@go-to-k/cdkd 0.296.26 → 0.296.27

package/dist/{provider-classes-C2uFHLt7.js → provider-classes-BcSDENeH.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-BoZuWtxK.js";
+import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-B61e5_Sk.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as definedAttributes, At as awaitInFlightSibling, B as INDEX_SETTLE_POLL_INTERVAL_MS, Ba as toCfnInteger, Co as hasMaskableValues, Cr as observeThenDisableInstanceApiTermination, Ea as findSilentDropProperties, F as compensateRemovedDeletionProtection, Fo as redactSecretsForState, G as hasCdkAutoDeleteTag, Ga as configIntegerRefusal, Gc as renderAssemblyPathEscape, Gn as acquireIdempotencyToken, Go as carriesSecretMask, Gr as s3BucketDomainName, H as waitForIndexesSettled, Ha as coerceCfnBoolean, I as deleteBudgetKey, J as markRefusedBeforeApplying, Ja as replayWarn, Jn as planTagDiff, Jr as s3BucketWebsiteUrl, K as isTruthyCfnBoolean, Ka as configStringRefusal, Kc as resolveAssemblyPath, Ki as refuseMalformedNestedChildOutputs, Kn as DBPROXY_TAGS_WHAT, Kr as s3BucketDualStackDomainName, L as resolveDynamoDbDeleteBudgetClock, La as WARM_THROUGHPUT_MEMBERS, M as DynamoDBGlobalTableProvider, Mc as canonicalizeRegion, Mt as getStackRecords, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Nc as derivePartitionAndUrlSuffix, Oa as withoutSilentDropProperties, P as beginDeleteWait, Po as markSameGenerationBag, Qn as tagPlanWarning, Qr as getAccountInfo, Qt as redactedDeleteAddressSkip, R as resolveDynamoDbDeleteBudgetMs, Ra as coerceWarmThroughput$1, Ro as dynamicReferenceTokens, Sr as isTerminationProtectionPropagationError, Tr as reEnableInstanceApiTermination, U as ECR_AUTO_DELETE_IMAGES_TAG, Ua as coerceCfnInteger, Uc as describeFileReadFailure, Un as reserveStackCreateToken, Ur as isSettledInstanceState, V as deleteTableWithIndexBusyRetry, Va as toFiniteNumber, Vn as earliestDefined, W as S3_AUTO_DELETE_OBJECTS_TAG, Wa as configBooleanRefusal, Wc as displayAssemblyPath, Wo as recoverMaskedOutput, Wr as s3BucketArn, Xa as requireConfigObject, Xn as refuseMalformedDesiredTags, Xt as isRedactedRecordedValue, Ya as requireConfigArray, Yn as readTagList, Yt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Za as requireConfigString, Zn as tagMapAsList, Zt as redactedDeleteAddressFields, _i as accountArgs, _r as withIndeterminateGuard, a as findNestedTemplateTreeDefect, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ci as parseWebACLArn, di as passedParameterClassesOf, er as stringifyIfAssigned, fa as refuseMalformedResourcesForDestroy, fr as slowCcOperationTimeoutMs, go as passedNoEchoParametersOf, gr as deleteSkipReason, gt as revertNestedChildFromJournal, io as sameLambdaFunctionAddress, kc as decodeListingKey, ks as rewriteTemplateAssetReferences, lr as getCurrentResourceSecrets, no as canonicalLambdaFunctionName, o as isAbsoluteAssetPath, pr as unchangedBehindSecretReference, pt as getNestedRevertRun, q as getPriorAttempts, qa as readConfigString, qn as DBPROXY_TAG_OPTIONS, qr as s3BucketRegionalDomainName, qt as getCurrentProducerRegions, ro as lambdaFunctionNameForMask, s as listNestedTemplateRows, t as DeployEngine, to as withRetry, vr as isWaitAbandonedError, wa as withheldAccountClause, wr as reDisableInstanceApiTermination, ws as stringifyValue, xr as ec2InstanceProtectionSite, yr as markWaitAbandoned, yt as getCurrentNestedStackContext, z as DELETE_INDEX_WAIT_PROCEED_NOTE, za as isWarmThroughputDecrease } from "./deploy-engine-DsF6NsaQ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ff8olbc5.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CXVhqA7j.js";
-import { RDSProvider } from "./rds-provider-CgIK1n7q.js";
-import { NeptuneProvider } from "./neptune-provider-4HoOfrUS.js";
-import { ASGProvider } from "./asg-provider-CbKWXl3P.js";
+import { $n as definedAttributes, At as awaitInFlightSibling, B as INDEX_SETTLE_POLL_INTERVAL_MS, Ba as toCfnInteger, Co as hasMaskableValues, Cr as observeThenDisableInstanceApiTermination, Ea as findSilentDropProperties, F as compensateRemovedDeletionProtection, Fo as redactSecretsForState, G as hasCdkAutoDeleteTag, Ga as configIntegerRefusal, Gc as renderAssemblyPathEscape, Gn as acquireIdempotencyToken, Go as carriesSecretMask, Gr as s3BucketDomainName, H as waitForIndexesSettled, Ha as coerceCfnBoolean, I as deleteBudgetKey, J as markRefusedBeforeApplying, Ja as replayWarn, Jn as planTagDiff, Jr as s3BucketWebsiteUrl, K as isTruthyCfnBoolean, Ka as configStringRefusal, Kc as resolveAssemblyPath, Ki as refuseMalformedNestedChildOutputs, Kn as DBPROXY_TAGS_WHAT, Kr as s3BucketDualStackDomainName, L as