@go-to-k/cdkd 0.296.19 → 0.296.21

package/dist/{provider-classes-ByXP467R.js → provider-classes-D9az4nS4.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-BoZuWtxK.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { A as beginDeleteWait, Aa as coerceWarmThroughput$1, Ac as displayAssemblyPath, B as S3_AUTO_DELETE_OBJECTS_TAG, Ba as replayWarn, Bn as DBPROXY_TAGS_WHAT, Br as s3BucketWebsiteUrl, Et as awaitInFlightSibling, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fa as coerceCfnInteger, Fn as earliestDefined, Fr as isSettledInstanceState, Gn as tagMapAsList, Gt as redactedDeleteAddressFields, H as isTruthyCfnBoolean, Ha as requireConfigObject, Hn as planTagDiff, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as configBooleanRefusal, Ir as s3BucketArn, Ja as canonicalLambdaFunctionName, Jn as stringifyIfAssigned, Kn as tagPlanWarning, Kt as redactedDeleteAddressSkip, L as deleteTableWithIndexBusyRetry, La as configIntegerRefusal, Ln as reserveStackCreateToken, Lr as s3BucketDomainName, M as deleteBudgetKey, Ma as toCfnInteger, Mc as resolveAssemblyPath, Mo as carriesSecretMask, N as resolveDynamoDbDeleteBudgetClock, Na as toFiniteNumber, O as DynamoDBGlobalTableProvider, Ot as getStackRecords, P as resolveDynamoDbDeleteBudgetMs, Pa as coerceCfnBoolean, R as waitForIndexesSettled, Ra as configStringRefusal, Ri as refuseMalformedNestedChildOutputs, Rr as s3BucketDualStackDomainName, So as redactSecretsForState, To as dynamicReferenceTokens, U as getPriorAttempts, Ua as requireConfigString, Un as readTagList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as hasCdkAutoDeleteTag, Va as requireConfigArray, Vn as DBPROXY_TAG_OPTIONS, Vt as getCurrentProducerRegions, W as markRefusedBeforeApplying, Wn as refuseMalformedDesiredTags, Wr as getAccountInfo, Wt as isRedactedRecordedValue, Xa as sameLambdaFunctionAddress, Ya as lambdaFunctionNameForMask, _r as reEnableInstanceApiTermination, a as findNestedTemplateTreeDefect, ao as passedNoEchoParametersOf, ar as unchangedBehindSecretReference, ba as withoutSilentDropProperties, c as renderNestedTemplateTreeDefect, cr as deleteSkipReason, dr as markWaitAbandoned, ei as parseWebACLArn, ft as revertNestedChildFromJournal, ga as withheldAccountClause, gr as reDisableInstanceApiTermination, gt as withNestedStackContext, hc as decodeListingKey, hr as observeThenDisableInstanceApiTermination, hs as rewriteTemplateAssetReferences, ht as getCurrentNestedStackContext, ia as refuseMalformedResourcesForDestroy, ir as slowCcOperationTimeoutMs, j as compensateRemovedDeletionProtection, ja as isWarmThroughputDecrease, jc as renderAssemblyPathEscape, jo as recoverMaskedOutput, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as WARM_THROUGHPUT_MEMBERS, kc as describeFileReadFailure, li as accountArgs, lr as withIndeterminateGuard, lt as getNestedRevertRun, mr as isTerminationProtectionPropagationError, o as isAbsoluteAssetPath, pr as ec2InstanceProtectionSite, qa as withRetry, qn as definedAttributes, ri as passedParameterClassesOf, s as listNestedTemplateRows, t as DeployEngine, tr as getCurrentResourceSecrets, uo as hasMaskableValues, ur as isWaitAbandonedError, us as stringifyValue, va as findSilentDropProperties, vc as canonicalizeRegion, xo as markSameGenerationBag, yc as derivePartitionAndUrlSuffix, z as ECR_AUTO_DELETE_IMAGES_TAG, za as readConfigString, zn as acquireIdempotencyToken, zr as s3BucketRegionalDomainName } from "./deploy-engine-DFGqFKxg.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ClhDA-4n.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B71EFlzv.js";
-import { RDSProvider } from "./rds-provider-DOBUTuj4.js";
-import { NeptuneProvider } from "./neptune-provider-DHPdyc-o.js";
-import { ASGProvider } from "./asg-provider-ha36d8C0.js";
