@go-to-k/cdkd 0.296.1 → 0.296.2

package/dist/{provider-classes-DNkoEEo4.js → provider-classes-CtsCylnp.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-Dvc7ddKe.js";
 import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as dynamicReferenceTokens, $i as withoutSilentDropProperties, $n as reEnableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, An as definedAttributes, B as getPriorAttempts, Bo as rewriteTemplateAssetReferences, Bs as decodeListingKey, Cn as DBPROXY_TAGS_WHAT, Ct as getStackRecords, D as beginDeleteWait, Da as canonicalLambdaFunctionName, Dn as refuseMalformedDesiredTags, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as withRetry, En as readTagList, F as waitForIndexesSettled, Fo as stringifyValue, Fr as parseWebACLArn, Gn as withIndeterminateGuard, Gt as redactedDeleteAddressFields, I as ECR_AUTO_DELETE_IMAGES_TAG, Ja as markSameGenerationBag, Kn as isWaitAbandonedError, Kt as redactedDeleteAddressSkip, L as S3_AUTO_DELETE_OBJECTS_TAG, La as hasMaskableValues, Ln as getCurrentResourceSecrets, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mt as getCurrentProducerRegions, N as INDEX_SETTLE_POLL_INTERVAL_MS, O as compensateRemovedDeletionProtection, Oa as lambdaFunctionNameForMask, On as tagMapAsList, P as deleteTableWithIndexBusyRetry, Qn as reDisableInstanceApiTermination, R as hasCdkAutoDeleteTag, Ri as refuseMalformedResourcesForDestroy, Rr as passedParameterClassesOf, Sa as requireConfigString, Sn as acquireIdempotencyToken, T as DynamoDBGlobalTableProvider, Tn as planTagDiff, Tr as getAccountInfo, Us as canonicalizeRegion, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as markRefusedBeforeApplying, Vn as unchangedBehindSecretReference, Wn as deleteSkipReason, Ws as derivePartitionAndUrlSuffix, Wt as isRedactedRecordedValue, Xn as isTerminationProtectionPropagationError, Ya as redactSecretsForState, Yn as ec2InstanceProtectionSite, Za as recoverMaskedOutput, Zi as findSilentDropProperties, Zn as observeThenDisableInstanceApiTermination, _a as configStringRefusal, _r as s3BucketArn, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ba as requireConfigArray, bn as reserveStackCreateToken, br as s3BucketRegionalDomainName, c as renderNestedTemplateTreeDefect, ca as WARM_THROUGHPUT_MEMBERS, da as toCfnInteger, dt as getNestedRevertRun, ec as describeFileReadFailure, fa as toFiniteNumber, ga as configIntegerRefusal, gr as isSettledInstanceState, ha as configBooleanRefusal, j as resolveDynamoDbDeleteBudgetMs, jn as stringifyIfAssigned, k as deleteBudgetKey, ka as sameLambdaFunctionAddress, kn as tagPlanWarning, la as coerceWarmThroughput$1, ma as coerceCfnInteger, mt as revertNestedChildFromJournal, nc as renderAssemblyPathEscape, o as isAbsoluteAssetPath, pa as coerceCfnBoolean, qn as markWaitAbandoned, rc as resolveAssemblyPath, ro as carriesSecretMask, s as listNestedTemplateRows, t as DeployEngine, tc as displayAssemblyPath, ua as isWarmThroughputDecrease, va as readConfigString, vi as refuseMalformedNestedChildOutputs, vn as earliestDefined, vr as s3BucketDomainName, vt as withNestedStackContext, wn as DBPROXY_TAG_OPTIONS, xa as requireConfigObject, xr as s3BucketWebsiteUrl, xt as awaitInFlightSibling, ya as replayWarn, yr as s3BucketDualStackDomainName, z as isTruthyCfnBoolean, zn as slowCcOperationTimeoutMs } from "./deploy-engine-xlct0Hcm.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-BRVCTUZu.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DXRavuSm.js";
-import { RDSProvider } from "./rds-provider-McCDKyXN.js";
-import { NeptuneProvider } from "./neptune-provider-Cdp4jX8S.js";
-import { ASGProvider } from "./asg-provider-BwWy0pBH.js";