resolveDynamoDbDeleteBudgetClock, La as WARM_THROUGHPUT_MEMBERS, M as DynamoDBGlobalTableProvider, Mc as canonicalizeRegion, Mt as getStackRecords, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Nc as derivePartitionAndUrlSuffix, Oa as withoutSilentDropProperties, P as beginDeleteWait, Po as markSameGenerationBag, Qn as tagPlanWarning, Qr as getAccountInfo, Qt as redactedDeleteAddressSkip, R as resolveDynamoDbDeleteBudgetMs, Ra as coerceWarmThroughput$1, Ro as dynamicReferenceTokens, Sr as isTerminationProtectionPropagationError, Tr as reEnableInstanceApiTermination, U as ECR_AUTO_DELETE_IMAGES_TAG, Ua as coerceCfnInteger, Uc as describeFileReadFailure, Un as reserveStackCreateToken, Ur as isSettledInstanceState, V as deleteTableWithIndexBusyRetry, Va as toFiniteNumber, Vn as earliestDefined, W as S3_AUTO_DELETE_OBJECTS_TAG, Wa as configBooleanRefusal, Wc as displayAssemblyPath, Wo as recoverMaskedOutput, Wr as s3BucketArn, Xa as requireConfigObject, Xn as refuseMalformedDesiredTags, Xt as isRedactedRecordedValue, Ya as requireConfigArray, Yn as readTagList, Yt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Za as requireConfigString, Zn as tagMapAsList, Zt as redactedDeleteAddressFields, _i as accountArgs, _r as withIndeterminateGuard, a as findNestedTemplateTreeDefect, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ci as parseWebACLArn, di as passedParameterClassesOf, er as stringifyIfAssigned, fa as refuseMalformedResourcesForDestroy, fr as slowCcOperationTimeoutMs, go as passedNoEchoParametersOf, gr as deleteSkipReason, gt as revertNestedChildFromJournal, io as sameLambdaFunctionAddress, kc as decodeListingKey, ks as rewriteTemplateAssetReferences, lr as getCurrentResourceSecrets, no as canonicalLambdaFunctionName, o as isAbsoluteAssetPath, pr as unchangedBehindSecretReference, pt as getNestedRevertRun, q as getPriorAttempts, qa as readConfigString, qn as DBPROXY_TAG_OPTIONS, qr as s3BucketRegionalDomainName, qt as getCurrentProducerRegions, ro as lambdaFunctionNameForMask, s as listNestedTemplateRows, t as DeployEngine, to as withRetry, vr as isWaitAbandonedError, wa as withheldAccountClause, wr as reDisableInstanceApiTermination, ws as stringifyValue, xr as ec2InstanceProtectionSite, yr as markWaitAbandoned, yt as getCurrentNestedStackContext, z as DELETE_INDEX_WAIT_PROCEED_NOTE, za as isWarmThroughputDecrease } from "./deploy-engine-DC4Yblxp.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BA2eujXF.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BwNb3_Ot.js";
+import { RDSProvider } from "./rds-provider-iouJXdXX.js";
+import { NeptuneProvider } from "./neptune-provider-DME95IcZ.js";
+import { ASGProvider } from "./asg-provider-BiMLPagi.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -10095,6 +10095,9 @@ function canonicalJson(value) {
 
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
+function isTableName(id) {
+	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
+}
 function mapSSESpecification(raw) {
 	if (raw === null || typeof raw !== "object") return;
 	const cfn = raw;
@@ -10453,6 +10456,7 @@ var DynamoDBTableProvider = class {
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
 		let tableCreated = false;
+		let createdTableId;
 		try {
 			const billingMode = requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", replayWarn(this.logger, context));
 			if (context?.replayingState !== true) {
@@ -10500,8 +10504,9 @@ var DynamoDBTableProvider = class {
 			if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
 			const createResourcePolicyDoc = this.extractResourcePolicyDocument(properties["ResourcePolicy"]);
 			if (createResourcePolicyDoc !== void 0) createParams.ResourcePolicy = createResourcePolicyDoc;
-			await (await this.getCreateClient()).send(new CreateTableCommand(createParams));
+			const createOut = await (await this.getCreateClient()).send(new CreateTableCommand(createParams));
 			tableCreated = true;
+			createdTableId = createOut?.TableDescription?.TableId;
 			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
 			const tableInfo = await this.waitForTableActive(tableName);
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
@@ -10533,7 +10538,7 @@ var DynamoDBTableProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 			}
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, tableName, error instanceof Error ? error : void 0);
-			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName);
+			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName, createdTableId);
 			throw thrown;
 		}
 	}
@@ -10877,7 +10882,8 @@ var DynamoDBTableProvider = class {
 			if (error instanceof ResourceNotFoundException$1) {
