanceMaintenancePolicyInput !== undefined && {\n            InstanceMaintenancePolicy: instanceMaintenancePolicyInput,\n          }),\n          ...(deletionProtectionInput !== undefined && {\n            DeletionProtection: deletionProtectionInput,\n          }),\n        })\n      );\n\n      this.logger.debug(`Successfully updated AutoScalingGroup ${logicalId}`);\n\n      const arn = await this.fetchArn(physicalId);\n      const attributes: Record<string, unknown> = {};\n      if (arn) attributes['Arn'] = arn;\n      if (launchTemplate?.LaunchTemplateId) {\n        attributes['LaunchTemplateID'] = launchTemplate.LaunchTemplateId;\n      }\n      return { physicalId, wasReplaced: false, attributes };\n    } catch (error) {\n      if (error instanceof ResourceUpdateNotSupportedError) throw error;\n      const cause = error instanceof Error ? error : undefined;\n      throw new ProvisioningError(\n        `Failed to update AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,\n        resourceType,\n        logicalId,\n        physicalId,\n        cause\n      );\n    }\n  }\n\n  async delete(\n    logicalId: string,\n    physicalId: string,\n    resourceType: string,\n    _properties?: Record<string, unknown>,\n    context?: DeleteContext\n  ): Promise<void> {\n    this.logger.debug(`Deleting AutoScalingGroup ${logicalId}: ${physicalId}`);\n\n    // `--remove-protection`: clear DeletionProtection in-place before the\n    // actual delete, then set ForceDelete=true so AWS terminates running\n    // instances as part of the delete (matches the \"I know what I'm doing\"\n    // intent of the flag). Without `removeProtection`, ForceDelete stays\n    // false and AWS rejects the delete on a group with running instances\n    // or DeletionProtection set, surfacing as ProvisioningError. The\n    // flip-off is idempotent — AWS accepts UpdateAutoScalingGroup\n    // (DeletionProtection: 'none') even when protection is already\n    // disabled, so we always issue it under the flag.\n    if (context?.removeProtection === true) {\n      try {\n        await this.getClient().send(\n          new UpdateAutoScalingGroupCommand({\n            AutoScalingGroupName: physicalId,\n            DeletionProtection: 'none' as never,\n          })\n        );\n        this.logger.debug(\n          `Disabled DeletionProtection on AutoScalingGroup ${logicalId} before delete`\n        );\n      } catch (flipError) {\n        // Non-fatal: log and proceed. The actual delete below surfaces\n        // any real error.\n        this.logger.debug(\n          `Could not disable DeletionProtection on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`\n        );\n      }\n\n      // ASG-level DeletionProtection + ForceDelete only governs the GROUP and\n      // its scale-in protection. If the group's launch template sets\n      // EC2-level termination protection (DisableApiTermination), the\n      // ForceDelete below still cannot terminate those instances and they\n      // ORPHAN after the group is gone (issue #796). Enumerate the group's\n      // current instances and flip each one's DisableApiTermination off first,\n      // mirroring the EC2Provider `--remove-protection` path.\n      await this.removeInstanceTerminationProtection(physicalId, logicalId);\n    }\n\n    try {\n      await this.getClient().send(\n        new DeleteAutoScalingGroupCommand({\n          AutoScalingGroupName: physicalId,\n          ForceDelete: context?.removeProtection === true,\n        })\n      );\n\n      this.logger.debug(`Successfully initiated deletion of AutoScalingGroup ${logicalId}`);\n\n      // Wait for the group to be fully gone. ASG delete is asynchronous —\n      // returning immediately would leave dependent EC2 / IAM / SG\n      // resources blocked on the lingering group.\n      await this.waitForGroupDeleted(physicalId);\n    } catch (error) {\n      if (this.isNotFoundError(error)) {\n        const clientRegion = await this.getClient().config.region();\n        assertRegionMatch(\n          clientRegion,\n          context?.expectedRegion,\n          resourceType,\n          logicalId,\n          physicalId\n        );\n        this.logger.debug(`AutoScalingGroup ${physicalId} does not exist, skipping deletion`);\n        return;\n      }\n      const cause = error instanceof Error ? error : undefined;\n      throw new ProvisioningError(\n        `Failed to delete AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,\n        resourceType,\n        logicalId,\n        physicalId,\n        cause\n      );\n    }\n  }\n\n  async getAttribute(\n    physicalId: string,\n    _resourceType: string,\n    attributeName: string\n  ): Promise<unknown> {\n    const group = await this.describeGroup(physicalId);\n    if (!group) {\n      throw new ProvisioningError(\n        `AutoScalingGroup ${physicalId} not found while resolving attribute ${attributeName}`,\n        'AWS::AutoScaling::AutoScalingGroup',\n        physicalId,\n        physicalId\n      );\n    }\n    switch (attributeName) {\n      case 'Arn':\n      case 'AutoScalingGroupARN':\n        return group.AutoScalingGroupARN ?? '';\n      case 'LaunchConfigurationName':\n        return group.LaunchConfigurationName ?? '';\n      case 'LaunchTemplateID':\n      case 'LaunchTemplateId':\n        return group.LaunchTemplate?.LaunchTemplateId ?? '';\n      default:\n        return '';\n    }\n  }\n\n  /**\n   * Read the AWS-current AutoScalingGroup configuration in CFn-property shape.\n   *\n   * Surfaces the user-controllable subset of `DescribeAutoScalingGroups`,\n   * with always-emit placeholders on user-controllable top-level keys per\n   * the cdkd PR #145 always-emit convention so that v3 `observedProperties`\n   * baseline catches console-side ADDs to fields a clean deploy did not\n   * template (e.g. a console-set `DeletionProtection: 'prevent-force-deletion'`\n   * on a group originally created without it).\n   *\n   * Sub-shapes (LifecycleHookSpecificationList / TrafficSources /\n   * NotificationConfigurations) are surfaced via three parallel Describe\n   * calls fired alongside the primary `DescribeAutoScalingGroups`. Each is\n   * best-effort: a per-call failure (e.g. permissions gap on\n   * `autoscaling:DescribeLifecycleHooks`) is logged at debug and the\n   * matching key falls back to its always-emit `[]` placeholder rather\n   * than aborting the whole drift read.\n   *\n   * `MetricsCollection` is reverse-mapped from `EnabledMetrics` (already\n   * present on the primary `DescribeAutoScalingGroups` response, so no\n   * extra call is needed).\n   *\n   * Returns `undefined` when the group is gone.\n   */\n  async readCurrentState(\n    physicalId: string,\n    _logicalId: string,\n    _resourceType: string\n  ): Promise<Record<string, unknown> | undefined> {\n    // Fire the four reads in parallel. Sub-shape failures are best-effort\n    // so a single permission gap does not break the whole drift read.\n    const groupPromise = (async () => {\n      try {\n        return await this.describeGroup(physicalId);\n      } catch (err) {\n        if (this.isNotFoundError(err)) return undefined;\n        throw err;\n      }\n    })();\n\n    const lifecycleHooksPromise = this.getClient()\n      .send(new DescribeLifecycleHooksCommand({ AutoScalingGroupName: physicalId }))\n      .then((r) => r.LifecycleHooks ?? [])\n      .catch((err) => {\n        this.logger.debug(\n          `DescribeLifecycleHooks(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`\n        );\n        return [];\n      });\n\n    const trafficSourcesPromise = this.getClient()\n      .send(new DescribeTrafficSourcesCommand({ AutoScalingGroupName: physicalId }))\n      .then((r) => r.TrafficSources ?? [])\n      .catch((err) => {\n        this.logger.debug(\n          `DescribeTrafficSources(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`\n        );\n        return [];\n      });\n\n    const notificationsPromise = this.getClient()\n      .send(new DescribeNotificationConfigurationsCommand({ AutoScalingGroupNames: [physicalId] }))\n      .then((r) => r.NotificationConfigurations ?? [])\n      .catch((err) => {\n        this.logger.debug(\n          `DescribeNotificationConfigurations(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`\n        );\n        return [];\n      });\n\n    const [group, lifecycleHooks, trafficSources, notifications] = await Promise.all([\n      groupPromise,\n      lifecycleHooksPromise,\n      trafficSourcesPromise,\n      notificationsPromise,\n    ]);\n\n    if (!group) return undefined;\n\n    const result: Record<string, unknown> = {};\n    if (group.AutoScalingGroupName !