@go-to-k/cdkd 0.290.14 → 0.290.16

package/dist/{asg-provider-BAYjqZuM.js → asg-provider-CvkcE8rH.js}

@@ -1,4 +1,4 @@
-import { It as assertRegionMatch, Ni as __exportAll, Pn as shellQuote, Pt as normalizeAwsTagsToCfn, _i as ResourceUpdateNotSupportedError, at as clearOnUpdateRemoval, hi as ProvisioningError, xt as disableInstanceApiTermination } from "./deploy-engine-v7h1H_Ac.js";
+import { It as assertRegionMatch, Ni as __exportAll, Pn as shellQuote, Pt as normalizeAwsTagsToCfn, _i as ResourceUpdateNotSupportedError, at as clearOnUpdateRemoval, hi as ProvisioningError, xt as disableInstanceApiTermination } from "./deploy-engine-B91NMqm1.js";
 import { C as displaySafe, n as getLogger, p as generateResourceName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
 import { EC2Client } from "@aws-sdk/client-ec2";
@@ -48,13 +48,29 @@ import { AttachLoadBalancerTargetGroupsCommand, AttachLoadBalancersCommand, Atta
 * renders its command through the EXPORTED {@link renderDisableCommand} —
 * the same sanitize / quote / suppress the five callers above get, with the
 * log-group text kept around it — and falls back to
-* {@link UNNAMEABLE_ID_CLAUSE} when the id is suppressed. The export exists
-* for exactly one caller that owns its own sentence; a second one should ask
-* whether it can use {@link protectedReplacementAdvice} instead.
+* {@link UNNAMEABLE_ID_CLAUSE} when the id is suppressed.
 * `tests/integration/loggroup-class-guard/verify.sh` greps the rendered
 * command, so its needle is the UNQUOTED form `shellQuote` produces for a
 * clean id.
 *
+* **The export is no longer for "exactly one caller".** Issue
+* [#3136](https://github.com/go-to-k/cdkd/issues/3136) found the same
+* hand-quoted `'${value}'` shape at four more sites that are NOT protected-arm
+* remedies at all — two partial-create cleanup warnings
+* (`ssm-parameter-provider.ts`, `s3-bucket-provider.ts`, the latter sharing one
+* clause between its two arms) and one import refusal
+* (`ssm-parameter-provider.ts`'s `refuseUnwritableParameterId`) — so the right
+* question for a NEW caller is not "can it use
+* {@link protectedReplacementAdvice} instead" but "is the value it pastes
+* cdkd-MINTED with a proven charset". Where it is not, it belongs here.
+* `efs-provider.ts`'s `aws efs describe-access-points --query
+* "AccessPoints[?ClientToken=='<token>']"` is the recorded counter-example and
+* deliberately does NOT route through this: the token comes from
+* `acquireIdempotencyToken`, which mints `cdkd-<sha256 hex>` and nothing else,
+* and those single quotes are JMESPath string delimiters INSIDE a
+* double-quoted shell argument — `shellQuote`'s escaping would produce invalid
+* JMESPath rather than safer shell.
+*
 * Two properties every caller owes, because only the caller can answer them:
 *
 * - **`evidence` must name the BAG it read.** Most read the RECORDED bag
@@ -120,6 +136,7 @@ function renderDisableCommand(disable) {
 	const resolved = disable;
 	const safeId = displaySafe(resolved.identifier, { asciiOnly: true });
 	if (!safeId || safeId !== resolved.identifier) return "";
+	if (resolved.maskSecrets && resolved.maskSecrets(safeId) !== safeId) return "";
 	const tail = resolved.after ? ` ${resolved.after}` : "";
 	return `${resolved.before} ${shellQuote(safeId)}${tail}`;
 }
@@ -1003,4 +1020,4 @@ function mapNotificationsToCfn(configurations) {
 
 //#endregion
 export { renderDisableCommand as a, protectedReplacementAdvice as i, asg_provider_exports as n, UNNAMEABLE_ID_CLAUSE as r, ASGProvider as t };
-//# sourceMappingURL=asg-provider-BAYjqZuM.js.map
+//# sourceMappingURL=asg-provider-CvkcE8rH.js.map

package/dist/asg-provider-CvkcE8rH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asg-provider-CvkcE8rH.js","names":["DeleteTagsCommand"],"sources":["../src/provisioning/replacement-protection-advice.ts","../src/provisioning/providers/asg-provider.ts"],"sourcesContent":["/**\n * The sentence a provider's replacement advice must say instead of a bare\n * \"re-deploy with `--replace`\" when cdkd's own properties already say the\n * resource carries a deletion / termination protection flag.\n *\n * Issue [#2579](https://github.com/go-to-k/cdkd/issues/2579) established the\n * shape on `AWS::Logs::LogGroup`: the advised replacement runs its DELETE from\n * the deploy engine, which never sets `DeleteContext.removeProtection` — every\n * provider's flip-off is gated on that field and only the DESTROY paths\n * (`cdkd destroy`, `cdkd state destroy`) set it, because `cdkd deploy`\n * registers no `--remove-protection` Option at all (`deployOptions` in\n * `src/cli/options.ts`, fenced by\n * `tests/unit/cli/replacement-remedy-cli-facts.test.ts` against the real\n * Commander tree). So AWS refuses the delete and the command cdkd just told the\n * user to run dies on a SECOND wall with nothing named to do about it.\n *\n * Issue [#2610](https://github.com/go-to-k/cdkd/issues/2610) swept that shape\n * across the tree and found the same dead end on five more providers. This\n * module is the shared definition those five sites use, so the mechanism is\n * stated once rather than paraphrased five times — the reason\n * `lock-contention-message.ts` exists one directory over, and the reason\n * `display-safe.ts`'s header gives for not widening a rule by hand.\n *\n * `docs/cli-deploy-safety.md`'s \"Deletion protection blocks a replacement\"\n * section names all six types whose refusal says this explicitly (issue\n * [#2658](https://github.com/go-to-k/cdkd/issues/2658)), including the two\n * exceptions worth knowing before adding a seventh: ASG's arm is narrower than\n * its protection setting, and Cognito's fires after the desired bag is applied.\n *\n * `logs-loggroup-provider.ts` does NOT route through it and keeps its own text:\n * three review rounds on #2579 shaped clauses that are true only of that type\n * (`--force-stateful-recreation` has no per-resource granularity;\n * `LogGroupName` is the type's only replacement property, so a same-name\n * `Retain` replacement cannot complete at all), and a `suffix` parameter wide\n * enough to carry them would make the shared part the smaller half. Its message\n * is pinned by its own tests; this one by\n * `tests/unit/provisioning/replacement-remedy-preconditions.test.ts`.\n *\n * **Read that as a decision about the TEXT, never about the id rendering.**\n * Since issue [#2669](https://github.com/go-to-k/cdkd/issues/2669) that site\n * renders its command through the EXPORTED {@link renderDisableCommand} —\n * the same sanitize / quote / suppress the five callers above get, with the\n * log-group text kept around it — and falls back to\n * {@link UNNAMEABLE_ID_CLAUSE} when the id is suppressed.\n * `tests/integration/loggroup-class-guard/verify.sh` greps the rendered\n * command, so its needle is the UNQUOTED form `shellQuote` produces for a\n * clean id.\n *\n * **The export is no longer for \"exactly one caller\".** Issue\n * [#3136](https://github.com/go-to-k/cdkd/issues/3136) found the same\n * hand-quoted `'${value}'` shape at four more sites that are NOT protected-arm\n * remedies at all — two partial-create cleanup warnings\n * (`ssm-parameter-provider.ts`, `s3-bucket-provider.ts`, the latter sharing one\n * clause between its two arms) and one import refusal\n * (`ssm-parameter-provider.ts`'s `refuseUnwritableParameterId`) — so the right\n * question for a NEW caller is not \"can it use\n * {@link protectedReplacementAdvice} instead\" but \"is the value it pastes\n * cdkd-MINTED with a proven charset\". Where it is not, it belongs here.\n * `efs-provider.ts`'s `aws efs describe-access-points --query\n * \"AccessPoints[?ClientToken=='<token>']\"` is the recorded counter-example and\n * deliberately does NOT route through this: the token comes from\n * `acquireIdempotencyToken`, which mints `cdkd-<sha256 hex>` and nothing else,\n * and those single quotes are JMESPath string delimiters INSIDE a\n * double-quoted shell argument — `shellQuote`'s escaping would produce invalid\n * JMESPath rather than safer shell.\n *\n * Two properties every caller owes, because only the caller can answer them:\n *\n * - **`evidence` must name the BAG it read.** Most read the RECORDED bag\n *   (`previousProperties`), which on the deploy path is\n *   `ResourceState.properties` — cdkd's best account of what AWS holds on the\n *   resource that is about to be deleted. A caller whose refusal fires AFTER\n *   the desired bag has been applied (`CognitoUserPoolProvider`'s schema guard\n *   runs after `UpdateUserPool`) must read the desired value first and say so.\n *   Protection enabled OUT OF BAND is in no bag at all, so such a resource\n *   still gets the short advice and still hits the wall — cdkd cannot see what\n *   it never recorded, and probing AWS from a refusal path would add a call to\n *   the failure route. Interpolate no unsanitized value into it: it is rendered\n *   to a terminal and captured into `deployments/*.jsonl`.\n * - **`disable.command` must change nothing but the flag.** Where a service's\n *   update API may take other members down with the flag, say so through\n *   `disable.caveat` — rendered OUTSIDE the backticks, so the pasteable span\n *   stays pasteable.\n *\n *   **State only what has been measured, per field.** This text used to assert\n *   that Cognito's `UpdateUserPool` \"resets every member it is not sent\" —\n *   AWS's own blanket wording, which `cognito-provider.ts`'s\n *   `readLiveMfaConfiguration` ledger shows holds FIELD BY FIELD and is FALSE\n *   for at least two (`MfaConfiguration` and both `Policies` sub-keys survive\n *   omission; `AutoVerifiedAttributes` does not). Issue\n *   [#2610](https://github.com/go-to-k/cdkd/issues/2610)'s review retired that\n *   universal from the user-facing caveat, and it survived HERE for a round —\n *   which is the failure mode worth naming, because this is the normative text\n *   a future caller copies. A blanket \"resets to default\" claim is per-field\n *   and needs a per-field measurement; `DeletionProtection`'s is issue\n *   [#2675](https://github.com/go-to-k/cdkd/issues/2675).\n */\n\nimport { displaySafe } from '../utils/display-safe.js';\nimport { shellQuote } from '../state/lock-contention-message.js';\n\n/**\n * The doc section every caller points at. A single constant so a rename of the\n * heading cannot leave five providers pointing at a section that no longer\n * exists; `tests/unit/provisioning/replacement-remedy-preconditions.test.ts`\n * resolves it against `docs/cli-deploy-safety.md`'s actual headings.\n */\nexport const DELETION_PROTECTION_DOC_POINTER =\n  '\"Deletion protection blocks a replacement, and deploy cannot clear it\" in docs/cli-deploy-safety.md';\n\n/** What the message says when the resource id cannot be named on a command line. */\nexport const UNNAMEABLE_ID_CLAUSE =\n  'Then disable protection out of band, via the console: the physical id cdkd recorded for this ' +\n  'resource cannot be reproduced safely on a command line, so any command shown here would act on ' +\n  'a different resource.';\n\n/**\n * A string the COMPILER can prove is a literal.\n *\n * Two shapes are rejected, and the second is the one a plain\n * `string extends T` test misses:\n *\n *  - a WIDENED `string` -- what every non-literal expression produces:\n *    `'lit ' + String(x)`, a `const` declared `: string`, a value read out of a\n *    builder's return type, a spread of any of those, and (deliberately) a\n *    concatenation of two literals;\n *  - a TEMPLATE LITERAL TYPE carrying an interpolation. `` `aws x ${derived}` ``\n *    does NOT widen to `string` -- its type is `` `aws x ${string}` ``, so\n *    `string extends T` is FALSE and a one-line constraint accepts it, while\n *    the interpolated span is exactly the attacker-controlled text this module\n *    exists to keep out of a pasteable command. `HasInterpolation` walks the\n *    type one character at a time and reports any tail that IS `string`, which\n *    is what a `${...}` hole leaves behind. Measured on the longest literal in\n *    use (203 characters): no depth error, whole-project typecheck unchanged.\n *\n * Both resolve to `never` and fail to assign, at `vp run typecheck`.\n *\n * **Why a TYPE and not a test.** This constraint replaced a source-text sniff\n * over `src/` that was three spellings deep by the time issue [#2610]'s fifth\n * review round reached it: the first cut tested only a value's opening\n * character; the second joined continuation lines only until the value first\n * looked literal, so Prettier's operator-at-line-start layout walked through;\n * the third derived its population from field names near an `identifier`, which\n * a builder returning `{ before, after }` from another module simply exits.\n * Each hole was closed and the next one was found by the next probe. A grep\n * cannot see a type, so the honest fix is to stop grepping: a widened `string`\n * is now a COMPILE ERROR, which no refactor, spread, shorthand or far-away\n * `const` can walk out of. `tests/unit/cli/replacement-remedy-cli-facts.test.ts`\n * pins one `@ts-expect-error` per evasion shape instead.\n *\n * The one shape it also rejects is a concatenation of two LITERALS\n * (`'a' + 'b'` widens to `string` in TypeScript). That is a real cost, paid\n * deliberately: a single literal is what the fence can see, and the one caller\n * that concatenated was rewritten to use one.\n */\ntype HasInterpolation<T extends string> = string extends T\n  ? true\n  : T extends `${infer _Head}${infer Rest}`\n    ? string extends Rest\n      ? true\n      : HasInterpolation<Rest>\n    : false;\n\nexport type CdkdAuthoredLiteral<T extends string> = HasInterpolation<T> extends true ? never : T;\n\n/**\n * The out-of-band disable command, split so only the IDENTIFIER is untrusted.\n *\n * `before` / `after` / `caveat` are rendered VERBATIM (inside the backticks for\n * the first two, beside them for the third), so they must be cdkd-authored\n * literals — the compiler now enforces that. `identifier` is the opposite: it\n * is a `state.json` value, and {@link protectedReplacementAdvice} sanitizes,\n * shell-quotes and suppresses it.\n */\nexport interface ProtectedReplacementDisableCommand<\n  Before extends string = string,\n  After extends string = string,\n  Caveat extends string = string,\n> {\n  /**\n   * Everything before the resource id, e.g.\n   * `aws elbv2 modify-load-balancer-attributes --load-balancer-arn`.\n   */\n  before: CdkdAuthoredLiteral<Before>;\n  /**\n   * The resource's physical id. SANITIZED and SHELL-QUOTED here, and the whole\n   * command is SUPPRESSED when sanitizing changes it — see\n   * {@link protectedReplacementAdvice}.\n   */\n  identifier: string;\n  /**\n   * Everything after the id, e.g.\n   * `--attributes Key=deletion_protection.enabled,Value=false`.\n   */\n  after?: CdkdAuthoredLiteral<After>;\n  /**\n   * Rendered as a sentence AFTER the command, never inside its backticks — it\n   * reaches the terminal and the persisted events store like everything else\n   * here.\n   */\n  caveat?: CdkdAuthoredLiteral<Caveat>;\n  /**\n   * The caller's secret masker, when it has one. Optional: most callers render\n   * a physical id read off `state.json` and have none.\n   *\n   * It exists because `shellQuote` can put a SECRET past the message-level\n   * mask, which is a hazard this module created and only this module can\n   * close (found by the security review of issue\n   * [#3136](https://github.com/go-to-k/cdkd/issues/3136)). `maskSecretsInText`\n   * matches by LITERAL occurrence, and `shellQuote` rewrites every inner `'`\n   * to `'\\''` — so a resolved `{{resolve:secretsmanager:...}}` value\n   * containing a quote no longer OCCURS in the finished line and comes through\n   * a masking sink in PLAINTEXT. The hand-quoted `'${value}'` this module\n   * replaced did not have that problem, because it left the value\n   * byte-identical.\n   *\n   * Supplying it makes {@link renderDisableCommand} SUPPRESS the command for\n   * any id the masker would change — the same answer sanitization already\n   * gets, for the same reason: a command cdkd cannot show honestly is better\n   * not shown. It is deliberately NOT applied to the rendered command, which\n   * would only reintroduce the escaping problem one layer up.