+import { A as beginDeleteWait, B as S3_AUTO_DELETE_OBJECTS_TAG, Ba as configStringRefusal, Bi as refuseMalformedNestedChildOutputs, Bn as DBPROXY_TAGS_WHAT, Br as s3BucketDualStackDomainName, Co as markSameGenerationBag, Do as dynamicReferenceTokens, Et as awaitInFlightSibling, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fa as toFiniteNumber, Fn as earliestDefined, Ga as requireConfigString, Gn as tagMapAsList, Gt as redactedDeleteAddressFields, H as isTruthyCfnBoolean, Ha as replayWarn, Hn as planTagDiff, Hr as s3BucketWebsiteUrl, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as coerceCfnBoolean, Jn as stringifyIfAssigned, Kn as tagPlanWarning, Kr as getAccountInfo, Kt as redactedDeleteAddressSkip, L as deleteTableWithIndexBusyRetry, La as coerceCfnInteger, Ln as reserveStackCreateToken, Lr as isSettledInstanceState, M as deleteBudgetKey, Ma as coerceWarmThroughput$1, Mc as displayAssemblyPath, N as resolveDynamoDbDeleteBudgetClock, Na as isWarmThroughputDecrease, Nc as renderAssemblyPathEscape, No as recoverMaskedOutput, O as DynamoDBGlobalTableProvider, Ot as getStackRecords, P as resolveDynamoDbDeleteBudgetMs, Pa as toCfnInteger, Pc as resolveAssemblyPath, Po as carriesSecretMask, Qa as sameLambdaFunctionAddress, R as waitForIndexesSettled, Ra as configBooleanRefusal, Rr as s3BucketArn, Sa as withoutSilentDropProperties, U as getPriorAttempts, Ua as requireConfigArray, Un as readTagList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as hasCdkAutoDeleteTag, Va as readConfigString, Vn as DBPROXY_TAG_OPTIONS, Vr as s3BucketRegionalDomainName, Vt as getCurrentProducerRegions, W as markRefusedBeforeApplying, Wa as requireConfigObject, Wn as refuseMalformedDesiredTags, Wt as isRedactedRecordedValue, Xa as canonicalLambdaFunctionName, Ya as withRetry, Za as lambdaFunctionNameForMask, _c as decodeListingKey, _r as observeThenDisableInstanceApiTermination, _s as rewriteTemplateAssetReferences, a as findNestedTemplateTreeDefect, ai as passedParameterClassesOf, ba as findSilentDropProperties, bc as canonicalizeRegion, c as renderNestedTemplateTreeDefect, di as accountArgs, dr as withIndeterminateGuard, fo as hasMaskableValues, fr as isWaitAbandonedError, fs as stringifyValue, ft as revertNestedChildFromJournal, gr as isTerminationProtectionPropagationError, gt as withNestedStackContext, hr as ec2InstanceProtectionSite, ht as getCurrentNestedStackContext, j as compensateRemovedDeletionProtection, ja as WARM_THROUGHPUT_MEMBERS, jc as describeFileReadFailure, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as getNestedRevertRun, ni as parseWebACLArn, o as isAbsoluteAssetPath, oa as refuseMalformedResourcesForDestroy, or as slowCcOperationTimeoutMs, pr as markWaitAbandoned, qn as definedAttributes, rr as getCurrentResourceSecrets, s as listNestedTemplateRows, so as passedNoEchoParametersOf, sr as unchangedBehindSecretReference, t as DeployEngine, ur as deleteSkipReason, va as withheldAccountClause, vr as reDisableInstanceApiTermination, wo as redactSecretsForState, xc as derivePartitionAndUrlSuffix, yr as reEnableInstanceApiTermination, z as ECR_AUTO_DELETE_IMAGES_TAG, za as configIntegerRefusal, zn as acquireIdempotencyToken, zr as s3BucketDomainName } from "./deploy-engine-CFgNpsEy.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-lZJS9r6W.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B5hwPYpu.js";
+import { RDSProvider } from "./rds-provider-CE85wFCg.js";
+import { NeptuneProvider } from "./neptune-provider-DGI_r9C8.js";
+import { ASGProvider } from "./asg-provider-D5_Zlj5T.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -3031,6 +3031,16 @@ function bucketLocationToRegion(constraint) {
 	if (value === "eu") return "eu-west-1";
 	return value;
 }
+const FAILED_CREATE_ORPHAN_NOT_EMPTY_SKIP_REASON = "the bucket a failed create left behind is not empty, and cdkd never empties such a bucket: something wrote to it after that create, so it may hold data or have been adopted by another deployment. Empty and delete it yourself if it is not in use";
+var BucketNotEmptyRefusal = class extends Error {
+	name = "BucketNotEmptyRefusal";
+};
+function isPlainBucketName(value) {
+	return typeof value === "string" && /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(value);
+}
+const BUCKET_LIST_IDENTITY_ATTEMPTS = 3;
+const BUCKET_LIST_IDENTITY_DELAY_MS = 1500;
+const BUCKET_LIST_IDENTITY_BUDGET_MS = 6e3;
 function isNoSuchBucketError(error) {
 	return error?.name === "NoSuchBucket";
 }
@@ -3137,6 +3147,10 @@ var S3BucketProvider = class S3BucketProvider {