== undefined) {\n      result['AutoScalingGroupName'] = group.AutoScalingGroupName;\n    }\n    if (group.LaunchTemplate) {\n      const lt: Record<string, unknown> = {};\n      if (group.LaunchTemplate.LaunchTemplateId !== undefined) {\n        lt['LaunchTemplateId'] = group.LaunchTemplate.LaunchTemplateId;\n      }\n      if (group.LaunchTemplate.LaunchTemplateName !== undefined) {\n        lt['LaunchTemplateName'] = group.LaunchTemplate.LaunchTemplateName;\n      }\n      if (group.LaunchTemplate.Version !== undefined) {\n        lt['Version'] = group.LaunchTemplate.Version;\n      }\n      result['LaunchTemplate'] = lt;\n    }\n    result['MinSize'] = group.MinSize ?? 0;\n    result['MaxSize'] = group.MaxSize ?? 0;\n    if (group.DesiredCapacity !== undefined) result['DesiredCapacity'] = group.DesiredCapacity;\n    // VPCZoneIdentifier round-trips back to the CFn list shape so the\n    // comparator sees the same array the template emitted, not the\n    // SDK-side comma-joined string.\n    if (group.VPCZoneIdentifier !== undefined && group.VPCZoneIdentifier !== '') {\n      result['VPCZoneIdentifier'] = group.VPCZoneIdentifier.split(',').map((s) => s.trim());\n    } else {\n      result['VPCZoneIdentifier'] = [];\n    }\n    result['AvailabilityZones'] = group.AvailabilityZones ?? [];\n    if (group.HealthCheckType !== undefined) result['HealthCheckType'] = group.HealthCheckType;\n    if (group.HealthCheckGracePeriod !== undefined) {\n      result['HealthCheckGracePeriod'] = group.HealthCheckGracePeriod;\n    }\n    if (group.DefaultCooldown !== undefined) {\n      // CFn template field is `Cooldown`; SDK / Describe response calls it\n      // `DefaultCooldown`. Surface under the CFn name so the comparator\n      // matches state directly.\n      result['Cooldown'] = group.DefaultCooldown;\n    }\n    result['NewInstancesProtectedFromScaleIn'] = group.NewInstancesProtectedFromScaleIn ?? false;\n    result['TerminationPolicies'] = group.TerminationPolicies ?? [];\n    result['CapacityRebalance'] = group.CapacityRebalance ?? false;\n    if (group.ServiceLinkedRoleARN !== undefined) {\n      result['ServiceLinkedRoleARN'] = group.ServiceLinkedRoleARN;\n    }\n    if (group.MaxInstanceLifetime !== undefined) {\n      result['MaxInstanceLifetime'] = group.MaxInstanceLifetime;\n    }\n    result['LoadBalancerNames'] = group.LoadBalancerNames ?? [];\n    result['TargetGroupARNs'] = group.TargetGroupARNs ?? [];\n    if (group.Context !== undefined) result['Context'] = group.Context;\n    if (group.DesiredCapacityType !== undefined) {\n      result['DesiredCapacityType'] = group.DesiredCapacityType;\n    }\n    if (group.DefaultInstanceWarmup !== undefined) {\n      result['DefaultInstanceWarmup'] = group.DefaultInstanceWarmup;\n    }\n    if (group.MixedInstancesPolicy !== undefined) {\n      result['MixedInstancesPolicy'] = group.MixedInstancesPolicy;\n    }\n    if (group.AvailabilityZoneDistribution !== undefined) {\n      result['AvailabilityZoneDistribution'] = group.AvailabilityZoneDistribution;\n    }\n    if (group.AvailabilityZoneImpairmentPolicy !== undefined) {\n      result['AvailabilityZoneImpairmentPolicy'] = group.AvailabilityZoneImpairmentPolicy;\n    }\n    if (group.CapacityReservationSpecification !== undefined) {\n      result['CapacityReservationSpecification'] = group.CapacityReservationSpecification;\n    }\n    if (group.InstanceMaintenancePolicy !== undefined) {\n      result['InstanceMaintenancePolicy'] = group.InstanceMaintenancePolicy;\n    }\n    if (group.DeletionProtection !== undefined) {\n      result['DeletionProtection'] = group.DeletionProtection;\n    } else {\n      // AWS reports `undefined` when the group has the AWS-side default\n      // (`'none'`). Always-emit placeholder so the v3 `observedProperties`\n      // baseline catches a console-side flip to `prevent-force-deletion`\n      // / `prevent-all-deletion`.\n      result['DeletionProtection'] = 'none';\n    }\n    // Tags: filter aws:* prefix and normalize to CFn shape sorted by Key.\n    // ASG returns Tags inside the AutoScalingGroup record (already populated\n    // by DescribeAutoScalingGroups — no separate ListTagsForResource call).\n    result['Tags'] = normalizeAwsTagsToCfn(group.Tags);\n\n    // Sub-shapes — reverse-map AWS responses to CFn template shape and\n    // always-emit `[]` placeholders so the v3 `observedProperties` baseline\n    // catches console-side ADDs to a previously-empty list.\n    result['MetricsCollection'] = mapEnabledMetricsToCfn(group.EnabledMetrics);\n    result['LifecycleHookSpecificationList'] = mapLifecycleHooksToCfn(lifecycleHooks);\n    // Strip ALL elbv2 / elb entries from TrafficSources — the canonical\n    // attachment state for these types lives in TargetGroupARNs /\n    // LoadBalancerNames. TrafficSources is meant for attachment types\n    // without a dedicated CFn property (VPC Lattice, VPC Endpoint\n    // Service). Filtering unconditionally avoids two failure modes\n    // surfaced by tests/integration/drift-revert-vpc (PR #547):\n    // double-attach/detach on revert, and stale TS entries from AWS's\n    // eventual-consistency window after Attach/Detach surfacing as\n    // false drift on the next read.\n    const dedupedTrafficSources = trafficSources.filter((t) => {\n      if (t.Identifier === undefined) return false;\n      if (t.Type === 'elbv2' || t.Type === 'elb') return false;\n      return true;\n    });\n    result['TrafficSources'] = mapTrafficSourcesToCfn(dedupedTrafficSources);\n    result['NotificationConfigurations'] = mapNotificationsToCfn(notifications);\n\n    return result;\n  }\n\n  // ─── Helpers ──────────────────────────────────────────────────────\n\n  private buildLaunchTemplate(\n    properties: Record<string, unknown>\n  ): LaunchTemplateSpecification | undefined {\n    const lt = properties['LaunchTemplate'] as\n      | { LaunchTemplateId?: string; LaunchTemplateName?: string; Version?: string | number }\n      | undefined;\n    if (!lt) return undefined;\n    const out: LaunchTemplateSpecification = {};\n    // AWS UpdateAutoScalingGroup rejects when both LaunchTemplateId and\n    // LaunchTemplateName are present in the same LaunchTemplate object\n    // (\"Valid requests must contain either launchTemplateId or\n    // LaunchTemplateName\"). DescribeAutoScalingGroups returns both, so\n    // a straight readCurrentState → update round-trip on `drift --revert`\n    // would hit this. Prefer the ID (canonical, doesn't change on LT\n    // rename) and only fall back to Name when ID is absent.\n    if (lt.LaunchTemplateId !== undefined) {\n      out.LaunchTemplateId = lt.LaunchTemplateId;\n      if (lt.LaunchTemplateName !== undefined) {\n        // User templated BOTH — AWS would reject the resulting Create /\n        // Update otherwise; we silently prefer the ID. Surface the\n        // choice in --verbose so a user wondering why their Name didn't\n        // take effect has an auditable signal.\n        this.logger.debug(\n          `buildLaunchTemplate: both LaunchTemplateId (${lt.LaunchTemplateId}) and LaunchTemplateName (${lt.LaunchTemplateName}) templated; dropping Name (#551)`\n        );\n      }\n    } else if (lt.LaunchTemplateName !== undefined) {\n      out.LaunchTemplateName = lt.LaunchTemplateName;\n    }\n    if (lt.Version !== undefined) {\n      // Defensive coercion: AWS SDK `LaunchTemplateSpecification.Version`\n      // is `string` and AWS rejects non-string forms with `Invalid\n      // launch template version: either '$Default', '$Latest', or a\n      // numeric version are allowed.`. cdkd's `IntrinsicResolver`\n      // resolves `Fn::GetAtt <LaunchTemplate>.LatestVersionNumber`\n      // through a per-type lookup; intermediate cases could surface\n      // numeric values, so we coerce defensively.\n      out.Version = String(lt.Version);\n    }\n    if (out.LaunchTemplateId === undefined && out.LaunchTemplateName === undefined) {\n      return undefined;\n    }\n    return out;\n  }\n\n  /**\n   * CFn `Tags` is `[{Key, Value, PropagateAtLaunch?}]`. AWS expects each\n   * tag to also carry `ResourceId: <groupName>` and `ResourceType:\n   * 'auto-scaling-group'`. We tack those on at create time so the SDK\n   * input shape matches without forcing the user to template them.\n   */\n  private buildTags(groupName: string, properties: Record<string, unknown>): ASGTag[] {\n    const raw = properties['Tags'] as\n      | Array<{ Key?: string; Value?: string; PropagateAtLaunch?: boolean }>\n      | undefined;\n    if (!raw) return [];\n    return raw\n      .filter((t) => t.Key !== undefined)\n      .map((t) => ({\n        ResourceId: groupName,\n        ResourceType: 'auto-scaling-group',\n        Key: t.Key as string,\n        Value: t.Value ?? '',\n        PropagateAtLaunch: t.PropagateAtLaunch ?? false,\n      }));\n  }\n\n  /**\n   * CFn `VPCZoneIdentifier` is a list of subnet ids; the AWS SDK input\n   * field is a comma-joined string.