@go-to-k/cdkd 0.294.8 → 0.294.10

package/dist/{provider-classes-DlVxBF89.js → provider-classes-R7yvwymx.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-B46YMG0h.js";
 import { $ as compositeIdFormatMessage, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, Ct as injectiveKeyPrefix, D as ProtectionFlipRegistry, Dn as markNameCollision, Dt as withPasteableAwsProfile, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, J as isInterruptedWaitError, Jt as ProvisioningError, L as userPoolProtectionSite, Ln as isAwsAuthoredFailure, M as observeThenDisableProtection, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, On as markReplayMayCollide, Ot as ambientClientDefaults, P as rdsFamilyProtectionSite, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, Rn as safeStringify, S as quotedRemedyLogicalId, St as injectiveKey, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as markRedactedCause, V as isAwsCliLiteral, Vn as isThrottlingError, W as renderDisableCommand, Wn as wrapMaskedAwsError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, _ as VALUE_NOT_SHOWN, _n as shellQuote, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, c as recordedPrincipalsRepair, ct as isSecretDerivedValue, dn as isInertUnquoted, dt as withDerivedNameMasks, et as compositeIdSeparatorRefusal, fn as pasteableCommand, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, j as logGroupProtectionSite, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kt as ambientCredentialConfig, ln as commandHole, lt as maskDeep, mn as plainOrDescribed, nt as logicalIdShown, o as readPrincipalLists, ot as createMaskedLogSinks, p as withRemovalDefaults, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedRetryLogger, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, un as hasClauseBreak, ut as maskerOrIdentity, v as isPlainImportJson, vn as withheldTargetClause, w as remedyLogicalId, x as normalizeAwsTagsToCfn, y as isPlainImportValue, z as UNNAMEABLE_ID_CLAUSE, zn as THROTTLING_ERROR_NAMES } from "./iam-policy-targets-CMSQGQnm.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $i as markAuxiliaryFailure, $t as DBPROXY_TAGS_WHAT, A as deleteTableWithIndexBusyRetry, Aa as carriesSecretMask, Bi as coerceCfnInteger, C as beginDeleteWait, Cn as markWaitAbandoned, Cs as resolveAssemblyPath, D as resolveDynamoDbDeleteBudgetMs, Dn as observeThenDisableInstanceApiTermination, E as resolveDynamoDbDeleteBudgetClock, Ea as dynamicReferenceTokens, En as isTerminationProtectionPropagationError, F as isTruthyCfnBoolean, Fi as coerceWarmThroughput$1, Gi as replayWarn, Hi as configIntegerRefusal, Ii as isWarmThroughputDecrease, Ji as requireConfigString, Jn as s3BucketDomainName, Jt as earliestDefined, Ki as requireConfigArray, Kn as isSettledInstanceState, Kr as refuseMalformedNestedChildOutputs, Li as toCfnInteger, M as ECR_AUTO_DELETE_IMAGES_TAG, N as S3_AUTO_DELETE_OBJECTS_TAG, O as DELETE_INDEX_WAIT_PROCEED_NOTE, On as reDisableInstanceApiTermination, P as hasCdkAutoDeleteTag, Pi as WARM_THROUGHPUT_MEMBERS, Q as getNestedRevertRun, Qi as withRetry, Qt as acquireIdempotencyToken, Ri as toFiniteNumber, S as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Sa as redactSecretsForState, Sn as isWaitAbandonedError, Ss as renderAssemblyPathEscape, T as deleteBudgetKey, Ti as withoutSilentDropProperties, Tn as ec2InstanceProtectionSite, Ui as configStringRefusal, Vi as configBooleanRefusal, Wi as readConfigString, Xn as s3BucketRegionalDomainName, Xt as reserveStackCreateToken, Yn as s3BucketDualStackDomainName, Zn as s3BucketWebsiteUrl, _n as unchangedBehindSecretReference, an as tagPlanWarning, bn as deleteSkipReason, bs as describeFileReadFailure, di as refuseMalformedResourcesForDestroy, dr as parseWebACLArn, ea as canonicalLambdaFunctionName, en as DBPROXY_TAG_OPTIONS, et as revertNestedChildFromJournal, f as getPriorAttempts, hn as slowCcOperationTimeoutMs, ht as getCurrentProducerRegions, in as tagMapAsList, it as withNestedStackContext, j as waitForIndexesSettled, k as INDEX_SETTLE_POLL_INTERVAL_MS, kn as reEnableInstanceApiTermination, ls as canonicalizeRegion, lt as