 		throw markNameCollision(new ProvisioningError(`Refusing to adopt S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): its BucketName is set explicitly and ${evidence}. S3 does not say who made it, so cdkd cannot tell it from one made outside this stack, and CloudFormation fails the same create. Nothing was applied to it. Choose a bucket name no other bucket holds. If no record of this stack holds that bucket and it is yours (left by an interrupted deploy, or kept by DeletionPolicy: Retain), delete it, or adopt it with \`cdkd import\`, and re-run; confirm it is yours first, since adopting a bucket hands it to this stack's \`cdkd destroy\`.`, resourceType, logicalId, bucketName, "cause" in via ? via.cause : void 0));
 	}
 	async ownsBucketNamed(bucketName) {
+		const listed = await this.listOwnedBucket(bucketName);
+		return "unknown" in listed ? listed : { owned: listed.bucket !== void 0 };
+	}
+	async listOwnedBucket(bucketName) {
 		try {
 			let token;
 			for (let page = 0; page < 100; page++) {
@@ -3145,13 +3159,14 @@ var S3BucketProvider = class S3BucketProvider {
 					MaxBuckets: 1e3,
 					...token !== void 0 ? { ContinuationToken: token } : {}
 				}));
-				if ((out.Buckets ?? []).some((b) => b.Name === bucketName)) return { owned: true };
+				const found = (out.Buckets ?? []).find((b) => b.Name === bucketName);
+				if (found !== void 0) return { bucket: found };
 				token = out.ContinuationToken || void 0;
-				if (token === void 0) return { owned: false };
+				if (token === void 0) return { bucket: void 0 };
 			}
 			return { unknown: "PaginationLimit" };
 		} catch (error) {
-			this.logger.debug(safeMsg`ListBuckets failed while checking S3 bucket ${this.shown(bucketName)}: ` + safeMsg`${describeAwsFailure(error).detail}`);
+			this.logger.debug(safeMsg`ListBuckets failed while reading this account's bucket list: ` + safeMsg`${describeAwsFailure(error).detail}`);
 			return { unknown: error instanceof Error ? error.name : typeof error };
 		}
 	}
@@ -4333,12 +4348,10 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			if (explicitBucketName && preflight.kind === "region" && preflight.region === "us-east-1") this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { preflightRegion: preflight.region });
 			let ownershipUnknown;
-			let listedFree = false;
 			if (explicitBucketName && preflight.kind === "indeterminate") {
 				const owned = await this.ownsBucketNamed(bucketName);
 				if ("owned" in owned && owned.owned) this.refuseExplicitNameHeld(logicalId, resourceType, bucketName, { listed: true });
 				if ("unknown" in owned) ownershipUnknown = owned.unknown;
-				else listedFree = true;
 			}
 			try {
 				const attemptStartMs = Date.now();
@@ -4348,7 +4361,7 @@ var S3BucketProvider = class S3BucketProvider {
 					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
 					throw sendError;
 				}
-				createdNewBucket = preflight.kind === "absent" || listedFree;
+				createdNewBucket = preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
 				if (createdNewBucket) windowSpent = true;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
@@ -4453,12 +4466,17 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting S3 bucket ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
-		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
+		const failedCreateOrphan = context?.failedCreateOrphan === true;
+		const allowAutoEmpty = !failedCreateOrphan && (context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects"));
 		if (context?.expectedRegion) await this.assertStateBucketRegion("delete", logicalId, resourceType, physicalId, context.expectedRegion, context);
 		else this.announceUnverifiedBucketIdentity("delete", logicalId, physicalId, noRecordedRegionCause());
 		try {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
+			if (failedCreateOrphan && error instanceof BucketNotEmptyRefusal) return {
+				outcome: "skipped",
+				reason: FAILED_CREATE_ORPHAN_NOT_EMPTY_SKIP_REASON
+			};
 			if (error instanceof NoSuchBucket) {
 				const clientRegion = await this.s3Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
@@ -5020,6 +5038,34 @@ var S3BucketProvider = class S3BucketProvider {
 		if (filter?.["Prefix"] !== void 0) out["Prefix"] = filter["Prefix"];
 		return out;
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::S3::Bucket") return "unknown";