+import { $a as recoverMaskedOutput, $i as findSilentDropProperties, $n as observeThenDisableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, Aa as lambdaFunctionNameForMask, An as tagMapAsList, B as getPriorAttempts, Bi as refuseMalformedResourcesForDestroy, Br as passedParameterClassesOf, Ca as requireConfigObject, Cr as s3BucketWebsiteUrl, Ct as getStackRecords, D as beginDeleteWait, Dn as planTagDiff, Dr as getAccountInfo, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, En as DBPROXY_TAG_OPTIONS, F as waitForIndexesSettled, Gs as canonicalizeRegion, Gt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ho as rewriteTemplateAssetReferences, Hs as decodeListingKey, I as ECR_AUTO_DELETE_IMAGES_TAG, Jn as isWaitAbandonedError, Jt as redactedDeleteAddressSkip, Kn as deleteSkipReason, Ks as derivePartitionAndUrlSuffix, Kt as isRedactedRecordedValue, L as S3_AUTO_DELETE_OBJECTS_TAG, Lo as stringifyValue, Lr as parseWebACLArn, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as definedAttributes, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as stringifyIfAssigned, O as compensateRemovedDeletionProtection, Oa as withRetry, On as readTagList, P as deleteTableWithIndexBusyRetry, Pt as getCurrentProducerRegions, Qn as isTerminationProtectionPropagationError, R as hasCdkAutoDeleteTag, Sa as requireConfigArray, Sn as reserveStackCreateToken, Sr as s3BucketRegionalDomainName, T as DynamoDBGlobalTableProvider, Tn as DBPROXY_TAGS_WHAT, Un as unchangedBehindSecretReference, V as markRefusedBeforeApplying, Vn as slowCcOperationTimeoutMs, Xa as markSameGenerationBag, Yn as markWaitAbandoned, Za as redactSecretsForState, Zn as ec2InstanceProtectionSite, _a as configBooleanRefusal, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ac as resolveAssemblyPath, ao as carriesSecretMask, ba as readConfigString, bi as refuseMalformedNestedChildOutputs, bn as earliestDefined, br as s3BucketDomainName, c as renderNestedTemplateTreeDefect, da as coerceWarmThroughput$1, dt as getNestedRevertRun, er as reDisableInstanceApiTermination, fa as isWarmThroughputDecrease, ga as coerceCfnInteger, ha as coerceCfnBoolean, ic as renderAssemblyPathEscape, j as resolveDynamoDbDeleteBudgetMs, ja as sameLambdaFunctionAddress, jn as tagPlanWarning, k as deleteBudgetKey, ka as canonicalLambdaFunctionName, kn as refuseMalformedDesiredTags, ma as toFiniteNumber, mt as revertNestedChildFromJournal, nc as describeFileReadFailure, o as isAbsoluteAssetPath, pa as toCfnInteger, qn as withIndeterminateGuard, qt as redactedDeleteAddressFields, rc as displayAssemblyPath, s as listNestedTemplateRows, t as DeployEngine, ta as withoutSilentDropProperties, to as dynamicReferenceTokens, tr as reEnableInstanceApiTermination, ua as WARM_THROUGHPUT_MEMBERS, va as configIntegerRefusal, vr as isSettledInstanceState, vt as withNestedStackContext, wa as requireConfigString, wn as acquireIdempotencyToken, xa as replayWarn, xr as s3BucketDualStackDomainName, xt as awaitInFlightSibling, ya as configStringRefusal, yr as s3BucketArn, z as isTruthyCfnBoolean, za as hasMaskableValues, zn as getCurrentResourceSecrets } from "./deploy-engine-C_Eg-RHm.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-COoTgydF.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CiMVZi4n.js";
+import { RDSProvider } from "./rds-provider-DQwvPJXB.js";
+import { NeptuneProvider } from "./neptune-provider-D2SmeISr.js";
+import { ASGProvider } from "./asg-provider-DedWRf1j.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -2606,7 +2606,7 @@ function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
 		identifier: bucketName,
 		maskSecrets
 	});
-	const lead = journaled ? "On a first-time create the failed deploy's rollback journal records the bucket for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy" : "Manual deletion may be required before the next deploy";
+	const lead = journaled ? "Outside a rollback's re-create, the failed deploy's rollback journal records the bucket for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy" : "Manual deletion may be required before the next deploy";
 	return command ? `${lead}: ${command}` : `${lead}, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.`;
 }
 function configItemId(item) {
@@ -5518,7 +5518,7 @@ var SQSQueuePolicyProvider = class {
 			this.logger.debug(`Successfully created SQS queue policy ${logicalId}`);
 			return {
 				physicalId: queues[0],
-				attributes: {}