getStackRecords, na as sameLambdaFunctionAddress, nn as readTagList, no as stringifyValue, on as definedAttributes, os as decodeListingKey, p as markRefusedBeforeApplying, pn as getCurrentResourceSecrets, qi as requireConfigObject, qn as s3BucketArn, rn as refuseMalformedDesiredTags, rt as getCurrentNestedStackContext, sn as stringifyIfAssigned, so as rewriteTemplateAssetReferences, st as awaitInFlightSibling, t as DeployEngine, ta as lambdaFunctionNameForMask, tn as planTagDiff, tr as getAccountInfo, ua as hasMaskableValues, us as derivePartitionAndUrlSuffix, w as compensateRemovedDeletionProtection, wa as recoverMaskedOutput, wi as findSilentDropProperties, x as DynamoDBGlobalTableProvider, xa as markSameGenerationBag, xn as withIndeterminateGuard, xs as displayAssemblyPath, zi as coerceCfnBoolean } from "./deploy-engine-C5kAhscq.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CPn7nqoS.js";
-import { a as canonicalizeIpProtocolValue, c as isAbsoluteAssetPath, i as resolveSecretDerivedPrincipals, l as listNestedTemplateRows, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, s as findNestedTemplateTreeDefect, t as canonicalizeIpv4Cidr, u as renderNestedTemplateTreeDefect } from "./program-CVOLJJ2z.js";
-import { RDSProvider } from "./rds-provider-a-vZsR9L.js";
-import { NeptuneProvider } from "./neptune-provider-DlFQdgwe.js";
-import { ASGProvider } from "./asg-provider-CsajFK4_.js";
+import { $i as requireConfigObject, $n as s3BucketDomainName, $t as earliestDefined, A as ECR_AUTO_DELETE_IMAGES_TAG, Aa as recoverMaskedOutput, An as ec2InstanceProtectionSite, As as renderAssemblyPathEscape, At as redactedDeleteAddressSkip, Bi as WARM_THROUGHPUT_MEMBERS, C as deleteBudgetKey, D as INDEX_SETTLE_POLL_INTERVAL_MS, Da as markSameGenerationBag, Dn as isWaitAbandonedError, Dt as REDACTED_DELETE_ADDRESS_SKIP_REASON, E as DELETE_INDEX_WAIT_PROCEED_NOTE, En as withIndeterminateGuard, F as markRefusedBeforeApplying, Gi as coerceCfnBoolean, Hi as isWarmThroughputDecrease, Ia as carriesSecretMask, Ji as configIntegerRefusal, Ki as coerceCfnInteger, M as hasCdkAutoDeleteTag, Ma as dynamicReferenceTokens, Mn as observeThenDisableInstanceApiTermination, N as isTruthyCfnBoolean, Nn as reDisableInstanceApiTermination, O as deleteTableWithIndexBusyRetry, Oa as redactSecretsForState, On as markWaitAbandoned, Os as describeFileReadFailure, Ot as isRedactedRecordedValue, P as getPriorAttempts, Pn as reEnableInstanceApiTermination, Q as getNestedRevertRun, Qi as requireConfigArray, Qn as s3BucketArn, S as compensateRemovedDeletionProtection, Sn as unchangedBehindSecretReference, T as resolveDynamoDbDeleteBudgetMs, Tn as deleteSkipReason, Ui as toCfnInteger, Vi as coerceWarmThroughput$1, Wi as toFiniteNumber, Xi as readConfigString, Yi as configStringRefusal, Zi as replayWarn, Zn as isSettledInstanceState, Zr as refuseMalformedNestedChildOutputs, _s as canonicalizeRegion, aa as markAuxiliaryFailure, an as DBPROXY_TAG_OPTIONS, b as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, bn as slowCcOperationTimeoutMs, ca as sameLambdaFunctionAddress, cn as refuseMalformedDesiredTags, dn as definedAttributes, ea as requireConfigString, er as s3BucketDualStackDomainName, et as revertNestedChildFromJournal, fn as stringifyIfAssigned, ga as hasMaskableValues, gi as refuseMalformedResourcesForDestroy, gr as parseWebACLArn, gt as getCurrentProducerRegions, ho as rewriteTemplateAssetReferences, ia as withRetry, in as DBPROXY_TAGS_WHAT, it as withNestedStackContext, j as S3_AUTO_DELETE_OBJECTS_TAG, ji as withoutSilentDropProperties, jn as isTerminationProtectionPropagationError, js as resolveAssemblyPath, k as waitForIndexesSettled, ki as findSilentDropProperties, ks as displayAssemblyPath, kt as redactedDeleteAddressFields, ln as tagMapAsList, lt as getStackRecords, ms as decodeListingKey, nr as s3BucketWebsiteUrl, oa as canonicalLambdaFunctionName, on as planTagDiff, or as getAccountInfo, qi as configBooleanRefusal, rn as acquireIdempotencyToken, rt as getCurrentNestedStackContext, sa as lambdaFunctionNameForMask, sn as readTagList, st as awaitInFlightSibling, t as DeployEngine, tn as reserveStackCreateToken, tr as s3BucketRegionalDomainName, un as tagPlanWarning, uo as stringifyValue, vn as getCurrentResourceSecrets, vs as derivePartitionAndUrlSuffix, w as resolveDynamoDbDeleteBudgetClock, x as beginDeleteWait, y as DynamoDBGlobalTableProvider } from "./deploy-engine-RCOtmm4V.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-2w-Hr9_h.js";
