@go-to-k/cdkd 0.294.9 → 0.294.10

package/dist/{provider-classes-DCbt28RB.js → provider-classes-R7yvwymx.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-B46YMG0h.js";
 import { $ as compositeIdFormatMessage, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, Ct as injectiveKeyPrefix, D as ProtectionFlipRegistry, Dn as markNameCollision, Dt as withPasteableAwsProfile, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, J as isInterruptedWaitError, Jt as ProvisioningError, L as userPoolProtectionSite, Ln as isAwsAuthoredFailure, M as observeThenDisableProtection, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, On as markReplayMayCollide, Ot as ambientClientDefaults, P as rdsFamilyProtectionSite, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, Rn as safeStringify, S as quotedRemedyLogicalId, St as injectiveKey, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as markRedactedCause, V as isAwsCliLiteral, Vn as isThrottlingError, W as renderDisableCommand, Wn as wrapMaskedAwsError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, _ as VALUE_NOT_SHOWN, _n as shellQuote, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, c as recordedPrincipalsRepair, ct as isSecretDerivedValue, dn as isInertUnquoted, dt as withDerivedNameMasks, et as compositeIdSeparatorRefusal, fn as pasteableCommand, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, j as logGroupProtectionSite, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kt as ambientCredentialConfig, ln as commandHole, lt as maskDeep, mn as plainOrDescribed, nt as logicalIdShown, o as readPrincipalLists, ot as createMaskedLogSinks, p as withRemovalDefaults, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedRetryLogger, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, un as hasClauseBreak, ut as maskerOrIdentity, v as isPlainImportJson, vn as withheldTargetClause, w as remedyLogicalId, x as normalizeAwsTagsToCfn, y as isPlainImportValue, z as UNNAMEABLE_ID_CLAUSE, zn as THROTTLING_ERROR_NAMES } from "./iam-policy-targets-CMSQGQnm.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $t as acquireIdempotencyToken, A as ECR_AUTO_DELETE_IMAGES_TAG, An as reEnableInstanceApiTermination, Bi as toFiniteNumber, C as deleteBudgetKey, Ca as markSameGenerationBag, Cn as isWaitAbandonedError, D as INDEX_SETTLE_POLL_INTERVAL_MS, Di as withoutSilentDropProperties, Dn as isTerminationProtectionPropagationError, Ds as resolveAssemblyPath, E as DELETE_INDEX_WAIT_PROCEED_NOTE, Ea as recoverMaskedOutput, En as ec2InstanceProtectionSite, Es as renderAssemblyPathEscape, F as markRefusedBeforeApplying, Gi as configStringRefusal, Hi as coerceCfnInteger, Ii as WARM_THROUGHPUT_MEMBERS, Ji as requireConfigArray, Jn as s3BucketArn, Ki as readConfigString, Li as coerceWarmThroughput$1, M as hasCdkAutoDeleteTag, Ma as carriesSecretMask, N as isTruthyCfnBoolean, O as deleteTableWithIndexBusyRetry, Oa as dynamicReferenceTokens, On as observeThenDisableInstanceApiTermination, P as getPriorAttempts, Q as getNestedRevertRun, Qn as s3BucketWebsiteUrl, Ri as isWarmThroughputDecrease, S as compensateRemovedDeletionProtection, Sn as withIndeterminateGuard, T as resolveDynamoDbDeleteBudgetMs, Ti as findSilentDropProperties, Ts as displayAssemblyPath, Ui as configBooleanRefusal, Vi as coerceCfnBoolean, Wi as configIntegerRefusal, Xi as requireConfigString, Xn as s3BucketDualStackDomainName, Yi as requireConfigObject, Yn as s3BucketDomainName, Yt as earliestDefined, Zn as s3BucketRegionalDomainName, Zt as reserveStackCreateToken, an as tagMapAsList, b as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, cn as stringifyIfAssigned, do as rewriteTemplateAssetReferences, ea as withRetry, en as DBPROXY_TAGS_WHAT, et as revertNestedChildFromJournal, fa as hasMaskableValues, fi