\n   */\n  private joinVpcZoneIdentifier(value: unknown): string | undefined {\n    if (value === undefined || value === null) return undefined;\n    if (Array.isArray(value)) {\n      const cleaned = value.map((v) => String(v).trim()).filter((v) => v.length > 0);\n      if (cleaned.length === 0) return undefined;\n      return cleaned.join(',');\n    }\n    if (typeof value === 'string') return value;\n    return undefined;\n  }\n\n  private async describeGroup(groupName: string) {\n    const response = await this.getClient().send(\n      new DescribeAutoScalingGroupsCommand({\n        AutoScalingGroupNames: [groupName],\n      })\n    );\n    return response.AutoScalingGroups?.[0];\n  }\n\n  /**\n   * Flip EC2-level termination protection (`DisableApiTermination`) off on\n   * every instance currently launched by the group, so the subsequent\n   * `DeleteAutoScalingGroup(ForceDelete: true)` can actually terminate them\n   * instead of orphaning the protected instances (issue #796). Best-effort:\n   * a Describe failure or a per-instance flip failure is logged at debug and\n   * does not block the delete (the modify WRITE lags the terminate READ, so\n   * the shared helper swallows propagation errors the same way the EC2 path\n   * does — the orphan, if any, surfaces as a leftover instance the caller\n   * can clean up rather than a hard delete failure).\n   */\n  private async removeInstanceTerminationProtection(\n    groupName: string,\n    logicalId: string\n  ): Promise<void> {\n    let instanceIds: string[];\n    try {\n      const group = await this.describeGroup(groupName);\n      instanceIds = (group?.Instances ?? [])\n        .map((i) => i.InstanceId)\n        .filter((id): id is string => typeof id === 'string' && id.length > 0);\n    } catch (describeError) {\n      this.logger.debug(\n        `Could not enumerate instances of AutoScalingGroup ${logicalId} for termination-protection removal: ${describeError instanceof Error ? describeError.message : String(describeError)}`\n      );\n      return;\n    }\n\n    if (instanceIds.length === 0) return;\n\n    this.logger.debug(\n      `Disabling EC2 termination protection on ${instanceIds.length} instance(s) of AutoScalingGroup ${logicalId} before force delete`\n    );\n    for (const instanceId of instanceIds) {\n      await disableInstanceApiTermination(this.getEc2Client(), instanceId, this.logger);\n    }\n  }\n\n  private async fetchArn(groupName: string): Promise<string | undefined> {\n    try {\n      const group = await this.describeGroup(groupName);\n      return group?.AutoScalingGroupARN;\n    } catch (err) {\n      this.logger.debug(\n        `DescribeAutoScalingGroups(${groupName}) failed: ${err instanceof Error ? err.message : String(err)}`\n      );\n      return undefined;\n    }\n  }\n\n  private isNotFoundError(error: unknown): boolean {\n    if (!(error instanceof Error)) return false;\n    const name = (error as { name?: string }).name ?? '';\n    const message = error.message.toLowerCase();\n    // ASG returns ValidationError with message \"AutoScalingGroup name not\n    // found\" rather than a typed NotFound exception; cover both shapes.\n    return (\n      name === 'ValidationError' &&\n      (message.includes('autoscalinggroup name not found') ||\n        message.includes('not found') ||\n        message.includes('does not exist'))\n    );\n  }\n\n  private async waitForGroupDeleted(groupName: string, maxWaitMs = 900_000): Promise<void> {\n    const startTime = Date.now();\n    let delay = 5_000;\n\n    while (Date.now() - startTime < maxWaitMs) {\n      try {\n        const group = await this.describeGroup(groupName);\n        if (!group) return;\n      } catch (error) {\n        if (this.isNotFoundError(error)) return;\n        throw error;\n      }\n\n      await this.sleep(delay);\n      delay = Math.min(delay * 2, 10_000);\n    }\n\n    throw new Error(\n      `Timed out waiting for AutoScalingGroup ${groupName} to be deleted (15 minute cap)`\n    );\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  // ─── Sub-shape diff helpers ───────────────────────────────────────\n  // Each helper is a no-op when before/after JSON is identical (the cheap\n  // structural-equality check happens first; we only build SDK calls for\n  // genuine diffs). Identity is positional within the array per CFn shape:\n  // `MetricsCollection` keyed on `Granularity`, `LifecycleHookSpecification\n  // List` on `LifecycleHookName`, `TrafficSources` on `Identifier`,\n  // `NotificationConfigurations` on `TopicARN`.\n\n  /**\n   * Diff and apply changes to the ASG's `Tags` property via the\n   * `CreateOrUpdateTags` / `DeleteTags` AWS APIs (#475). CFn Tags shape is\n   * `[{Key, Value, PropagateAtLaunch}]`; AWS Tag input adds `ResourceId`\n   * (= the ASG name) and `ResourceType: 'auto-scaling-group'`.\n   *\n   * Diff semantics:\n   *   - Removed keys → `DeleteTags`.\n   *   - Added keys → `CreateOrUpdateTags`.\n   *   - Modified value or `PropagateAtLaunch` flag → `CreateOrUpdateTags`\n   *     (the AWS API upserts by `(ResourceId, ResourceType, Key)` tuple, so\n   *     a single upsert call replaces the old value).\n   *\n   * No-op when before/after JSON is identical.\n   */\n  private async applyTagsDiff(physicalId: string, next: unknown, prev: unknown): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    type CfnTag = { Key?: string; Value?: string; PropagateAtLaunch?: boolean };\n    const nextEntries = (Array.isArray(next) ? next : []) as CfnTag[];\n    const prevEntries = (Array.isArray(prev) ? prev : []) as CfnTag[];\n    const nextByKey = new Map<string, CfnTag>();\n    for (const t of nextEntries) {\n      if (t.Key) nextByKey.set(t.Key, t);\n    }\n    const prevByKey = new Map<string, CfnTag>();\n    for (const t of prevEntries) {\n      if (t.Key) prevByKey.set(t.Key, t);\n    }\n    // Delete keys removed from `next`.\n    const toDelete: CfnTag[] = [];\n    for (const [key, tag] of prevByKey) {\n      if (!nextByKey.has(key)) toDelete.push(tag);\n    }\n    if (toDelete.length > 0) {\n      await this.getClient().send(\n        new DeleteTagsCommand({\n          // DeleteTags is keyed only by (ResourceId, ResourceType, Key).\n          // Intentionally omit `Value` / `PropagateAtLaunch`: AWS treats\n          // those as additional match constraints, so passing the\n          // cdkd-recorded values would silently no-op when a console-side\n          // edit drifted them between deploys. cdkd owns the tag, so\n          // delete-by-key matches the \"we own the resource\" intent.\n          Tags: toDelete.map((t) => ({\n            ResourceId: physicalId,\n            ResourceType: 'auto-scaling-group',\n            Key: t.Key as string,\n          })),\n        })\n      );\n    }\n    // Upsert keys whose value / propagate-flag differs.\n    const toUpsert: CfnTag[] = [];\n    for (const [key, tag] of nextByKey) {\n      const before = prevByKey.get(key);\n      if (JSON.stringify(before) === JSON.stringify(tag)) continue;\n      toUpsert.push(tag);\n    }\n    if (toUpsert.length > 0) {\n      await this.getClient().send(\n        new CreateOrUpdateTagsCommand({\n          Tags: toUpsert.map((t) => ({\n            ResourceId: physicalId,\n            ResourceType: 'auto-scaling-group',\n            Key: t.Key as string,\n            ...(t.Value !== undefined && { Value: t.Value }),\n            ...(t.PropagateAtLaunch !== undefined && {\n              PropagateAtLaunch: t.PropagateAtLaunch,\n            }),\n          })),\n        })\n      );\n    }\n  }\n\n  /**\n   * Diff `LoadBalancerNames` (Classic Load Balancers) and issue\n   * `AttachLoadBalancers` / `DetachLoadBalancers` for the delta (#476).\n   * Names are opaque strings; AWS allows N attached LBs per ASG so this\n   * helper batches every add into one Attach call and every remove into\n   * one Detach call. No-op when before/after JSON is identical.\n   */\n  private async applyLoadBalancerNamesDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextNames = (Array.isArray(next) ? next : []).filter(\n      (n): n is string => typeof n === 'string'\n    );\n    const prevNames = (Array.isArray(prev) ? prev : []).filter(\n      (n): n is string => typeof n === 'string'\n    );\n    const nextSet = new Set(nextNames);\n    const prevSet = new Set(prevNames);\n    const toAttach = nextNames.filter((n) => !prevSet.has(n));\n    const toDetach = prevNames.filter((n) => !nextSet.has(n));\n    if (toDetach.length > 0) {\n      await this.getClient().send(\n        new DetachLoadBalancersCommand({\n          AutoScalingGroupName: physicalId,\n          LoadBalancerNames: toDetach,\n        })\n      );\n    }\n    if (toAttach.length > 0) {\n      await this.getClient().send(\n        new AttachLoadBalancersCommand({\n          AutoScalingGroupName: physicalId,\n          LoadBalancerNames: toAttach,\n        })\n      );\n    }\n  }\n\n  /**\n   * Diff `TargetGroupARNs` (ALB / NLB target groups) and issue\n   * `AttachLoadBalancerTargetGroups` /\n   * `DetachLoadBalancerTargetGroups` for the delta (#476). Target-group\n   * ARNs are opaque strings; same per-call batching pattern as\n   * `applyLoadBalancerNamesDiff`. No-op when before/after JSON is\n   * identical.