\n   */\n  maskSecrets?: (text: string) => string;\n}\n\n/** The same shape with the literal constraint discharged, for internal use. */\ninterface ResolvedDisableCommand {\n  before: string;\n  identifier: string;\n  after?: string;\n  caveat?: string;\n  maskSecrets?: (text: string) => string;\n}\n\nexport interface ProtectedReplacementAdviceArgs<\n  Before extends string = string,\n  After extends string = string,\n  Caveat extends string = string,\n> {\n  /**\n   * A complete clause naming WHAT cdkd read and WHERE, with no trailing\n   * punctuation — e.g. `\"cdkd's recorded properties for this cluster carry\n   * Instances.TerminationProtected: true\"`. It is the first half of the\n   * returned sentence, so it must read as a subject + verb.\n   */\n  evidence: string;\n  /**\n   * The flags the SHORT advice at this site names, spelled exactly as the user\n   * would type them (e.g. `'cdkd deploy --replace --force-stateful-recreation'`).\n   * Named twice in the output — once in the refusal and once in the re-run — so\n   * the two can never drift.\n   */\n  replaceFlags: string;\n  /** A concrete out-of-band way to turn protection off. */\n  disable: ProtectedReplacementDisableCommand<Before, After, Caveat>;\n}\n\n/**\n * Render `disable` as a pasteable command, or `''` when its id cannot be named.\n *\n * The id reaching here is NOT an AWS-minted literal, which an earlier revision\n * of this module claimed and the review of issue [#2610] disproved: the deploy\n * engine passes `currentResource.physicalId` straight off `state.json`, and for\n * `AWS::DynamoDB::GlobalTable` and `AWS::AutoScaling::AutoScalingGroup` the\n * physical id is the TEMPLATE-chosen name. So it is exactly the class\n * `lock-contention-message.ts` handles, and it gets the identical treatment\n * rather than a second spelling of it:\n *\n *  - sanitize FIRST (`asciiOnly`, a positive allowlist — a control character\n *    has no legitimate place in an AWS physical id, and left in it forges lines\n *    on the operator's terminal and inside `deployments/*.jsonl`);\n *  - then `shellQuote`, the SAME predicate the force-unlock hint uses, so a\n *    value carrying a quote or a space cannot truncate when pasted;\n *  - and SUPPRESS the whole command when sanitizing CHANGED the value, because\n *    a command naming the sanitized id would act on a DIFFERENT resource — the\n *    wrong-target harm that module exists to prevent, and the reason emitting\n *    no command is the honest answer rather than a fallback.\n */\nexport function renderDisableCommand<\n  Before extends string,\n  After extends string = string,\n  Caveat extends string = string,\n>(disable: ProtectedReplacementDisableCommand<Before, After, Caveat>): string {\n  // EXPORTED since issue [#2669] for the one caller that owns its own sentence\n  // (`logs-loggroup-provider.ts`), and exported OVER THE CONSTRAINED shape:\n  // the generic signature keeps `CdkdAuthoredLiteral` in force for a direct\n  // caller exactly as {@link protectedReplacementAdvice} keeps it for the\n  // five, so a template-derived `before` / `after` is a COMPILE error at both\n  // entry points (`tests/unit/cli/replacement-remedy-cli-facts.test.ts` pins\n  // the direct call). Exporting the discharged `ResolvedDisableCommand`\n  // instead would have re-opened the door the constraint exists to close.\n  const resolved = disable as ResolvedDisableCommand;\n  const safeId = displaySafe(resolved.identifier, { asciiOnly: true });\n  if (!safeId || safeId !== resolved.identifier) return '';\n  // A SECRET-bearing id is suppressed for the same reason a sanitized one is:\n  // see {@link ProtectedReplacementDisableCommand.maskSecrets} for why the\n  // message-level mask cannot catch it once `shellQuote` has escaped a quote.\n  // Only a caller that HAS a masker can ask this; the rest are unchanged.\n  if (resolved.maskSecrets && resolved.maskSecrets(safeId) !== safeId) return '';\n  const tail = resolved.after ? ` ${resolved.after}` : '';\n  return `${resolved.before} ${shellQuote(safeId)}${tail}`;\n}\n\n/**\n * Build the \"your advised replacement is blocked by a protection flag\" advice.\n *\n * Deliberately STOPS at what a provider's `update()` can know. It sees neither\n * `UpdateReplacePolicy` nor what the replacement then does, and three review\n * rounds on issue [#2579] each proved a different sentence about that\n * downstream mechanism false — so the outcome of disabling is handed to the\n * doc, which has the policy in view. A shorter message that is TRUE beats a\n * complete one that is not.\n */\nexport function protectedReplacementAdvice<\n  Before extends string,\n  After extends string = string,\n  Caveat extends string = string,\n>(args: ProtectedReplacementAdviceArgs<Before, After, Caveat>): string {\n  const { evidence, replaceFlags } = args;\n  // Rendered from the still-CONSTRAINED shape, so this call is fenced like a\n  // direct one; the discharged view below is only for reading `caveat`.\n  const command = renderDisableCommand(args.disable);\n  const disable = args.disable as ResolvedDisableCommand;\n  const head =\n    `${evidence}, so ${replaceFlags} alone will NOT succeed while AWS still has protection on: ` +\n    `the replacement DELETES the resource, AWS refuses that delete while protection is on, and ` +\n    `cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and ` +\n    `cdkd state destroy act on one). Read ${DELETION_PROTECTION_DOC_POINTER} BEFORE you disable ` +\n    `anything: whether disabling helps at all, and what the flag ends up as, depend on your ` +\n    `UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can ` +\n    `see.`;\n  if (!command) return `${head} ${UNNAMEABLE_ID_CLAUSE} Then re-run with ${replaceFlags}.`;\n  const caveat = disable.caveat ? ` ${disable.caveat}` : '';\n  return (\n    `${head} Then disable protection out of band — \\`${command}\\`, or via the console.${caveat} ` +\n    `Then re-run with ${replaceFlags}.`\n  );\n}\n","import {\n  AutoScalingClient,\n  CreateAutoScalingGroupCommand,\n  UpdateAutoScalingGroupCommand,\n  DeleteAutoScalingGroupCommand,\n  DescribeAutoScalingGroupsCommand,\n  type DescribeAutoScalingGroupsCommandOutput,\n  DescribeLifecycleHooksCommand,\n  DescribeTrafficSourcesCommand,\n  DescribeNotificationConfigurationsCommand,\n  EnableMetricsCollectionCommand,\n  DisableMetricsCollectionCommand,\n  PutLifecycleHookCommand,\n  DeleteLifecycleHookCommand,\n  AttachTrafficSourcesCommand,\n  DetachTrafficSourcesCommand,\n  PutNotificationConfigurationCommand,\n  DeleteNotificationConfigurationCommand,\n  CreateOrUpdateTagsCommand,\n  DeleteTagsCommand,\n  AttachLoadBalancersCommand,\n  DetachLoadBalancersCommand,\n  AttachLoadBalancerTargetGroupsCommand,\n  DetachLoadBalancerTargetGroupsCommand,\n  type Tag as ASGTag,\n  type LaunchTemplateSpecification,\n  type AvailabilityZoneDistribution,\n  type CapacityReservationSpecification,\n  type DeletionProtection,\n  type InstanceMaintenancePolicy,\n} from '@aws-sdk/client-auto-scaling';\nimport { EC2Client } from '@aws-sdk/client-ec2';\nimport { getLogger } from '../../utils/logger.js';\nimport { ProvisioningError, ResourceUpdateNotSupportedError } from '../../utils/error-handler.js';\nimport { assertRegionMatch, type DeleteContext } from '../region-check.js';\nimport { disableInstanceApiTermination } from '../ec2-termination-protection.js';\nimport { generateResourceName } from '../resource-name.js';\nimport { normalizeAwsTagsToCfn } from '../import-helpers.js';\nimport type {\n  ResourceProvider,\n  ResourceCreateResult,\n  ResourceUpdateResult,\n  CreateContext,\n  UpdateContext,\n  SecretMasker,\n} from '../../types/resource.js';\nimport { clearOnUpdateRemoval } from '../update-removal.js';\nimport { protectedReplacementAdvice } from '../replacement-protection-advice.js';\nimport { awsClientDefaults } from '../../utils/aws-client-defaults.js';\n\n/**\n * AWS Auto Scaling Provider\n *\n * Implements resource provisioning for `AWS::AutoScaling::AutoScalingGroup`.\n *\n * WHY a dedicated SDK provider (instead of CC API fallback):\n *   1. Owns the `--remove-protection` flip-off: ASG protection has three\n *      levels (`none` / `prevent-force-deletion` / `prevent-all-deletion`)\n *      and the destroy path needs to (a) clear it via `UpdateAutoScalingGroup\n *      ({DeletionProtection: 'none'})` before the actual delete and (b) set\n *      `ForceDelete: true` on `DeleteAutoScalingGroup` so AWS terminates any\n *      running instances as part of the delete (matches the user's \"I know\n *      what I'm doing\" intent).\n *   2. Faster than CC API for the common case — direct Create/Update calls\n *      with no eventual-consistency polling beyond what `DescribeAutoScaling\n *      Groups` already provides.\n *\n * Update has narrower coverage than create: AWS does not support modifying\n * `AutoScalingGroupName` (immutable) — that diff still surfaces\n * `ResourceUpdateNotSupportedError` so the caller can `cdkd deploy\n * --replace`. The mutable fields handled in-place via\n * `UpdateAutoScalingGroup` include MinSize / MaxSize / DesiredCapacity /\n * VPCZoneIdentifier / HealthCheckType / HealthCheckGracePeriod /\n * DefaultCooldown / Cooldown / NewInstancesProtectedFromScaleIn /\n * MaxInstanceLifetime / TerminationPolicies / CapacityRebalance /\n * ServiceLinkedRoleARN / Context / DesiredCapacityType /\n * DefaultInstanceWarmup / AvailabilityZones / AvailabilityZoneDistribution\n * / AvailabilityZoneImpairmentPolicy / SkipZonalShiftValidation /\n * CapacityReservationSpecification / InstanceMaintenancePolicy /\n * DeletionProtection / MixedInstancesPolicy / LaunchTemplate.\n *\n * `UpdateAutoScalingGroup` has merge semantics (absent input field = \"no\n * change\"), so update() routes every optional mutable field through\n * `clearOnUpdateRemoval` — a property REMOVED from the template is reset to\n * its CFn default / SDK-documented clear sentinel, matching CloudFormation\n * (issue #1160).\n *\n * Sub-shape diffs are applied via dedicated AWS APIs before the main\n * `UpdateAutoScalingGroup` call:\n *   - `Tags` → `CreateOrUpdateTags` / `DeleteTags` (#475)\n *   - `LoadBalancerNames` → `AttachLoadBalancers` /\n *     `DetachLoadBalancers` (#476)\n *   - `TargetGroupARNs` → `AttachLoadBalancerTargetGroups` /\n *     `DetachLoadBalancerTargetGroups` (#476)\n *   - `MetricsCollection` → `EnableMetricsCollection` /\n *     `DisableMetricsCollection`\n *   - `LifecycleHookSpecificationList` → per-entry `PutLifecycleHook` /\n *     `DeleteLifecycleHook`\n *   - `TrafficSources` → `AttachTrafficSources` /\n *     `DetachTrafficSources`\n *   - `NotificationConfigurations` → per-topic\n *     `PutNotificationConfiguration` /\n *     `DeleteNotificationConfiguration`\n *\n * Each helper is a no-op when the before/after JSON is identical.\n */\nexport class ASGProvider implements ResourceProvider {\n  private asgClient?: AutoScalingClient;\n  private ec2Client?: EC2Client;\n  private readonly providerRegion = process.env['AWS_REGION'];\n  private logger = getLogger().child('ASGProvider');\n\n  handledProperties = new Map<string, ReadonlySet<string>>([\n    [\n      'AWS::AutoScaling::AutoScalingGroup',\n      new Set([\n        'AutoScalingGroupName',\n        'LaunchTemplate',\n        'MinSize',\n        'MaxSize',\n        'DesiredCapacity',\n        'VPCZoneIdentifier',\n        'AvailabilityZones',\n        'HealthCheckType',\n        'HealthCheckGracePeriod',\n        'Cooldown',\n        'DefaultCooldown',\n        'Tags',\n        'TerminationPolicies',\n        'NewInstancesProtectedFromScaleIn',\n        'CapacityRebalance',\n        'ServiceLinkedRoleARN',\n        'MaxInstanceLifetime',\n        'LoadBalancerNames',\n        'TargetGroupARNs',\n        'MetricsCollection',\n        'LifecycleHookSpecificationList',\n        'MixedInstancesPolicy',\n        'Context',\n        'DesiredCapacityType',\n        'DefaultInstanceWarmup',\n        'TrafficSources',\n        'NotificationConfigurations',\n        'AvailabilityZoneDistribution',\n        'AvailabilityZoneImpairmentPolicy',\n        'SkipZonalShiftValidation',\n        'CapacityReservationSpecification',\n        'InstanceMaintenancePolicy',\n        'DeletionProtection',\n      ]),\n    ],\n  ]);\n\n  unhandledByDesign = new Map<string, ReadonlyMap<string, string>>([\n    [\n      'AWS::AutoScaling::AutoScalingGroup',\n      new Map<string, string>([\n        [\n          'LaunchConfigurationName',\n          'AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead',\n        ],\n        [\n          'NotificationConfiguration',\n          'Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires',\n        ],\n      ]),\n    ],\n  ]);\n\n  private getClient(): AutoScalingClient {\n    if (!this.asgClient) {\n      this.asgClient = new AutoScalingClient({\n        ...awsClientDefaults(),\n        ...(this.providerRegion ? { region: this.providerRegion } : {}),\n      });\n    }\n    return this.asgClient;\n  }\n\n  private getEc2Client(): EC2Client {\n    if (!this.ec2Client) {\n      this.ec2Client = new EC2Client({\n        ...awsClientDefaults(),\n        ...(this.providerRegion ? { region: this.providerRegion } : {}),\n      });\n    }\n    return this.ec2Client;\n  }\n\n  // ─── Dispatch ─────────────────────────────────────────────────────\n\n  /**\n   * The `context` parameter is read for ONE thing: `maskSecrets` (issue #1932\n   * item 3, adopted here by issue #1997).\n   *\n   * An earlier revision of this comment claimed the create path had no site to\n   * mask, on the grounds that it names \"only the logical id and the generated\n   * group name\". Both halves were wrong: `groupName` falls back to a generated\n   * name only when `AutoScalingGroupName` is ABSENT, so when the template\n   * DECLARES it the value is a resolved property value — and it IS logged, on\n   * the line below. Debug level is not an exemption; the contract's rule is any\n   * log line that interpolates a value from the `properties` bag, and this\n   * provider already masks its convergence-poll debug line for that reason.\n   */\n  async create(\n    logicalId: string,\n    resourceType: string,\n    properties: Record<string, unknown>,\n    context?: CreateContext\n  ): Promise<ResourceCreateResult> {\n    if (resourceType !== 'AWS::AutoScaling::AutoScalingGroup') {\n      throw new ProvisioningError(\n        `Unsupported resource type: ${resourceType}`,\n        resourceType,\n        logicalId\n      );\n    }\n\n    const groupName =\n      (properties['AutoScalingGroupName'] as string | undefined) ||\n      generateResourceName(logicalId, { maxLength: 255 });\n\n    // ONE masked sink for this method's own lines (issue #1997).\n    const maskSecrets: SecretMasker = context?.maskSecrets ?? ((text) => text);\n    const debug = (message: string): void => this.logger.debug(maskSecrets(message));\n    debug(`Creating AutoScalingGroup ${logicalId}: ${maskSecrets(groupName)}`);\n\n    try {\n      const launchTemplate = this.buildLaunchTemplate(properties);\n      const tags = this.buildTags(groupName, properties);\n      const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties['VPCZoneIdentifier']);\n\n      const minSize = properties['MinSize'] != null ? Number(properties['MinSize']) : 0;\n      const maxSize = properties['MaxSize'] != null ? Number(properties['MaxSize']) : minSize;\n\n      await this.getClient().send(\n        new CreateAutoScalingGroupCommand({\n          AutoScalingGroupName: groupName,\n          MinSize: minSize,\n          MaxSize: maxSize,\n          ...(properties['DesiredCapacity'] != null && {\n            DesiredCapacity: Number(properties['DesiredCapacity']),\n          }),\n          ...(launchTemplate && { LaunchTemplate: launchTemplate }),\n          ...(properties['MixedInstancesPolicy'] !== undefined && {\n            MixedInstancesPolicy: properties['MixedInstancesPolicy'] as never,\n          }),\n          ...(vpcZoneIdentifier !== undefined && { VPCZoneIdentifier: vpcZoneIdentifier }),\n          ...(properties['AvailabilityZones'] !== undefined && {\n            AvailabilityZones: properties['AvailabilityZones'] as string[],\n          }),\n          ...(properties['HealthCheckType'] !== undefined && {\n            HealthCheckType: properties['HealthCheckType'] as string,\n          }),\n          ...(properties['HealthCheckGracePeriod'] != null && {\n            HealthCheckGracePeriod: Number(properties['HealthCheckGracePeriod']),\n          }),\n          ...(properties['Cooldown'] != null && {\n            DefaultCooldown: Number(properties['Cooldown']),\n          }),\n          ...(properties['DefaultCooldown'] != null && {\n            DefaultCooldown: Number(properties['DefaultCooldown']),\n          }),\n          ...