+import { a as canonicalizeIpProtocolValue, c as isAbsoluteAssetPath, i as resolveSecretDerivedPrincipals, l as listNestedTemplateRows, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, s as findNestedTemplateTreeDefect, t as canonicalizeIpv4Cidr, u as renderNestedTemplateTreeDefect } from "./program-Eed63bId.js";
+import { RDSProvider } from "./rds-provider-DqHELwjV.js";
+import { NeptuneProvider } from "./neptune-provider-CHnIs1hG.js";
+import { ASGProvider } from "./asg-provider-BFlmarbF.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -39,13 +39,13 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCo
 import * as zlib from "node:zlib";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
-import { AlreadyExistsException, ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
@@ -57,36 +57,11 @@ import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliv
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$13, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
 
-//#region src/provisioning/redacted-delete-address.ts
-function isRedactedRecordedValue(value) {
-	if (carriesSecretMask(value)) return true;
-	let text;
-	try {
-		text = typeof value === "string" ? value : JSON.stringify(value);
-	} catch {
-		return false;
-	}
-	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
-}
-const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
-function redactedDeleteAddressFields(fields) {
-	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
-}
-function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
-	if (redactedFields.length === 0) return void 0;
-	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
-	return {
-		outcome: "skipped",
-		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
-	};
-}
-
-//#endregion
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
 const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no delete issued";
@@ -15388,7 +15363,7 @@ var EC2Provider = class {
 		if (input.knownPhysicalId) return this.verifyExplicit(input.logicalId, input.resourceType, input.knownPhysicalId, input.properties ?? {});
 		return null;
 	}
-	async readCurrentState(physicalId, logicalId, resourceType, properties) {
+	async readCurrentState(physicalId, logicalId, resourceType, properties, context) {
 		try {
 			switch (resourceType) {
 				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
@@ -15399,10 +15374,11 @@ var EC2Provider = class {
 				case "AWS::EC2::SecurityGroup": return await this.readSecurityGroupCurrentState(physicalId, properties);
 				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId);
 				case "AWS::EC2::NetworkAcl": return await this.readNetworkAclCurrentState(physicalId);
+				case "AWS::EC2::EIP": return await this.readEipCurrentState(physicalId, properties, context?.afterOwnWrite === true);
 				case "AWS::EC2::VPCGatewayAttachment": return await this.readVpcGatewayAttachmentCurrentState(physicalId);
 				case "AWS::EC2::Route": return await this.readRouteCurrentState(physicalId);
 				case "AWS::EC2::SubnetRouteTableAssociation": return await this.readSubnetRouteTableAssociationCurrentState(physicalId);
-				case "AWS::EC2::SecurityGroupIngress": return await this.readSecurityGroupIngressCurrentState(physicalId, properties);
+				case "AWS::EC2::SecurityGroupIngress": return await this.readSecurityGroupIngressCurrentState(physicalId, properties, context);
 				case "AWS::EC2::NetworkAclEntry": return await this.readNetworkAclEntryCurrentState(physicalId);
 				case "AWS::EC2::SubnetNetworkAclAssociation": return await this.readSubnetNetworkAclAssociationCurrentState(physicalId);
 				default:
@@ -15488,6 +15464,22 @@ var EC2Provider = class {
 		if (primary?.PrivateIp !== void 0) result["PrivateIpAddress"] = primary.PrivateIp;