+				attributes: { [WRITTEN_QUEUES_KEY]: queues.join(",") }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -5527,12 +5527,15 @@ var SQSQueuePolicyProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating SQS queue policy ${logicalId}: ${physicalId}`);
 		const queues = properties["Queues"];
 		const policyDocument = properties["PolicyDocument"];
 		if (!queues || queues.length === 0) throw new ProvisioningError(`Queues is required for SQS queue policy ${logicalId}`, resourceType, logicalId, physicalId);
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for SQS queue policy ${logicalId}`, resourceType, logicalId, physicalId);
+		const written = recordedQueues(physicalId, context?.recordedAttributes);
+		const listedOnly = await this.queuesCarryingDocument(listedQueues(previousProperties).filter((url) => !written.includes(url) && !queues.includes(url)), previousProperties["PolicyDocument"], logicalId);
+		const removed = [...written.filter((url) => !queues.includes(url)), ...listedOnly];
 		try {
 			const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
 			for (const queueUrl of queues) {
@@ -5542,21 +5545,35 @@ var SQSQueuePolicyProvider = class {
 					Attributes: { Policy: policyDoc }
 				}));
 			}
+			for (const queueUrl of removed) await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion, "pre-update");
 			this.logger.debug(`Successfully updated SQS queue policy ${logicalId}`);
 			return {
 				physicalId: queues[0],
 				wasReplaced: false,
-				attributes: {}
+				attributes: { [WRITTEN_QUEUES_KEY]: queues.join(",") }
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SQS queue policy ${logicalId}: ${physicalId}`);
-		const queueUrls = physicalId.split(",");
+		const named = physicalId.includes(",") ? splitQueueUrls(physicalId) : recordedQueues(physicalId, context?.recordedAttributes);
+		const queueUrls = [...physicalId.includes(",") ? [] : await this.queuesCarryingDocument(listedQueues(properties ?? {}).filter((url) => !named.includes(url)), properties?.["PolicyDocument"], logicalId), ...named];
+		if (queueUrls.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
 		for (const queueUrl of queueUrls) try {
+			await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context?.expectedRegion);
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
+	}
+	async clearQueuePolicy(queueUrl, resourceType, logicalId, expectedRegion, phase = "not-found") {
+		try {
 			await this.sqsClient.send(new SetQueueAttributesCommand({
 				QueueUrl: queueUrl,
 				Attributes: { Policy: "" }
@@ -5564,33 +5581,77 @@ var SQSQueuePolicyProvider = class {
 		} catch (error) {
 			if (error instanceof Error && (error.name === "QueueDoesNotExist" || error.message.includes("does not exist"))) {
 				const clientRegion = await this.sqsClient.config.region();
-				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, queueUrl);
+				assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, queueUrl, phase);
 				this.logger.debug(`Queue ${queueUrl} does not exist, skipping policy deletion`);
-				continue;
+				return;
 			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw error;
 		}
-		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		let policyAttr;
+	async queuesCarryingDocument(candidates, document, logicalId) {
+		if (candidates.length === 0) return [];
+		let reference;
+		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$1(document);
+		if (reference === void 0) {
+			this.logger.warn(safeMsg`The queues ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`);
+			return [];
+		}
+		const carrying = [];
+		for (const queueUrl of candidates) {
+			const current = await this.readPolicyForWidening(queueUrl);
+			if (current.kind === "policy" && canonicalPolicy(current.policy) === reference) carrying.push(queueUrl);
+			else if (current.kind === "unreadable") this.logger.warn(safeMsg`Could not read the policy of queue ${queueUrl} (${current.reason}), so it is not cleared: it may still carry the policy of ${logicalId}.`);
+			else this.logger.debug(safeMsg`Queue ${queueUrl} does not carry the policy of ${logicalId}; left as is`);