(properties['TerminationPolicies'] !== undefined && {\n            TerminationPolicies: properties['TerminationPolicies'] as string[],\n          }),\n          ...(properties['NewInstancesProtectedFromScaleIn'] !== undefined && {\n            NewInstancesProtectedFromScaleIn: properties[\n              'NewInstancesProtectedFromScaleIn'\n            ] as boolean,\n          }),\n          ...(properties['CapacityRebalance'] !== undefined && {\n            CapacityRebalance: properties['CapacityRebalance'] as boolean,\n          }),\n          ...(properties['ServiceLinkedRoleARN'] !== undefined && {\n            ServiceLinkedRoleARN: properties['ServiceLinkedRoleARN'] as string,\n          }),\n          ...(properties['MaxInstanceLifetime'] != null && {\n            MaxInstanceLifetime: Number(properties['MaxInstanceLifetime']),\n          }),\n          ...(properties['LoadBalancerNames'] !== undefined && {\n            LoadBalancerNames: properties['LoadBalancerNames'] as string[],\n          }),\n          ...(properties['TargetGroupARNs'] !== undefined && {\n            TargetGroupARNs: properties['TargetGroupARNs'] as string[],\n          }),\n          ...(properties['Context'] !== undefined && {\n            Context: properties['Context'] as string,\n          }),\n          ...(properties['DesiredCapacityType'] !== undefined && {\n            DesiredCapacityType: properties['DesiredCapacityType'] as string,\n          }),\n          ...(properties['DefaultInstanceWarmup'] != null && {\n            DefaultInstanceWarmup: Number(properties['DefaultInstanceWarmup']),\n          }),\n          ...(properties['LifecycleHookSpecificationList'] !== undefined && {\n            LifecycleHookSpecificationList: properties['LifecycleHookSpecificationList'] as never,\n          }),\n          ...(properties['TrafficSources'] !== undefined && {\n            TrafficSources: properties['TrafficSources'] as never,\n          }),\n          ...(properties['AvailabilityZoneDistribution'] !== undefined && {\n            AvailabilityZoneDistribution: properties['AvailabilityZoneDistribution'] as never,\n          }),\n          ...(properties['AvailabilityZoneImpairmentPolicy'] !== undefined && {\n            AvailabilityZoneImpairmentPolicy: properties[\n              'AvailabilityZoneImpairmentPolicy'\n            ] as never,\n          }),\n          ...(properties['SkipZonalShiftValidation'] !== undefined && {\n            SkipZonalShiftValidation: properties['SkipZonalShiftValidation'] as boolean,\n          }),\n          ...(properties['CapacityReservationSpecification'] !== undefined && {\n            CapacityReservationSpecification: properties[\n              'CapacityReservationSpecification'\n            ] as never,\n          }),\n          ...(properties['InstanceMaintenancePolicy'] !== undefined && {\n            InstanceMaintenancePolicy: properties['InstanceMaintenancePolicy'] as never,\n          }),\n          ...(properties['DeletionProtection'] !== undefined && {\n            DeletionProtection: properties['DeletionProtection'] as never,\n          }),\n          ...(tags.length > 0 && { Tags: tags }),\n        })\n      );\n\n      debug(`Successfully created AutoScalingGroup ${logicalId}: ${maskSecrets(groupName)}`);\n\n      const arn = await this.fetchArn(groupName);\n      const attributes: Record<string, unknown> = {};\n      if (arn) attributes['Arn'] = arn;\n      if (launchTemplate?.LaunchTemplateId) {\n        attributes['LaunchTemplateID'] = launchTemplate.LaunchTemplateId;\n      }\n      return { physicalId: groupName, attributes };\n    } catch (error) {\n      const cause = error instanceof Error ? error : undefined;\n      throw new ProvisioningError(\n        `Failed to create AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,\n        resourceType,\n        logicalId,\n        groupName,\n        cause\n      );\n    }\n  }\n\n  /**\n   * The `context` parameter is read for ONE thing today: `maskSecrets` (issue\n   * #1932 item 3, adopted here by issue #1997). `applyTargetGroupArnsDiff` is\n   * the only path in this provider that interpolates a RESOLVED property value\n   * into a log line — its convergence timeout names the expected\n   * `TargetGroupARNs` set — so it is the only one the masker is threaded into.\n   *\n   * `create()` takes the masker too — see its own doc for why the original\n   * \"nothing to mask there\" reading was wrong.\n   */\n  async update(\n    logicalId: string,\n    physicalId: string,\n    resourceType: string,\n    properties: Record<string, unknown>,\n    previousProperties: Record<string, unknown>,\n    context?: UpdateContext\n  ): Promise<ResourceUpdateResult> {\n    if (resourceType !== 'AWS::AutoScaling::AutoScalingGroup') {\n      throw new ProvisioningError(\n        `Unsupported resource type: ${resourceType}`,\n        resourceType,\n        logicalId,\n        physicalId\n      );\n    }\n    this.logger.debug(`Updating AutoScalingGroup ${logicalId}: ${physicalId}`);\n\n    // Reject diffs on fields AWS does not support modifying via\n    // UpdateAutoScalingGroup. The replacement-detection layer typically\n    // catches AutoScalingGroupName changes earlier; this is defense-in-\n    // depth + the only place to surface the equivalent error for\n    // sub-resource fields the caller may reasonably expect to round-trip.\n    const stringEq = (a: unknown, b: unknown): boolean => JSON.stringify(a) === JSON.stringify(b);\n    if (!stringEq(properties['AutoScalingGroupName'], previousProperties['AutoScalingGroupName'])) {\n      // Issue [#2610] site 8. `--replace` alone cannot succeed on a group whose\n      // recorded `DeletionProtection` is `'prevent-all-deletion'` (see the\n      // level analysis below for why that is the ONLY blocking level): the\n      // replacement's DELETE runs from the deploy engine, which never sets\n      // `DeleteContext.removeProtection` — `delete()` below gates BOTH its\n      // flip-off and its `ForceDelete: true` on exactly that field. See\n      // `../replacement-protection-advice.ts`.\n      //\n      // Read the RECORDED bag: this guard fires before any\n      // `UpdateAutoScalingGroup` in this method, so AWS still holds what\n      // `previousProperties` records.\n      //\n      // The value is a THREE-level string enum, and only the strictest level\n      // blocks a deploy-side replacement. AWS's own wording: the setting\n      // controls whether `DeleteAutoScalingGroup` is allowed \"according to the\n      // specified protection level\" -- `prevent-force-deletion` withholds only\n      // the FORCE delete, and the deploy engine's replacement issues\n      // `ForceDelete: false` (see `delete()` below, where the flag rides\n      // `context?.removeProtection`). So on `prevent-force-deletion` the delete\n      // is not refused BECAUSE of protection, and telling the user to clear it\n      // would name a remedy that fixes nothing -- the exact defect issue\n      // [#2610] is about, reintroduced by an over-wide predicate. An ABSENT\n      // value is the AWS-side default, which `readCurrentState` writes back as\n      // the explicit `'none'` placeholder.\n      const recordedProtection = previousProperties['DeletionProtection'];\n      const remedy =\n        recordedProtection === 'prevent-all-deletion'\n          ? protectedReplacementAdvice({\n              evidence:\n                \"cdkd's recorded properties for this group carry \" +\n                'DeletionProtection: prevent-all-deletion',\n              replaceFlags: 'cdkd deploy --replace',\n              disable: {\n                before: 'aws autoscaling update-auto-scaling-group --auto-scaling-group-name',\n                identifier: physicalId,\n                after: '--deletion-protection none',\n              },\n            })\n          : 'Use cdkd deploy --replace to replace the group.';\n      throw new ResourceUpdateNotSupportedError(\n        resourceType,\n        logicalId,\n        'AutoScalingGroupName is immutable on AWS — UpdateAutoScalingGroup does not accept a new name; the name is fixed at creation. ' +\n          remedy\n      );\n    }\n    try {\n      // Sub-shape diffs are applied via separate per-shape SDK calls\n      // BEFORE the main UpdateAutoScalingGroup. AWS does not expose these\n      // fields on UpdateAutoScalingGroup, so each one rides its own\n      // dedicated API. Each per-shape helper is a no-op when the\n      // before/after JSON is identical.\n      await this.applyTagsDiff(physicalId, properties['Tags'], previousProperties['Tags']);\n      await this.applyLoadBalancerNamesDiff(\n        physicalId,\n        properties['LoadBalancerNames'],\n        previousProperties['LoadBalancerNames']\n      );\n      await this.applyTargetGroupArnsDiff(\n        physicalId,\n        properties['TargetGroupARNs'],\n        previousProperties['TargetGroupARNs'],\n        context?.maskSecrets\n      );\n      await this.applyMetricsCollectionDiff(\n        physicalId,\n        properties['MetricsCollection'],\n        previousProperties['MetricsCollection']\n      );\n      await this.applyLifecycleHooksDiff(\n        physicalId,\n        properties['LifecycleHookSpecificationList'],\n        previousProperties['LifecycleHookSpecificationList']\n      );\n      await this.applyTrafficSourcesDiff(\n        physicalId,\n        properties['TrafficSources'],\n        previousProperties['TrafficSources']\n      );\n      await this.applyNotificationConfigurationsDiff(\n        physicalId,\n        properties['NotificationConfigurations'],\n        previousProperties['NotificationConfigurations']\n      );\n\n      const launchTemplate = this.buildLaunchTemplate(properties);\n      const vpcZoneIdentifier = this.joinVpcZoneIdentifier(properties['VPCZoneIdentifier']);\n\n      // issue #1160: `UpdateAutoScalingGroup` has merge semantics — an absent\n      // input field means \"no change\" — while CloudFormation resets a property\n      // REMOVED from the template to its default. Resolve every optional\n      // mutable field through `clearOnUpdateRemoval` so a removal sends the\n      // explicit CFn default (or the SDK-documented clear sentinel) instead of\n      // silently keeping the old live value. Each reset value's doc basis is\n      // noted inline (models_0.d.ts = the AWS SDK command/model doc).\n      //\n      // Deliberately NOT reset on removal:\n      //   - DesiredCapacity: CFn leaves current capacity unmanaged when the\n      //     property is absent (scaling policies own it) — leaving it\n      //     unchanged IS the CFn-parity behavior.\n      //   - MinSize / MaxSize: required properties, never removable.\n      //   - LaunchTemplate vs MixedInstancesPolicy, VPCZoneIdentifier vs\n      //     AvailabilityZones: mutually-exclusive pairs — a \"removal\" is\n      //     really a switch to the other member, which the API applies by\n      //     presence; pure removal of both is an invalid template.\n      //   - ServiceLinkedRoleARN: no documented clear sentinel; the default\n      //     is an account-specific service-linked-role ARN — leave unchanged.\n      //   - Context: SDK doc says \"Reserved.\" — leave unchanged.\n      //   - SkipZonalShiftValidation: transient per-request validation flag,\n      //     not persisted group config — nothing to reset.\n      //   - AvailabilityZoneImpairmentPolicy: DEFERRED — the SDK model\n      //     documents no default for `ImpairedZoneHealthCheckBehavior` (and\n      //     none for `ZonalShiftEnabled`), so a reset shape cannot be derived\n      //     without guessing; removal currently keeps the live value.\n      //\n      // Sub-field removal inside a KEPT config object (issue #1225 — the\n      // #1160 bug class one level down) is deliberately passed through\n      // verbatim here:\n      //   - InstanceMaintenancePolicy: a kept-but-partial object (one of the\n      //     two percentages dropped) is REJECTED by AWS — the SDK doc requires\n      //     \"Both MinHealthyPercentage and MaxHealthyPercentage must be\n      //     specified\". CloudFormation submits the same partial object, so the\n      //     loud failure IS the CFn-parity behavior; there is no silent drop\n      //     to normalize away.\n      //   - CapacityReservationSpecification: whether AWS keeps or clears a\n      //     previously-set CapacityReservationTarget when only the preference\n      //     is re-sent is UNPROBED (a live probe needs a billed Capacity\n      //     Reservation); the kept-partial object passes through unchanged.\n      //   - AvailabilityZoneDistribution: single sub-field — no partial shape\n      //     exists.\n      const healthCheckTypeInput = clearOnUpdateRemoval(\n        properties['HealthCheckType'] as string | undefined,\n        previousProperties['HealthCheckType'] as string | undefined,\n        // SDK doc: \"EC2 is the default health check and cannot be disabled.\n        // ... Only specify EC2 if you must clear a value that was previously\n        // set.\"\n        'EC2'\n      );\n      const healthCheckGracePeriodInput = clearOnUpdateRemoval(\n        properties['HealthCheckGracePeriod'] != null\n          ? Number(properties['HealthCheckGracePeriod'])\n          : undefined,\n        previousProperties['HealthCheckGracePeriod'] != null\n          ? Number(previousProperties['HealthCheckGracePeriod'])\n          : undefined,\n        // CFn default: 0 seconds.\n        0\n      );\n      // CFn's template key is `Cooldown`; cdkd also accepts the SDK-side\n      // spelling `DefaultCooldown`. Treat the two keys as ONE logical field on\n      // both sides so switching spellings is never misread as a removal.\n      const cooldownRaw = properties['Cooldown'] ?? properties['DefaultCooldown'];\n      const prevCooldownRaw =\n        previousProperties['Cooldown'] ?? previousProperties['DefaultCooldown'];\n      const defaultCooldownInput = clearOnUpdateRemoval(\n        cooldownRaw != null ? Number(cooldownRaw) : undefined,\n        prevCooldownRaw != null ? Number(prevCooldownRaw) : undefined,\n        // CFn default: 300 seconds.\n        300\n      );\n      const terminationPoliciesInput = clearOnUpdateRemoval(\n        properties['TerminationPolicies'] as string[] | undefined,\n        previousProperties['TerminationPolicies'] as string[] | undefined,\n        // CFn/API default termination policy.\n        ['Default']\n      );\n      const newInstancesProtectedInput = clearOnUpdateRemoval(\n        properties['NewInstancesProtectedFromScaleIn'] as boolean | undefined,\n        previousProperties['NewInstancesProtectedFromScaleIn'] as boolean | undefined,\n        false\n      );\n      const capacityRebalanceInput = clearOnUpdateRemoval(\n        properties['CapacityRebalance'] as boolean | undefined,\n        previousProperties['CapacityRebalance'] as boolean | undefined,\n        false\n      );\n      const maxInstanceLifetimeInput = clearOnUpdateRemoval(\n        properties['MaxInstanceLifetime'] != null\n          ? Number(properties['MaxInstanceLifetime'])\n          : undefined,\n        previousProperties['MaxInstanceLifetime'] != null\n          ? Number(previousProperties['MaxInstanceLifetime'])\n          : undefined,\n        // SDK doc: \"To clear a previously set value, specify a new value of 0.\"\n        0\n      );\n      const desiredCapacityTypeInput = clearOnUpdateRemoval(\n        properties['DesiredCapacityType'] as string | undefined,\n        previousProperties['DesiredCapacityType'] as string | undefined,\n        // SDK doc: \"By default, Amazon EC2 Auto Scaling specifies units\".\n        'units'\n      );\n      const defaultInstanceWarmupInput = clearOnUpdateRemoval(\n        properties['DefaultInstanceWarmup'] != null\n          ? Number(properties['DefaultInstanceWarmup'])\n          : undefined,\n        previousProperties['DefaultInstanceWarmup'] != null\n          ? Number(previousProperties['DefaultInstanceWarmup'])\n          : undefined,\n        // SDK doc: \"To remove a value that you previously set, include the\n        // property but specify -1 for the value.\"\n        -1\n      );\n      const instanceMaintenancePolicyInput = clearOnUpdateRemoval(\n        properties['InstanceMaintenancePolicy'] as InstanceMaintenancePolicy | undefined,\n        previousProperties['InstanceMaintenancePolicy'] as InstanceMaintenancePolicy | undefined,\n        // SDK doc (both sub-fields): \"To clear a previously set value,\n        // specify a value of -1.