 		return result;
 	}
+	async readEipCurrentState(physicalId, properties, afterOwnWrite) {
+		const { allocationId, publicIp } = this.parseEipPhysicalId(physicalId);
+		if (!allocationId && !publicIp) return void 0;
+		const addr = (await this.ec2Client.send(new DescribeAddressesCommand(allocationId ? { AllocationIds: [allocationId] } : { PublicIps: [publicIp] }))).Addresses?.find((a) => allocationId ? a.AllocationId === allocationId : a.PublicIp === publicIp);
+		if (!addr) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (addr.Domain !== void 0) result["Domain"] = addr.Domain;
+		if (addr.InstanceId !== void 0 && properties?.["InstanceId"] != null) result["InstanceId"] = addr.InstanceId;
+		if (addr.NetworkBorderGroup !== void 0) result["NetworkBorderGroup"] = addr.NetworkBorderGroup;
+		if (addr.PublicIpv4Pool !== void 0) result["PublicIpv4Pool"] = addr.PublicIpv4Pool;
+		const tags = normalizeAwsTagsToCfn(addr.Tags);
+		const declared = properties?.["Tags"];
+		const bag = afterOwnWrite && Array.isArray(declared) && !tagListsMatch(tags, declared) ? declared : tags;
+		if (bag.length > 0) result["Tags"] = bag;
+		return result;
+	}
 	async readRouteTableCurrentState(physicalId) {
 		const rt = (await this.ec2Client.send(new DescribeRouteTablesCommand({ RouteTableIds: [physicalId] }))).RouteTables?.[0];
 		if (!rt) return RESOURCE_NOT_FOUND;
@@ -15657,7 +15649,7 @@ var EC2Provider = class {
 		}
 		return RESOURCE_NOT_FOUND;
 	}
-	async readSecurityGroupIngressCurrentState(physicalId, properties) {
+	async readSecurityGroupIngressCurrentState(physicalId, properties, context) {
 		const parts = physicalId.split("|");
 		if (parts.length < 4) return void 0;
 		const groupId = parts[0];
@@ -15678,13 +15670,50 @@ var EC2Provider = class {
 				GroupId: groupId,
 				...match
 			};
-			return;
+			const fallback = await this.readSgIngressByIdentity(groupId, flat, properties, context);
+			return fallback === void 0 ? void 0 : {
+				GroupId: groupId,
+				...fallback
+			};
 		}
 		return {
 			GroupId: groupId,
 			...flat[0]
 		};
 	}
+	async readSgIngressByIdentity(groupId, flat, properties, context) {
+		if (context?.afterOwnWrite === true) return void 0;
+		const recordedId = recordedSgRuleId(context?.attributes);
+		if (recordedId === void 0) return void 0;
+		if (!Number.isFinite(cfnIngressPortValue(properties["FromPort"])) || !Number.isFinite(cfnIngressPortValue(properties["ToPort"]))) return;
+		const identity = (rule) => {
+			const key = JSON.parse(sgRuleKey(rule, "ingress"));
+			delete key["d"];
+			if (properties["SourceSecurityGroupOwnerId"] == null) delete key["peerOwner"];
+			key["f"] = cfnIngressPortValue(rule["FromPort"]);
+			key["t"] = cfnIngressPortValue(rule["ToPort"]);
+			return JSON.stringify(key);
+		};
+		const wanted = identity(properties);
+		const matches = flat.filter((r) => identity(r) === wanted);
+		if (matches.length !== 1) return void 0;
+		const match = matches[0];
+		const siblings = Object.entries(context?.siblings ?? {});
+		if (stackIngressRuleHolder(siblings, "", groupId, properties) !== void 0 || siblings.some(([, sibling]) => sibling.resourceType === "AWS::EC2::SecurityGroupIngress" && recordedSgRuleId(sibling.attributes) === recordedId)) return;
+		let owned;
+		try {
+			owned = (await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({ SecurityGroupRuleIds: [recordedId] }))).SecurityGroupRules?.find((r) => r.SecurityGroupRuleId === recordedId);
+		} catch (err) {
+			this.logger.debug(safeMsg`readCurrentState: recorded rule ${recordedId} could not be read (${describeAwsFailure(err).summary}); the ingress rule stays unknown`);
+			return;
+		}
+		if (owned === void 0 || owned.IsEgress === true || owned.GroupId !== groupId || !securityGroupRuleMatchesCfnIngress(owned, properties) || descriptionKey(owned.Description) !== descriptionKey(match["Description"])) return;
+		return {
+			...match,
+			...properties["FromPort"] != null && { FromPort: properties["FromPort"] },
+			...properties["ToPort"] != null && { ToPort: properties["ToPort"] }
+		};
+	}
 	async readNetworkAclEntryCurrentState(physicalId) {