\n   */\n  private async applyTargetGroupArnsDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown,\n    maskSecrets?: SecretMasker\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextArns = (Array.isArray(next) ? next : []).filter(\n      (a): a is string => typeof a === 'string'\n    );\n    const prevArns = (Array.isArray(prev) ? prev : []).filter(\n      (a): a is string => typeof a === 'string'\n    );\n    const nextSet = new Set(nextArns);\n    const prevSet = new Set(prevArns);\n    const toAttach = nextArns.filter((a) => !prevSet.has(a));\n    const toDetach = prevArns.filter((a) => !nextSet.has(a));\n    if (toDetach.length > 0) {\n      await this.getClient().send(\n        new DetachLoadBalancerTargetGroupsCommand({\n          AutoScalingGroupName: physicalId,\n          TargetGroupARNs: toDetach,\n        })\n      );\n    }\n    if (toAttach.length > 0) {\n      await this.getClient().send(\n        new AttachLoadBalancerTargetGroupsCommand({\n          AutoScalingGroupName: physicalId,\n          TargetGroupARNs: toAttach,\n        })\n      );\n    }\n    // AttachLoadBalancerTargetGroups is async — the target group starts in\n    // 'Adding' state and only becomes visible in\n    // DescribeAutoScalingGroups.TargetGroupARNs after AWS internal\n    // propagation. A subsequent `cdkd drift` read right after the call\n    // returns can otherwise see a stale snapshot and report drift\n    // against the AWS-side empty list (surfaced by tests/integration/\n    // drift-revert-vpc's step-6 \"drift again\" check). Bounded poll to\n    // confirm the post-state matches the intent before returning so the\n    // caller's next read is consistent.\n    if (toDetach.length > 0 || toAttach.length > 0) {\n      await this.waitForTargetGroupArnsConvergence(physicalId, new Set(nextArns), maskSecrets);\n    }\n  }\n\n  private static readonly TG_CONVERGENCE_TIMEOUT_MS = 30_000;\n  private static readonly TG_CONVERGENCE_POLL_INTERVAL_MS = 1_000;\n\n  /**\n   * `maskSecrets` is the caller's secret masker (issue #1932 item 3, adopted\n   * here by issue #1997), threaded from `UpdateContext` via\n   * `applyTargetGroupArnsDiff`. `expected` is built from the RESOLVED\n   * `TargetGroupARNs` bag, so a `{{resolve:secretsmanager:...}}` scalar in it is\n   * already plaintext by the time this method names it. It defaults to IDENTITY\n   * so every existing caller and unit test keeps working unchanged.\n   */\n  private async waitForTargetGroupArnsConvergence(\n    physicalId: string,\n    expected: Set<string>,\n    maskSecrets: SecretMasker = (text) => text\n  ): Promise<void> {\n    // ONE masked sink per level for every line in this method (issue #1997),\n    // rather than a `maskSecrets(...)` at each call: a line added later is\n    // masked by construction instead of by the author remembering. Each is the\n    // OUTER of two layers — a finished message is always longer than the value\n    // inside it, so it can only reach `maskSecretsInText`'s SUBSTRING arm, which\n    // ignores needles below `MIN_NEEDLE_LENGTH` (4); the per-ARN mask below is\n    // the inner layer, reaching the WHOLE-VALUE arm at any length.\n    const warn = (message: string): void => this.logger.warn(maskSecrets(message));\n    const debug = (message: string): void => this.logger.debug(maskSecrets(message));\n    const deadlineMs = Date.now() + ASGProvider.TG_CONVERGENCE_TIMEOUT_MS;\n    let lastObserved: Set<string> = new Set();\n    while (Date.now() < deadlineMs) {\n      let resp: DescribeAutoScalingGroupsCommandOutput | undefined;\n      try {\n        resp = await this.getClient().send(\n          new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [physicalId] })\n        );\n      } catch (err) {\n        // Transient throttle / network blip during the 30s window must\n        // not throw out of applyTargetGroupArnsDiff — the Attach/Detach\n        // already succeeded, and propagating would fail the whole\n        // update path. Log + retry; the loop will fall through to the\n        // timeout-warn path if the API is genuinely down.\n        debug(\n          `applyTargetGroupArnsDiff convergence poll: transient error, retrying — ${\n            err instanceof Error ? err.message : String(err)\n          }`\n        );\n        await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));\n        continue;\n      }\n      lastObserved = new Set(resp.AutoScalingGroups?.[0]?.TargetGroupARNs ?? []);\n      if (lastObserved.size === expected.size && [...expected].every((a) => lastObserved.has(a))) {\n        return;\n      }\n      await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));\n    }\n    // Timeout — surface as a warning rather than failure so the caller\n    // still sees the SDK-side success; drift can re-report if the\n    // propagation is still stuck. Includes observed vs expected so\n    // post-mortem doesn't need a re-deploy.\n    // Sort both sides before stringify for visual symmetry — expected\n    // comes from the caller's insertion order, observed from AWS-side\n    // order; eyeballing the diff in logs is easier when both are sorted.\n    //\n    // Each ARN is masked INDIVIDUALLY before being stringified (issue #1997):\n    // `JSON.stringify` escapes `\"` / `\\` / newlines, so a secret carrying any of\n    // them no longer OCCURS in the finished line and the outer sink alone would\n    // miss it. The observed side is masked too — it comes back from AWS, but a\n    // resolved secret sent by an earlier deploy is exactly what AWS echoes.\n    const expectedSorted = [...expected].sort().map((a) => maskSecrets(a));\n    const observedSorted = [...lastObserved].sort().map((a) => maskSecrets(a));\n    warn(\n      `applyTargetGroupArnsDiff: TG set did not converge within ${ASGProvider.TG_CONVERGENCE_TIMEOUT_MS}ms for ASG ${physicalId}. expected=${JSON.stringify(expectedSorted)} observed=${JSON.stringify(observedSorted)}`\n    );\n  }\n\n  private async applyMetricsCollectionDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      Granularity?: string;\n      Metrics?: string[];\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      Granularity?: string;\n      Metrics?: string[];\n    }>;\n    const prevByGranularity = new Map<string, string[] | undefined>();\n    for (const e of prevEntries) {\n      if (e.Granularity) prevByGranularity.set(e.Granularity, e.Metrics);\n    }\n    const nextByGranularity = new Map<string, string[] | undefined>();\n    for (const e of nextEntries) {\n      if (e.Granularity) nextByGranularity.set(e.Granularity, e.Metrics);\n    }\n    // Disable removed granularities first, then issue Enable for the\n    // intended state of every Granularity in `next`. AWS treats Enable as\n    // additive within a Granularity, so a remove-then-add pattern works\n    // even when the Metrics list shrinks.\n    for (const [granularity, metrics] of prevByGranularity) {\n      if (!nextByGranularity.has(granularity)) {\n        await this.getClient().send(\n          new DisableMetricsCollectionCommand({\n            AutoScalingGroupName: physicalId,\n            ...(metrics && metrics.length > 0 ? { Metrics: metrics } : {}),\n          })\n        );\n      }\n    }\n    for (const [granularity, metrics] of nextByGranularity) {\n      const before = prevByGranularity.get(granularity);\n      if (JSON.stringify(before ?? null) === JSON.stringify(metrics ?? null)) continue;\n      // If the Metrics list shrunk, disable the removed metrics first\n      // (AWS Enable is additive). When `metrics` is undefined or empty,\n      // AWS treats that as \"all metrics\" — disable any prior subset\n      // before re-enabling the full set.\n      if (before && before.length > 0) {\n        const removed = metrics ? before.filter((m) => !metrics.includes(m)) : [];\n        if (removed.length > 0) {\n          await this.getClient().send(\n            new DisableMetricsCollectionCommand({\n              AutoScalingGroupName: physicalId,\n              Metrics: removed,\n            })\n          );\n        }\n      }\n      await this.getClient().send(\n        new EnableMetricsCollectionCommand({\n          AutoScalingGroupName: physicalId,\n          Granularity: granularity,\n          ...