\"\n        { MinHealthyPercentage: -1, MaxHealthyPercentage: -1 }\n      );\n      const capacityReservationSpecInput = clearOnUpdateRemoval(\n        properties['CapacityReservationSpecification'] as\n          | CapacityReservationSpecification\n          | undefined,\n        previousProperties['CapacityReservationSpecification'] as\n          | CapacityReservationSpecification\n          | undefined,\n        // SDK doc: \"default - Auto Scaling uses the Capacity Reservation\n        // preference from your launch template or an open Capacity\n        // Reservation.\" — the behavior of a group that never set the field.\n        { CapacityReservationPreference: 'default' }\n      );\n      const availabilityZoneDistributionInput = clearOnUpdateRemoval(\n        properties['AvailabilityZoneDistribution'] as AvailabilityZoneDistribution | undefined,\n        previousProperties['AvailabilityZoneDistribution'] as\n          | AvailabilityZoneDistribution\n          | undefined,\n        // SDK doc: \"The default is balanced-best-effort.\"\n        { CapacityDistributionStrategy: 'balanced-best-effort' }\n      );\n      const deletionProtectionInput = clearOnUpdateRemoval(\n        properties['DeletionProtection'] as DeletionProtection | undefined,\n        previousProperties['DeletionProtection'] as DeletionProtection | undefined,\n        // SDK doc: \"Default: none\" — also the flip-off value delete() uses.\n        'none'\n      );\n\n      await this.getClient().send(\n        new UpdateAutoScalingGroupCommand({\n          AutoScalingGroupName: physicalId,\n          ...(properties['MinSize'] != null && { MinSize: Number(properties['MinSize']) }),\n          ...(properties['MaxSize'] != null && { MaxSize: Number(properties['MaxSize']) }),\n          ...(properties['DesiredCapacity'] != null && {\n            DesiredCapacity: Number(properties['DesiredCapacity']),\n          }),\n          ...(launchTemplate && { LaunchTemplate: launchTemplate }),\n          ...(properties['MixedInstancesPolicy'] !== undefined && {\n            MixedInstancesPolicy: properties['MixedInstancesPolicy'] as never,\n          }),\n          ...(vpcZoneIdentifier !== undefined && { VPCZoneIdentifier: vpcZoneIdentifier }),\n          ...(properties['AvailabilityZones'] !== undefined && {\n            AvailabilityZones: properties['AvailabilityZones'] as string[],\n          }),\n          ...(healthCheckTypeInput !== undefined && {\n            HealthCheckType: healthCheckTypeInput,\n          }),\n          ...(healthCheckGracePeriodInput !== undefined && {\n            HealthCheckGracePeriod: healthCheckGracePeriodInput,\n          }),\n          ...(defaultCooldownInput !== undefined && {\n            DefaultCooldown: defaultCooldownInput,\n          }),\n          ...(terminationPoliciesInput !== undefined && {\n            TerminationPolicies: terminationPoliciesInput,\n          }),\n          ...(newInstancesProtectedInput !== undefined && {\n            NewInstancesProtectedFromScaleIn: newInstancesProtectedInput,\n          }),\n          ...(capacityRebalanceInput !== undefined && {\n            CapacityRebalance: capacityRebalanceInput,\n          }),\n          ...(properties['ServiceLinkedRoleARN'] !== undefined && {\n            ServiceLinkedRoleARN: properties['ServiceLinkedRoleARN'] as string,\n          }),\n          ...(maxInstanceLifetimeInput !== undefined && {\n            MaxInstanceLifetime: maxInstanceLifetimeInput,\n          }),\n          ...(properties['Context'] !== undefined && {\n            Context: properties['Context'] as string,\n          }),\n          ...(desiredCapacityTypeInput !== undefined && {\n            DesiredCapacityType: desiredCapacityTypeInput,\n          }),\n          ...(defaultInstanceWarmupInput !== undefined && {\n            DefaultInstanceWarmup: defaultInstanceWarmupInput,\n          }),\n          ...(availabilityZoneDistributionInput !== undefined && {\n            AvailabilityZoneDistribution: availabilityZoneDistributionInput,\n          }),\n          // Removal reset DEFERRED (no SDK-documented default for the\n          // sub-fields) — see the comment block above.\n          ...(properties['AvailabilityZoneImpairmentPolicy'] !== undefined && {\n            AvailabilityZoneImpairmentPolicy: properties[\n              'AvailabilityZoneImpairmentPolicy'\n            ] as never,\n          }),\n          ...(properties['SkipZonalShiftValidation'] !== undefined && {\n            SkipZonalShiftValidation: properties['SkipZonalShiftValidation'] as boolean,\n          }),\n          ...(capacityReservationSpecInput !== undefined && {\n            CapacityReservationSpecification: capacityReservationSpecInput,\n          }),\n          ...(instanceMaintenancePolicyInput !== undefined && {\n            InstanceMaintenancePolicy: instanceMaintenancePolicyInput,\n          }),\n          ...(deletionProtectionInput !== undefined && {\n            DeletionProtection: deletionProtectionInput,\n          }),\n        })\n      );\n\n      this.logger.debug(`Successfully updated AutoScalingGroup ${logicalId}`);\n\n      const arn = await this.fetchArn(physicalId);\n      const attributes: Record<string, unknown> = {};\n      if (arn) attributes['Arn'] = arn;\n      if (launchTemplate?.LaunchTemplateId) {\n        attributes['LaunchTemplateID'] = launchTemplate.LaunchTemplateId;\n      }\n      return { physicalId, wasReplaced: false, attributes };\n    } catch (error) {\n      if (error instanceof ResourceUpdateNotSupportedError) throw error;\n      const cause = error instanceof Error ? error : undefined;\n      throw new ProvisioningError(\n        `Failed to update AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,\n        resourceType,\n        logicalId,\n        physicalId,\n        cause\n      );\n    }\n  }\n\n  async delete(\n    logicalId: string,\n    physicalId: string,\n    resourceType: string,\n    _properties?: Record<string, unknown>,\n    context?: DeleteContext\n  ): Promise<void> {\n    this.logger.debug(`Deleting AutoScalingGroup ${logicalId}: ${physicalId}`);\n\n    // `--remove-protection`: clear DeletionProtection in-place before the\n    // actual delete, then set ForceDelete=true so AWS terminates running\n    // instances as part of the delete (matches the \"I know what I'm doing\"\n    // intent of the flag). Without `removeProtection`, ForceDelete stays\n    // false and AWS rejects the delete on a group with running instances\n    // or DeletionProtection set, surfacing as ProvisioningError. The\n    // flip-off is idempotent — AWS accepts UpdateAutoScalingGroup\n    // (DeletionProtection: 'none') even when protection is already\n    // disabled, so we always issue it under the flag.\n    if (context?.removeProtection === true) {\n      try {\n        await this.getClient().send(\n          new UpdateAutoScalingGroupCommand({\n            AutoScalingGroupName: physicalId,\n            DeletionProtection: 'none' as never,\n          })\n        );\n        this.logger.debug(\n          `Disabled DeletionProtection on AutoScalingGroup ${logicalId} before delete`\n        );\n      } catch (flipError) {\n        // Non-fatal: log and proceed. The actual delete below surfaces\n        // any real error.\n        this.logger.debug(\n          `Could not disable DeletionProtection on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`\n        );\n      }\n\n      // ASG-level DeletionProtection + ForceDelete only governs the GROUP and\n      // its scale-in protection. If the group's launch template sets\n      // EC2-level termination protection (DisableApiTermination), the\n      // ForceDelete below still cannot terminate those instances and they\n      // ORPHAN after the group is gone (issue #796). Enumerate the group's\n      // current instances and flip each one's DisableApiTermination off first,\n      // mirroring the EC2Provider `--remove-protection` path.\n      await this.removeInstanceTerminationProtection(physicalId, logicalId);\n    }\n\n    try {\n      await this.getClient().send(\n        new DeleteAutoScalingGroupCommand({\n          AutoScalingGroupName: physicalId,\n          ForceDelete: context?.removeProtection === true,\n        })\n      );\n\n      this.logger.debug(`Successfully initiated deletion of AutoScalingGroup ${logicalId}`);\n\n      // Wait for the group to be fully gone. ASG delete is asynchronous —\n      // returning immediately would leave dependent EC2 / IAM / SG\n      // resources blocked on the lingering group.\n      await this.waitForGroupDeleted(physicalId);\n    } catch (error) {\n      if (this.isNotFoundError(error)) {\n        const clientRegion = await this.getClient().config.region();\n        assertRegionMatch(\n          clientRegion,\n          context?.expectedRegion,\n          resourceType,\n          logicalId,\n          physicalId\n        );\n        this.logger.debug(`AutoScalingGroup ${physicalId} does not exist, skipping deletion`);\n        return;\n      }\n      const cause = error instanceof Error ? error : undefined;\n      throw new ProvisioningError(\n        `Failed to delete AutoScalingGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,\n        resourceType,\n        logicalId,\n        physicalId,\n        cause\n      );\n    }\n  }\n\n  async getAttribute(\n    physicalId: string,\n    _resourceType: string,\n    attributeName: string\n  ): Promise<unknown> {\n    const group = await this.describeGroup(physicalId);\n    if (!group) {\n      throw new ProvisioningError(\n        `AutoScalingGroup ${physicalId} not found while resolving attribute ${attributeName}`,\n        'AWS::AutoScaling::AutoScalingGroup',\n        physicalId,\n        physicalId\n      );\n    }\n    switch (attributeName) {\n      case 'Arn':\n      case 'AutoScalingGroupARN':\n        return group.AutoScalingGroupARN ?? '';\n      case 'LaunchConfigurationName':\n        return group.LaunchConfigurationName ?? '';\n      case 'LaunchTemplateID':\n      case 'LaunchTemplateId':\n        return group.LaunchTemplate?.LaunchTemplateId ?? '';\n      default:\n        return '';\n    }\n  }\n\n  /**\n   * Read the AWS-current AutoScalingGroup configuration in CFn-property shape.\n   *\n   * Surfaces the user-controllable subset of `DescribeAutoScalingGroups`,\n   * with always-emit placeholders on user-controllable top-level keys per\n   * the cdkd PR #145 always-emit convention so that v3 `observedProperties`\n   * baseline catches console-side ADDs to fields a clean deploy did not\n   * template (e.g. a console-set `DeletionProtection: 'prevent-force-deletion'`\n   * on a group originally created without it).\n   *\n   * Sub-shapes (LifecycleHookSpecificationList / TrafficSources /\n   * NotificationConfigurations) are surfaced via three parallel Describe\n   * calls fired alongside the primary `DescribeAutoScalingGroups`. Each is\n   * best-effort: a per-call failure (e.g. permissions gap on\n   * `autoscaling:DescribeLifecycleHooks`) is logged at debug and the\n   * matching key falls back to its always-emit `[]` placeholder rather\n   * than aborting the whole drift read.\n   *\n   * `MetricsCollection` is reverse-mapped from `EnabledMetrics` (already\n   * present on the primary `DescribeAutoScalingGroups` response, so no\n   * extra call is needed).\n   *\n   * Returns `undefined` when the group is gone.\n   */\n  async readCurrentState(\n    physicalId: string,\n    _logicalId: string,\n    _resourceType: string\n  ): Promise<Record<string, unknown> | undefined> {\n    // Fire the four reads in parallel. Sub-shape failures are best-effort\n    // so a single permission gap does not break the whole drift read.\n    const groupPromise = (async () => {\n      try {\n        return await this.describeGroup(physicalId);\n      } catch (err) {\n        if (this.isNotFoundError(err)) return undefined;\n        throw err;\n      }\n    })();\n\n    const lifecycleHooksPromise = this.getClient()\n      .send(new DescribeLifecycleHooksCommand({ AutoScalingGroupName: physicalId }))\n      .then((r) => r.LifecycleHooks ?? [])\n      .catch((err) => {\n        this.logger.debug(\n          `DescribeLifecycleHooks(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`\n        );\n        return [];\n      });\n\n    const trafficSourcesPromise = this.getClient()\n      .send(new DescribeTrafficSourcesCommand({ AutoScalingGroupName: physicalId }))\n      .then((r) => r.TrafficSources ?? [])\n      .catch((err) => {\n        this.logger.debug(\n          `DescribeTrafficSources(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`\n        );\n        return [];\n      });\n\n    const notificationsPromise = this.getClient()\n      .send(new DescribeNotificationConfigurationsCommand({ AutoScalingGroupNames: [physicalId] }))\n      .then((r) => r.NotificationConfigurations ?? [])\n      .catch((err) => {\n        this.logger.debug(\n          `DescribeNotificationConfigurations(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`\n        );\n        return [];\n      });\n\n    const [group, lifecycleHooks, trafficSources, notifications] = await Promise.all([\n      groupPromise,\n      lifecycleHooksPromise,\n      trafficSourcesPromise,\n      notificationsPromise,\n    ]);\n\n    if (!group) return undefined;\n\n    const result: Record<string, unknown> = {};\n    if (group.AutoScalingGroupName !== undefined) {\n      result['AutoScalingGroupName'] = group.AutoScalingGroupName;\n    }\n    if (group.LaunchTemplate) {\n      const lt: Record<string, unknown> = {};\n      if (group.LaunchTemplate.LaunchTemplateId !== undefined) {\n        lt['LaunchTemplateId'] = group.LaunchTemplate.LaunchTemplateId;\n      }\n      if (group.LaunchTemplate.LaunchTemplateName !== undefined) {\n        lt['LaunchTemplateName'] = group.LaunchTemplate.LaunchTemplateName;\n      }\n      if (group.LaunchTemplate.Version !== undefined) {\n        lt['Version'] = group.LaunchTemplate.Version;\n      }\n      result['LaunchTemplate'] = lt;\n    }\n    result['MinSize'] = group.MinSize ?? 0;\n    result['MaxSize'] = group.MaxSize ?? 0;\n    if (group.DesiredCapacity !== undefined) result['DesiredCapacity'] = group.DesiredCapacity;\n    // VPCZoneIdentifier round-trips back to the CFn list shape so the\n    // comparator sees the same array the template emitted, not the\n    // SDK-side comma-joined string.\n    if (group.VPCZoneIdentifier !== undefined && group.VPCZoneIdentifier !== '') {\n      result['VPCZoneIdentifier'] = group.VPCZoneIdentifier.split(',').map((s) => s.trim());\n    } else {\n      result['VPCZoneIdentifier'] = [];\n    }\n    result['AvailabilityZones'] = group.AvailabilityZones ?? [];\n    if (group.HealthCheckType !== undefined) result['HealthCheckType'] = group.HealthCheckType;\n    if (group.HealthCheckGracePeriod !== undefined) {\n      result['HealthCheckGracePeriod'] = group.HealthCheckGracePeriod;\n    }\n    if (group.DefaultCooldown !== undefined) {\n      // CFn template field is `Cooldown`; SDK / Describe response calls it\n      // `DefaultCooldown`. Surface under the CFn name so the comparator\n      // matches state directly.\n      result['Cooldown'] = group.DefaultCooldown;\n    }\n    result['NewInstancesProtectedFromScaleIn'] = group.NewInstancesProtectedFromScaleIn ?? false;\n    result['TerminationPolicies'] = group.TerminationPolicies ?? [];\n    result['CapacityRebalance'] = group.CapacityRebalance ?? false;\n    if (group.ServiceLinkedRoleARN !== undefined) {\n      result['ServiceLinkedRoleARN'] = group.ServiceLinkedRoleARN;\n    }\n    if (group.MaxInstanceLifetime !== undefined) {\n      result['MaxInstanceLifetime'] = group.MaxInstanceLifetime;\n    }\n    result['LoadBalancerNames'] = group.LoadBalancerNames ?? [];\n    result['TargetGroupARNs'] = group.TargetGroupARNs ?? [];\n    if (group.Context !== undefined) result['Context'] = group.Context;\n    if (group.DesiredCapacityType !== undefined) {\n      result['DesiredCapacityType'] = group.DesiredCapacityType;\n    }\n    if (group.DefaultInstanceWarmup !== undefined) {\n      result['DefaultInstanceWarmup'] = group.DefaultInstanceWarmup;\n    }\n    if (group.MixedInstancesPolicy !== undefined) {\n      result['MixedInstancesPolicy'] = group.MixedInstancesPolicy;\n    }\n    if (group.AvailabilityZoneDistribution !== undefined) {\n      result['AvailabilityZoneDistribution'] = group.AvailabilityZoneDistribution;\n    }\n    if (group.AvailabilityZoneImpairmentPolicy !