 		const parts = physicalId.split("|");
 		if (parts.length < 3) return void 0;
@@ -16061,6 +16090,15 @@ function stackIngressRuleHolder(records, selfLogicalId, groupId, rule, idCheck)
 		}
 	}
 }
+function tagListsMatch(live, declared) {
+	const pairs = (list) => list.every((entry) => isPlainRecord$1(entry) && typeof entry["Key"] === "string") ? list.map((entry) => {
+		const tag = entry;
+		return JSON.stringify([tag["Key"], tag["Value"] ?? ""]);
+	}).sort() : void 0;
+	const a = pairs(live);
+	const b = pairs(declared);
+	return a !== void 0 && b !== void 0 && JSON.stringify(a) === JSON.stringify(b);
+}
 function isPlainRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -20616,6 +20654,11 @@ function wasMeaningfullyConfigured(value, discriminatorKey) {
 
 //#endregion
 //#region src/provisioning/providers/ecs-provider.ts
+const registerTaskDefinitionLatch = new AmbiguousCreateLatch("ecs:RegisterTaskDefinition");
+const taskDefinitionsRegisteredByThisProcess = new RecentIdSet();
+function familyOfTaskDefinitionArn(arn) {
+	return /:task-definition\/(.+):\d+$/.exec(arn)?.[1];
+}
 function convertTags(tags) {
 	if (tags.length === 0) return void 0;
 	return tags.map((t) => ({
@@ -20686,6 +20729,7 @@ function isEcsErrorNamed(error, names) {
 const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 var ECSProvider = class {
 	ecsClient;
+	taskDefinitionCreateClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ECSProvider");
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::ECS::Service", /* @__PURE__ */ new Map([
@@ -20764,6 +20808,65 @@ var ECSProvider = class {
 		});
 		return this.ecsClient;
 	}
+	getTaskDefinitionCreateClient() {
+		if (!this.taskDefinitionCreateClient) this.taskDefinitionCreateClient = withoutServerErrorRetries(new ECSClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.taskDefinitionCreateClient;
+	}
+	async reportPossibleOrphanTaskDefinitions(logicalId, family, window, log) {
+		const client = this.getClient();
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(client, aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "RegisterTaskDefinition",
+			service: "ECS",
+			listAction: "ListTaskDefinitions",
+			subject: `a revision of task definition family ${log.value(family)}`,
+			noun: "task definition revision(s)",
+			list: async () => {
+				const ids = [];
+				let nextToken;
+				let pages = 0;
+				do {
+					const page = await client.send(new ListTaskDefinitionsCommand({
+						familyPrefix: family,
+						status: "ACTIVE",
+						sort: "DESC",
+						...nextToken && { nextToken }
+					}));
+					pages++;
+					for (const arn of page.taskDefinitionArns ?? []) {
+						if (familyOfTaskDefinitionArn(arn) !== family) continue;
+						let registeredAt;
+						let active = true;
+						try {
+							const described = await client.send(new DescribeTaskDefinitionCommand({ taskDefinition: arn }));
+							registeredAt = described.taskDefinition?.registeredAt;
+							active = (described.taskDefinition?.status ?? "ACTIVE") === "ACTIVE";
+						} catch (error) {
+							if (isTaskDefinitionMissingError(error)) continue;
+							throw error;
+						}
+						if (registeredAt === void 0 || registeredAt.getTime() < window.floorMs) return {
+							ids,
+							truncated: false
+						};
+						if (active && isInsideWindow(registeredAt, window) && !taskDefinitionsRegisteredByThisProcess.has(arn)) ids.push(arn);
+					}
+					nextToken = page.nextToken;
+				} while (nextToken && pages < 20);
+				return {
+					ids,
+					truncated: Boolean(nextToken)
+				};
+			},
+			inspect: (arn) => aws`aws ecs describe-task-definition --task-definition ${arn}${regionArg}`.render(),
+			remove: (arn) => aws`aws ecs deregister-task-definition --task-definition ${arn}${regionArg}`.render(),
+			removeVerb: "deregister it"
+		});
+	}
 	wrapMaskedError(log, error, build) {
 		const raw = error instanceof Error ? error.message : String(error);
 		const masked = log.mask(raw);
@@ -20915,28 +21018,39 @@ var ECSProvider = class {
 	async createTaskDefinition(logicalId, resourceType, properties, log) {