as refuseMalformedResourcesForDestroy, fr as parseWebACLArn, gn as slowCcOperationTimeoutMs, gt as getCurrentProducerRegions, ia as sameLambdaFunctionAddress, in as refuseMalformedDesiredTags, it as withNestedStackContext, j as S3_AUTO_DELETE_OBJECTS_TAG, k as waitForIndexesSettled, kn as reDisableInstanceApiTermination, lt as getStackRecords, mn as getCurrentResourceSecrets, ms as derivePartitionAndUrlSuffix, na as canonicalLambdaFunctionName, nn as planTagDiff, nr as getAccountInfo, on as tagPlanWarning, oo as stringifyValue, ps as canonicalizeRegion, qi as replayWarn, qn as isSettledInstanceState, qr as refuseMalformedNestedChildOutputs, ra as lambdaFunctionNameForMask, rn as readTagList, rt as getCurrentNestedStackContext, sn as definedAttributes, st as awaitInFlightSibling, t as DeployEngine, ta as markAuxiliaryFailure, tn as DBPROXY_TAG_OPTIONS, us as decodeListingKey, vn as unchangedBehindSecretReference, w as resolveDynamoDbDeleteBudgetClock, wa as redactSecretsForState, wn as markWaitAbandoned, ws as describeFileReadFailure, x as beginDeleteWait, xn as deleteSkipReason, y as DynamoDBGlobalTableProvider, zi as toCfnInteger } from "./deploy-engine-BTOCDCWf.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CBT2LPe1.js";
-import { a as canonicalizeIpProtocolValue, c as isAbsoluteAssetPath, i as resolveSecretDerivedPrincipals, l as listNestedTemplateRows, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, s as findNestedTemplateTreeDefect, t as canonicalizeIpv4Cidr, u as renderNestedTemplateTreeDefect } from "./program-DMJnrQOG.js";
-import { RDSProvider } from "./rds-provider-J6zl27x3.js";
-import { NeptuneProvider } from "./neptune-provider-BQ-CGoYJ.js";
-import { ASGProvider } from "./asg-provider-3uLGAhIx.js";
+import { $i as requireConfigObject, $n as s3BucketDomainName, $t as earliestDefined, A as ECR_AUTO_DELETE_IMAGES_TAG, Aa as recoverMaskedOutput, An as ec2InstanceProtectionSite, As as renderAssemblyPathEscape, At as redactedDeleteAddressSkip, Bi as WARM_THROUGHPUT_MEMBERS, C as deleteBudgetKey, D as INDEX_SETTLE_POLL_INTERVAL_MS, Da as markSameGenerationBag, Dn as isWaitAbandonedError, Dt as REDACTED_DELETE_ADDRESS_SKIP_REASON, E as DELETE_INDEX_WAIT_PROCEED_NOTE, En as withIndeterminateGuard, F as markRefusedBeforeApplying, Gi as coerceCfnBoolean, Hi as isWarmThroughputDecrease, Ia as carriesSecretMask, Ji as configIntegerRefusal, Ki as coerceCfnInteger, M as hasCdkAutoDeleteTag, Ma as dynamicReferenceTokens, Mn as observeThenDisableInstanceApiTermination, N as isTruthyCfnBoolean, Nn as reDisableInstanceApiTermination, O as deleteTableWithIndexBusyRetry, Oa as redactSecretsForState, On as markWaitAbandoned, Os as describeFileReadFailure, Ot as isRedactedRecordedValue, P as getPriorAttempts, Pn as reEnableInstanceApiTermination, Q as getNestedRevertRun, Qi as requireConfigArray, Qn as s3BucketArn, S as compensateRemovedDeletionProtection, Sn as unchangedBehindSecretReference, T as resolveDynamoDbDeleteBudgetMs, Tn as deleteSkipReason, Ui as toCfnInteger, Vi as coerceWarmThroughput$1, Wi as toFiniteNumber, Xi as readConfigString, Yi as configStringRefusal, Zi as replayWarn, Zn as isSettledInstanceState, Zr as refuseMalformedNestedChildOutputs, _s as canonicalizeRegion, aa as markAuxiliaryFailure, an as DBPROXY_TAG_OPTIONS, b as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, bn as slowCcOperationTimeoutMs, ca as sameLambdaFunctionAddress, cn as refuseMalformedDesiredTags, dn as definedAttributes, ea as requireConfigString, er as s3BucketDualStackDomainName, et as revertNestedChildFromJournal, fn as stringifyIfAssigned, ga as hasMaskableValues, gi as refuseMalformedResourcesForDestroy, gr as parseWebACLArn, gt as getCurrentProducerRegions, ho as rewriteTemplateAssetReferences, ia as