== undefined) {\n      result['AvailabilityZoneImpairmentPolicy'] = group.AvailabilityZoneImpairmentPolicy;\n    }\n    if (group.CapacityReservationSpecification !== undefined) {\n      result['CapacityReservationSpecification'] = group.CapacityReservationSpecification;\n    }\n    if (group.InstanceMaintenancePolicy !== undefined) {\n      result['InstanceMaintenancePolicy'] = group.InstanceMaintenancePolicy;\n    }\n    if (group.DeletionProtection !== undefined) {\n      result['DeletionProtection'] = group.DeletionProtection;\n    } else {\n      // AWS reports `undefined` when the group has the AWS-side default\n      // (`'none'`). Always-emit placeholder so the v3 `observedProperties`\n      // baseline catches a console-side flip to `prevent-force-deletion`\n      // / `prevent-all-deletion`.\n      result['DeletionProtection'] = 'none';\n    }\n    // Tags: filter aws:* prefix and normalize to CFn shape sorted by Key.\n    // ASG returns Tags inside the AutoScalingGroup record (already populated\n    // by DescribeAutoScalingGroups — no separate ListTagsForResource call).\n    result['Tags'] = normalizeAwsTagsToCfn(group.Tags);\n\n    // Sub-shapes — reverse-map AWS responses to CFn template shape and\n    // always-emit `[]` placeholders so the v3 `observedProperties` baseline\n    // catches console-side ADDs to a previously-empty list.\n    result['MetricsCollection'] = mapEnabledMetricsToCfn(group.EnabledMetrics);\n    result['LifecycleHookSpecificationList'] = mapLifecycleHooksToCfn(lifecycleHooks);\n    // Strip ALL elbv2 / elb entries from TrafficSources — the canonical\n    // attachment state for these types lives in TargetGroupARNs /\n    // LoadBalancerNames. TrafficSources is meant for attachment types\n    // without a dedicated CFn property (VPC Lattice, VPC Endpoint\n    // Service). Filtering unconditionally avoids two failure modes\n    // surfaced by tests/integration/drift-revert-vpc (PR #547):\n    // double-attach/detach on revert, and stale TS entries from AWS's\n    // eventual-consistency window after Attach/Detach surfacing as\n    // false drift on the next read.\n    const dedupedTrafficSources = trafficSources.filter((t) => {\n      if (t.Identifier === undefined) return false;\n      if (t.Type === 'elbv2' || t.Type === 'elb') return false;\n      return true;\n    });\n    result['TrafficSources'] = mapTrafficSourcesToCfn(dedupedTrafficSources);\n    result['NotificationConfigurations'] = mapNotificationsToCfn(notifications);\n\n    return result;\n  }\n\n  // ─── Helpers ──────────────────────────────────────────────────────\n\n  private buildLaunchTemplate(\n    properties: Record<string, unknown>\n  ): LaunchTemplateSpecification | undefined {\n    const lt = properties['LaunchTemplate'] as\n      | { LaunchTemplateId?: string; LaunchTemplateName?: string; Version?: string | number }\n      | undefined;\n    if (!lt) return undefined;\n    const out: LaunchTemplateSpecification = {};\n    // AWS UpdateAutoScalingGroup rejects when both LaunchTemplateId and\n    // LaunchTemplateName are present in the same LaunchTemplate object\n    // (\"Valid requests must contain either launchTemplateId or\n    // LaunchTemplateName\"). DescribeAutoScalingGroups returns both, so\n    // a straight readCurrentState → update round-trip on `drift --revert`\n    // would hit this. Prefer the ID (canonical, doesn't change on LT\n    // rename) and only fall back to Name when ID is absent.\n    if (lt.LaunchTemplateId !== undefined) {\n      out.LaunchTemplateId = lt.LaunchTemplateId;\n      if (lt.LaunchTemplateName !== undefined) {\n        // User templated BOTH — AWS would reject the resulting Create /\n        // Update otherwise; we silently prefer the ID. Surface the\n        // choice in --verbose so a user wondering why their Name didn't\n        // take effect has an auditable signal.\n        this.logger.debug(\n          `buildLaunchTemplate: both LaunchTemplateId (${lt.LaunchTemplateId}) and LaunchTemplateName (${lt.LaunchTemplateName}) templated; dropping Name (#551)`\n        );\n      }\n    } else if (lt.LaunchTemplateName !== undefined) {\n      out.LaunchTemplateName = lt.LaunchTemplateName;\n    }\n    if (lt.Version !== undefined) {\n      // Defensive coercion: AWS SDK `LaunchTemplateSpecification.Version`\n      // is `string` and AWS rejects non-string forms with `Invalid\n      // launch template version: either '$Default', '$Latest', or a\n      // numeric version are allowed.`. cdkd's `IntrinsicResolver`\n      // resolves `Fn::GetAtt <LaunchTemplate>.LatestVersionNumber`\n      // through a per-type lookup; intermediate cases could surface\n      // numeric values, so we coerce defensively.\n      out.Version = String(lt.Version);\n    }\n    if (out.LaunchTemplateId === undefined && out.LaunchTemplateName === undefined) {\n      return undefined;\n    }\n    return out;\n  }\n\n  /**\n   * CFn `Tags` is `[{Key, Value, PropagateAtLaunch?}]`. AWS expects each\n   * tag to also carry `ResourceId: <groupName>` and `ResourceType:\n   * 'auto-scaling-group'`. We tack those on at create time so the SDK\n   * input shape matches without forcing the user to template them.\n   */\n  private buildTags(groupName: string, properties: Record<string, unknown>): ASGTag[] {\n    const raw = properties['Tags'] as\n      | Array<{ Key?: string; Value?: string; PropagateAtLaunch?: boolean }>\n      | undefined;\n    if (!raw) return [];\n    return raw\n      .filter((t) => t.Key !== undefined)\n      .map((t) => ({\n        ResourceId: groupName,\n        ResourceType: 'auto-scaling-group',\n        Key: t.Key as string,\n        Value: t.Value ?? '',\n        PropagateAtLaunch: t.PropagateAtLaunch ?? false,\n      }));\n  }\n\n  /**\n   * CFn `VPCZoneIdentifier` is a list of subnet ids; the AWS SDK input\n   * field is a comma-joined string.\n   */\n  private joinVpcZoneIdentifier(value: unknown): string | undefined {\n    if (value === undefined || value === null) return undefined;\n    if (Array.isArray(value)) {\n      const cleaned = value.map((v) => String(v).trim()).filter((v) => v.length > 0);\n      if (cleaned.length === 0) return undefined;\n      return cleaned.join(',');\n    }\n    if (typeof value === 'string') return value;\n    return undefined;\n  }\n\n  private async describeGroup(groupName: string) {\n    const response = await this.getClient().send(\n      new DescribeAutoScalingGroupsCommand({\n        AutoScalingGroupNames: [groupName],\n      })\n    );\n    return response.AutoScalingGroups?.[0];\n  }\n\n  /**\n   * Flip EC2-level termination protection (`DisableApiTermination`) off on\n   * every instance currently launched by the group, so the subsequent\n   * `DeleteAutoScalingGroup(ForceDelete: true)` can actually terminate them\n   * instead of orphaning the protected instances (issue #796). Best-effort:\n   * a Describe failure or a per-instance flip failure is logged at debug and\n   * does not block the delete (the modify WRITE lags the terminate READ, so\n   * the shared helper swallows propagation errors the same way the EC2 path\n   * does — the orphan, if any, surfaces as a leftover instance the caller\n   * can clean up rather than a hard delete failure).\n   */\n  private async removeInstanceTerminationProtection(\n    groupName: string,\n    logicalId: string\n  ): Promise<void> {\n    let instanceIds: string[];\n    try {\n      const group = await this.describeGroup(groupName);\n      instanceIds = (group?.Instances ?? [])\n        .map((i) => i.InstanceId)\n        .filter((id): id is string => typeof id === 'string' && id.length > 0);\n    } catch (describeError) {\n      this.logger.debug(\n        `Could not enumerate instances of AutoScalingGroup ${logicalId} for termination-protection removal: ${describeError instanceof Error ? describeError.message : String(describeError)}`\n      );\n      return;\n    }\n\n    if (instanceIds.length === 0) return;\n\n    this.logger.debug(\n      `Disabling EC2 termination protection on ${instanceIds.length} instance(s) of AutoScalingGroup ${logicalId} before force delete`\n    );\n    for (const instanceId of instanceIds) {\n      await disableInstanceApiTermination(this.getEc2Client(), instanceId, this.logger);\n    }\n  }\n\n  private async fetchArn(groupName: string): Promise<string | undefined> {\n    try {\n      const group = await this.describeGroup(groupName);\n      return group?.AutoScalingGroupARN;\n    } catch (err) {\n      this.logger.debug(\n        `DescribeAutoScalingGroups(${groupName}) failed: ${err instanceof Error ? err.message : String(err)}`\n      );\n      return undefined;\n    }\n  }\n\n  private isNotFoundError(error: unknown): boolean {\n    if (!(error instanceof Error)) return false;\n    const name = (error as { name?: string }).name ?? '';\n    const message = error.message.toLowerCase();\n    // ASG returns ValidationError with message \"AutoScalingGroup name not\n    // found\" rather than a typed NotFound exception; cover both shapes.\n    return (\n      name === 'ValidationError' &&\n      (message.includes('autoscalinggroup name not found') ||\n        message.includes('not found') ||\n        message.includes('does not exist'))\n    );\n  }\n\n  private async waitForGroupDeleted(groupName: string, maxWaitMs = 900_000): Promise<void> {\n    const startTime = Date.now();\n    let delay = 5_000;\n\n    while (Date.now() - startTime < maxWaitMs) {\n      try {\n        const group = await this.describeGroup(groupName);\n        if (!group) return;\n      } catch (error) {\n        if (this.isNotFoundError(error)) return;\n        throw error;\n      }\n\n      await this.sleep(delay);\n      delay = Math.min(delay * 2, 10_000);\n    }\n\n    throw new Error(\n      `Timed out waiting for AutoScalingGroup ${groupName} to be deleted (15 minute cap)`\n    );\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  // ─── Sub-shape diff helpers ───────────────────────────────────────\n  // Each helper is a no-op when before/after JSON is identical (the cheap\n  // structural-equality check happens first; we only build SDK calls for\n  // genuine diffs). Identity is positional within the array per CFn shape:\n  // `MetricsCollection` keyed on `Granularity`, `LifecycleHookSpecification\n  // List` on `LifecycleHookName`, `TrafficSources` on `Identifier`,\n  // `NotificationConfigurations` on `TopicARN`.\n\n  /**\n   * Diff and apply changes to the ASG's `Tags` property via the\n   * `CreateOrUpdateTags` / `DeleteTags` AWS APIs (#475). CFn Tags shape is\n   * `[{Key, Value, PropagateAtLaunch}]`; AWS Tag input adds `ResourceId`\n   * (= the ASG name) and `ResourceType: 'auto-scaling-group'`.\n   *\n   * Diff semantics:\n   *   - Removed keys → `DeleteTags`.\n   *   - Added keys → `CreateOrUpdateTags`.\n   *   - Modified value or `PropagateAtLaunch` flag → `CreateOrUpdateTags`\n   *     (the AWS API upserts by `(ResourceId, ResourceType, Key)` tuple, so\n   *     a single upsert call replaces the old value).\n   *\n   * No-op when before/after JSON is identical.\n   */\n  private async applyTagsDiff(physicalId: string, next: unknown, prev: unknown): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    type CfnTag = { Key?: string; Value?: string; PropagateAtLaunch?: boolean };\n    const nextEntries = (Array.isArray(next) ? next : []) as CfnTag[];\n    const prevEntries = (Array.isArray(prev) ? prev : []) as CfnTag[];\n    const nextByKey = new Map<string, CfnTag>();\n    for (const t of nextEntries) {\n      if (t.Key) nextByKey.set(t.Key, t);\n    }\n    const prevByKey = new Map<string, CfnTag>();\n    for (const t of prevEntries) {\n      if (t.Key) prevByKey.set(t.Key, t);\n    }\n    // Delete keys removed from `next`.\n    const toDelete: CfnTag[] = [];\n    for (const [key, tag] of prevByKey) {\n      if (!nextByKey.has(key)) toDelete.push(tag);\n    }\n    if (toDelete.length > 0) {\n      await this.getClient().send(\n        new DeleteTagsCommand({\n          // DeleteTags is keyed only by (ResourceId, ResourceType, Key).\n          // Intentionally omit `Value` / `PropagateAtLaunch`: AWS treats\n          // those as additional match constraints, so passing the\n          // cdkd-recorded values would silently no-op when a console-side\n          // edit drifted them between deploys. cdkd owns the tag, so\n          // delete-by-key matches the \"we own the resource\" intent.\n          Tags: toDelete.map((t) => ({\n            ResourceId: physicalId,\n            ResourceType: 'auto-scaling-group',\n            Key: t.Key as string,\n          })),\n        })\n      );\n    }\n    // Upsert keys whose value / propagate-flag differs.\n    const toUpsert: CfnTag[] = [];\n    for (const [key, tag] of nextByKey) {\n      const before = prevByKey.get(key);\n      if (JSON.stringify(before) === JSON.stringify(tag)) continue;\n      toUpsert.push(tag);\n    }\n    if (toUpsert.length > 0) {\n      await this.getClient().send(\n        new CreateOrUpdateTagsCommand({\n          Tags: toUpsert.map((t) => ({\n            ResourceId: physicalId,\n            ResourceType: 'auto-scaling-group',\n            Key: t.Key as string,\n            ...(t.Value !== undefined && { Value: t.Value }),\n            ...(t.PropagateAtLaunch !== undefined && {\n              PropagateAtLaunch: t.PropagateAtLaunch,\n            }),\n          })),\n        })\n      );\n    }\n  }\n\n  /**\n   * Diff `LoadBalancerNames` (Classic Load Balancers) and issue\n   * `AttachLoadBalancers` / `DetachLoadBalancers` for the delta (#476).\n   * Names are opaque strings; AWS allows N attached LBs per ASG so this\n   * helper batches every add into one Attach call and every remove into\n   * one Detach call. No-op when before/after JSON is identical.\n   */\n  private async applyLoadBalancerNamesDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextNames = (Array.isArray(next) ? next : []).filter(\n      (n): n is string => typeof n === 'string'\n    );\n    const prevNames = (Array.isArray(prev) ? prev : []).filter(\n      (n): n is string => typeof n === 'string'\n    );\n    const nextSet = new Set(nextNames);\n    const prevSet = new Set(prevNames);\n    const toAttach = nextNames.filter((n) => !prevSet.has(n));\n    const toDetach = prevNames.filter((n) => !nextSet.has(n));\n    if (toDetach.length > 0) {\n      await this.getClient().send(\n        new DetachLoadBalancersCommand({\n          AutoScalingGroupName: physicalId,\n          LoadBalancerNames: toDetach,\n        })\n      );\n    }\n    if (toAttach.length > 0) {\n      await this.getClient().send(\n        new AttachLoadBalancersCommand({\n          AutoScalingGroupName: physicalId,\n          LoadBalancerNames: toAttach,\n        })\n      );\n    }\n  }\n\n  /**\n   * Diff `TargetGroupARNs` (ALB / NLB target groups) and issue\n   * `AttachLoadBalancerTargetGroups` /\n   * `DetachLoadBalancerTargetGroups` for the delta (#476). Target-group\n   * ARNs are opaque strings; same per-call batching pattern as\n   * `applyLoadBalancerNamesDiff`. No-op when before/after JSON is\n   * identical.\n   */\n  private async applyTargetGroupArnsDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown,\n    maskSecrets?: SecretMasker\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextArns = (Array.isArray(next) ? next : []).filter(\n      (a): a is string => typeof a === 'string'\n    );\n    const prevArns = (Array.isArray(prev) ? prev : []).filter(\n      (a): a is string => typeof a === 'string'\n    );\n    const nextSet = new Set(nextArns);\n    const prevSet = new Set(prevArns);\n    const toAttach = nextArns.filter((a) => !prevSet.has(a));\n    const toDetach = prevArns.filter((a) => !nextSet.has(a));\n    if (toDetach.length > 0) {\n      await this.getClient().send(\n        new DetachLoadBalancerTargetGroupsCommand({\n          AutoScalingGroupName: physicalId,\n          TargetGroupARNs: toDetach,\n        })\n      );\n    }\n    if (toAttach.length > 0) {\n      await this.getClient().send(\n        new AttachLoadBalancerTargetGroupsCommand({\n          AutoScalingGroupName: physicalId,\n          TargetGroupARNs: toAttach,\n        })\n      );\n    }\n    // AttachLoadBalancerTargetGroups is async — the target group starts in\n    // 'Adding' state and only becomes visible in\n    // DescribeAutoScalingGroups.TargetGroupARNs after AWS internal\n    // propagation. A subsequent `cdkd drift` read right after the call\n    // returns can otherwise see a stale snapshot and report drift\n    // against the AWS-side empty list (surfaced by tests/integration/\n    // drift-revert-vpc's step-6 \"drift again\" check). Bounded poll to\n    // confirm the post-state matches the intent before returning so the\n    // caller's next read is consistent.