 		log.debug(`Creating ECS task definition ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const client = this.getClient();
+		const family = properties["Family"] || generateResourceName(logicalId, { maxLength: 255 });
 		try {
-			const taskDef = (await client.send(new RegisterTaskDefinitionCommand({
-				family: properties["Family"] || generateResourceName(logicalId, { maxLength: 255 }),
-				containerDefinitions: this.convertContainerDefinitions(properties["ContainerDefinitions"]),
-				cpu: properties["Cpu"],
-				memory: properties["Memory"],
-				networkMode: properties["NetworkMode"],
-				requiresCompatibilities: properties["RequiresCompatibilities"],
-				executionRoleArn: properties["ExecutionRoleArn"],
-				taskRoleArn: properties["TaskRoleArn"],
-				volumes: this.convertVolumes(properties["Volumes"]),
-				placementConstraints: this.convertTaskDefinitionPlacementConstraints(properties["PlacementConstraints"]),
-				tags: convertTags(desiredTags),
-				runtimePlatform: this.convertRuntimePlatform(properties["RuntimePlatform"]),
-				proxyConfiguration: this.convertProxyConfiguration(properties["ProxyConfiguration"]),
-				pidMode: properties["PidMode"],
-				ipcMode: properties["IpcMode"],
-				ephemeralStorage: this.convertEphemeralStorage(properties["EphemeralStorage"]),
-				enableFaultInjection: properties["EnableFaultInjection"]
-			}))).taskDefinition;
+			const orphanWindow = registerTaskDefinitionLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanTaskDefinitions(logicalId, family, orphanWindow, log);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await this.getTaskDefinitionCreateClient().send(new RegisterTaskDefinitionCommand({
+					family,
+					containerDefinitions: this.convertContainerDefinitions(properties["ContainerDefinitions"]),
+					cpu: properties["Cpu"],
+					memory: properties["Memory"],
+					networkMode: properties["NetworkMode"],
+					requiresCompatibilities: properties["RequiresCompatibilities"],
+					executionRoleArn: properties["ExecutionRoleArn"],
+					taskRoleArn: properties["TaskRoleArn"],
+					volumes: this.convertVolumes(properties["Volumes"]),
+					placementConstraints: this.convertTaskDefinitionPlacementConstraints(properties["PlacementConstraints"]),
+					tags: convertTags(desiredTags),
+					runtimePlatform: this.convertRuntimePlatform(properties["RuntimePlatform"]),
+					proxyConfiguration: this.convertProxyConfiguration(properties["ProxyConfiguration"]),
+					pidMode: properties["PidMode"],
+					ipcMode: properties["IpcMode"],
+					ephemeralStorage: this.convertEphemeralStorage(properties["EphemeralStorage"]),
+					enableFaultInjection: properties["EnableFaultInjection"]
+				}));
+			} catch (error) {
+				registerTaskDefinitionLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			const taskDef = response.taskDefinition;
 			if (!taskDef || !taskDef.taskDefinitionArn) throw new Error("RegisterTaskDefinition did not return task definition ARN");
+			taskDefinitionsRegisteredByThisProcess.add(taskDef.taskDefinitionArn);
 			log.debug(`Successfully created ECS task definition ${logicalId}: ${taskDef.taskDefinitionArn}`);
 			return {
 				physicalId: taskDef.taskDefinitionArn,
@@ -28554,6 +28668,8 @@ const createGraphqlApiLatch = new AmbiguousCreateLatch("CreateGraphqlApi");
 const graphqlApisCreatedByThisProcess = new RecentIdSet();
 const MAX_GRAPHQL_API_LIST_PAGES = 40;
 const MAX_REPORTED_ORPHAN_APIS = 5;
+const createApiKeyLatch = new AmbiguousCreateLatch("CreateApiKey");
+const apiKeysCreatedByThisProcess = new RecentIdSet();
 const APPSYNC_DATASOURCE_ID_FORMAT = {
 	label: "AppSync DataSource",
 	segments: ["apiId", "name"]
@@ -29755,7 +29871,18 @@ var AppSyncProvider = class {
 			const input = { apiId };
 			if (properties["Description"]) input.description = properties["Description"];
 			if (properties["Expires"]) input.expires = properties["Expires"];
-			apiKeyId = (await this.getClient().send(new CreateApiKeyCommand(input))).apiKey.id;
+			const orphanWindow = createApiKeyLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanApiKeys(logicalId, input, orphanWindow, createMaskedLogSinks(this.logger, context?.maskSecrets));