withRetry, in as DBPROXY_TAGS_WHAT, it as withNestedStackContext, j as S3_AUTO_DELETE_OBJECTS_TAG, ji as withoutSilentDropProperties, jn as isTerminationProtectionPropagationError, js as resolveAssemblyPath, k as waitForIndexesSettled, ki as findSilentDropProperties, ks as displayAssemblyPath, kt as redactedDeleteAddressFields, ln as tagMapAsList, lt as getStackRecords, ms as decodeListingKey, nr as s3BucketWebsiteUrl, oa as canonicalLambdaFunctionName, on as planTagDiff, or as getAccountInfo, qi as configBooleanRefusal, rn as acquireIdempotencyToken, rt as getCurrentNestedStackContext, sa as lambdaFunctionNameForMask, sn as readTagList, st as awaitInFlightSibling, t as DeployEngine, tn as reserveStackCreateToken, tr as s3BucketRegionalDomainName, un as tagPlanWarning, uo as stringifyValue, vn as getCurrentResourceSecrets, vs as derivePartitionAndUrlSuffix, w as resolveDynamoDbDeleteBudgetClock, x as beginDeleteWait, y as DynamoDBGlobalTableProvider } from "./deploy-engine-RCOtmm4V.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-2w-Hr9_h.js";
+import { a as canonicalizeIpProtocolValue, c as isAbsoluteAssetPath, i as resolveSecretDerivedPrincipals, l as listNestedTemplateRows, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, s as findNestedTemplateTreeDefect, t as canonicalizeIpv4Cidr, u as renderNestedTemplateTreeDefect } from "./program-Eed63bId.js";
+import { RDSProvider } from "./rds-provider-DqHELwjV.js";
+import { NeptuneProvider } from "./neptune-provider-CHnIs1hG.js";
+import { ASGProvider } from "./asg-provider-BFlmarbF.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -39,7 +39,7 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCo
 import * as zlib from "node:zlib";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
@@ -57,36 +57,11 @@ import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliv
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$13, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
 
-//#region src/provisioning/redacted-delete-address.ts
-function isRedactedRecordedValue(value) {
-	if (carriesSecretMask(value)) return true;
-	let text;
-	try {
-		text = typeof value === "string" ? value : JSON.stringify(value);
-	} catch {
-		return false;
-	}
-	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
-}
-const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
-function redactedDeleteAddressFields(fields) {
-	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
-}
-function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
-	if (redactedFields.length === 0) return void 0;
-	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
-	return {
-		outcome: "skipped",
-		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
-	};
-}
-
-//#endregion
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
 const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no delete issued";
@@ -20679,6 +20654,11 @@ function wasMeaningfullyConfigured(value, discriminatorKey) {
 
 //#endregion
 //#region src/provisioning/providers/ecs-provider.ts
+const registerTaskDefinitionLatch = new AmbiguousCreateLatch("ecs:RegisterTaskDefinition");
+const taskDefinitionsRegisteredByThisProcess = new RecentIdSet();
+function familyOfTaskDefinitionArn(arn) {
+	return /:task-definition\/(.+):\d+$/.exec(arn)?.[1];
+}
 function convertTags(tags) {
 	if (tags.length === 0) return void 0;
 	return tags.map((t) => ({
@@ -20749,6 +20729,7 @@ function isEcsErrorNamed(error, names) {
 const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 var ECSProvider = class {
 	ecsClient;
+	taskDefinitionCreateClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ECSProvider");
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::ECS::Service", /* @__PURE__ */ new Map([
@@ -20827,6 +20808,65 @@ var ECSProvider = class {