\n    if (toDetach.length > 0 || toAttach.length > 0) {\n      await this.waitForTargetGroupArnsConvergence(physicalId, new Set(nextArns), maskSecrets);\n    }\n  }\n\n  private static readonly TG_CONVERGENCE_TIMEOUT_MS = 30_000;\n  private static readonly TG_CONVERGENCE_POLL_INTERVAL_MS = 1_000;\n\n  /**\n   * `maskSecrets` is the caller's secret masker (issue #1932 item 3, adopted\n   * here by issue #1997), threaded from `UpdateContext` via\n   * `applyTargetGroupArnsDiff`. `expected` is built from the RESOLVED\n   * `TargetGroupARNs` bag, so a `{{resolve:secretsmanager:...}}` scalar in it is\n   * already plaintext by the time this method names it. It defaults to IDENTITY\n   * so every existing caller and unit test keeps working unchanged.\n   */\n  private async waitForTargetGroupArnsConvergence(\n    physicalId: string,\n    expected: Set<string>,\n    maskSecrets: SecretMasker = (text) => text\n  ): Promise<void> {\n    // ONE masked sink per level for every line in this method (issue #1997),\n    // rather than a `maskSecrets(...)` at each call: a line added later is\n    // masked by construction instead of by the author remembering. Each is the\n    // OUTER of two layers — a finished message is always longer than the value\n    // inside it, so it can only reach `maskSecretsInText`'s SUBSTRING arm, which\n    // ignores needles below `MIN_NEEDLE_LENGTH` (4); the per-ARN mask below is\n    // the inner layer, reaching the WHOLE-VALUE arm at any length.\n    const warn = (message: string): void => this.logger.warn(maskSecrets(message));\n    const debug = (message: string): void => this.logger.debug(maskSecrets(message));\n    const deadlineMs = Date.now() + ASGProvider.TG_CONVERGENCE_TIMEOUT_MS;\n    let lastObserved: Set<string> = new Set();\n    while (Date.now() < deadlineMs) {\n      let resp: DescribeAutoScalingGroupsCommandOutput | undefined;\n      try {\n        resp = await this.getClient().send(\n          new DescribeAutoScalingGroupsCommand({ AutoScalingGroupNames: [physicalId] })\n        );\n      } catch (err) {\n        // Transient throttle / network blip during the 30s window must\n        // not throw out of applyTargetGroupArnsDiff — the Attach/Detach\n        // already succeeded, and propagating would fail the whole\n        // update path. Log + retry; the loop will fall through to the\n        // timeout-warn path if the API is genuinely down.\n        debug(\n          `applyTargetGroupArnsDiff convergence poll: transient error, retrying — ${\n            err instanceof Error ? err.message : String(err)\n          }`\n        );\n        await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));\n        continue;\n      }\n      lastObserved = new Set(resp.AutoScalingGroups?.[0]?.TargetGroupARNs ?? []);\n      if (lastObserved.size === expected.size && [...expected].every((a) => lastObserved.has(a))) {\n        return;\n      }\n      await new Promise((r) => setTimeout(r, ASGProvider.TG_CONVERGENCE_POLL_INTERVAL_MS));\n    }\n    // Timeout — surface as a warning rather than failure so the caller\n    // still sees the SDK-side success; drift can re-report if the\n    // propagation is still stuck. Includes observed vs expected so\n    // post-mortem doesn't need a re-deploy.\n    // Sort both sides before stringify for visual symmetry — expected\n    // comes from the caller's insertion order, observed from AWS-side\n    // order; eyeballing the diff in logs is easier when both are sorted.\n    //\n    // Each ARN is masked INDIVIDUALLY before being stringified (issue #1997):\n    // `JSON.stringify` escapes `\"` / `\\` / newlines, so a secret carrying any of\n    // them no longer OCCURS in the finished line and the outer sink alone would\n    // miss it. The observed side is masked too — it comes back from AWS, but a\n    // resolved secret sent by an earlier deploy is exactly what AWS echoes.\n    const expectedSorted = [...expected].sort().map((a) => maskSecrets(a));\n    const observedSorted = [...lastObserved].sort().map((a) => maskSecrets(a));\n    warn(\n      `applyTargetGroupArnsDiff: TG set did not converge within ${ASGProvider.TG_CONVERGENCE_TIMEOUT_MS}ms for ASG ${physicalId}. expected=${JSON.stringify(expectedSorted)} observed=${JSON.stringify(observedSorted)}`\n    );\n  }\n\n  private async applyMetricsCollectionDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      Granularity?: string;\n      Metrics?: string[];\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      Granularity?: string;\n      Metrics?: string[];\n    }>;\n    const prevByGranularity = new Map<string, string[] | undefined>();\n    for (const e of prevEntries) {\n      if (e.Granularity) prevByGranularity.set(e.Granularity, e.Metrics);\n    }\n    const nextByGranularity = new Map<string, string[] | undefined>();\n    for (const e of nextEntries) {\n      if (e.Granularity) nextByGranularity.set(e.Granularity, e.Metrics);\n    }\n    // Disable removed granularities first, then issue Enable for the\n    // intended state of every Granularity in `next`. AWS treats Enable as\n    // additive within a Granularity, so a remove-then-add pattern works\n    // even when the Metrics list shrinks.\n    for (const [granularity, metrics] of prevByGranularity) {\n      if (!nextByGranularity.has(granularity)) {\n        await this.getClient().send(\n          new DisableMetricsCollectionCommand({\n            AutoScalingGroupName: physicalId,\n            ...(metrics && metrics.length > 0 ? { Metrics: metrics } : {}),\n          })\n        );\n      }\n    }\n    for (const [granularity, metrics] of nextByGranularity) {\n      const before = prevByGranularity.get(granularity);\n      if (JSON.stringify(before ?? null) === JSON.stringify(metrics ?? null)) continue;\n      // If the Metrics list shrunk, disable the removed metrics first\n      // (AWS Enable is additive). When `metrics` is undefined or empty,\n      // AWS treats that as \"all metrics\" — disable any prior subset\n      // before re-enabling the full set.\n      if (before && before.length > 0) {\n        const removed = metrics ? before.filter((m) => !metrics.includes(m)) : [];\n        if (removed.length > 0) {\n          await this.getClient().send(\n            new DisableMetricsCollectionCommand({\n              AutoScalingGroupName: physicalId,\n              Metrics: removed,\n            })\n          );\n        }\n      }\n      await this.getClient().send(\n        new EnableMetricsCollectionCommand({\n          AutoScalingGroupName: physicalId,\n          Granularity: granularity,\n          ...(metrics && metrics.length > 0 ? { Metrics: metrics } : {}),\n        })\n      );\n    }\n  }\n\n  private async applyLifecycleHooksDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      LifecycleHookName?: string;\n      LifecycleTransition?: string;\n      RoleARN?: string;\n      NotificationTargetARN?: string;\n      NotificationMetadata?: string;\n      HeartbeatTimeout?: number;\n      DefaultResult?: string;\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      LifecycleHookName?: string;\n    }>;\n    const nextNames = new Set(\n      nextEntries.map((e) => e.LifecycleHookName).filter((n): n is string => !!n)\n    );\n    // Delete hooks no longer in `next`.\n    for (const e of prevEntries) {\n      if (e.LifecycleHookName && !nextNames.has(e.LifecycleHookName)) {\n        await this.getClient().send(\n          new DeleteLifecycleHookCommand({\n            AutoScalingGroupName: physicalId,\n            LifecycleHookName: e.LifecycleHookName,\n          })\n        );\n      }\n    }\n    // PutLifecycleHook is upsert — issue for every hook in `next` whose\n    // shape differs from the matching `prev` entry.\n    const prevByName = new Map<string, unknown>();\n    for (const e of prevEntries) {\n      if (e.LifecycleHookName) prevByName.set(e.LifecycleHookName, e);\n    }\n    for (const e of nextEntries) {\n      if (!e.LifecycleHookName) continue;\n      const prevHook = prevByName.get(e.LifecycleHookName);\n      if (JSON.stringify(prevHook) === JSON.stringify(e)) continue;\n      await this.getClient().send(\n        new PutLifecycleHookCommand({\n          AutoScalingGroupName: physicalId,\n          LifecycleHookName: e.LifecycleHookName,\n          ...(e.LifecycleTransition !== undefined && {\n            LifecycleTransition: e.LifecycleTransition,\n          }),\n          ...(e.RoleARN !== undefined && { RoleARN: e.RoleARN }),\n          ...(e.NotificationTargetARN !== undefined && {\n            NotificationTargetARN: e.NotificationTargetARN,\n          }),\n          ...(e.NotificationMetadata !== undefined && {\n            NotificationMetadata: e.NotificationMetadata,\n          }),\n          ...(e.HeartbeatTimeout !== undefined && { HeartbeatTimeout: e.HeartbeatTimeout }),\n          ...(e.DefaultResult !== undefined && { DefaultResult: e.DefaultResult }),\n        })\n      );\n    }\n  }\n\n  private async applyTrafficSourcesDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      Identifier?: string;\n      Type?: string;\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      Identifier?: string;\n      Type?: string;\n    }>;\n    const nextIds = new Set(nextEntries.map((e) => e.Identifier).filter((i): i is string => !!i));\n    const prevIds = new Set(prevEntries.map((e) => e.Identifier).filter((i): i is string => !!i));\n    const toDetach = prevEntries.filter((e) => e.Identifier && !nextIds.has(e.Identifier));\n    const toAttach = nextEntries.filter((e) => e.Identifier && !prevIds.has(e.Identifier));\n    if (toDetach.length > 0) {\n      await this.getClient().send(\n        new DetachTrafficSourcesCommand({\n          AutoScalingGroupName: physicalId,\n          TrafficSources: toDetach.map((e) => ({\n            Identifier: e.Identifier as string,\n            ...(e.Type !== undefined && { Type: e.Type }),\n          })),\n        })\n      );\n    }\n    if (toAttach.length > 0) {\n      await this.getClient().send(\n        new AttachTrafficSourcesCommand({\n          AutoScalingGroupName: physicalId,\n          TrafficSources: toAttach.map((e) => ({\n            Identifier: e.Identifier as string,\n            ...(e.Type !== undefined && { Type: e.Type }),\n          })),\n        })\n      );\n    }\n  }\n\n  private async applyNotificationConfigurationsDiff(\n    physicalId: string,\n    next: unknown,\n    prev: unknown\n  ): Promise<void> {\n    if (JSON.stringify(next ?? []) === JSON.stringify(prev ?? [])) return;\n    // CFn `NotificationConfigurations` is an array of `{TopicARN,\n    // NotificationTypes[]}`; AWS `PutNotificationConfiguration` is keyed\n    // by TopicARN — one call per topic. AWS reports each notification\n    // type as a separate response entry (one row per `(asgName, topicArn,\n    // notificationType)` triple), but cdkd state stores the CFn shape, so\n    // both sides of the diff share the per-topic key.\n    const nextEntries = (Array.isArray(next) ? next : []) as Array<{\n      TopicARN?: string;\n      NotificationTypes?: string[];\n    }>;\n    const prevEntries = (Array.isArray(prev) ? prev : []) as Array<{\n      TopicARN?: string;\n      NotificationTypes?: string[];\n    }>;\n    const nextByTopic = new Map<string, string[] | undefined>();\n    for (const e of nextEntries) {\n      if (e.TopicARN) nextByTopic.set(e.TopicARN, e.NotificationTypes);\n    }\n    const prevByTopic = new Map<string, string[] | undefined>();\n    for (const e of prevEntries) {\n      if (e.TopicARN) prevByTopic.set(e.TopicARN, e.NotificationTypes);\n    }\n    for (const topic of prevByTopic.keys()) {\n      if (!nextByTopic.has(topic)) {\n        await this.getClient().send(\n          new DeleteNotificationConfigurationCommand({\n            AutoScalingGroupName: physicalId,\n            TopicARN: topic,\n          })\n        );\n      }\n    }\n    for (const [topic, types] of nextByTopic) {\n      const before = prevByTopic.get(topic);\n      if (JSON.stringify(before ?? null) === JSON.stringify(types ?? null)) continue;\n      await this.getClient().send(\n        new PutNotificationConfigurationCommand({\n          AutoScalingGroupName: physicalId,\n          TopicARN: topic,\n          NotificationTypes: types ?? [],\n        })\n      );\n    }\n  }\n}\n\n// ─── File-level reverse-mappers (CFn template shape) ────────────────\n\n/**\n * Reverse-map AWS `EnabledMetrics: [{Metric, Granularity}]` (flat list,\n * one row per enabled metric) back to the CFn array shape\n * `[{Granularity, Metrics?[]}]`. Metrics with the same Granularity are\n * grouped together; the resulting Metrics list is sorted alphabetically\n * for stable positional compare in the drift comparator.\n *\n * Always returns a placeholder `[]` per the cdkd PR #145 always-emit\n * convention so a console-side EnableMetricsCollection on a previously-\n * empty group surfaces as drift on the v3 `observedProperties` baseline.\n */\nfunction mapEnabledMetricsToCfn(\n  enabledMetrics:\n    | Array<{ Metric?: string | undefined; Granularity?: string | undefined }>\n    | undefined\n): Array<{ Granularity: string; Metrics?: string[] }> {\n  if (!enabledMetrics || enabledMetrics.length === 0) return [];\n  const byGranularity = new Map<string, Set<string>>();\n  for (const e of enabledMetrics) {\n    const g = e.Granularity;\n    if (!g) continue;\n    let set = byGranularity.get(g);\n    if (!set) {\n      set = new Set();\n      byGranularity.set(g, set);\n    }\n    if (e.Metric) set.add(e.Metric);\n  }\n  const result: Array<{ Granularity: string; Metrics?: string[] }> = [];\n  // Sort by Granularity for stable positional compare.\n  for (const granularity of Array.from(byGranularity.keys()).sort()) {\n    const metrics = Array.from(byGranularity.get(granularity) ?? []).sort();\n    result.push(\n      metrics.length > 0\n        ? { Granularity: granularity, Metrics: metrics }\n        : { Granularity: granularity }\n    );\n  }\n  return result;\n}\n\n/**\n * Reverse-map AWS `DescribeLifecycleHooks` response to the CFn\n * `LifecycleHookSpecificationList` shape. Each hook is surfaced under the\n * exact CFn property name. AWS-side fields cdkd state never carried\n * (`AutoScalingGroupName` — duplicated on every hook by AWS,\n * `GlobalTimeout` — AWS-derived) are filtered out. Sorted by\n * LifecycleHookName for stable positional compare.\n */\nfunction mapLifecycleHooksToCfn(\n  hooks: Array<{\n    LifecycleHookName?: string | undefined;\n    LifecycleTransition?: string | undefined;\n    NotificationTargetARN?: string | undefined;\n    RoleARN?: string | undefined;\n    NotificationMetadata?: string | undefined;\n    HeartbeatTimeout?: number | undefined;\n    DefaultResult?: string | undefined;\n  }>\n): Array<Record<string, unknown>> {\n  if (!hooks || hooks.length === 0) return [];\n  const result: Array<Record<string, unknown>> = [];\n  for (const h of hooks) {\n    if (!h.LifecycleHookName) continue;\n    const entry: Record<string, unknown> = { LifecycleHookName: h.LifecycleHookName };\n    if (h.LifecycleTransition !== undefined) entry['LifecycleTransition'] = h.LifecycleTransition;\n    if (h.RoleARN !== undefined) entry['RoleARN'] = h.RoleARN;\n    if (h.NotificationTargetARN !== undefined) {\n      entry['NotificationTargetARN'] = h.NotificationTargetARN;\n    }\n    if (h.NotificationMetadata !== undefined) {\n      entry['NotificationMetadata'] = h.NotificationMetadata;\n    }\n    if (h.HeartbeatTimeout !== undefined) entry['HeartbeatTimeout'] = h.HeartbeatTimeout;\n    if (h.DefaultResult !== undefined) entry['DefaultResult'] = h.DefaultResult;\n    result.push(entry);\n  }\n  result.sort((a, b) =>\n    String(a['LifecycleHookName']).localeCompare(String(b['LifecycleHookName']))\n  );\n  return result;\n}\n\n/**\n * Reverse-map AWS `DescribeTrafficSources` response to the CFn\n * `TrafficSources` shape `[{Identifier, Type?}]`. AWS-side runtime fields\n * (`State`, the deprecated `TrafficSource` alias) are filtered out.\n * Sorted by Identifier for stable positional compare.\n */\nfunction mapTrafficSourcesToCfn(\n  trafficSources: Array<{ Identifier?: string | undefined; Type?: string | undefined }>\n): Array<Record<string, unknown>> {\n  if (!trafficSources || trafficSources.length === 0) return [];\n  const result: Array<Record<string, unknown>> = [];\n  for (const t of trafficSources) {\n    if (!t.Identifier) continue;\n    const entry: Record<string, unknown> = { Identifier: t.Identifier };\n    if (t.Type !