+		if (!isPlainBucketName(journaledPhysicalId) || !isPlainBucketName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		const want = canonicalizeRegion(context.expectedRegion);
+		if (canonicalizeRegion(await this.getRegion()) !== want) return "unknown";
+		const probe = await this.probeBucketRegion(record.physicalId);
+		return probe.kind === "region" && probe.region === want ? "different" : "unknown";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::S3::Bucket" || !isPlainBucketName(physicalId)) return void 0;
+		const want = canonicalizeRegion(context.expectedRegion);
+		if (canonicalizeRegion(await this.getRegion()) !== want) return void 0;
+		const probe = await this.probeBucketRegion(physicalId);
+		if (probe.kind === "absent") return RESOURCE_NOT_FOUND;
+		if (probe.kind !== "region" || probe.region !== want) return void 0;
+		const started = Date.now();
+		for (let attempt = 0; attempt < BUCKET_LIST_IDENTITY_ATTEMPTS; attempt++) {
+			if (attempt > 0) {
+				if (Date.now() - started > BUCKET_LIST_IDENTITY_BUDGET_MS) return void 0;
+				await new Promise((r) => setTimeout(r, BUCKET_LIST_IDENTITY_DELAY_MS));
+			}
+			const listed = await this.listOwnedBucket(physicalId);
+			if ("unknown" in listed) return void 0;
+			const created = listed.bucket?.CreationDate;
+			if (created instanceof Date && !Number.isNaN(created.getTime())) return `${physicalId}|${want}|${created.toISOString()}`;
+		}
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
 		if (explicit) try {
@@ -5044,7 +5090,7 @@ var S3BucketProvider = class S3BucketProvider {
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
-				if (!allowAutoEmpty) throw new Error(`bucket ${displaySafe(bucketName)} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
+				if (!allowAutoEmpty) throw new BucketNotEmptyRefusal(`bucket ${displaySafe(bucketName)} is not empty. Matching CloudFormation, cdkd does not delete a non-empty bucket unless it opted into automatic emptying (CDK's autoDeleteObjects: true, i.e. the '${S3_AUTO_DELETE_OBJECTS_TAG}' tag). Either empty the bucket first (delete all objects — and for versioned buckets all object versions and delete markers), or redeploy with autoDeleteObjects: true and destroy again.`);
 				this.logger.info(`Bucket ${displaySafe(bucketName)} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
 				await this.emptyBucket(bucketName);
 				continue;
@@ -43817,6 +43863,17 @@ var NestedStackProvider = class {
 			nestedTemplates: void 0,
 			childUnaddressed: void 0
 		};
+		const childNoEchoReresolver = deleteContext?.noEchoReresolver === void 0 ? void 0 : await deleteContext.noEchoReresolver.forNestedChild(logicalId, {
+			properties: _properties,
+			noEchoLeaves: deleteContext.recordedNoEchoLeaves,
+			values: deleteContext.noEchoDeleteValues
+		}, childStackName, (templatePath) => {
+			const { template, grandchildTemplates } = this.readChildTemplate(templatePath);
+			return {
+				template,
+				nestedTemplates: grandchildTemplates
+			};
+		}, (properties) => this.extractParameters(properties));
 		const childResult = await withNestedStackContext(childCtx, () => runDestroyForStack(childStackName, childStateData.state, {
 			stateBackend: ctx.stateBackend,
 			lockManager: ctx.lockManager,
@@ -43832,6 +43889,7 @@ var NestedStackProvider = class {
 			...deleteContext?.removeProtection === true && { removeProtection: true },
 			...deleteContext?.resolveSecretDerivedPrincipals !== void 0 && { resolveSecretDerivedPrincipals: { inheritedProducerRegions: deleteContext.resolveSecretDerivedPrincipals.importedProducerRegions } },
 			...deleteContext?.stackDestroy === true && { stackDestroy: true },
+			...childNoEchoReresolver !== void 0 && { noEchoReresolver: childNoEchoReresolver },
 			...(ctx.destroyOptions?.skipFinalSnapshot === true || ctx.options?.skipFinalSnapshot === true) && { skipFinalSnapshot: true },
 			...ctx.destroyOptions?.resourceWarnAfterMs !== void 0 && { resourceWarnAfterMs: ctx.destroyOptions.resourceWarnAfterMs },
 			...ctx.destroyOptions?.resourceTimeoutMs !== void 0 && { resourceTimeoutMs: ctx.destroyOptions.resourceTimeoutMs },
@@ -44377,4 +44435,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-ByXP467R.js.map
+//# sourceMappingURL=provider-classes-D9az4nS4.js.map