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await this.getCreateClient().send(new CreateApiKeyCommand(input));
+			} catch (error) {
+				createApiKeyLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			apiKeyId = response.apiKey.id;
+			apiKeysCreatedByThisProcess.add(injectiveKey(apiId, apiKeyId));
 			this.logger.debug(`Successfully created ApiKey ${logicalId}: ${apiKeyId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -29780,6 +29907,31 @@ var AppSyncProvider = class {
 			}
 		};
 	}
+	async reportPossibleOrphanApiKeys(logicalId, input, window, log) {
+		const apiId = String(input.apiId);
+		const description = input.description ?? "";
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "CreateApiKey",
+			service: "AppSync",
+			listAction: "ListApiKeys",
+			subject: `an API key on GraphQL API ${log.value(apiId)}${description === "" ? "" : ` described ${log.value(description)}`}`,
+			noun: "API key(s)",
+			list: () => collectOrphanIds(async (nextToken) => {
+				const page = await this.getClient().send(new ListApiKeysCommand({
+					apiId,
+					maxResults: 25,
+					...nextToken && { nextToken }
+				}));
+				return {
+					items: page.apiKeys ?? [],
+					next: page.nextToken
+				};
+			}, (key) => key.id && (key.description ?? "") === description && !apiKeysCreatedByThisProcess.has(injectiveKey(apiId, key.id)) ? `****${key.id.slice(-4)}${key.expires === void 0 || !Number.isFinite(key.expires) ? "" : ` (expires ${(/* @__PURE__ */ new Date(key.expires * 1e3)).toISOString()})`}` : void 0),
+			inspect: () => aws`aws appsync list-api-keys --api-id ${apiId}${regionArg}`.render()
+		});
+	}
 	async deleteApiKey(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting ApiKey ${logicalId}: ${physicalId}`);
 		const [apiId, apiKeyId] = physicalId.split("|");
@@ -30526,7 +30678,6 @@ var GlueProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			if (error instanceof AlreadyExistsException) throw markNonRetryable(new ProvisioningError(`Failed to create Glue Table ${logicalId}: a table named '${v(tableName)}' is present in database '${v(databaseName)}' (${describeCatalog(catalogId, log.mask)}), so cdkd did not create it and left that table untouched. Choose a TableInput.Name no table holds, or remove that table yourself if it is unwanted. If it is the table this resource already manages, the planned replacement keeps its address: revert the change that planned it.`, resourceType, logicalId, void 0, error));
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create Glue Table ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
@@ -39466,6 +39617,7 @@ function readRepoList(kind, value, side) {
 }
 var CodeCommitRepositoryProvider = class {
 	client;
+	createClient;
 	s3Client;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("CodeCommitRepositoryProvider");
@@ -39485,6 +39637,13 @@ var CodeCommitRepositoryProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new CodeCommitClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
@@ -39513,7 +39672,7 @@ var CodeCommitRepositoryProvider = class {
 			const tags = toSdkTagMap(lists.Tags);
 			const description = properties["RepositoryDescription"];
 			const kmsKeyId = properties["KmsKeyId"];
-			const metadata = (await this.getClient().send(new CreateRepositoryCommand$1({
+			const metadata = (await this.getCreateClient().send(new CreateRepositoryCommand$1({
 				repositoryName,
 				...description !== void 0 ? { repositoryDescription: description } : {},
 				...kmsKeyId !== void 0 ? { kmsKeyId } : {},
@@ -39861,7 +40020,7 @@ var CodeCommitRepositoryProvider = class {
 			this.logger.warn(`Code.S3 object s3://${bucket}/${key} contained no files; skipping seed commit for ${repositoryName}`);
 			return;
 		}
-		await this.getClient().send(new CreateCommitCommand({
+		await this.getCreateClient().send(new CreateCommitCommand({
 			repositoryName,
 			branchName,
 			commitMessage: "Initial commit",
@@ -39883,8 +40042,11 @@ var CodeCommitRepositoryProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+const createLifecyclePolicyLatch = new AmbiguousCreateLatch("dlm:CreateLifecyclePolicy");