== undefined) entry['Type'] = t.Type;\n    result.push(entry);\n  }\n  result.sort((a, b) => String(a['Identifier']).localeCompare(String(b['Identifier'])));\n  return result;\n}\n\n/**\n * Reverse-map AWS `DescribeNotificationConfigurations` (a flat list, one\n * row per `(topicArn, notificationType)`) into the CFn shape\n * `[{TopicARN, NotificationTypes[]}]`. NotificationTypes are grouped per\n * TopicARN and sorted alphabetically for stable positional compare.\n */\nfunction mapNotificationsToCfn(\n  configurations: Array<{ TopicARN?: string | undefined; NotificationType?: string | undefined }>\n): Array<Record<string, unknown>> {\n  if (!configurations || configurations.length === 0) return [];\n  const byTopic = new Map<string, Set<string>>();\n  for (const c of configurations) {\n    if (!c.TopicARN) continue;\n    let set = byTopic.get(c.TopicARN);\n    if (!set) {\n      set = new Set();\n      byTopic.set(c.TopicARN, set);\n    }\n    if (c.NotificationType) set.add(c.NotificationType);\n  }\n  const result: Array<Record<string, unknown>> = [];\n  for (const topic of Array.from(byTopic.keys()).sort()) {\n    const types = Array.from(byTopic.get(topic) ?? []).sort();\n    result.push({ TopicARN: topic, NotificationTypes: types });\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2GA,MAAa,kCACX;;AAGF,MAAa,uBACX;;;;;;;;;;;;;;;;;;;;;;AAsKF,SAAgB,qBAId,SAA4E;CAS5E,MAAM,WAAW;CACjB,MAAM,SAAS,YAAY,SAAS,YAAY,EAAE,WAAW,KAAK,CAAC;CACnE,IAAI,CAAC,UAAU,WAAW,SAAS,YAAY,OAAO;CAKtD,IAAI,SAAS,eAAe,SAAS,YAAY,MAAM,MAAM,QAAQ,OAAO;CAC5E,MAAM,OAAO,SAAS,QAAQ,IAAI,SAAS,UAAU;CACrD,OAAO,GAAG,SAAS,OAAO,GAAG,WAAW,MAAM,IAAI;AACpD;;;;;;;;;;;AAYA,SAAgB,2BAId,MAAqE;CACrE,MAAM,EAAE,UAAU,iBAAiB;CAGnC,MAAM,UAAU,qBAAqB,KAAK,OAAO;CACjD,MAAM,UAAU,KAAK;CACrB,MAAM,OACJ,GAAG,SAAS,OAAO,aAAa,2QAGQ,gCAAgC;CAI1E,IAAI,CAAC,SAAS,OAAO,GAAG,KAAK,GAAG,qBAAqB,oBAAoB,aAAa;CAEtF,OACE,GAAG,KAAK,2CAA2C,QAAQ,yBAF9C,QAAQ,SAAS,IAAI,QAAQ,WAAW,GAEsC,oBACvE,aAAa;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvOA,IAAa,cAAb,MAAa,YAAwC;CACnD,AAAQ;CACR,AAAQ;CACR,AAAiB,iBAAiB,QAAQ,IAAI;CAC9C,AAAQ,SAAS,UAAU,CAAC,CAAC,MAAM,aAAa;CAEhD,oCAAoB,IAAI,IAAiC,CACvD,CACE,sDACA,IAAI,IAAI;EACN;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH,CACF,CAAC;CAED,oCAAoB,IAAI,IAAyC,CAC/D,CACE,sDACA,IAAI,IAAoB,CACtB,CACE,2BACA,2EACF,GACA,CACE,6BACA,wFACF,CACF,CAAC,CACH,CACF,CAAC;CAED,AAAQ,YAA+B;EACrC,IAAI,CAAC,KAAK,WACR,KAAK,YAAY,IAAI,kBAAkB;GACrC,GAAG,kBAAkB;GACrB,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;EAC/D,CAAC;EAEH,OAAO,KAAK;CACd;CAEA,AAAQ,eAA0B;EAChC,IAAI,CAAC,KAAK,WACR,KAAK,YAAY,IAAI,UAAU;GAC7B,GAAG,kBAAkB;GACrB,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;EAC/D,CAAC;EAEH,OAAO,KAAK;CACd;;;;;;;;;;;;;;CAiBA,MAAM,OACJ,WACA,cACA,YACA,SAC+B;EAC/B,IAAI,iBAAiB,sCACnB,MAAM,IAAI,kBACR,8BAA8B,gBAC9B,cACA,SACF;EAGF,MAAM,YACH,WAAW,2BACZ,qBAAqB,WAAW,EAAE,WAAW,IAAI,CAAC;EAGpD,MAAM,cAA4B,SAAS,iBAAiB,SAAS;EACrE,MAAM,SAAS,YAA0B,KAAK,OAAO,MAAM,YAAY,OAAO,CAAC;EAC/E,MAAM,6BAA6B,UAAU,IAAI,YAAY,SAAS,GAAG;EAEzE,IAAI;GACF,MAAM,iBAAiB,KAAK,oBAAoB,UAAU;GAC1D,MAAM,OAAO,KAAK,UAAU,WAAW,UAAU;GACjD,MAAM,oBAAoB,KAAK,sBAAsB,WAAW,oBAAoB;GAEpF,MAAM,UAAU,WAAW,cAAc,OAAO,OAAO,WAAW,UAAU,IAAI;GAChF,MAAM,UAAU,WAAW,cAAc,OAAO,OAAO,WAAW,UAAU,IAAI;GAEhF,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;IAChC,sBAAsB;IACtB,SAAS;IACT,SAAS;IACT,GAAI,WAAW,sBAAsB,QAAQ,EAC3C,iBAAiB,OAAO,WAAW,kBAAkB,EACvD;IACA,GAAI,kBAAkB,EAAE,gBAAgB,eAAe;IACvD,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,sBAAsB,UAAa,EAAE,mBAAmB,kBAAkB;IAC9E,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,WAAW,uBAAuB,UAAa,EACjD,iBAAiB,WAAW,mBAC9B;IACA,GAAI,WAAW,6BAA6B,QAAQ,EAClD,wBAAwB,OAAO,WAAW,yBAAyB,EACrE;IACA,GAAI,WAAW,eAAe,QAAQ,EACpC,iBAAiB,OAAO,WAAW,WAAW,EAChD;IACA,GAAI,WAAW,sBAAsB,QAAQ,EAC3C,iBAAiB,OAAO,WAAW,kBAAkB,EACvD;IACA,GAAI,WAAW,2BAA2B,UAAa,EACrD,qBAAqB,WAAW,uBAClC;IACA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,WAAW,0BAA0B,QAAQ,EAC/C,qBAAqB,OAAO,WAAW,sBAAsB,EAC/D;IACA,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,WAAW,uBAAuB,UAAa,EACjD,iBAAiB,WAAW,mBAC9B;IACA,GAAI,WAAW,eAAe,UAAa,EACzC,SAAS,WAAW,WACtB;IACA,GAAI,WAAW,2BAA2B,UAAa,EACrD,qBAAqB,WAAW,uBAClC;IACA,GAAI,WAAW,4BAA4B,QAAQ,EACjD,uBAAuB,OAAO,WAAW,wBAAwB,EACnE;IACA,GAAI,WAAW,sCAAsC,UAAa,EAChE,gCAAgC,WAAW,kCAC7C;IACA,GAAI,WAAW,sBAAsB,UAAa,EAChD,gBAAgB,WAAW,kBAC7B;IACA,GAAI,WAAW,oCAAoC,UAAa,EAC9D,8BAA8B,WAAW,gCAC3C;IACA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,gCAAgC,UAAa,EAC1D,0BAA0B,WAAW,4BACvC;IACA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,iCAAiC,UAAa,EAC3D,2BAA2B,WAAW,6BACxC;IACA,GAAI,WAAW,0BAA0B,UAAa,EACpD,oBAAoB,WAAW,sBACjC;IACA,GAAI,KAAK,SAAS,KAAK,EAAE,MAAM,KAAK;GACtC,CAAC,CACH;GAEA,MAAM,yCAAyC,UAAU,IAAI,YAAY,SAAS,GAAG;GAErF,MAAM,MAAM,MAAM,KAAK,SAAS,SAAS;GACzC,MAAM,aAAsC,CAAC;GAC7C,IAAI,KAAK,WAAW,SAAS;GAC7B,IAAI,gBAAgB,kBAClB,WAAW,sBAAsB,eAAe;GAElD,OAAO;IAAE,YAAY;IAAW;GAAW;EAC7C,SAAS,OAAO;GACd,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;GAC/C,MAAM,IAAI,kBACR,qCAAqC,UAAU,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxG,cACA,WACA,WACA,KACF;EACF;CACF;;;;;;;;;;;CAYA,MAAM,OACJ,WACA,YACA,cACA,YACA,oBACA,SAC+B;EAC/B,IAAI,iBAAiB,sCACnB,MAAM,IAAI,kBACR,8BAA8B,gBAC9B,cACA,WACA,UACF;EAEF,KAAK,OAAO,MAAM,6BAA6B,UAAU,IAAI,YAAY;EAOzE,MAAM,YAAY,GAAY,MAAwB,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;EAC5F,IAAI,CAAC,SAAS,WAAW,yBAAyB,mBAAmB,uBAAuB,GAAG;GA0B7F,MAAM,SADqB,mBAAmB,0BAErB,yBACnB,2BAA2B;IACzB,UACE;IAEF,cAAc;IACd,SAAS;KACP,QAAQ;KACR,YAAY;KACZ,OAAO;IACT;GACF,CAAC,IACD;GACN,MAAM,IAAI,gCACR,cACA,WACA,kIACE,MACJ;EACF;EACA,IAAI;GAMF,MAAM,KAAK,cAAc,YAAY,WAAW,SAAS,mBAAmB,OAAO;GACnF,MAAM,KAAK,2BACT,YACA,WAAW,sBACX,mBAAmB,oBACrB;GACA,MAAM,KAAK,yBACT,YACA,WAAW,oBACX,mBAAmB,oBACnB,SAAS,WACX;GACA,MAAM,KAAK,2BACT,YACA,WAAW,sBACX,mBAAmB,oBACrB;GACA,MAAM,KAAK,wBACT,YACA,WAAW,mCACX,mBAAmB,iCACrB;GACA,MAAM,KAAK,wBACT,YACA,WAAW,mBACX,mBAAmB,iBACrB;GACA,MAAM,KAAK,oCACT,YACA,WAAW,+BACX,mBAAmB,6BACrB;GAEA,MAAM,iBAAiB,KAAK,oBAAoB,UAAU;GAC1D,MAAM,oBAAoB,KAAK,sBAAsB,WAAW,oBAAoB;GA4CpF,MAAM,uBAAuB,qBAC3B,WAAW,oBACX,mBAAmB,oBAInB,KACF;GACA,MAAM,8BAA8B,qBAClC,WAAW,6BAA6B,OACpC,OAAO,WAAW,yBAAyB,IAC3C,QACJ,mBAAmB,6BAA6B,OAC5C,OAAO,mBAAmB,yBAAyB,IACnD,QAEJ,CACF;GAIA,MAAM,cAAc,WAAW,eAAe,WAAW;GACzD,MAAM,kBACJ,mBAAmB,eAAe,mBAAmB;GACvD,MAAM,uBAAuB,qBAC3B,eAAe,OAAO,OAAO,WAAW,IAAI,QAC5C,mBAAmB,OAAO,OAAO,eAAe,IAAI,QAEpD,GACF;GACA,MAAM,2BAA2B,qBAC/B,WAAW,wBACX,mBAAmB,wBAEnB,CAAC,SAAS,CACZ;GACA,MAAM,6BAA6B,qBACjC,WAAW,qCACX,mBAAmB,qCACnB,KACF;GACA,MAAM,yBAAyB,qBAC7B,WAAW,sBACX,mBAAmB,sBACnB,KACF;GACA,MAAM,2BAA2B,qBAC/B,WAAW,0BAA0B,OACjC,OAAO,WAAW,sBAAsB,IACxC,QACJ,mBAAmB,0BAA0B,OACzC,OAAO,mBAAmB,sBAAsB,IAChD,QAEJ,CACF;GACA,MAAM,2BAA2B,qBAC/B,WAAW,wBACX,mBAAmB,wBAEnB,OACF;GACA,MAAM,6BAA6B,qBACjC,WAAW,4BAA4B,OACnC,OAAO,WAAW,wBAAwB,IAC1C,QACJ,mBAAmB,4BAA4B,OAC3C,OAAO,mBAAmB,wBAAwB,IAClD,QAGJ,EACF;GACA,MAAM,iCAAiC,qBACrC,WAAW,8BACX,mBAAmB,8BAGnB;IAAE,sBAAsB;IAAI,sBAAsB;GAAG,CACvD;GACA,MAAM,+BAA+B,qBACnC,WAAW,qCAGX,mBAAmB,qCAMnB,EAAE,+BAA+B,UAAU,CAC7C;GACA,MAAM,oCAAoC,qBACxC,WAAW,iCACX,mBAAmB,iCAInB,EAAE,8BAA8B,uBAAuB,CACzD;GACA,MAAM,0BAA0B,qBAC9B,WAAW,uBACX,mBAAmB,uBAEnB,MACF;GAEA,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;IAChC,sBAAsB;IACtB,GAAI,WAAW,cAAc,QAAQ,EAAE,SAAS,OAAO,WAAW,UAAU,EAAE;IAC9E,GAAI,WAAW,cAAc,QAAQ,EAAE,SAAS,OAAO,WAAW,UAAU,EAAE;IAC9E,GAAI,WAAW,sBAAsB,QAAQ,EAC3C,iBAAiB,OAAO,WAAW,kBAAkB,EACvD;IACA,GAAI,kBAAkB,EAAE,gBAAgB,eAAe;IACvD,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,sBAAsB,UAAa,EAAE,mBAAmB,kBAAkB;IAC9E,GAAI,WAAW,yBAAyB,UAAa,EACnD,mBAAmB,WAAW,qBAChC;IACA,GAAI,yBAAyB,UAAa,EACxC,iBAAiB,qBACnB;IACA,GAAI,gCAAgC,UAAa,EAC/C,wBAAwB,4BAC1B;IACA,GAAI,yBAAyB,UAAa,EACxC,iBAAiB,qBACnB;IACA,GAAI,6BAA6B,UAAa,EAC5C,qBAAqB,yBACvB;IACA,GAAI,+BAA+B,UAAa,EAC9C,kCAAkC,2BACpC;IACA,GAAI,2BAA2B,UAAa,EAC1C,mBAAmB,uBACrB;IACA,GAAI,WAAW,4BAA4B,UAAa,EACtD,sBAAsB,WAAW,wBACnC;IACA,GAAI,6BAA6B,UAAa,EAC5C,qBAAqB,yBACvB;IACA,GAAI,WAAW,eAAe,UAAa,EACzC,SAAS,WAAW,WACtB;IACA,GAAI,6BAA6B,UAAa,EAC5C,qBAAqB,yBACvB;IACA,GAAI,+BAA+B,UAAa,EAC9C,uBAAuB,2BACzB;IACA,GAAI,sCAAsC,UAAa,EACrD,8BAA8B,kCAChC;IAGA,GAAI,WAAW,wCAAwC,UAAa,EAClE,kCAAkC,WAChC,oCAEJ;IACA,GAAI,WAAW,gCAAgC,UAAa,EAC1D,0BAA0B,WAAW,4BACvC;IACA,GAAI,iCAAiC,UAAa,EAChD,kCAAkC,6BACpC;IACA,GAAI,mCAAmC,UAAa,EAClD,2BAA2B,+BAC7B;IACA,GAAI,4BAA4B,UAAa,EAC3C,oBAAoB,wBACtB;GACF,CAAC,CACH;GAEA,KAAK,OAAO,MAAM,yCAAyC,WAAW;GAEtE,MAAM,MAAM,MAAM,KAAK,SAAS,UAAU;GAC1C,MAAM,aAAsC,CAAC;GAC7C,IAAI,KAAK,WAAW,SAAS;GAC7B,IAAI,gBAAgB,kBAClB,WAAW,sBAAsB,eAAe;GAElD,OAAO;IAAE;IAAY,aAAa;IAAO;GAAW;EACtD,SAAS,OAAO;GACd,IAAI,iBAAiB,iCAAiC,MAAM;GAC5D,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;GAC/C,MAAM,IAAI,kBACR,qCAAqC,UAAU,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxG,cACA,WACA,YACA,KACF;EACF;CACF;CAEA,MAAM,OACJ,WACA,YACA,cACA,aACA,SACe;EACf,KAAK,OAAO,MAAM,6BAA6B,UAAU,IAAI,YAAY;EAWzE,IAAI,SAAS,qBAAqB,MAAM;GACtC,IAAI;IACF,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;KAChC,sBAAsB;KACtB,oBAAoB;IACtB,CAAC,CACH;IACA,KAAK,OAAO,MACV,mDAAmD,UAAU,eAC/D;GACF,SAAS,WAAW;IAGlB,KAAK,OAAO,MACV,2CAA2C,WAAW,IAAI,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,GAC7H;GACF;GASA,MAAM,KAAK,oCAAoC,YAAY,SAAS;EACtE;EAEA,IAAI;GACF,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,8BAA8B;IAChC,sBAAsB;IACtB,aAAa,SAAS,qBAAqB;GAC7C,CAAC,CACH;GAEA,KAAK,OAAO,MAAM,uDAAuD,WAAW;GAKpF,MAAM,KAAK,oBAAoB,UAAU;EAC3C,SAAS,OAAO;GACd,IAAI,KAAK,gBAAgB,KAAK,GAAG;IAC/B,MAAM,eAAe,MAAM,KAAK,UAAU,CAAC,CAAC,OAAO,OAAO;IAC1D,kBACE,cACA,SAAS,gBACT,cACA,WACA,UACF;IACA,KAAK,OAAO,MAAM,oBAAoB,WAAW,mCAAmC;IACpF;GACF;GACA,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;GAC/C,MAAM,IAAI,kBACR,qCAAqC,UAAU,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxG,cACA,WACA,YACA,KACF;EACF;CACF;CAEA,MAAM,aACJ,YACA,eACA,eACkB;EAClB,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU;EACjD,IAAI,CAAC,OACH,MAAM,IAAI,kBACR,oBAAoB,WAAW,uCAAuC,iBACtE,sCACA,YACA,UACF;EAEF,QAAQ,eAAR;GACE,KAAK;GACL,KAAK,uBACH,OAAO,MAAM,uBAAuB;GACtC,KAAK,2BACH,OAAO,MAAM,2BAA2B;GAC1C,KAAK;GACL,KAAK,oBACH,OAAO,MAAM,gBAAgB,oBAAoB;GACnD,SACE,OAAO;EACX;CACF;;;;;;;;;;;;;;;;;;;;;;;;;CA0BA,MAAM,iBACJ,YACA,YACA,eAC8C;EAG9C,MAAM,gBAAgB,YAAY;GAChC,IAAI;IACF,OAAO,MAAM,KAAK,cAAc,UAAU;GAC5C,SAAS,KAAK;IACZ,IAAI,KAAK,gBAAgB,GAAG,GAAG,OAAO;IACtC,MAAM;GACR;EACF,EAAC,CAAE;EAEH,MAAM,wBAAwB,KAAK,UAAU,CAAC,CAC3C,KAAK,IAAI,8BAA8B,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAC7E,MAAM,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CACnC,OAAO,QAAQ;GACd,KAAK,OAAO,MACV,0BAA0B,WAAW,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAClG;GACA,OAAO,CAAC;EACV,CAAC;EAEH,MAAM,wBAAwB,KAAK,UAAU,CAAC,CAC3C,KAAK,IAAI,8BAA8B,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAC7E,MAAM,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CACnC,OAAO,QAAQ;GACd,KAAK,OAAO,MACV,0BAA0B,WAAW,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAClG;GACA,OAAO,CAAC;EACV,CAAC;EAEH,MAAM,uBAAuB,KAAK,UAAU,CAAC,CAC1C,KAAK,IAAI,0CAA0C,EAAE,uBAAuB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAC5F,MAAM,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAC/C,OAAO,QAAQ;GACd,KAAK,OAAO,MACV,sCAAsC,WAAW,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAC9G;GACA,OAAO,CAAC;EACV,CAAC;EAEH,MAAM,CAAC,OAAO,gBAAgB,gBAAgB,iBAAiB,MAAM,QAAQ,IAAI;GAC/E;GACA;GACA;GACA;EACF,CAAC;EAED,IAAI,CAAC,OAAO,OAAO;EAEnB,MAAM,SAAkC,CAAC;EACzC,IAAI,MAAM,yBAAyB,QACjC,OAAO,0BAA0B,MAAM;EAEzC,IAAI,MAAM,gBAAgB;GACxB,MAAM,KAA8B,CAAC;GACrC,IAAI,MAAM,eAAe,qBAAqB,QAC5C,GAAG,sBAAsB,MAAM,eAAe;GAEhD,IAAI,MAAM,eAAe,uBAAuB,QAC9C,GAAG,wBAAwB,MAAM,eAAe;GAElD,IAAI,MAAM,eAAe,YAAY,QACnC,GAAG,aAAa,MAAM,eAAe;GAEvC,OAAO,oBAAoB;EAC7B;EACA,OAAO,aAAa,MAAM,WAAW;EACrC,OAAO,aAAa,MAAM,WAAW;EACrC,IAAI,MAAM,oBAAoB,QAAW,OAAO,qBAAqB,MAAM;EAI3E,IAAI,MAAM,sBAAsB,UAAa,MAAM,sBAAsB,IACvE,OAAO,uBAAuB,MAAM,kBAAkB,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC;OAEpF,OAAO,uBAAuB,CAAC;EAEjC,OAAO,uBAAuB,MAAM,qBAAqB,CAAC;EAC1D,IAAI,MAAM,oBAAoB,QAAW,OAAO,qBAAqB,MAAM;EAC3E,IAAI,MAAM,2BAA2B,QACnC,OAAO,4BAA4B,MAAM;EAE3C,IAAI,MAAM,oBAAoB,QAI5B,OAAO,cAAc,MAAM;EAE7B,OAAO,sCAAsC,MAAM,oCAAoC;EACvF,OAAO,yBAAyB,MAAM,uBAAuB,CAAC;EAC9D,OAAO,uBAAuB,MAAM,qBAAqB;EACzD,IAAI,MAAM,yBAAyB,QACjC,OAAO,0BAA0B,MAAM;EAEzC,IAAI,MAAM,wBAAwB,QAChC,OAAO,yBAAyB,MAAM;EAExC,OAAO,uBAAuB,MAAM,qBAAqB,CAAC;EAC1D,OAAO,qBAAqB,MAAM,mBAAmB,CAAC;EACtD,IAAI,MAAM,YAAY,QAAW,OAAO,aAAa,MAAM;EAC3D,IAAI,MAAM,wBAAwB,QAChC,OAAO,yBAAyB,MAAM;EAExC,IAAI,MAAM,0BAA0B,QAClC,OAAO,2BAA2B,MAAM;EAE1C,IAAI,MAAM,yBAAyB,QACjC,OAAO,0BAA0B,MAAM;EAEzC,IAAI,MAAM,iCAAiC,QACzC,OAAO,kCAAkC,MAAM;EAEjD,IAAI,MAAM,qCAAqC,QAC7C,OAAO,sCAAsC,MAAM;EAErD,IAAI,MAAM,qCAAqC,QAC7C,OAAO,sCAAsC,MAAM;EAErD,IAAI,MAAM,8BAA8B,QACtC,OAAO,+BAA+B,MAAM;EAE9C,IAAI,MAAM,uBAAuB,QAC/B,OAAO,wBAAwB,MAAM;OAMrC,OAAO,wBAAwB;EAKjC,OAAO,UAAU,sBAAsB,MAAM,IAAI;EAKjD,OAAO,uBAAuB,uBAAuB,MAAM,cAAc;EACzE,OAAO,oCAAoC,uBAAuB,cAAc;EAehF,OAAO,oBAAoB,uBALG,eAAe,QAAQ,MAAM;GACzD,IAAI,EAAE,eAAe,QAAW,OAAO;GACvC,IAAI,EAAE,SAAS,WAAW,EAAE,SAAS,OAAO,OAAO;GACnD,OAAO;EACT,CACsE,CAAC;EACvE,OAAO,gCAAgC,sBAAsB,aAAa;EAE1E,OAAO;CACT;CAIA,AAAQ,oBACN,YACyC;EACzC,MAAM,KAAK,WAAW;EAGtB,IAAI,CAAC,IAAI,OAAO;EAChB,MAAM,MAAmC,CAAC;EAQ1C,IAAI,GAAG,qBAAqB,QAAW;GACrC,IAAI,mBAAmB,GAAG;GAC1B,IAAI,GAAG,uBAAuB,QAK5B,KAAK,OAAO,MACV,+CAA+C,GAAG,iBAAiB,4BAA4B,GAAG,mBAAmB,kCACvH;EAEJ,OAAO,IAAI,GAAG,uBAAuB,QACnC,IAAI,qBAAqB,GAAG;EAE9B,IAAI,GAAG,YAAY,QAQjB,IAAI,UAAU,OAAO,GAAG,OAAO;EAEjC,IAAI,IAAI,qBAAqB,UAAa,IAAI,uBAAuB,QACnE;EAEF,OAAO;CACT;;;;;;;CAQA,AAAQ,UAAU,WAAmB,YAA+C;EAClF,MAAM,MAAM,WAAW;EAGvB,IAAI,CAAC,KAAK,OAAO,CAAC;EAClB,OAAO,IACJ,QAAQ,MAAM,EAAE,QAAQ,MAAS,CAAC,CAClC,KAAK,OAAO;GACX,YAAY;GACZ,cAAc;GACd,KAAK,EAAE;GACP,OAAO,EAAE,SAAS;GAClB,mBAAmB,EAAE,qBAAqB;EAC5C,EAAE;CACN;;;;;CAMA,AAAQ,sBAAsB,OAAoC;EAChE,IAAI,UAAU,UAAa,UAAU,MAAM,OAAO;EAClD,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,UAAU,MAAM,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,CAAC;GAC7E,IAAI,QAAQ,WAAW,GAAG,OAAO;GACjC,OAAO,QAAQ,KAAK,GAAG;EACzB;EACA,IAAI,OAAO,UAAU,UAAU,OAAO;CAExC;CAEA,MAAc,cAAc,WAAmB;EAM7C,QAAO,MALgB,KAAK,UAAU,CAAC,CAAC,KACtC,IAAI,iCAAiC,EACnC,uBAAuB,CAAC,SAAS,EACnC,CAAC,CACH,EACe,CAAC,oBAAoB;CACtC;;;;;;;;;;;;CAaA,MAAc,oCACZ,WACA,WACe;EACf,IAAI;EACJ,IAAI;GAEF,gBAAe,MADK,KAAK,cAAc,SAAS,EAC5B,EAAE,aAAa,CAAC,EAAC,CAClC,KAAK,MAAM,EAAE,UAAU,CAAC,CACxB,QAAQ,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;EACzE,SAAS,eAAe;GACtB,KAAK,OAAO,MACV,qDAAqD,UAAU,uCAAuC,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,GACrL;GACA;EACF;EAEA,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,OAAO,MACV,2CAA2C,YAAY,OAAO,mCAAmC,UAAU,qBAC7G;EACA,KAAK,MAAM,cAAc,aACvB,MAAM,8BAA8B,KAAK,aAAa,GAAG,YAAY,KAAK,MAAM;CAEpF;CAEA,MAAc,SAAS,WAAgD;EACrE,IAAI;GAEF,QAAO,MADa,KAAK,cAAc,SAAS,EACpC,EAAE;EAChB,SAAS,KAAK;GACZ,KAAK,OAAO,MACV,6BAA6B,UAAU,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GACpG;GACA;EACF;CACF;CAEA,AAAQ,gBAAgB,OAAyB;EAC/C,IAAI,EAAE,iBAAiB,QAAQ,OAAO;EACtC,MAAM,OAAQ,MAA4B,QAAQ;EAClD,MAAM,UAAU,MAAM,QAAQ,YAAY;EAG1C,OACE,SAAS,sBACR,QAAQ,SAAS,iCAAiC,KACjD,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,gBAAgB;CAEvC;CAEA,MAAc,oBAAoB,WAAmB,YAAY,KAAwB;EACvF,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI,QAAQ;EAEZ,OAAO,KAAK,IAAI,IAAI,YAAY,WAAW;GACzC,IAAI;IAEF,IAAI,CAAC,MADe,KAAK,cAAc,SAAS,GACpC;GACd,SAAS,OAAO;IACd,IAAI,KAAK,gBAAgB,KAAK,GAAG;IACjC,MAAM;GACR;GAEA,MAAM,KAAK,MAAM,KAAK;GACtB,QAAQ,KAAK,IAAI,QAAQ,GAAG,GAAM;EACpC;EAEA,MAAM,IAAI,MACR,0CAA0C,UAAU,+BACtD;CACF;CAEA,AAAQ,MAAM,IAA2B;EACvC,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;CACzD;;;;;;;;;;;;;;;;CAyBA,MAAc,cAAc,YAAoB,MAAe,MAA8B;EAC3F,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAE/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EACnD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EACnD,MAAM,4BAAY,IAAI,IAAoB;EAC1C,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,CAAC;EAEnC,MAAM,4BAAY,IAAI,IAAoB;EAC1C,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,CAAC;EAGnC,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,CAAC,KAAK,QAAQ,WACvB,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG,SAAS,KAAK,GAAG;EAE5C,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAIA,oBAAkB,EAOpB,MAAM,SAAS,KAAK,OAAO;GACzB,YAAY;GACZ,cAAc;GACd,KAAK,EAAE;EACT,EAAE,EACJ,CAAC,CACH;EAGF,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW;GAClC,MAAM,SAAS,UAAU,IAAI,GAAG;GAChC,IAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,GAAG,GAAG;GACpD,SAAS,KAAK,GAAG;EACnB;EACA,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,0BAA0B,EAC5B,MAAM,SAAS,KAAK,OAAO;GACzB,YAAY;GACZ,cAAc;GACd,KAAK,EAAE;GACP,GAAI,EAAE,UAAU,