 		});
 		return this.ecsClient;
 	}
+	getTaskDefinitionCreateClient() {
+		if (!this.taskDefinitionCreateClient) this.taskDefinitionCreateClient = withoutServerErrorRetries(new ECSClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.taskDefinitionCreateClient;
+	}
+	async reportPossibleOrphanTaskDefinitions(logicalId, family, window, log) {
+		const client = this.getClient();
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(client, aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "RegisterTaskDefinition",
+			service: "ECS",
+			listAction: "ListTaskDefinitions",
+			subject: `a revision of task definition family ${log.value(family)}`,
+			noun: "task definition revision(s)",
+			list: async () => {
+				const ids = [];
+				let nextToken;
+				let pages = 0;
+				do {
+					const page = await client.send(new ListTaskDefinitionsCommand({
+						familyPrefix: family,
+						status: "ACTIVE",
+						sort: "DESC",
+						...nextToken && { nextToken }
+					}));
+					pages++;
+					for (const arn of page.taskDefinitionArns ?? []) {
+						if (familyOfTaskDefinitionArn(arn) !== family) continue;
+						let registeredAt;
+						let active = true;
+						try {
+							const described = await client.send(new DescribeTaskDefinitionCommand({ taskDefinition: arn }));
+							registeredAt = described.taskDefinition?.registeredAt;
+							active = (described.taskDefinition?.status ?? "ACTIVE") === "ACTIVE";
+						} catch (error) {
+							if (isTaskDefinitionMissingError(error)) continue;
+							throw error;
+						}
+						if (registeredAt === void 0 || registeredAt.getTime() < window.floorMs) return {
+							ids,
+							truncated: false
+						};
+						if (active && isInsideWindow(registeredAt, window) && !taskDefinitionsRegisteredByThisProcess.has(arn)) ids.push(arn);
+					}
+					nextToken = page.nextToken;
+				} while (nextToken && pages < 20);
+				return {
+					ids,
+					truncated: Boolean(nextToken)
+				};
+			},
+			inspect: (arn) => aws`aws ecs describe-task-definition --task-definition ${arn}${regionArg}`.render(),
+			remove: (arn) => aws`aws ecs deregister-task-definition --task-definition ${arn}${regionArg}`.render(),
+			removeVerb: "deregister it"
+		});
+	}
 	wrapMaskedError(log, error, build) {
 		const raw = error instanceof Error ? error.message : String(error);
 		const masked = log.mask(raw);
@@ -20978,28 +21018,39 @@ var ECSProvider = class {
 	async createTaskDefinition(logicalId, resourceType, properties, log) {
 		log.debug(`Creating ECS task definition ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const client = this.getClient();
+		const family = properties["Family"] || generateResourceName(logicalId, { maxLength: 255 });
 		try {
-			const taskDef = (await client.send(new RegisterTaskDefinitionCommand({
-				family: properties["Family"] || generateResourceName(logicalId, { maxLength: 255 }),
-				containerDefinitions: this.convertContainerDefinitions(properties["ContainerDefinitions"]),
-				cpu: properties["Cpu"],
-				memory: properties["Memory"],
-				networkMode: properties["NetworkMode"],
-				requiresCompatibilities: properties["RequiresCompatibilities"],
-				executionRoleArn: properties["ExecutionRoleArn"],
-				taskRoleArn: properties["TaskRoleArn"],
-				volumes: this.convertVolumes(properties["Volumes"]),
-				placementConstraints: this.convertTaskDefinitionPlacementConstraints(properties["PlacementConstraints"]),
-				tags: convertTags(desiredTags),
-				runtimePlatform: this.convertRuntimePlatform(properties["RuntimePlatform"]),
-				proxyConfiguration: this.convertProxyConfiguration(properties["ProxyConfiguration"]),
-				pidMode: properties["PidMode"],
-				ipcMode: properties["IpcMode"],
-				ephemeralStorage: this.convertEphemeralStorage(properties["EphemeralStorage"]),