(metrics && metrics.length > 0 ? { Metrics: metrics } : {}),\n        })\n      );\n    }\n  }\n\n  private async applyLifecycleHooksDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      LifecycleHookName?: string;\n      LifecycleTransition?: string;\n      RoleARN?: string;\n      NotificationTargetARN?: string;\n      NotificationMetadata?: string;\n      HeartbeatTimeout?: number;\n      DefaultResult?: string;\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      LifecycleHookName?: string;\n    }>;\n    const nextNames = new Set(\n      nextEntries.map((e) => e.LifecycleHookName).filter((n): n is string => !!n)\n    );\n    // Delete hooks no longer in `next`.\n    for (const e of prevEntries) {\n      if (e.LifecycleHookName && !nextNames.has(e.LifecycleHookName)) {\n        await this.getClient().send(\n          new DeleteLifecycleHookCommand({\n            AutoScalingGroupName: physicalId,\n            LifecycleHookName: e.LifecycleHookName,\n          })\n        );\n      }\n    }\n    // PutLifecycleHook is upsert — issue for every hook in `next` whose\n    // shape differs from the matching `prev` entry.\n    const prevByName = new Map<string, unknown>();\n    for (const e of prevEntries) {\n      if (e.LifecycleHookName) prevByName.set(e.LifecycleHookName, e);\n    }\n    for (const e of nextEntries) {\n      if (!e.LifecycleHookName) continue;\n      const prevHook = prevByName.get(e.LifecycleHookName);\n      if (JSON.stringify(prevHook) === JSON.stringify(e)) continue;\n      await this.getClient().send(\n        new PutLifecycleHookCommand({\n          AutoScalingGroupName: physicalId,\n          LifecycleHookName: e.LifecycleHookName,\n          ...(e.LifecycleTransition !== undefined && {\n            LifecycleTransition: e.LifecycleTransition,\n          }),\n          ...(e.RoleARN !== undefined && { RoleARN: e.RoleARN }),\n          ...(e.NotificationTargetARN !== undefined && {\n            NotificationTargetARN: e.NotificationTargetARN,\n          }),\n          ...(e.NotificationMetadata !== undefined && {\n            NotificationMetadata: e.NotificationMetadata,\n          }),\n          ...(e.HeartbeatTimeout !== undefined && { HeartbeatTimeout: e.HeartbeatTimeout }),\n          ...(e.DefaultResult !== undefined && { DefaultResult: e.DefaultResult }),\n        })\n      );\n    }\n  }\n\n  private async applyTrafficSourcesDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      Identifier?: string;\n      Type?: string;\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      Identifier?: string;\n      Type?: string;\n    }>;\n    const nextIds = new Set(nextEntries.map((e) => e.Identifier).filter((i): i is string => !!i));\n    const prevIds = new Set(prevEntries.map((e) => e.Identifier).filter((i): i is string => !!i));\n    const toDetach = prevEntries.filter((e) => e.Identifier && !nextIds.has(e.Identifier));\n    const toAttach = nextEntries.filter((e) => e.Identifier && !prevIds.has(e.Identifier));\n    if (toDetach.length > 0) {\n      await this.getClient().send(\n        new DetachTrafficSourcesCommand({\n          AutoScalingGroupName: physicalId,\n          TrafficSources: toDetach.map((e) => ({\n            Identifier: e.Identifier as string,\n            ...(e.Type !== undefined && { Type: e.Type }),\n          })),\n        })\n      );\n    }\n    if (toAttach.length > 0) {\n      await this.getClient().send(\n        new AttachTrafficSourcesCommand({\n          AutoScalingGroupName: physicalId,\n          TrafficSources: toAttach.map((e) => ({\n            Identifier: e.Identifier as string,\n            ...(e.Type !== undefined && { Type: e.Type }),\n          })),\n        })\n      );\n    }\n  }\n\n  private async applyNotificationConfigurationsDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    // CFn `NotificationConfigurations` is an array of `{TopicARN,\n    // NotificationTypes[]}`; AWS `PutNotificationConfiguration` is keyed\n    // by TopicARN — one call per topic. AWS reports each notification\n    // type as a separate response entry (one row per `(asgName, topicArn,\n    // notificationType)` triple), but cdkd state stores the CFn shape, so\n    // both sides of the diff share the per-topic key.\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      TopicARN?: string;\n      NotificationTypes?: string[];\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      TopicARN?: string;\n      NotificationTypes?: string[];\n    }>;\n    const nextByTopic = new Map<string, string[] | undefined>();\n    for (const e of nextEntries) {\n      if (e.TopicARN) nextByTopic.set(e.TopicARN, e.NotificationTypes);\n    }\n    const prevByTopic = new Map<string, string[] | undefined>();\n    for (const e of prevEntries) {\n      if (e.TopicARN) prevByTopic.set(e.TopicARN, e.NotificationTypes);\n    }\n    for (const topic of prevByTopic.keys()) {\n      if (!nextByTopic.has(topic)) {\n        await this.getClient().send(\n          new DeleteNotificationConfigurationCommand({\n            AutoScalingGroupName: physicalId,\n            TopicARN: topic,\n          })\n        );\n      }\n    }\n    for (const [topic, types] of nextByTopic) {\n      const before = prevByTopic.get(topic);\n      if (JSON.stringify(before ?? null) === JSON.stringify(types ?? null)) continue;\n      await this.getClient().send(\n        new PutNotificationConfigurationCommand({\n          AutoScalingGroupName: physicalId,\n          TopicARN: topic,\n          NotificationTypes: types ?? [],\n        })\n      );\n    }\n  }\n}\n\n// ─── File-level reverse-mappers (CFn template shape) ────────────────\n\n/**\n * Reverse-map AWS `EnabledMetrics: [{Metric, Granularity}]` (flat list,\n * one row per enabled metric) back to the CFn array shape\n * `[{Granularity, Metrics?[]}]`. Metrics with the same Granularity are\n * grouped together; the resulting Metrics list is sorted alphabetically\n * for stable positional compare in the drift comparator.\n *\n * Always returns a placeholder `[]` per the cdkd PR #145 always-emit\n * convention so a console-side EnableMetricsCollection on a previously-\n * empty group surfaces as drift on the v3 `observedProperties` baseline.\n */\nfunction mapEnabledMetricsToCfn(\n  enabledMetrics:\n    | Array<{ Metric?: string | undefined; Granularity?: string | undefined }>\n    | undefined\n): Array<{ Granularity: string; Metrics?: string[] }> {\n  if (!enabledMetrics || enabledMetrics.length === 0) return [];\n  const byGranularity = new Map<string, Set<string>>();\n  for (const e of enabledMetrics) {\n    const g = e.Granularity;\n    if (!g) continue;\n    let set = byGranularity.get(g);\n    if (!set) {\n      set = new Set();\n      byGranularity.set(g, set);\n    }\n    if (e.Metric) set.add(e.Metric);\n  }\n  const result: Array<{ Granularity: string; Metrics?: string[] }> = [];\n  // Sort by Granularity for stable positional compare.\n  for (const granularity of Array.from(byGranularity.keys()).sort()) {\n    const metrics = Array.from(byGranularity.get(granularity) ?? []).sort();\n    result.push(\n      metrics.length > 0\n        ? { Granularity: granularity, Metrics: metrics }\n        : { Granularity: granularity }\n    );\n  }\n  return result;\n}\n\n/**\n * Reverse-map AWS `DescribeLifecycleHooks` response to the CFn\n * `LifecycleHookSpecificationList` shape. Each hook is surfaced under the\n * exact CFn property name. AWS-side fields cdkd state never carried\n * (`AutoScalingGroupName` — duplicated on every hook by AWS,\n * `GlobalTimeout` — AWS-derived) are filtered out. Sorted by\n * LifecycleHookName for stable positional compare.\n */\nfunction mapLifecycleHooksToCfn(\n  hooks: Array<{\n    LifecycleHookName?: string | undefined;\n    LifecycleTransition?: string | undefined;\n    NotificationTargetARN?: string | undefined;\n    RoleARN?: string | undefined;\n    NotificationMetadata?: string | undefined;\n    HeartbeatTimeout?: number | undefined;\n    DefaultResult?: string | undefined;\n  }>\n): Array<Record<string, unknown>> {\n  if (!hooks || hooks.length === 0) return [];\n  const result: Array<Record<string, unknown>> = [];\n  for (const h of hooks) {\n    if (!h.LifecycleHookName) continue;\n    const entry: Record<string, unknown> = { LifecycleHookName: h.LifecycleHookName };\n    if (h.LifecycleTransition !== undefined) entry['LifecycleTransition'] = h.LifecycleTransition;\n    if (h.RoleARN !== undefined) entry['RoleARN'] = h.RoleARN;\n    if (h.NotificationTargetARN !== undefined) {\n      entry['NotificationTargetARN'] = h.NotificationTargetARN;\n    }\n    if (h.NotificationMetadata !