UAAa,EAAE,OAAO,EAAE,MAAM;GAC9C,GAAI,EAAE,sBAAsB,UAAa,EACvC,mBAAmB,EAAE,kBACvB;EACF,EAAE,EACJ,CAAC,CACH;CAEJ;;;;;;;;CASA,MAAc,2BACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,aAAa,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QACjD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,aAAa,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QACjD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,UAAU,IAAI,IAAI,SAAS;EACjC,MAAM,UAAU,IAAI,IAAI,SAAS;EACjC,MAAM,WAAW,UAAU,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACxD,MAAM,WAAW,UAAU,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACxD,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,2BAA2B;GAC7B,sBAAsB;GACtB,mBAAmB;EACrB,CAAC,CACH;EAEF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,2BAA2B;GAC7B,sBAAsB;GACtB,mBAAmB;EACrB,CAAC,CACH;CAEJ;;;;;;;;;CAUA,MAAc,yBACZ,YACA,MACA,MACA,aACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,YAAY,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QAChD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,YAAY,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,EAAC,CAAE,QAChD,MAAmB,OAAO,MAAM,QACnC;EACA,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACvD,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;EACvD,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,sCAAsC;GACxC,sBAAsB;GACtB,iBAAiB;EACnB,CAAC,CACH;EAEF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,sCAAsC;GACxC,sBAAsB;GACtB,iBAAiB;EACnB,CAAC,CACH;EAWF,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,GAC3C,MAAM,KAAK,kCAAkC,YAAY,IAAI,IAAI,QAAQ,GAAG,WAAW;CAE3F;CAEA,OAAwB,4BAA4B;CACpD,OAAwB,kCAAkC;;;;;;;;;CAU1D,MAAc,kCACZ,YACA,UACA,eAA6B,SAAS,MACvB;EAQf,MAAM,QAAQ,YAA0B,KAAK,OAAO,KAAK,YAAY,OAAO,CAAC;EAC7E,MAAM,SAAS,YAA0B,KAAK,OAAO,MAAM,YAAY,OAAO,CAAC;EAC/E,MAAM,aAAa,KAAK,IAAI,IAAI,YAAY;EAC5C,IAAI,+BAA4B,IAAI,IAAI;EACxC,OAAO,KAAK,IAAI,IAAI,YAAY;GAC9B,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,KAC5B,IAAI,iCAAiC,EAAE,uBAAuB,CAAC,UAAU,EAAE,CAAC,CAC9E;GACF,SAAS,KAAK;IAMZ,MACE,0EACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;IACA,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,YAAY,+BAA+B,CAAC;IACnF;GACF;GACA,eAAe,IAAI,IAAI,KAAK,oBAAoB,EAAE,EAAE,mBAAmB,CAAC,CAAC;GACzE,IAAI,aAAa,SAAS,SAAS,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,MAAM,aAAa,IAAI,CAAC,CAAC,GACvF;GAEF,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,YAAY,+BAA+B,CAAC;EACrF;EAcA,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC;EACrE,MAAM,iBAAiB,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC;EACzE,KACE,4DAA4D,YAAY,0BAA0B,aAAa,WAAW,aAAa,KAAK,UAAU,cAAc,EAAE,YAAY,KAAK,UAAU,cAAc,GACjN;CACF;CAEA,MAAc,2BACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,oCAAoB,IAAI,IAAkC;EAChE,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,aAAa,kBAAkB,IAAI,EAAE,aAAa,EAAE,OAAO;EAEnE,MAAM,oCAAoB,IAAI,IAAkC;EAChE,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,aAAa,kBAAkB,IAAI,EAAE,aAAa,EAAE,OAAO;EAMnE,KAAK,MAAM,CAAC,aAAa,YAAY,mBACnC,IAAI,CAAC,kBAAkB,IAAI,WAAW,GACpC,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,gCAAgC;GAClC,sBAAsB;GACtB,GAAI,WAAW,QAAQ,SAAS,IAAI,EAAE,SAAS,QAAQ,IAAI,CAAC;EAC9D,CAAC,CACH;EAGJ,KAAK,MAAM,CAAC,aAAa,YAAY,mBAAmB;GACtD,MAAM,SAAS,kBAAkB,IAAI,WAAW;GAChD,IAAI,KAAK,UAAU,UAAU,IAAI,MAAM,KAAK,UAAU,WAAW,IAAI,GAAG;GAKxE,IAAI,UAAU,OAAO,SAAS,GAAG;IAC/B,MAAM,UAAU,UAAU,OAAO,QAAQ,MAAM,CAAC,QAAQ,SAAS,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,QAAQ,SAAS,GACnB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,gCAAgC;KAClC,sBAAsB;KACtB,SAAS;IACX,CAAC,CACH;GAEJ;GACA,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,+BAA+B;IACjC,sBAAsB;IACtB,aAAa;IACb,GAAI,WAAW,QAAQ,SAAS,IAAI,EAAE,SAAS,QAAQ,IAAI,CAAC;GAC9D,CAAC,CACH;EACF;CACF;CAEA,MAAc,wBACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EASnD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAGnD,MAAM,YAAY,IAAI,IACpB,YAAY,KAAK,MAAM,EAAE,iBAAiB,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAC5E;EAEA,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,qBAAqB,CAAC,UAAU,IAAI,EAAE,iBAAiB,GAC3D,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,2BAA2B;GAC7B,sBAAsB;GACtB,mBAAmB,EAAE;EACvB,CAAC,CACH;EAKJ,MAAM,6BAAa,IAAI,IAAqB;EAC5C,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,mBAAmB,WAAW,IAAI,EAAE,mBAAmB,CAAC;EAEhE,KAAK,MAAM,KAAK,aAAa;GAC3B,IAAI,CAAC,EAAE,mBAAmB;GAC1B,MAAM,WAAW,WAAW,IAAI,EAAE,iBAAiB;GACnD,IAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,CAAC,GAAG;GACpD,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,wBAAwB;IAC1B,sBAAsB;IACtB,mBAAmB,EAAE;IACrB,GAAI,EAAE,wBAAwB,UAAa,EACzC,qBAAqB,EAAE,oBACzB;IACA,GAAI,EAAE,YAAY,UAAa,EAAE,SAAS,EAAE,QAAQ;IACpD,GAAI,EAAE,0BAA0B,UAAa,EAC3C,uBAAuB,EAAE,sBAC3B;IACA,GAAI,EAAE,yBAAyB,UAAa,EAC1C,sBAAsB,EAAE,qBAC1B;IACA,GAAI,EAAE,qBAAqB,UAAa,EAAE,kBAAkB,EAAE,iBAAiB;IAC/E,GAAI,EAAE,kBAAkB,UAAa,EAAE,eAAe,EAAE,cAAc;GACxE,CAAC,CACH;EACF;CACF;CAEA,MAAc,wBACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAC/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAAC;EAC5F,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAAC;EAC5F,MAAM,WAAW,YAAY,QAAQ,MAAM,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAC;EACrF,MAAM,WAAW,YAAY,QAAQ,MAAM,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAC;EACrF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,4BAA4B;GAC9B,sBAAsB;GACtB,gBAAgB,SAAS,KAAK,OAAO;IACnC,YAAY,EAAE;IACd,GAAI,EAAE,SAAS,UAAa,EAAE,MAAM,EAAE,KAAK;GAC7C,EAAE;EACJ,CAAC,CACH;EAEF,IAAI,SAAS,SAAS,GACpB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,4BAA4B;GAC9B,sBAAsB;GACtB,gBAAgB,SAAS,KAAK,OAAO;IACnC,YAAY,EAAE;IACd,GAAI,EAAE,SAAS,UAAa,EAAE,MAAM,EAAE,KAAK;GAC7C,EAAE;EACJ,CAAC,CACH;CAEJ;CAEA,MAAc,oCACZ,YACA,MACA,MACe;EACf,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,GAAG;EAO/D,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,cAAe,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;EAInD,MAAM,8BAAc,IAAI,IAAkC;EAC1D,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,UAAU,YAAY,IAAI,EAAE,UAAU,EAAE,iBAAiB;EAEjE,MAAM,8BAAc,IAAI,IAAkC;EAC1D,KAAK,MAAM,KAAK,aACd,IAAI,EAAE,UAAU,YAAY,IAAI,EAAE,UAAU,EAAE,iBAAiB;EAEjE,KAAK,MAAM,SAAS,YAAY,KAAK,GACnC,IAAI,CAAC,YAAY,IAAI,KAAK,GACxB,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,uCAAuC;GACzC,sBAAsB;GACtB,UAAU;EACZ,CAAC,CACH;EAGJ,KAAK,MAAM,CAAC,OAAO,UAAU,aAAa;GACxC,MAAM,SAAS,YAAY,IAAI,KAAK;GACpC,IAAI,KAAK,UAAU,UAAU,IAAI,MAAM,KAAK,UAAU,SAAS,IAAI,GAAG;GACtE,MAAM,KAAK,UAAU,CAAC,CAAC,KACrB,IAAI,oCAAoC;IACtC,sBAAsB;IACtB,UAAU;IACV,mBAAmB,SAAS,CAAC;GAC/B,CAAC,CACH;EACF;CACF;AACF;;;;;;;;;;;;AAeA,SAAS,uBACP,gBAGoD;CACpD,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG,OAAO,CAAC;CAC5D,MAAM,gCAAgB,IAAI,IAAyB;CACnD,KAAK,MAAM,KAAK,gBAAgB;EAC9B,MAAM,IAAI,EAAE;EACZ,IAAI,CAAC,GAAG;EACR,IAAI,MAAM,cAAc,IAAI,CAAC;EAC7B,IAAI,CAAC,KAAK;GACR,sBAAM,IAAI,IAAI;GACd,cAAc,IAAI,GAAG,GAAG;EAC1B;EACA,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,MAAM;CAChC;CACA,MAAM,SAA6D,CAAC;CAEpE,KAAK,MAAM,eAAe,MAAM,KAAK,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;EACjE,MAAM,UAAU,MAAM,KAAK,cAAc,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;EACtE,OAAO,KACL,QAAQ,SAAS,IACb;GAAE,aAAa;GAAa,SAAS;EAAQ,IAC7C,EAAE,aAAa,YAAY,CACjC;CACF;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAS,uBACP,OASgC;CAChC,IAAI,CAAC,SAAS,MAAM,WAAW,GAAG,OAAO,CAAC;CAC1C,MAAM,SAAyC,CAAC;CAChD,KAAK,MAAM,KAAK,OAAO;EACrB,IAAI,CAAC,EAAE,mBAAmB;EAC1B,MAAM,QAAiC,EAAE,mBAAmB,EAAE,kBAAkB;EAChF,IAAI,EAAE,wBAAwB,QAAW,MAAM,yBAAyB,EAAE;EAC1E,IAAI,EAAE,YAAY,QAAW,MAAM,aAAa,EAAE;EAClD,IAAI,EAAE,0BAA0B,QAC9B,MAAM,2BAA2B,EAAE;EAErC,IAAI,EAAE,yBAAyB,QAC7B,MAAM,0BAA0B,EAAE;EAEpC,IAAI,EAAE,qBAAqB,QAAW,MAAM,sBAAsB,EAAE;EACpE,IAAI,EAAE,kBAAkB,QAAW,MAAM,mBAAmB,EAAE;EAC9D,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,MAAM,GAAG,MACd,OAAO,EAAE,oBAAoB,CAAC,CAAC,cAAc,OAAO,EAAE,oBAAoB,CAAC,CAC7E;CACA,OAAO;AACT;;;;;;;AAQA,SAAS,uBACP,gBACgC;CAChC,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG,OAAO,CAAC;CAC5D,MAAM,SAAyC,CAAC;CAChD,KAAK,MAAM,KAAK,gBAAgB;EAC9B,IAAI,CAAC,EAAE,YAAY;EACnB,MAAM,QAAiC,EAAE,YAAY,EAAE,WAAW;EAClE,IAAI,EAAE,SAAS,QAAW,MAAM,UAAU,EAAE;EAC5C,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,MAAM,GAAG,MAAM,OAAO,EAAE,aAAa,CAAC,CAAC,cAAc,OAAO,EAAE,aAAa,CAAC,CAAC;CACpF,OAAO;AACT;;;;;;;AAQA,SAAS,sBACP,gBACgC;CAChC,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG,OAAO,CAAC;CAC5D,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,KAAK,gBAAgB;EAC9B,IAAI,CAAC,EAAE,UAAU;EACjB,IAAI,MAAM,QAAQ,IAAI,EAAE,QAAQ;EAChC,IAAI,CAAC,KAAK;GACR,sBAAM,IAAI,IAAI;GACd,QAAQ,IAAI,EAAE,UAAU,GAAG;EAC7B;EACA,IAAI,EAAE,kBAAkB,IAAI,IAAI,EAAE,gBAAgB;CACpD;CACA,MAAM,SAAyC,CAAC;CAChD,KAAK,MAAM,SAAS,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;EACrD,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;EACxD,OAAO,KAAK;GAAE,UAAU;GAAO,mBAAmB;EAAM,CAAC;CAC3D;CACA,OAAO;AACT"}

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CqnAWzcc.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-1FTpsWNc.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-DD0X9qLM.js");
+	const { buildProgram } = await import("./program-U03H43s7.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-v7h1H_Ac.js → deploy-engine-B91NMqm1.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CqnAWzcc.js";
+import { t as getCdkdVersion } from "./version-1FTpsWNc.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -102,6 +102,8 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
 	"The operator role is invalid or doesn't have sufficient permissions",
+	"doesn't have permission to perform ec2:DescribeSecurityGroups",
+	"One or more security group IDs are invalid",
 	"permissions required to assume the role",
 	"does not have a trust relationship allowing",
 	"authorized to assume the provided role",
@@ -29650,7 +29652,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BAYjqZuM.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CvkcE8rH.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31921,9 +31923,18 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* that keeps `transientAuthzMaxRetries` at 2 is simply absent, and matching
 	* every other resource type is the correct answer instead.
 	*
-	* A thrown retry also skips the exec-env recycle: the denial is on CDKD's own
-	* principal, not on the backing function's role, so there is no warm
-	* container holding stale credentials to invalidate.
+	* A thrown retry also skips the exec-env recycle, because every rejection this
+	* arm admits is decided before the handler can run: no environment was ever
+	* CREATED, so there is no warm container holding stale credentials to
+	* invalidate. ("Before an execution environment is engaged" would be the
+	* weaker bar -- the issue #3227 VPC rejections are raised DURING environment
+	* setup, at ENI attach, not before it starts.) For the
+	* original case that is also a matter of whose permission it is -- the
+	* deploying principal's `lambda:InvokeFunction`, not the function's role --
+	* but that is not the general reason: the issue #3227 entries can surface as
+	* a VPC-networking rejection about the FUNCTION's own role
+	* (`EC2AccessDeniedException`), and there is still nothing to recycle,
+	* for the same reason.
 	*
 	* Deliberately NOT overridable by an env var. It bounds no handler
 	* invocation, so there is nothing for a user to trade off — the same reason
@@ -32369,11 +32380,13 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*    documents the drop-`cause` class in this very directory; a top-level-only
 	*    read would silently un-retry a wrapped propagation denial.
 	*
-	* **Nearly every pattern in that union is an AUTHORIZATION or
-	* REQUEST-VALIDATION rejection, and that is what makes replaying an `Invoke`
-	* safe here.** Such a rejection is decided at the API front door, before any
-	* execution environment is engaged, so the handler provably did not run and a
-	* replay cannot re-deliver work — the hazard `disableOuterRetry` exists for.
+	* **Replaying an `Invoke` is safe here because every rejection this admits
+	* is decided before the handler can run, so the handler provably did not run.**
+	* Nearly every pattern in the union is an AUTHORIZATION or
+	* REQUEST-VALIDATION rejection, decided at the API front door, before any
+	* execution environment is engaged -- the commonest way to satisfy that, but
+	* not the only one (see below). Either way a replay cannot re-deliver work —
+	* the hazard `disableOuterRetry` exists for.
 	*
 	* The union is shared, so it can acquire a member that is NOT front-door, and
 	* one already has: the Lambda CapacityProvider operator-role rejection added
@@ -32384,7 +32397,20 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* between acceptance and resolution — the exact window a post-acceptance
 	* rejection arrives in — reaches this classifier with the flag still false.
 	* Front-door-ness is therefore a property each entry owes, not one the shared
-	* list confers; check a new entry against this paragraph before adding it.
+	* list confers, and it is judged ON THIS PATH: a wording that is
+	* post-acceptance where it originates is admissible if it cannot reach a CR
+	* `Invoke` / `Publish` failure at all, OR if the only `Invoke` / `Publish`
+	* rejection that could carry it is itself decided before the handler can run.
+	* BOTH replayed calls are in scope: this classifier gates the SNS `Publish`
+	* replay as well as the Lambda `Invoke` one, so an argument about `Invoke`
+	* alone does not admit an entry. The issue #3227 entries rest on the second
+	* arm for `Invoke` -- `EC2AccessDeniedException` /
+	* `InvalidSecurityGroupIDException` are raised when Lambda cannot set up VPC
+	* networking, during setup and before the handler can run -- and on the
+	* first for `Publish`, which carries no Lambda VPC-networking text at all.
+	* The argument must cover the whole matched substring. The
+	* literal-set fence in `custom-resource-provider-thrown-retry.test.ts`
+	* enforces that an entry arrives examined, and carries the ledger.
 	*
 	* It is also why this classifier deliberately does NOT reach for the broader
 	* `isRetryableTransientError`: a throttle, an HTTP 5xx or a socket timeout can
@@ -37225,12 +37251,18 @@ const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 * `update()` (`this.create(...)` in ACM certificate / IAM managed policy / IAM
 * role / Lambda permission / SNS subscription). Those are NOT template-driven
 * — this executor's `revert` arm calls `provider.update(...)` with
-* `previousState.properties`, so they forward a STATE record on a replay — but
-* they CANNOT receive a `CreateContext`: `update()`'s own context is an
-* `UpdateContext`, which carries no `replayingState` to forward.
-* The constraint that follows is on providers, not on this constant: a
-* provider with a create-side pre-flight refusal must not re-create inside
-* `update()`. See `CreateContext` in `src/types/resource.ts`.
+* `previousState.properties`, so they forward a STATE record on a replay — and
+* they still pass NO `CreateContext`, so a create-side pre-flight refusal
+* would still fire there. The constraint that follows is on providers, not on
+* this constant: a provider with a create-side pre-flight refusal must not
+* re-create inside `update()`. See `CreateContext` in `src/types/resource.ts`.
+*
+* What issue [#3141](https://github.com/go-to-k/cdkd/issues/3141) changed is
+* that the INFORMATION now exists on that path — `UpdateContext` carries its
+* own `replayingState`, set by both revert arms below — so such a provider
+* could build a `CreateContext` from it instead of relying on the constraint.
+* None does today; the five sites are untouched. Read that as a route that
+* opened, not as a constraint that lifted.
 */
 const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
 /**
@@ -38450,7 +38482,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					currentProps ?? {},
 					{
 						maskSecrets: createSecretMasker(secrets),
-						expectedRegion: ctx.region
+						expectedRegion: ctx.region,
+						replayingState: true
 					}
 				], op.logicalId, logger, isInterrupted, secrets);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
@@ -38618,7 +38651,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						attemptedProps ?? {},
 						{
 							maskSecrets: createSecretMasker(secrets),
-							expectedRegion: ctx.region
+							expectedRegion: ctx.region,
+							replayingState: true
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
@@ -42379,4 +42413,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-v7h1H_Ac.js.map
+//# sourceMappingURL=deploy-engine-B91NMqm1.js.map