-				enableFaultInjection: properties["EnableFaultInjection"]
-			}))).taskDefinition;
+			const orphanWindow = registerTaskDefinitionLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanTaskDefinitions(logicalId, family, orphanWindow, log);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await this.getTaskDefinitionCreateClient().send(new RegisterTaskDefinitionCommand({
+					family,
+					containerDefinitions: this.convertContainerDefinitions(properties["ContainerDefinitions"]),
+					cpu: properties["Cpu"],
+					memory: properties["Memory"],
+					networkMode: properties["NetworkMode"],
+					requiresCompatibilities: properties["RequiresCompatibilities"],
+					executionRoleArn: properties["ExecutionRoleArn"],
+					taskRoleArn: properties["TaskRoleArn"],
+					volumes: this.convertVolumes(properties["Volumes"]),
+					placementConstraints: this.convertTaskDefinitionPlacementConstraints(properties["PlacementConstraints"]),
+					tags: convertTags(desiredTags),
+					runtimePlatform: this.convertRuntimePlatform(properties["RuntimePlatform"]),
+					proxyConfiguration: this.convertProxyConfiguration(properties["ProxyConfiguration"]),
+					pidMode: properties["PidMode"],
+					ipcMode: properties["IpcMode"],
+					ephemeralStorage: this.convertEphemeralStorage(properties["EphemeralStorage"]),
+					enableFaultInjection: properties["EnableFaultInjection"]
+				}));
+			} catch (error) {
+				registerTaskDefinitionLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			const taskDef = response.taskDefinition;
 			if (!taskDef || !taskDef.taskDefinitionArn) throw new Error("RegisterTaskDefinition did not return task definition ARN");
+			taskDefinitionsRegisteredByThisProcess.add(taskDef.taskDefinitionArn);
 			log.debug(`Successfully created ECS task definition ${logicalId}: ${taskDef.taskDefinitionArn}`);
 			return {
 				physicalId: taskDef.taskDefinitionArn,
@@ -39566,6 +39617,7 @@ function readRepoList(kind, value, side) {
 }
 var CodeCommitRepositoryProvider = class {
 	client;
+	createClient;
 	s3Client;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("CodeCommitRepositoryProvider");
@@ -39585,6 +39637,13 @@ var CodeCommitRepositoryProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new CodeCommitClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
@@ -39613,7 +39672,7 @@ var CodeCommitRepositoryProvider = class {
 			const tags = toSdkTagMap(lists.Tags);
 			const description = properties["RepositoryDescription"];
 			const kmsKeyId = properties["KmsKeyId"];
-			const metadata = (await this.getClient().send(new CreateRepositoryCommand$1({
+			const metadata = (await this.getCreateClient().send(new CreateRepositoryCommand$1({
 				repositoryName,
 				...description !== void 0 ? { repositoryDescription: description } : {},
 				...kmsKeyId !== void 0 ? { kmsKeyId } : {},
@@ -39961,7 +40020,7 @@ var CodeCommitRepositoryProvider = class {
 			this.logger.warn(`Code.S3 object s3://${bucket}/${key} contained no files; skipping seed commit for ${repositoryName}`);
 			return;
 		}
-		await this.getClient().send(new CreateCommitCommand({
+		await this.getCreateClient().send(new CreateCommitCommand({
 			repositoryName,
 			branchName,
 			commitMessage: "Initial commit",
@@ -39983,8 +40042,11 @@ var CodeCommitRepositoryProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+const createLifecyclePolicyLatch = new AmbiguousCreateLatch("dlm:CreateLifecyclePolicy");
+const policiesCreatedByThisProcess = new RecentIdSet();
 var DLMLifecyclePolicyProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("DLMLifecyclePolicyProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
