@go-to-k/cdkd 0.296.18 → 0.296.19

package/dist/{provider-classes-Dc_SVoFZ.js → provider-classes-ByXP467R.js}

@@ -2,14 +2,14 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-BoZuWtxK.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { Aa as coerceWarmThroughput$1, Ac as displayAssemblyPath, Ba as replayWarn, Bn as DBPROXY_TAGS_WHAT, Br as s3BucketWebsiteUrl, Ct as INDEX_SETTLE_POLL_INTERVAL_MS, Dt as S3_AUTO_DELETE_OBJECTS_TAG, Et as ECR_AUTO_DELETE_IMAGES_TAG, Fa as coerceCfnInteger, Fn as earliestDefined, Fr as isSettledInstanceState, Gn as tagMapAsList, Gt as redactedDeleteAddressFields, Ha as requireConfigObject, Hn as planTagDiff, Ia as configBooleanRefusal, Ir as s3BucketArn, Ja as canonicalLambdaFunctionName, Jn as stringifyIfAssigned, Kn as tagPlanWarning, Kt as redactedDeleteAddressSkip, La as configIntegerRefusal, Ln as reserveStackCreateToken, Lr as s3BucketDomainName, Ma as toCfnInteger, Mc as resolveAssemblyPath, Mo as carriesSecretMask, Na as toFiniteNumber, Ot as hasCdkAutoDeleteTag, Pa as coerceCfnBoolean, Ra as configStringRefusal, Ri as refuseMalformedNestedChildOutputs, Rr as s3BucketDualStackDomainName, So as redactSecretsForState, St as DELETE_INDEX_WAIT_PROCEED_NOTE, T as markRefusedBeforeApplying, To as dynamicReferenceTokens, Tt as waitForIndexesSettled, Ua as requireConfigString, Un as readTagList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, Va as requireConfigArray, Vn as DBPROXY_TAG_OPTIONS, Vt as getCurrentProducerRegions, W as getNestedRevertRun, Wn as refuseMalformedDesiredTags, Wr as getAccountInfo, Wt as isRedactedRecordedValue, X as getCurrentNestedStackContext, Xa as sameLambdaFunctionAddress, Ya as lambdaFunctionNameForMask, Z as withNestedStackContext, _r as reEnableInstanceApiTermination, _t as beginDeleteWait, a as findNestedTemplateTreeDefect, ao as passedNoEchoParametersOf, ar as unchangedBehindSecretReference, ba as withoutSilentDropProperties, bt as resolveDynamoDbDeleteBudgetClock, c as renderNestedTemplateTreeDefect, cr as deleteSkipReason, dr as markWaitAbandoned, ei as parseWebACLArn, ga as withheldAccountClause, gr as reDisableInstanceApiTermination, gt as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, hc as decodeListingKey, hr as observeThenDisableInstanceApiTermination, hs as rewriteTemplateAssetReferences, ht as DynamoDBGlobalTableProvider, ia as refuseMalformedResourcesForDestroy, ir as slowCcOperationTimeoutMs, ja as isWarmThroughputDecrease, jc as renderAssemblyPathEscape, jo as recoverMaskedOutput, ka as WARM_THROUGHPUT_MEMBERS, kc as describeFileReadFailure, kt as isTruthyCfnBoolean, li as accountArgs, lr as withIndeterminateGuard, lt as getStackRecords, mr as isTerminationProtectionPropagationError, o as isAbsoluteAssetPath, pr as ec2InstanceProtectionSite, q as revertNestedChildFromJournal, qa as withRetry, qn as definedAttributes, ri as passedParameterClassesOf, s as listNestedTemplateRows, st as awaitInFlightSibling, t as DeployEngine, tr as getCurrentResourceSecrets, uo as hasMaskableValues, ur as isWaitAbandonedError, us as stringifyValue, va as findSilentDropProperties, vc as canonicalizeRegion, vt as compensateRemovedDeletionProtection, w as getPriorAttempts, wt as deleteTableWithIndexBusyRetry, xo as markSameGenerationBag, xt as resolveDynamoDbDeleteBudgetMs, yc as derivePartitionAndUrlSuffix, yt as deleteBudgetKey, za as readConfigString, zn as acquireIdempotencyToken, zr as s3BucketRegionalDomainName } from "./deploy-engine-DWbbP9w6.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DMZhalf-.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BGAUJbns.js";
-import { RDSProvider } from "./rds-provider-DArbEUG9.js";
-import { NeptuneProvider } from "./neptune-provider-0RhO6C4E.js";
-import { ASGProvider } from "./asg-provider-B3568WgD.js";