== undefined) {\n      entry['NotificationMetadata'] = h.NotificationMetadata;\n    }\n    if (h.HeartbeatTimeout !== undefined) entry['HeartbeatTimeout'] = h.HeartbeatTimeout;\n    if (h.DefaultResult !== undefined) entry['DefaultResult'] = h.DefaultResult;\n    result.push(entry);\n  }\n  result.sort((a, b) =>\n    String(a['LifecycleHookName']).localeCompare(String(b['LifecycleHookName']))\n  );\n  return result;\n}\n\n/**\n * Reverse-map AWS `DescribeTrafficSources` response to the CFn\n * `TrafficSources` shape `[{Identifier, Type?}]`. AWS-side runtime fields\n * (`State`, the deprecated `TrafficSource` alias) are filtered out.\n * Sorted by Identifier for stable positional compare.\n */\nfunction mapTrafficSourcesToCfn(\n  trafficSources: Array<{ Identifier?: string | undefined; Type?: string | undefined }>\n): Array<Record<string, unknown>> {\n  if (!trafficSources || trafficSources.length === 0) return [];\n  const result: Array<Record<string, unknown>> = [];\n  for (const t of trafficSources) {\n    if (!t.Identifier) continue;\n    const entry: Record<string, unknown> = { Identifier: t.Identifier };\n    if (t.Type !== undefined) entry['Type'] = t.Type;\n    result.push(entry);\n  }\n  result.sort((a, b) => String(a['Identifier']).localeCompare(String(b['Identifier'])));\n  return result;\n}\n\n/**\n * Reverse-map AWS `DescribeNotificationConfigurations` (a flat list, one\n * row per `(topicArn, notificationType)`) into the CFn shape\n * `[{TopicARN, NotificationTypes[]}]`. NotificationTypes are grouped per\n * TopicARN and sorted alphabetically for stable positional compare.\n */\nfunction mapNotificationsToCfn(\n  configurations: Array<{ TopicARN?: string | undefined; NotificationType?: string | undefined }>\n): Array<Record<string, unknown>> {\n  if (!configurations || configurations.length === 0) return [];\n  const byTopic = new Map<string, Set<string>>();\n  for (const c of configurations) {\n    if (!c.TopicARN) continue;\n    let set = byTopic.get(c.TopicARN);\n    if (!set) {\n      set = new Set();\n      byTopic.set(c.TopicARN, set);\n    }\n    if (c.NotificationType) set.add(c.NotificationType);\n  }\n  const result: Array<Record<string, unknown>> = [];\n  for (const topic of Array.from(byTopic.keys()).sort()) {\n    const types = Array.from(byTopic.get(topic) ?? []).sort();\n    result.push({ TopicARN: topic, NotificationTypes: types });\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,MAAa,kCACX;;AAGF,MAAa,uBACX;;;;;;;;;;;;;;;;;;;;;;AA+IF,SAAS,qBAAqB,SAAyC;CACrE,MAAM,SAAS,YAAY,QAAQ,YAAY,EAAE,WAAW,KAAK,CAAC;CAClE,IAAI,CAAC,UAAU,WAAW,QAAQ,YAAY,OAAO;CACrD,MAAM,OAAO,QAAQ,QAAQ,IAAI,QAAQ,UAAU;CACnD,OAAO,GAAG,QAAQ,OAAO,GAAG,WAAW,MAAM,IAAI;AACnD;;;;;;;;;;;AAYA,SAAgB,2BAId,MAAqE;CACrE,MAAM,EAAE,UAAU,iBAAiB;CAGnC,MAAM,UAAU,KAAK;CACrB,MAAM,UAAU,qBAAqB,OAAO;CAC5C,MAAM,OACJ,GAAG,SAAS,OAAO,aAAa,2QAGQ,gCAAgC;CAI1E,IAAI,CAAC,SAAS,OAAO,GAAG,KAAK,GAAG,qBAAqB,oBAAoB,aAAa;CAEtF,OACE,GAAG,KAAK,2CAA2C,QAAQ,yBAF9C,QAAQ,SAAS,IAAI,QAAQ,WAAW,GAEsC,oBACvE,aAAa;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC1KA,IAAa,cAAb,MAAa,YAAwC;CACnD,AAAQ;CACR,AAAQ;CACR,AAAiB,iBAAiB,QAAQ,IAAI;CAC9C,AAAQ,SAAS,UAAU,CAAC,CAAC,MAAM,aAAa;CAEhD,oCAAoB,IAAI,IAAiC,CACvD,CACE,sDACA,IAAI,IAAI;EACN;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH,CACF,CAAC;CAED,oCAAoB,IAAI,IAAyC,CAC/D,CACE,sDACA,IAAI,IAAoB,CACtB,CACE,2BACA,2EACF,GACA,CACE,6BACA,wFACF,CACF,CAAC,CACH,CACF,CAAC;CAED,AAAQ,YAA+B;EACrC,IAAI,CAAC,KAAK,WACR,KAAK,YAAY,IAAI,kBAAkB;GACrC,GAAG,kBAAkB;GACrB,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;EAC/D,CAAC;EAEH,OAAO,KAAK;CACd;CAEA,AAAQ,eAA0B;EAChC,IAAI,CAAC,KAAK,WACR,KAAK,YAAY,IAAI,UAAU;GAC7B,GAAG,kBAAkB;GACrB,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;EAC/D,CAAC;EAEH,OAAO,KAAK;CACd;;;;;;;;;;;;;;CAiBA,MAAM,OACJ,WACA,cACA,YACA,SAC+B;EAC/B,IAAI,iBAAiB,sCACnB,MAAM,IAAI,kBACR,8BAA8B,gBAC9B,cACA,SACF;EAGF,MAAM,YACH,WAAW,2BACZ,qBAAqB,WAAW,EAAE,WAAW,IAAI,CAAC;EAGpD,MAAM,cAA4B,SAAS,iBAAiB,SAAS;EACrE,MAAM,SAAS,YAA0B,KAAK,OAAO,MAAM,YAAY,OAAO,CAAC;EAC/E,MAAM,6BAA6B,UAAU,IAAI,YAAY,SAAS,GAAG;EAEzE,IAAI;GACF,MAAM,iBAAiB,KAAK,oBAAoB,UAAU;GAC1D,MAAM,OAAO,KAAK,UAAU,WAAW,UAAU;GACjD,MAAM,oBAAoB,KAAK,sBAAsB,WAAW,oBAAoB;GAEpF,MAAM,UAAU,WAAW,cAAc,OAAO,OAAO,WAAW,UAAU,IAAI;GAChF,MAAM,UAAU,WAAW,cAAc,OAAO,OAAO,WAAW,UAAU,IAAI;GAEhF,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;IAChC,sBAAsB;IACtB,SAAS;IACT,SAAS;IACT,GAAI,WAAW,sBAAsB,QAAQ,EAC3C,iBAAiB,OAAO,WAAW,kBAAkB,EACvD;IACA,GAAI,kBAAkB,EAAE,gBAAgB,eAAe;IACvD,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,sBAAsB,UAAa,EAAE,mBAAmB,kBAAkB;IAC9E,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,WAAW,uBAAuB,UAAa,EACjD,iBAAiB,WAAW,mBAC9B;IACA,GAAI,WAAW,6BAA6B,QAAQ,EAClD,wBAAwB,OAAO,WAAW,yBAAyB,EACrE;IACA,GAAI,WAAW,eAAe,QAAQ,EACpC,iBAAiB,OAAO,WAAW,WAAW,EAChD;IACA,GAAI,WAAW,sBAAsB,QAAQ,EAC3C,iBAAiB,OAAO,WAAW,kBAAkB,EACvD;IACA,GAAI,WAAW,2BAA2B,UAAa,EACrD,qBAAqB,WAAW,uBAClC;IACA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,WAAW,0BAA0B,QAAQ,EAC/C,qBAAqB,OAAO,WAAW,sBAAsB,EAC/D;IACA,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,WAAW,uBAAuB,UAAa,EACjD,iBAAiB,WAAW,mBAC9B;IACA,GAAI,WAAW,eAAe,UAAa,EACzC,SAAS,WAAW,WACtB;IACA,GAAI,WAAW,2BAA2B,UAAa,EACrD,qBAAqB,WAAW,uBAClC;IACA,GAAI,WAAW,4BAA4B,QAAQ,EACjD,uBAAuB,OAAO,WAAW,wBAAwB,EACnE;IACA,GAAI,WAAW,sCAAsC,UAAa,EAChE,gCAAgC,WAAW,kCAC7C;IACA,GAAI,WAAW,sBAAsB,UAAa,EAChD,gBAAgB,WAAW,kBAC7B;IACA,GAAI,WAAW,oCAAoC,UAAa,EAC9D,8BAA8B,WAAW,gCAC3C;IACA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,gCAAgC,UAAa,EAC1D,0BAA0B,WAAW,4BACvC;IACA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,iCAAiC,UAAa,EAC3D,2BAA2B,WAAW,6BACxC;IACA,GAAI,WAAW,0BAA0B,UAAa,EACpD,oBAAoB,WAAW,sBACjC;IACA,GAAI,KAAK,SAAS,KAAK,EAAE,MAAM,KAAK;GACtC,CAAC,CACH;GAEA,MAAM,yCAAyC,UAAU,IAAI,YAAY,SAAS,GAAG;GAErF,MAAM,MAAM,MAAM,KAAK,SAAS,SAAS;GACzC,MAAM,aAAsC,CAAC;GAC7C,IAAI,KAAK,WAAW,SAAS;GAC7B,IAAI,gBAAgB,kBAClB,WAAW,sBAAsB,eAAe;GAElD,OAAO;IAAE,YAAY;IAAW;GAAW;EAC7C,SAAS,OAAO;GACd,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;GAC/C,MAAM,IAAI,kBACR,qCAAqC,UAAU,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxG,cACA,WACA,WACA,KACF;EACF;CACF;;;;;;;;;;;CAYA,MAAM,OACJ,WACA,YACA,cACA,YACA,oBACA,SAC+B;EAC/B,IAAI,iBAAiB,sCACnB,MAAM,IAAI,kBACR,8BAA8B,gBAC9B,cACA,WACA,UACF;EAEF,KAAK,OAAO,MAAM,6BAA6B,UAAU,IAAI,YAAY;EAOzE,MAAM,YAAY,GAAY,MAAwB,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;EAC5F,IAAI,CAAC,SAAS,WAAW,yBAAyB,mBAAmB,uBAAuB,GAwC1F,MAAM,IAAI,gCACR,cACA,WACA,mIAlByB,mBAAmB,0BAErB,yBACnB,2BAA2B;GACzB,UACE;GAEF,cAAc;GACd,SAAS;IACP,QAAQ;IACR,YAAY;IACZ,OAAO;GACT;EACF,CAAC,IACD,kDAMN;EAEF,IAAI;GAMF,MAAM,KAAK,cAAc,YAAY,WAAW,SAAS,mBAAmB,OAAO;GACnF,MAAM,KAAK,2BACT,YACA,WAAW,sBACX,mBAAmB,oBACrB;GACA,MAAM,KAAK,yBACT,YACA,WAAW,oBACX,mBAAmB,oBACnB,SAAS,WACX;GACA,MAAM,KAAK,2BACT,YACA,WAAW,sBACX,mBAAmB,oBACrB;GACA,MAAM,KAAK,wBACT,YACA,WAAW,mCACX,mBAAmB,iCACrB;GACA,MAAM,KAAK,wBACT,YACA,WAAW,mBACX,mBAAmB,iBACrB;GACA,MAAM,KAAK,oCACT,YACA,WAAW,+BACX,mBAAmB,6BACrB;GAEA,MAAM,iBAAiB,KAAK,oBAAoB,UAAU;GAC1D,MAAM,oBAAoB,KAAK,sBAAsB,WAAW,oBAAoB;GA4CpF,MAAM,uBAAuB,qBAC3B,WAAW,oBACX,mBAAmB,oBAInB,KACF;GACA,MAAM,8BAA8B,qBAClC,WAAW,6BAA6B,OACpC,OAAO,WAAW,yBAAyB,IAC3C,QACJ,mBAAmB,6BAA6B,OAC5C,OAAO,mBAAmB,yBAAyB,IACnD,QAEJ,CACF;GAIA,MAAM,cAAc,WAAW,eAAe,WAAW;GACzD,MAAM,kBACJ,mBAAmB,eAAe,mBAAmB;GACvD,MAAM,uBAAuB,qBAC3B,eAAe,OAAO,OAAO,WAAW,IAAI,QAC5C,mBAAmB,OAAO,OAAO,eAAe,IAAI,QAEpD,GACF;GACA,MAAM,2BAA2B,qBAC/B,WAAW,wBACX,mBAAmB,wBAEnB,CAAC,SAAS,CACZ;GACA,MAAM,6BAA6B,qBACjC,WAAW,qCACX,mBAAmB,qCACnB,KACF;GACA,MAAM,yBAAyB,qBAC7B,WAAW,sBACX,mBAAmB,sBACnB,KACF;GACA,MAAM,2BAA2B,qBAC/B,WAAW,0BAA0B,OACjC,OAAO,WAAW,sBAAsB,IACxC,QACJ,mBAAmB,0BAA0B,OACzC,OAAO,mBAAmB,sBAAsB,IAChD,QAEJ,CACF;GACA,MAAM,2BAA2B,qBAC/B,WAAW,wBACX,mBAAmB,wBAEnB,OACF;GACA,MAAM,6BAA6B,qBACjC,WAAW,4BAA4B,OACnC,OAAO,WAAW,wBAAwB,IAC1C,QACJ,mBAAmB,4BAA4B,OAC3C,OAAO,mBAAmB,wBAAwB,IAClD,QAGJ,EACF;GACA,MAAM,iCAAiC,qBACrC,WAAW,8BACX,mBAAmB,8BAGnB;IAAE,sBAAsB;IAAI,sBAAsB;GAAG,CACvD;GACA,MAAM,+BAA+B,qBACnC,WAAW,qCAGX,mBAAmB,qCAMnB,EAAE,+BAA+B,UAAU,CAC7C;GACA,MAAM,oCAAoC,qBACxC,WAAW,iCACX,mBAAmB,iCAInB,EAAE,8BAA8B,uBAAuB,CACzD;GACA,MAAM,0BAA0B,qBAC9B,WAAW,uBACX,mBAAmB,uBAEnB,MACF;GAEA,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;IAChC,sBAAsB;IACtB,GAAI,WAAW,cAAc,QAAQ,EAAE,SAAS,OAAO,WAAW,UAAU,EAAE;IAC9E,GAAI,WAAW,cAAc,QAAQ,EAAE,SAAS,OAAO,WAAW,UAAU,EAAE;IAC9E,GAAI,WAAW,sBAAsB,QAAQ,EAC3C,iBAAiB,OAAO,WAAW,kBAAkB,EACvD;IACA,GAAI,kBAAkB,EAAE,gBAAgB,eAAe;IACvD,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,sBAAsB,UAAa,EAAE,mBAAmB,kBAAkB;IAC9E,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,yBAAyB,UAAa,EACxC,iBAAiB,qBACnB;IACA,GAAI,gCAAgC,UAAa,EAC/C,wBAAwB,4BAC1B;IACA,GAAI,yBAAyB,UAAa,EACxC,iBAAiB,qBACnB;IACA,GAAI,6BAA6B,UAAa,EAC5C,qBAAqB,yBACvB;IACA,GAAI,+BAA+B,UAAa,EAC9C,kCAAkC,2BACpC;IACA,GAAI,2BAA2B,UAAa,EAC1C,mBAAmB,uBACrB;IACA,