@@ -40008,6 +40070,53 @@ var DLMLifecyclePolicyProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new DLMClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
+	async reportPossibleOrphanPolicies(logicalId, input, window, log) {
+		const description = input.Description ?? "";
+		const isDefault = input.DefaultPolicy != null;
+		const kind = isDefault ? "a default lifecycle policy" : "a lifecycle policy";
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "CreateLifecyclePolicy",
+			service: "DLM",
+			listAction: "GetLifecyclePolicies",
+			subject: description === "" ? `${kind} with no description` : `${kind} described ${log.value(description)}`,
+			noun: "lifecycle policy(ies)",
+			list: async () => {
+				const page = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
+				const ids = [];
+				for (const summary of page.Policies ?? []) {
+					const id = summary.PolicyId;
+					if (!id || (summary.Description ?? "") !== description || summary.DefaultPolicy === true !== isDefault || policiesCreatedByThisProcess.has(id)) continue;
+					let created;
+					let defaultType;
+					try {
+						const detail = await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: id }));
+						created = detail.Policy?.DateCreated;
+						defaultType = detail.Policy?.PolicyDetails?.ResourceType;
+					} catch (error) {
+						if (error instanceof ResourceNotFoundException$14) continue;
+						throw error;
+					}
+					if (isDefault && defaultType !== void 0 && defaultType !== input.DefaultPolicy) continue;
+					if (isInsideWindow(created, window)) ids.push(id);
+				}
+				return {
+					ids,
+					truncated: false
+				};
+			},
+			inspect: (id) => aws`aws dlm get-lifecycle-policy --policy-id ${id}${regionArg}`.render(),
+			remove: (id) => aws`aws dlm delete-lifecycle-policy --policy-id ${id}${regionArg}`.render()
+		});
+	}
 	toSdkFields(properties) {
 		return {
 			...properties["ExecutionRoleArn"] != null && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
@@ -40049,23 +40158,34 @@ var DLMLifecyclePolicyProvider = class {
 	async fetchPolicyArn(policyId) {
 		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating DLM Lifecycle Policy ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		try {
 			const tags = desiredTags.length > 0 ? Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value])) : void 0;
 			const input = {
 				...this.toSdkFields(properties),
-				...properties["DefaultPolicy"] !== void 0 && { DefaultPolicy: properties["DefaultPolicy"] },
+				...properties["DefaultPolicy"] != null && { DefaultPolicy: properties["DefaultPolicy"] },
 				...tags && { Tags: tags }
 			};
-			const response = await this.getClient().send(new CreateLifecyclePolicyCommand(input));
+			const orphanWindow = createLifecyclePolicyLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanPolicies(logicalId, input, orphanWindow, log);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await this.getCreateClient().send(new CreateLifecyclePolicyCommand(input));
+			} catch (error) {
+				createLifecyclePolicyLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
 			if (!response.PolicyId) throw new Error("CreateLifecyclePolicy did not return a PolicyId");
+			policiesCreatedByThisProcess.add(response.PolicyId);
 			let arn = "";
 			try {
 				arn = await this.fetchPolicyArn(response.PolicyId);
 			} catch (err) {
-				this.logger.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${describeAwsFailure(err).detail}`);
+				log.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${log.value(describeAwsFailure(err).detail)}`);
 			}
 			this.logger.debug(`Successfully created DLM Lifecycle Policy ${logicalId}: ${response.PolicyId}`);
 			return {
@@ -42263,4 +42383,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DCbt28RB.js.map
+//# sourceMappingURL=provider-classes-R7yvwymx.js.map