+import { A as beginDeleteWait, Aa as coerceWarmThroughput$1, Ac as displayAssemblyPath, B as S3_AUTO_DELETE_OBJECTS_TAG, Ba as replayWarn, Bn as DBPROXY_TAGS_WHAT, Br as s3BucketWebsiteUrl, Et as awaitInFlightSibling, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fa as coerceCfnInteger, Fn as earliestDefined, Fr as isSettledInstanceState, Gn as tagMapAsList, Gt as redactedDeleteAddressFields, H as isTruthyCfnBoolean, Ha as requireConfigObject, Hn as planTagDiff, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as configBooleanRefusal, Ir as s3BucketArn, Ja as canonicalLambdaFunctionName, Jn as stringifyIfAssigned, Kn as tagPlanWarning, Kt as redactedDeleteAddressSkip, L as deleteTableWithIndexBusyRetry, La as configIntegerRefusal, Ln as reserveStackCreateToken, Lr as s3BucketDomainName, M as deleteBudgetKey, Ma as toCfnInteger, Mc as resolveAssemblyPath, Mo as carriesSecretMask, N as resolveDynamoDbDeleteBudgetClock, Na as toFiniteNumber, O as DynamoDBGlobalTableProvider, Ot as getStackRecords, P as resolveDynamoDbDeleteBudgetMs, Pa as coerceCfnBoolean, R as waitForIndexesSettled, Ra as configStringRefusal, Ri as refuseMalformedNestedChildOutputs, Rr as s3BucketDualStackDomainName, So as redactSecretsForState, To as dynamicReferenceTokens, U as getPriorAttempts, Ua as requireConfigString, Un as readTagList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as hasCdkAutoDeleteTag, Va as requireConfigArray, Vn as DBPROXY_TAG_OPTIONS, Vt as getCurrentProducerRegions, W as markRefusedBeforeApplying, Wn as refuseMalformedDesiredTags, Wr as getAccountInfo, Wt as isRedactedRecordedValue, Xa as sameLambdaFunctionAddress, Ya as lambdaFunctionNameForMask, _r as reEnableInstanceApiTermination, a as findNestedTemplateTreeDefect, ao as passedNoEchoParametersOf, ar as unchangedBehindSecretReference, ba as withoutSilentDropProperties, c as renderNestedTemplateTreeDefect, cr as deleteSkipReason, dr as markWaitAbandoned, ei as parseWebACLArn, ft as revertNestedChildFromJournal, ga as withheldAccountClause, gr as reDisableInstanceApiTermination, gt as withNestedStackContext, hc as decodeListingKey, hr as observeThenDisableInstanceApiTermination, hs as rewriteTemplateAssetReferences, ht as getCurrentNestedStackContext, ia as refuseMalformedResourcesForDestroy, ir as slowCcOperationTimeoutMs, j as compensateRemovedDeletionProtection, ja as isWarmThroughputDecrease, jc as renderAssemblyPathEscape, jo as recoverMaskedOutput, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as WARM_THROUGHPUT_MEMBERS, kc as describeFileReadFailure, li as accountArgs, lr as withIndeterminateGuard, lt as getNestedRevertRun, mr as isTerminationProtectionPropagationError, o as isAbsoluteAssetPath, pr as ec2InstanceProtectionSite, qa as withRetry, qn as definedAttributes, ri as passedParameterClassesOf, s as listNestedTemplateRows, t as DeployEngine, tr as getCurrentResourceSecrets, uo as hasMaskableValues, ur as isWaitAbandonedError, us as stringifyValue, va as findSilentDropProperties, vc as canonicalizeRegion, xo as markSameGenerationBag, yc as derivePartitionAndUrlSuffix, z as ECR_AUTO_DELETE_IMAGES_TAG, za as readConfigString, zn as acquireIdempotencyToken, zr as s3BucketRegionalDomainName } from "./deploy-engine-DFGqFKxg.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ClhDA-4n.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B71EFlzv.js";
+import { RDSProvider } from "./rds-provider-DOBUTuj4.js";
+import { NeptuneProvider } from "./neptune-provider-DHPdyc-o.js";
+import { ASGProvider } from "./asg-provider-ha36d8C0.js";
 import { createHash, randomUUID } from "node:crypto";
-import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -3123,14 +3123,37 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		return holder.client;
 	}
-	refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, region, via) {
+	refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, region, via, explicitName) {
 		const aws = pasteableAwsCommand(this.shownMask);
 		const regionArg = region ? aws` --region ${region}` : aws``;
 		const owned = aws`aws s3api list-buckets --prefix ${bucketName}`.render();
 		const versions = aws`aws s3api list-object-versions --bucket ${bucketName} --max-items 10${regionArg}`.render();
 		const deletion = aws`aws s3api delete-bucket --bucket ${bucketName}${regionArg}`.render();