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,6BAA6B,UAAa,EAC5C,qBAAqB,yBACvB;IACA,GAAI,WAAW,eAAe,UAAa,EACzC,SAAS,WAAW,WACtB;IACA,GAAI,6BAA6B,UAAa,EAC5C,qBAAqB,yBACvB;IACA,GAAI,+BAA+B,UAAa,EAC9C,uBAAuB,2BACzB;IACA,GAAI,sCAAsC,UAAa,EACrD,8BAA8B,kCAChC;IAGA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,gCAAgC,UAAa,EAC1D,0BAA0B,WAAW,4BACvC;IACA,GAAI,iCAAiC,UAAa,EAChD,kCAAkC,6BACpC;IACA,GAAI,mCAAmC,UAAa,EAClD,2BAA2B,+BAC7B;IACA,GAAI,4BAA4B,UAAa,EAC3C,oBAAoB,wBACtB;GACF,CAAC,CACH;GAEA,KAAK,OAAO,MAAM,yCAAyC,WAAW;GAEtE,MAAM,MAAM,MAAM,KAAK,SAAS,UAAU;GAC1C,MAAM,aAAsC,CAAC;GAC7C,IAAI,KAAK,WAAW,SAAS;GAC7B,IAAI,gBAAgB,kBAClB,WAAW,sBAAsB,eAAe;GAElD,OAAO;IAAE;IAAY,aAAa;IAAO;GAAW;EACtD,SAAS,OAAO;GACd,IAAI,iBAAiB,iCAAiC,MAAM;GAC5D,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;GAC/C,MAAM,IAAI,kBACR,qCAAqC,UAAU,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxG,cACA,WACA,YACA,KACF;EACF;CACF;CAEA,MAAM,OACJ,WACA,YACA,cACA,aACA,SACe;EACf,KAAK,OAAO,MAAM,6BAA6B,UAAU,IAAI,YAAY;EAWzE,IAAI,SAAS,qBAAqB,MAAM;GACtC,IAAI;IACF,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;KAChC,sBAAsB;KACtB,oBAAoB;IACtB,CAAC,CACH;IACA,KAAK,OAAO,MACV,mDAAmD,UAAU,eAC/D;GACF,SAAS,WAAW;IAGlB,KAAK,OAAO,MACV,2CAA2C,WAAW,IAAI,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,GAC7H;GACF;GASA,MAAM,KAAK,oCAAoC,YAAY,SAAS;EACtE;EAEA,IAAI;GACF,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;IAChC,sBAAsB;IACtB,aAAa,SAAS,qBAAqB;GAC7C,CAAC,CACH;GAEA,KAAK,OAAO,MAAM,uDAAuD,WAAW;GAKpF,MAAM,KAAK,oBAAoB,UAAU;EAC3C,SAAS,OAAO;GACd,IAAI,KAAK,gBAAgB,KAAK,GAAG;IAE/B,kBACE,MAFyB,KAAK,UAAU,CAAC,CAAC,OAAO,OAAO,GAGxD,SAAS,gBACT,cACA,WACA,UACF;IACA,KAAK,OAAO,MAAM,oBAAoB,WAAW,mCAAmC;IACpF;GACF;GACA,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;GAC/C,MAAM,IAAI,kBACR,qCAAqC,UAAU,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxG,cACA,WACA,YACA,KACF;EACF;CACF;CAEA,MAAM,aACJ,YACA,eACA,eACkB;EAClB,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU;EACjD,IAAI,CAAC,OACH,MAAM,IAAI,kBACR,oBAAoB,WAAW,uCAAuC,iBACtE,sCACA,YACA,UACF;EAEF,QAAQ,eAAR;GACE,KAAK;GACL,KAAK,uBACH,OAAO,MAAM,uBAAuB;GACtC,KAAK,2BACH,OAAO,MAAM,2BAA2B;GAC1C,KAAK;GACL,KAAK,oBACH,OAAO,MAAM,gBAAgB,oBAAoB;GACnD,SACE,OAAO;EACX;CACF;;;;;;;;;;;;;;;;;;;;;;;;;CA0BA,MAAM,iBACJ,YACA,YACA,eAC8C;EAG9C,MAAM,gBAAgB,YAAY;GAChC,IAAI;IACF,OAAO,MAAM,KAAK,cAAc,UAAU;GAC5C,SAAS,KAAK;IACZ,IAAI,KAAK,gBAAgB,GAAG,GAAG,OAAO;IACtC,MAAM;GACR;EACF,EAAC,CAAE;EAEH,MAAM,wBAAwB,KAAK,UAAU,CAAC,CAC3C,KAAK,IAAI,8BAA8B,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAC7E,MAAM,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CACnC,OAAO,QAAQ;GACd,KAAK,OAAO,MACV,0BAA0B,WAAW,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAClG;GACA,OAAO,CAAC;EACV,CAAC;EAEH,MAAM,wBAAwB,KAAK,UAAU,CAAC,CAC3C,KAAK,IAAI,8BAA8B,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAC7E,MAAM,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CACnC,OAAO,QAAQ;GACd,KAAK,OAAO,MACV,0BAA0B,WAAW,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAClG;GACA,OAAO,CAAC;EACV,CAAC;EAEH,MAAM,uBAAuB,KAAK,UAAU,CAAC,CAC1C,KAAK,IAAI,0CAA0C,EAAE,uBAAuB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAC5F,MAAM,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAC/C,OAAO,QAAQ;GACd,KAAK,OAAO,MACV,sCAAsC,WAAW,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAC9G;GACA,OAAO,CAAC;EACV,CAAC;EAEH,MAAM,CAAC,OAAO,gBAAgB,gBAAgB,iBAAiB,MAAM,QAAQ,IAAI;GAC/E;GACA;GACA;GACA;EACF,CAAC;EAED,IAAI,CAAC,OAAO,OAAO;EAEnB,MAAM,SAAkC,CAAC;EACzC,IAAI,MAAM,yBAAyB,QACjC,OAAO,0BAA0B,MAAM;EAEzC,IAAI,MAAM,gBAAgB;GACxB,MAAM,KAA8B,CAAC;GACrC,IAAI,MAAM,eAAe,qBAAqB,QAC5C,GAAG,sBAAsB,MAAM,eAAe;GAEhD,IAAI,MAAM,eAAe,uBAAuB,QAC9C,GAAG,wBAAwB,MAAM,eAAe;GAElD,IAAI,MAAM,eAAe,YAAY,QACnC,GAAG,aAAa,MAAM,eAAe;GAEvC,OAAO,oBAAoB;EAC7B;EACA,OAAO,aAAa,MAAM,WAAW;EACrC,OAAO,aAAa,MAAM,WAAW;EACrC,IAAI,MAAM,oBAAoB,QAAW,OAAO,qBAAqB,MAAM;EAI3E,IAAI,MAAM,sBAAsB,UAAa,MAAM,sBAAsB,IACvE,OAAO,uBAAuB,MAAM,kBAAkB,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC;OAEpF,OAAO,uBAAuB,CAAC;EAEjC,OAAO,uBAAuB,MAAM,qBAAqB,CAAC;EAC1D,IAAI,MAAM,oBAAoB,QAAW,OAAO,qBAAqB,MAAM;EAC3E,IAAI,MAAM,2BAA2B,QACnC,OAAO,4BAA4B,MAAM;EAE3C,IAAI,MAAM,oBAAoB,QAI5B,OAAO,cAAc,MAAM;EAE7B,OAAO,sCAAsC,MAAM,oCAAoC;EACvF,OAAO,yBAAyB,MAAM,uBAAuB,CAAC;EAC9D,OAAO,uBAAuB,MAAM,qBAAqB;EACzD,IAAI,MAAM,yBAAyB,QACjC,OAAO,0BAA0B,MAAM;EAEzC,IAAI,MAAM,wBAAwB,QAChC,OAAO,yBAAyB,MAAM;EAExC,OAAO,uBAAuB,MAAM,qBAAqB,CAAC;EAC1D,OAAO,qBAAqB,MAAM,mBAAmB,CAAC;EACtD,IAAI,MAAM,YAAY,QAAW,OAAO,aAAa,MAAM;EAC3D,IAAI,MAAM,wBAAwB,QAChC,OAAO,yBAAyB,MAAM;EAExC,IAAI,MAAM,0BAA0B,QAClC,OAAO,2BAA2B,MAAM;EAE1C,IAAI,MAAM,yBAAyB,QACjC,OAAO,0BAA0B,MAAM;EAEzC,IAAI,MAAM,iCAAiC,QACzC,OAAO,kCAAkC,MAAM;EAEjD,IAAI,MAAM,qCAAqC,QAC7C,OAAO,sCAAsC,MAAM;EAErD,IAAI,MAAM,qCAAqC,QAC7C,OAAO,sCAAsC,MAAM;EAErD,IAAI,MAAM,8BAA8B,QACtC,OAAO,+BAA+B,MAAM;EAE9C,IAAI,MAAM,uBAAuB,QAC/B,OAAO,wBAAwB,MAAM;OAMrC,OAAO,wBAAwB;EAKjC,OAAO,UAAU,sBAAsB,MAAM,IAAI;EAKjD,OAAO,uBAAuB,uBAAuB,MAAM,cAAc;EACzE,OAAO,oCAAoC,uBAAuB,cAAc;EAehF,OAAO,oBAAoB,uBALG,eAAe,QAAQ,MAAM;GACzD,IAAI,EAAE,eAAe,QAAW,OAAO;GACvC,IAAI,EAAE,SAAS,WAAW,EAAE,SAAS,OAAO,OAAO;GACnD,OAAO;EACT,CACsE,CAAC;EACvE,OAAO,gCAAgC,sBAAsB,aAAa;EAE1E,OAAO;CACT;CAIA,AAAQ,oBACN,YACyC;EACzC,MAAM,KAAK,WAAW;EAGtB,IAAI,CAAC,IAAI,OAAO;EAChB,MAAM,MAAmC,CAAC;EAQ1C,IAAI,GAAG,qBAAqB,QAAW;GACrC,IAAI,mBAAmB,GAAG;GAC1B,IAAI,GAAG,uBAAuB,QAK5B,KAAK,OAAO,MACV,+CAA+C,GAAG,iBAAiB,4BAA4B,GAAG,mBAAmB,kCACvH;EAEJ,OAAO,IAAI,GAAG,uBAAuB,QACnC,IAAI,qBAAqB,GAAG;EAE9B,IAAI,GAAG,YAAY,QAQjB,IAAI,UAAU,OAAO,GAAG,OAAO;EAEjC,IAAI,IAAI,qBAAqB,UAAa,IAAI,uBAAuB,QACnE;EAEF,OAAO;CACT;;;;;;;CAQA,AAAQ,UAAU,WAAmB,YAA+C;EAClF,MAAM,MAAM,WAAW;EAGvB,IAAI,CAAC,KAAK,OAAO,CAAC;EAClB,OAAO,IACJ,QAAQ,MAAM,EAAE,QAAQ,MAAS,CAAC,CAClC,KAAK,OAAO;GACX,YAAY;GACZ,cAAc;GACd,KAAK,EAAE;GACP,OAAO,EAAE,SAAS;GAClB,mBAAmB,EAAE,qBAAqB;EAC5C,EAAE;CACN;;;;;CAMA,AAAQ,sBAAsB,OAAoC;EAChE,IAAI,UAAU,UAAa,UAAU,MAAM,OAAO;EAClD,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,UAAU,MAAM,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,CAAC;GAC7E,IAAI,QAAQ,WAAW,GAAG,OAAO;GACjC,OAAO,QAAQ,KAAK,GAAG;EACzB;EACA,IAAI,OAAO,UAAU,UAAU,OAAO;CAExC;CAEA,MAAc,cAAc,WAAmB;EAM7C,QAAO,MALgB,KAAK,UAAU,CAAC,CAAC,KACtC,IAAI,iCAAiC,EACnC,uBAAuB,CAAC,SAAS,EACnC,CAAC,CACH,EACe,CAAC,oBAAoB;CACtC;;;;;;;;;;;;CAaA,MAAc,oCACZ,WACA,WACe;EACf,IAAI;EACJ,IAAI;GAEF,gBAAe,MADK,KAAK,cAAc,SAAS,EAC5B,EAAE,aAAa,CAAC,EAAC,CAClC,KAAK,MAAM,EAAE,UAAU,CAAC,CACxB,QAAQ,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;EACzE,SAAS,eAAe;GACtB,KAAK,OAAO,MACV,qDAAqD,UAAU,uCAAuC,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,GACrL;GACA;EACF;EAEA,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,OAAO,MACV,2CAA2C,YAAY,OAAO,mCAAmC,UAAU,qBAC7G;EACA,KAAK,MAAM,cAAc,aACvB,MAAM,8BAA8B,KAAK,aAAa,GAAG,YAAY,KAAK,MAAM;CAEpF;CAEA,MAAc,SAAS,WAAgD;EACrE,IAAI;GAEF,QAAO,MADa,KAAK,cAAc,SAAS,EACpC,EAAE;EAChB,SAAS,KAAK;GACZ,KAAK,OAAO,MACV,6BAA6B,UAAU,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GACpG;GACA;EACF;CACF;CAEA,AAAQ,gBAAgB,OAAyB;EAC/C,IAAI,EAAE,iBAAiB,QAAQ,OAAO;EACtC,MAAM,OAAQ,MAA4B,QAAQ;EAClD,MAAM,UAAU,MAAM,QAAQ,YAAY;EAG1C,OACE,SAAS,sBACR,QAAQ,SAAS,iCAAiC,KACjD,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,gBAAgB;CAEvC;CAEA,MAAc,oBAAoB,WAAmB,YAAY,KAAwB;EACvF,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI,QAAQ;EAEZ,OAAO,KAAK,IAAI,IAAI,YAAY,WAAW;GACzC,IAAI;IAEF,IAAI,CAAC,MADe,KAAK,cAAc,SAAS,GACpC;GACd,SAAS,OAAO;IACd,IAAI,KAAK,gBAAgB,KAAK,GAAG;IACjC,MAAM;GACR;GAEA,MAAM,KAAK,MAAM,KAAK;GACtB,QAAQ,KAAK,IAAI,QAAQ,GAAG,GAAM;EACpC;EAEA,MAAM,IAAI,MACR,0CAA0C,UAAU,+BACtD;CACF;CAEA,AAAQ,MAAM,IAA2B;EACvC,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;CACzD;;;;;;;;;;;;;;;;CAyBA,MAAc,cAAc,YAAoB,MAAe,MAA8B;EAC3F,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAE/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EACnD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EACnD,MAAM,4BAAY,IAAI,IAAoB;EAC1C,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,CAAC;EAEnC,MAAM,4BAAY,IAAI,IAAoB;EAC1C,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,CAAC;EAGnC,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,CAAC,KAAK,QAAQ,WACvB,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG,SAAS,KAAK,GAAG;EAE5C,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAIA,oBAAkB,EAOpB,MAAM,SAAS,KAAK,OAAO;GACzB,YAAY;GACZ,cAAc;GACd,KAAK,EAAE;EACT,EAAE,EACJ,CAAC,CACH;EAGF,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW;GAClC,MAAM,SAAS,UAAU,IAAI,GAAG;GAChC,IAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,GAAG,GAAG;GACpD,SAAS,KAAK,GAAG;EACnB;EACA,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,0BAA0B,EAC5B,MAAM,SAAS,KAAK,OAAO;GACzB,YAAY;GACZ,cAAc;GACd,KAAK,EAAE;GACP,GAAI,EAAE,UAAU,UAAa,EAAE,OAAO,EAAE,MAAM;GAC9C,GAAI,EAAE,sBAAsB,UAAa,EACvC,mBAAmB,EAAE,kBACvB;EACF,EAAE,EACJ,CAAC,CACH;CAEJ;;;;;;;;CASA,MAAc,2BACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