+		}
+		return carrying;
+	}
+	async readPolicyForWidening(queueUrl) {
 		try {
-			policyAttr = (await this.sqsClient.send(new GetQueueAttributesCommand({
-				QueueUrl: physicalId,
+			const policy = (await this.sqsClient.send(new GetQueueAttributesCommand({
+				QueueUrl: queueUrl,
 				AttributeNames: ["Policy"]
 			}))).Attributes?.["Policy"];
+			return policy ? {
+				kind: "policy",
+				policy
+			} : { kind: "none" };
 		} catch (err) {
-			const e = err;
-			if (e.name === "QueueDoesNotExist" || e.name === "AWS.SimpleQueueService.NonExistentQueue") return RESOURCE_NOT_FOUND;
-			throw err;
+			const name = err.name;
+			if (name === "QueueDoesNotExist" || name === "AWS.SimpleQueueService.NonExistentQueue") return { kind: "none" };
+			return {
+				kind: "unreadable",
+				reason: name ?? "error"
+			};
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const queueUrls = splitQueueUrls(physicalId);
+		if (queueUrls.length === 0) return void 0;
+		const held = [];
+		let firstPolicy;
+		for (const queueUrl of queueUrls) {
+			let policyAttr;
+			try {
+				policyAttr = (await this.sqsClient.send(new GetQueueAttributesCommand({
+					QueueUrl: queueUrl,
+					AttributeNames: ["Policy"]
+				}))).Attributes?.["Policy"];
+			} catch (err) {
+				const e = err;
+				if (e.name === "QueueDoesNotExist" || e.name === "AWS.SimpleQueueService.NonExistentQueue") continue;
+				throw err;
+			}
+			if (!policyAttr) continue;
+			held.push(queueUrl);
+			firstPolicy ??= policyAttr;
 		}
-		if (!policyAttr) return RESOURCE_NOT_FOUND;
-		const result = { Queues: [physicalId] };
+		if (firstPolicy === void 0) return RESOURCE_NOT_FOUND;
+		const result = { Queues: held };
 		try {
-			result["PolicyDocument"] = JSON.parse(policyAttr);
+			result["PolicyDocument"] = JSON.parse(firstPolicy);
 		} catch {
-			result["PolicyDocument"] = policyAttr;
+			result["PolicyDocument"] = firstPolicy;
 		}
 		return result;
 	}
@@ -5615,6 +5676,49 @@ var SQSQueuePolicyProvider = class {
 function isSqsQueueUrl(value) {
 	return value.startsWith("https://sqs.") && value.includes("/");
 }
+const WRITTEN_QUEUES_KEY = "cdkd:WrittenQueues";
+function recordedQueues(physicalId, attributes) {
+	const named = splitQueueUrls(physicalId);
+	const value = attributes?.[WRITTEN_QUEUES_KEY];
+	if (typeof value !== "string") return named;
+	const recorded = splitQueueUrls(value);
+	if (recorded.length === 0 || !recorded.every(isListedQueueUrl)) return named;
+	for (const url of recorded) if (!named.includes(url)) named.push(url);
+	return named;
+}
+function listedQueues(bag) {
+	const listed = bag["Queues"];
+	if (!Array.isArray(listed)) return [];
+	const out = [];
+	for (const entry of listed) if (typeof entry === "string" && isListedQueueUrl(entry) && !out.includes(entry)) out.push(entry);
+	return out;
+}
+function isListedQueueUrl(value) {
+	return isSqsQueueUrl(value) && !value.includes(",") && !value.includes("*");
+}
+function canonicalJson$1(value) {
+	const sortKeys = (v) => {
+		if (Array.isArray(v)) return v.map(sortKeys);
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			for (const key of Object.keys(v).sort()) out[key] = sortKeys(v[key]);
+			return out;
+		}
+		return v;
+	};
+	const sorted = sortKeys(value);
+	return JSON.stringify(sorted);
+}
+function canonicalPolicy(text) {
+	try {
+		return canonicalJson$1(JSON.parse(text));
+	} catch {
+		return `raw:${text}`;
+	}
+}
+function splitQueueUrls(physicalId) {
+	return physicalId.split(",").filter((url) => url.length > 0);
+}
 
 //#endregion
 //#region src/provisioning/providers/create-ownership.ts
@@ -5748,7 +5852,7 @@ var SNSTopicProvider = class {
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = topicArn;
-					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()}`);
+					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -11185,7 +11289,7 @@ var LogsLogGroupProvider = class {
 						identifier: logGroupName,
 						maskSecrets: mask
 					});