 		const presence = "preflight" in via && via.preflight === "indeterminate" ? "a bucket of that name may exist (cdkd could not read its location)" : "the bucket now exists";
-		throw markNonRetryable(new ProvisioningError(`Refusing to adopt S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): an earlier attempt of this create ended without a definite answer (a server error or a lost response) after it may have created the bucket, and ${presence}, so cdkd cannot tell whether this deploy or someone else created it. Check whether this account owns it: ${owned} (it lists only this account's buckets; its CreationDate is a hint, not proof, since some bucket changes update it), and whether it holds any object or object version: ${versions}. If it is listed there, its CreationDate matches the failed attempt, it is empty, and nobody else on your team uses this name, it is this deploy's orphan: delete it with ${deletion} (S3 refuses with BucketNotEmpty if anything is left in it) and re-run the deploy. If it is a bucket you mean this stack to own, re-run the deploy to adopt it.`, resourceType, logicalId, bucketName, "cause" in via ? via.cause : void 0));
+		throw markNonRetryable(new ProvisioningError(`Refusing to adopt S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): an earlier attempt of this create ended without a definite answer (a server error or a lost response) after it may have created the bucket, and ${presence}, so cdkd cannot tell whether this deploy or someone else created it. Check whether this account owns it: ${owned} (it lists only this account's buckets; its CreationDate is a hint, not proof, since some bucket changes update it), and whether it holds any object or object version: ${versions}. If it is listed there, its CreationDate matches the failed attempt, it is empty, and nobody else on your team uses this name, it is this deploy's orphan: delete it with ${deletion} (S3 refuses with BucketNotEmpty if anything is left in it) and re-run the deploy. ` + (explicitName ? "If it is a bucket you mean this stack to own, adopt it with `cdkd import` and re-run: its BucketName is set explicitly, so a re-run alone refuses it." : `If it is a bucket you mean this stack to own, re-run the deploy to adopt it.`), resourceType, logicalId, bucketName, "cause" in via ? via.cause : void 0));
+	}
+	refuseExplicitNameHeld(logicalId, resourceType, bucketName, via) {
+		const evidence = "cause" in via ? "S3 answered BucketAlreadyOwnedByYou: a bucket of that name already exists, and this account owns it" : "listed" in via ? "a bucket of that name already exists in this account's bucket list (a us-east-1 CreateBucket would answer 200 OK over it and reset its access control lists), so CreateBucket was not sent" : `a bucket of that name already exists in ${via.preflightRegion}, where CreateBucket answers 200 OK over a bucket you own and resets its access control lists, so it was not sent`;
+		throw markNameCollision(new ProvisioningError(`Refusing to adopt S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): its BucketName is set explicitly and ${evidence}. S3 does not say who made it, so cdkd cannot tell it from one made outside this stack, and CloudFormation fails the same create. Nothing was applied to it. Choose a bucket name no other bucket holds. If no record of this stack holds that bucket and it is yours (left by an interrupted deploy, or kept by DeletionPolicy: Retain), delete it, or adopt it with \`cdkd import\`, and re-run; confirm it is yours first, since adopting a bucket hands it to this stack's \`cdkd destroy\`.`, resourceType, logicalId, bucketName, "cause" in via ? via.cause : void 0));
+	}
+	async ownsBucketNamed(bucketName) {
+		try {
+			let token;
+			for (let page = 0; page < 100; page++) {
+				const out = await this.s3Client.send(new ListBucketsCommand({
+					Prefix: bucketName,
+					MaxBuckets: 1e3,
+					...token !== void 0 ? { ContinuationToken: token } : {}
+				}));
+				if ((out.Buckets ?? []).some((b) => b.Name === bucketName)) return { owned: true };
+				token = out.ContinuationToken || void 0;