+const policiesCreatedByThisProcess = new RecentIdSet();
 var DLMLifecyclePolicyProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("DLMLifecyclePolicyProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
@@ -39908,6 +40070,53 @@ var DLMLifecyclePolicyProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new DLMClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
+	async reportPossibleOrphanPolicies(logicalId, input, window, log) {
+		const description = input.Description ?? "";
+		const isDefault = input.DefaultPolicy != null;
+		const kind = isDefault ? "a default lifecycle policy" : "a lifecycle policy";
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "CreateLifecyclePolicy",
+			service: "DLM",
+			listAction: "GetLifecyclePolicies",
+			subject: description === "" ? `${kind} with no description` : `${kind} described ${log.value(description)}`,
+			noun: "lifecycle policy(ies)",
+			list: async () => {
+				const page = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
+				const ids = [];
+				for (const summary of page.Policies ?? []) {
+					const id = summary.PolicyId;
+					if (!id || (summary.Description ?? "") !== description || summary.DefaultPolicy === true !== isDefault || policiesCreatedByThisProcess.has(id)) continue;
+					let created;
+					let defaultType;
+					try {
+						const detail = await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: id }));
+						created = detail.Policy?.DateCreated;
+						defaultType = detail.Policy?.PolicyDetails?.ResourceType;
+					} catch (error) {
+						if (error instanceof ResourceNotFoundException$14) continue;
+						throw error;
+					}
+					if (isDefault && defaultType !== void 0 && defaultType !== input.DefaultPolicy) continue;
+					if (isInsideWindow(created, window)) ids.push(id);
+				}
+				return {
+					ids,
+					truncated: false
+				};
+			},
+			inspect: (id) => aws`aws dlm get-lifecycle-policy --policy-id ${id}${regionArg}`.render(),
+			remove: (id) => aws`aws dlm delete-lifecycle-policy --policy-id ${id}${regionArg}`.render()
+		});
+	}
 	toSdkFields(properties) {
 		return {
 			...properties["ExecutionRoleArn"] != null && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
@@ -39949,23 +40158,34 @@ var DLMLifecyclePolicyProvider = class {
 	async fetchPolicyArn(policyId) {
 		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating DLM Lifecycle Policy ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		try {
 			const tags = desiredTags.length > 0 ? Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value])) : void 0;
 			const input = {
 				...this.toSdkFields(properties),
-				...properties["DefaultPolicy"] !== void 0 && { DefaultPolicy: properties["DefaultPolicy"] },
+				...properties["DefaultPolicy"] != null && { DefaultPolicy: properties["DefaultPolicy"] },
 				...tags && { Tags: tags }
 			};
-			const response = await this.getClient().send(new CreateLifecyclePolicyCommand(input));
+			const orphanWindow = createLifecyclePolicyLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanPolicies(logicalId, input, orphanWindow, log);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await this.getCreateClient().send(new CreateLifecyclePolicyCommand(input));
+			} catch (error) {
+				createLifecyclePolicyLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
 			if (!response.PolicyId) throw new Error("CreateLifecyclePolicy did not return a PolicyId");
+			policiesCreatedByThisProcess.add(response.PolicyId);
 			let arn = "";
 			try {
 				arn = await this.fetchPolicyArn(response.PolicyId);
 			} catch (err) {
-				this.logger.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${describeAwsFailure(err).detail}`);
+				log.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${log.value(describeAwsFailure(err).detail)}`);
 			}
 			this.logger.debug(`Successfully created DLM Lifecycle Policy ${logicalId}: ${response.PolicyId}`);
 			return {
@@ -42163,4 +42383,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DlVxBF89.js.map
+//# sourceMappingURL=provider-classes-R7yvwymx.js.map