,aAAa,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QACjD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,aAAa,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QACjD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,UAAU,IAAI,IAAI,SAAS;EACjC,MAAM,UAAU,IAAI,IAAI,SAAS;EACjC,MAAM,WAAW,UAAU,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACxD,MAAM,WAAW,UAAU,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACxD,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,2BAA2B;GAC7B,sBAAsB;GACtB,mBAAmB;EACrB,CAAC,CACH;EAEF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,2BAA2B;GAC7B,sBAAsB;GACtB,mBAAmB;EACrB,CAAC,CACH;CAEJ;;;;;;;;;CAUA,MAAc,yBACZ,YACA,MACA,MACA,aACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,YAAY,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QAChD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,YAAY,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QAChD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACvD,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACvD,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,sCAAsC;GACxC,sBAAsB;GACtB,iBAAiB;EACnB,CAAC,CACH;EAEF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,sCAAsC;GACxC,sBAAsB;GACtB,iBAAiB;EACnB,CAAC,CACH;EAWF,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,GAC3C,MAAM,KAAK,kCAAkC,YAAY,IAAI,IAAI,QAAQ,GAAG,WAAW;CAE3F;CAEA,OAAwB,4BAA4B;CACpD,OAAwB,kCAAkC;;;;;;;;;CAU1D,MAAc,kCACZ,YACA,UACA,eAA6B,SAAS,MACvB;EAQf,MAAM,QAAQ,YAA0B,KAAK,OAAO,KAAK,YAAY,OAAO,CAAC;EAC7E,MAAM,SAAS,YAA0B,KAAK,OAAO,MAAM,YAAY,OAAO,CAAC;EAC/E,MAAM,aAAa,KAAK,IAAI,IAAI,YAAY;EAC5C,IAAI,+BAA4B,IAAI,IAAI;EACxC,OAAO,KAAK,IAAI,IAAI,YAAY;GAC9B,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,KAC5B,IAAI,iCAAiC,EAAE,uBAAuB,CAAC,UAAU,EAAE,CAAC,CAC9E;GACF,SAAS,KAAK;IAMZ,MACE,0EACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;IACA,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,YAAY,+BAA+B,CAAC;IACnF;GACF;GACA,eAAe,IAAI,IAAI,KAAK,oBAAoB,EAAE,EAAE,mBAAmB,CAAC,CAAC;GACzE,IAAI,aAAa,SAAS,SAAS,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,MAAM,aAAa,IAAI,CAAC,CAAC,GACvF;GAEF,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,YAAY,+BAA+B,CAAC;EACrF;EAcA,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC;EACrE,MAAM,iBAAiB,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC;EACzE,KACE,4DAA4D,YAAY,0BAA0B,aAAa,WAAW,aAAa,KAAK,UAAU,cAAc,EAAE,YAAY,KAAK,UAAU,cAAc,GACjN;CACF;CAEA,MAAc,2BACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,oCAAoB,IAAI,IAAkC;EAChE,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,aAAa,kBAAkB,IAAI,EAAE,aAAa,EAAE,OAAO;EAEnE,MAAM,oCAAoB,IAAI,IAAkC;EAChE,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,aAAa,kBAAkB,IAAI,EAAE,aAAa,EAAE,OAAO;EAMnE,KAAK,MAAM,CAAC,aAAa,YAAY,mBACnC,IAAI,CAAC,kBAAkB,IAAI,WAAW,GACpC,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,gCAAgC;GAClC,sBAAsB;GACtB,GAAI,WAAW,QAAQ,SAAS,IAAI,EAAE,SAAS,QAAQ,IAAI,CAAC;EAC9D,CAAC,CACH;EAGJ,KAAK,MAAM,CAAC,aAAa,YAAY,mBAAmB;GACtD,MAAM,SAAS,kBAAkB,IAAI,WAAW;GAChD,IAAI,KAAK,UAAU,UAAU,IAAI,MAAM,KAAK,UAAU,WAAW,IAAI,GAAG;GAKxE,IAAI,UAAU,OAAO,SAAS,GAAG;IAC/B,MAAM,UAAU,UAAU,OAAO,QAAQ,MAAM,CAAC,QAAQ,SAAS,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,QAAQ,SAAS,GACnB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,gCAAgC;KAClC,sBAAsB;KACtB,SAAS;IACX,CAAC,CACH;GAEJ;GACA,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,+BAA+B;IACjC,sBAAsB;IACtB,aAAa;IACb,GAAI,WAAW,QAAQ,SAAS,IAAI,EAAE,SAAS,QAAQ,IAAI,CAAC;GAC9D,CAAC,CACH;EACF;CACF;CAEA,MAAc,wBACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EASnD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAGnD,MAAM,YAAY,IAAI,IACpB,YAAY,KAAK,MAAM,EAAE,iBAAiB,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAC5E;EAEA,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,qBAAqB,CAAC,UAAU,IAAI,EAAE,iBAAiB,GAC3D,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,2BAA2B;GAC7B,sBAAsB;GACtB,mBAAmB,EAAE;EACvB,CAAC,CACH;EAKJ,MAAM,6BAAa,IAAI,IAAqB;EAC5C,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,mBAAmB,WAAW,IAAI,EAAE,mBAAmB,CAAC;EAEhE,KAAK,MAAM,KAAK,aAAa;GAC3B,IAAI,CAAC,EAAE,mBAAmB;GAC1B,MAAM,WAAW,WAAW,IAAI,EAAE,iBAAiB;GACnD,IAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,CAAC,GAAG;GACpD,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,wBAAwB;IAC1B,sBAAsB;IACtB,mBAAmB,EAAE;IACrB,GAAI,EAAE,wBAAwB,UAAa,EACzC,qBAAqB,EAAE,oBACzB;IACA,GAAI,EAAE,YAAY,UAAa,EAAE,SAAS,EAAE,QAAQ;IACpD,GAAI,EAAE,0BAA0B,UAAa,EAC3C,uBAAuB,EAAE,sBAC3B;IACA,GAAI,EAAE,yBAAyB,UAAa,EAC1C,sBAAsB,EAAE,qBAC1B;IACA,GAAI,EAAE,qBAAqB,UAAa,EAAE,kBAAkB,EAAE,iBAAiB;IAC/E,GAAI,EAAE,kBAAkB,UAAa,EAAE,eAAe,EAAE,cAAc;GACxE,CAAC,CACH;EACF;CACF;CAEA,MAAc,wBACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAAC;EAC5F,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAAC;EAC5F,MAAM,WAAW,YAAY,QAAQ,MAAM,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAC;EACrF,MAAM,WAAW,YAAY,QAAQ,MAAM,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAC;EACrF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,4BAA4B;GAC9B,sBAAsB;GACtB,gBAAgB,SAAS,KAAK,OAAO;IACnC,YAAY,EAAE;IACd,GAAI,EAAE,SAAS,UAAa,EAAE,MAAM,EAAE,KAAK;GAC7C,EAAE;EACJ,CAAC,CACH;EAEF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,4BAA4B;GAC9B,sBAAsB;GACtB,gBAAgB,SAAS,KAAK,OAAO;IACnC,YAAY,EAAE;IACd,GAAI,EAAE,SAAS,UAAa,EAAE,MAAM,EAAE,KAAK;GAC7C,EAAE;EACJ,CAAC,CACH;CAEJ;CAEA,MAAc,oCACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAO/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,8BAAc,IAAI,IAAkC;EAC1D,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,UAAU,YAAY,IAAI,EAAE,UAAU,EAAE,iBAAiB;EAEjE,MAAM,8BAAc,IAAI,IAAkC;EAC1D,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,UAAU,YAAY,IAAI,EAAE,UAAU,EAAE,iBAAiB;EAEjE,KAAK,MAAM,SAAS,YAAY,KAAK,GACnC,IAAI,CAAC,YAAY,IAAI,KAAK,GACxB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,uCAAuC;GACzC,sBAAsB;GACtB,UAAU;EACZ,CAAC,CACH;EAGJ,KAAK,MAAM,CAAC,OAAO,UAAU,aAAa;GACxC,MAAM,SAAS,YAAY,IAAI,KAAK;GACpC,IAAI,KAAK,UAAU,UAAU,IAAI,MAAM,KAAK,UAAU,SAAS,IAAI,GAAG;GACtE,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,oCAAoC;IACtC,sBAAsB;IACtB,UAAU;IACV,mBAAmB,SAAS,CAAC;GAC/B,CAAC,CACH;EACF;CACF;AACF;;;;;;;;;;;;AAeA,SAAS,uBACP,gBAGoD;CACpD,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG,OAAO,CAAC;CAC5D,MAAM,gCAAgB,IAAI,IAAyB;CACnD,KAAK,MAAM,KAAK,gBAAgB;EAC9B,MAAM,IAAI,EAAE;EACZ,IAAI,CAAC,GAAG;EACR,IAAI,MAAM,cAAc,IAAI,CAAC;EAC7B,IAAI,CAAC,KAAK;GACR,sBAAM,IAAI,IAAI;GACd,cAAc,IAAI,GAAG,GAAG;EAC1B;EACA,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,MAAM;CAChC;CACA,MAAM,SAA6D,CAAC;CAEpE,KAAK,MAAM,eAAe,MAAM,KAAK,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;EACjE,MAAM,UAAU,MAAM,KAAK,cAAc,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;EACtE,OAAO,KACL,QAAQ,SAAS,IACb;GAAE,aAAa;GAAa,SAAS;EAAQ,IAC7C,EAAE,aAAa,YAAY,CACjC;CACF;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAS,uBACP,OASgC;CAChC,IAAI,CAAC,SAAS,MAAM,WAAW,GAAG,OAAO,CAAC;CAC1C,MAAM,SAAyC,CAAC;CAChD,KAAK,MAAM,KAAK,OAAO;EACrB,IAAI,CAAC,EAAE,mBAAmB;EAC1B,MAAM,QAAiC,EAAE,mBAAmB,EAAE,kBAAkB;EAChF,IAAI,EAAE,wBAAwB,QAAW,MAAM,yBAAyB,EAAE;EAC1E,IAAI,EAAE,YAAY,QAAW,MAAM,aAAa,EAAE;EAClD,IAAI,EAAE,0BAA0B,QAC9B,MAAM,2BAA2B,EAAE;EAErC,IAAI,EAAE,yBAAyB,QAC7B,MAAM,0BAA0B,EAAE;EAEpC,IAAI,EAAE,qBAAqB,QAAW,MAAM,sBAAsB,EAAE;EACpE,IAAI,EAAE,kBAAkB,QAAW,MAAM,mBAAmB,EAAE;EAC9D,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,MAAM,GAAG,MACd,OAAO,EAAE,oBAAoB,CAAC,CAAC,cAAc,OAAO,EAAE,oBAAoB,CAAC,CAC7E;CACA,OAAO;AACT;;;;;;;AAQA,SAAS,uBACP,gBACgC;CAChC,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG,OAAO,CAAC;CAC5D,MAAM,SAAyC,CAAC;CAChD,KAAK,MAAM,KAAK,gBAAgB;EAC9B,IAAI,CAAC,EAAE,YAAY;EACnB,MAAM,QAAiC,EAAE,YAAY,EAAE,WAAW;EAClE,IAAI,EAAE,SAAS,QAAW,MAAM,UAAU,EAAE;EAC5C,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,MAAM,GAAG,MAAM,OAAO,EAAE,aAAa,CAAC,CAAC,cAAc,OAAO,EAAE,aAAa,CAAC,CAAC;CACpF,OAAO;AACT;;;;;;;AAQA,SAAS,sBACP,gBACgC;CAChC,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG,OAAO,CAAC;CAC5D,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,KAAK,gBAAgB;EAC9B,IAAI,CAAC,EAAE,UAAU;EACjB,IAAI,MAAM,QAAQ,IAAI,EAAE,QAAQ;EAChC,IAAI,CAAC,KAAK;GACR,sBAAM,IAAI,IAAI;GACd,QAAQ,IAAI,EAAE,UAAU,GAAG;EAC7B;EACA,IAAI,EAAE,kBAAkB,IAAI,IAAI,EAAE,gBAAgB;CACpD;CACA,MAAM,SAAyC,CAAC;CAChD,KAAK,MAAM,SAAS,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;EACrD,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;EACxD,OAAO,KAAK;GAAE,UAAU;GAAO,mBAAmB;EAAM,CAAC;CAC3D;CACA,OAAO;AACT"}

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-D3md0Lde.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-Rs7TV7Gz.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-CG34-sQd.js");
+	const { buildProgram } = await import("./program-D2Vykejc.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);