+				if (token === void 0) return { owned: false };
+			}
+			return { unknown: "PaginationLimit" };
+		} catch (error) {
+			this.logger.debug(safeMsg`ListBuckets failed while checking S3 bucket ${this.shown(bucketName)}: ` + safeMsg`${describeAwsFailure(error).detail}`);
+			return { unknown: error instanceof Error ? error.name : typeof error };
+		}
 	}
 	async getRegion() {
 		return await this.s3Client.config.region() || "us-east-1";
@@ -4285,6 +4308,7 @@ var S3BucketProvider = class S3BucketProvider {
 		if (this.opMask === void 0) return this.maskedView(createMaskedLogSinks(this.logger, context?.maskSecrets)).create(logicalId, resourceType, properties, context);
 		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const explicitBucketName = Boolean(properties["BucketName"]);
 		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
 			maxLength: 63,
 			lowercase: true,
@@ -4305,7 +4329,16 @@ var S3BucketProvider = class S3BucketProvider {
 			ambiguousWindow = takeCreateBucketWindow(logicalId);
 			if (ambiguousWindow !== void 0 && (preflight.kind === "indeterminate" || preflight.kind === "region" && preflight.region === "us-east-1")) {
 				windowSpent = true;
-				this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { preflight: preflight.kind });
+				this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { preflight: preflight.kind }, explicitBucketName);
+			}
+			if (explicitBucketName && preflight.kind === "region" && preflight.region === "us-east-1") this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { preflightRegion: preflight.region });
+			let ownershipUnknown;
+			let listedFree = false;
+			if (explicitBucketName && preflight.kind === "indeterminate") {
+				const owned = await this.ownsBucketNamed(bucketName);
+				if ("owned" in owned && owned.owned) this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { listed: true });
+				if ("unknown" in owned) ownershipUnknown = owned.unknown;
+				else listedFree = true;
 			}
 			try {
 				const attemptStartMs = Date.now();
@@ -4315,11 +4348,12 @@ var S3BucketProvider = class S3BucketProvider {
 					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
 					throw sendError;
 				}
-				createdNewBucket = preflight.kind === "absent";
+				createdNewBucket = preflight.kind === "absent" || listedFree;
 				bucketLeftBehind = createdNewBucket;
 				if (createdNewBucket) windowSpent = true;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
 				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
+				if (ownershipUnknown !== void 0 && preflight.kind === "indeterminate") this.logger.warn(safeMsg`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) was ` + `sent to CreateBucket without knowing whether a bucket of that explicit name ` + safeMsg`already existed: the region probe (${preflight.errorName}) and the bucket ` + safeMsg`listing (${ownershipUnknown}) both failed. In us-east-1 CreateBucket answers 200 ` + "OK over a bucket you own, so if one existed it has now been configured and recorded as this stack's. Re-run with --verbose for AWS's own message.");
 				this.logger.debug(`Created S3 bucket: ${this.shown(bucketName)}`);
 			} catch (createError) {
 				if (createError instanceof ProvisioningError) throw createError;
@@ -4328,8 +4362,9 @@ var S3BucketProvider = class S3BucketProvider {
 					await this.assertExistingBucketRegion(logicalId, resourceType, bucketName, region, createError);
 					if (ambiguousWindow !== void 0) {
 						windowSpent = true;
-						this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { cause: createError });
+						this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { cause: createError }, explicitBucketName);
 					}
+					if (explicitBucketName) this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { cause: createError });
 					this.logger.debug(`S3 bucket ${this.shown(bucketName)} already exists and is owned by you`);
 				} else throw createError;
 			}
@@ -44342,4 +44377,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dc_SVoFZ.js.map
+//# sourceMappingURL=provider-classes-ByXP467R.js.map