-					const manualStep = deleteCommand ? `On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "On a first-time create the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
+					const manualStep = deleteCommand ? `Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "Outside a rollback's re-create, the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
 					this.logger.warn(mask(`Failed to clean up partially-created log group ${displaySafe(logicalId)} (${displaySafe(mask(logGroupName))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`));
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -12371,7 +12475,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 						identifier: name,
 						maskSecrets: mask
 					});
-					const manualStep = deleteCommand ? `On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "On a first-time create the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
+					const manualStep = deleteCommand ? `Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "Outside a rollback's re-create, the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
 					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -23210,13 +23314,13 @@ var ELBv2Provider = class {
 					this.logger.warn(maskerOrIdentity(maskSecrets)(skippedCleanupText(heldBefore, `Listener ${logicalId} (${listenerArn})`, pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render())));
 					throw markAuxiliaryFailure(innerError, logicalId);
 				}
-				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
 					leftBehindArn = listenerArn;
-					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`);
+					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -28738,13 +28842,13 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
-				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete fails, on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`));
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete fails, outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`));
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
 					leftBehindServiceId = void 0;
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`);
+					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -33007,7 +33111,7 @@ var KMSProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				const aws = pasteableAwsCommand();
 				const region = await this.regionArg(aws);
-				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS on a first-time create, its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
+				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS (outside a rollback's re-create), its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
@@ -35458,7 +35562,7 @@ var PipesPipeProvider = class {
 		const orphaned = async (why) => {
 			const aws = pasteableAwsCommand(mask);
 			const command = aws`aws pipes delete-pipe --name ${name}${await orphanCommandRegionArg(this.getClient(), aws)}`;
-			original.message += ` (cdkd could not delete the pipe it had created: ${why}; on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`. ` + (command.text !== void 0 ? `Otherwise delete it yourself with: ${command.text})` : `Otherwise delete it yourself from the EventBridge Pipes console.)`);
+			original.message += ` (cdkd could not delete the pipe it had created: ${why}; outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`. ` + (command.text !== void 0 ? `Otherwise delete it yourself with: ${command.text})` : `Otherwise delete it yourself from the EventBridge Pipes console.)`);
 			return leftBehind();
 		};
 		try {
@@ -36492,7 +36596,7 @@ var FSxFileSystemProvider = class {
 				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
 				survivorId = fileSystemId;
-				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself to stop billing`);
+				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself to stop billing`);
 			}
 			if (error instanceof ProvisioningError) {
 				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
@@ -43136,4 +43240,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DNkoEEo4.js.map
+//# sourceMappingURL=provider-classes-CtsCylnp.js.map