 				const clientRegion = await this.dynamoDBClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  DynamoDB table ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
@@ -11413,6 +11419,36 @@ var DynamoDBTableProvider = class {
 			throw err;
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::DynamoDB::Table") return "unknown";
+		if (!isTableName(journaledPhysicalId) || !isTableName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.dynamoDBClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordTableId = await this.readTableIdIfExists(record.physicalId);
+		if (recordTableId === void 0) return "unknown";
+		const journaledTableId = await this.readTableIdIfExists(journaledPhysicalId);
+		if (journaledTableId === void 0) return "different";
+		return journaledTableId === recordTableId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::DynamoDB::Table" || !isTableName(physicalId)) return void 0;
+		if (await this.dynamoDBClient.config.region() !== context.expectedRegion) return void 0;
+		const live = await this.readTableIdIfExists(physicalId);
+		return live === void 0 ? RESOURCE_NOT_FOUND : live;
+	}
+	async readTableIdIfExists(tableName) {
+		let response;
+		try {
+			response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$1) return void 0;
+			throw error;
+		}
+		if (response.Table?.TableName !== tableName) throw new Error("DescribeTable answered for another table than the one asked for");
+		const tableId = response.Table.TableId;
+		if (typeof tableId !== "string" || tableId === "") throw new Error("DescribeTable returned no TableId");
+		return tableId;
+	}
 	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isWarmThroughputDecrease(desired, live)) return false;
@@ -11896,7 +11932,7 @@ var LogsLogGroupProvider = class {
 				maskSecrets: maskerOrIdentity(context?.maskSecrets)
 			});
 			const disableStep = disableCommand ? `Then disable deletion protection — \`${disableCommand}\`, or via the console — and re-deploy with ${replaceFlags}` : `${UNNAMEABLE_ID_CLAUSE} Then re-deploy with ${replaceFlags}`;
-			const remedy = deletionProtected ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. ${disableStep} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`;
+			const remedy = deletionProtected ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" at https://cdkd.dev/cli-deploy-safety/#deletion-protection-blocks-a-replacement-and-deploy-cannot-clear-it BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. ${disableStep} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`;
 			const shownClass = (c) => plainIdentOr(c, "a class value that is not a plain identifier");
 			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass (from ${shownClass(prevClass)} to ${shownClass(nextClass)}) cannot be changed after creation. ${remedy} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		}
@@ -12142,6 +12178,9 @@ var LogsLogGroupProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/cloudwatch-alarm-provider.ts
+function isAlarmWriteThrottle(error) {
+	return isThrottlingError(error) || error instanceof Error && error.message.includes("Rate exceeded");
+}
 var CloudWatchAlarmProvider = class {
 	cloudWatchClient;
 	logger = getLogger().child("CloudWatchAlarmProvider");
@@ -12184,7 +12223,7 @@ var CloudWatchAlarmProvider = class {
 				Key,
 				Value
 			}));
-			await this.cloudWatchClient.send(new PutMetricAlarmCommand(createParams));
+			await this.sendWithThrottleRetry("PutMetricAlarm", logicalId, () => this.cloudWatchClient.send(new PutMetricAlarmCommand(createParams)));
 			this.logger.debug(`Successfully created CloudWatch alarm ${logicalId}: ${alarmName}`);
 			return {
 				physicalId: alarmName,
@@ -12199,7 +12238,7 @@ var CloudWatchAlarmProvider = class {
 		this.logger.debug(`Updating CloudWatch alarm ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
-			await this.cloudWatchClient.send(new PutMetricAlarmCommand(this.buildAlarmParams(physicalId, properties)));
+			await this.sendWithThrottleRetry("PutMetricAlarm", logicalId, () => this.cloudWatchClient.send(new PutMetricAlarmCommand(this.buildAlarmParams(physicalId, properties))));
 			this.logger.debug(`Successfully updated CloudWatch alarm ${logicalId}`);
 			const alarmArn = await this.getAlarmArn(physicalId);
 			await this.applyTagDiff(alarmArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
@@ -12213,10 +12252,34 @@ var CloudWatchAlarmProvider = class {
 			throw new ProvisioningError(`Failed to update CloudWatch alarm ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	throttleDelaysMs = [
+		1e3,
+		2e3,
+		4e3,
+		8e3,
+		16e3,
+		2e4,
+		2e4,
+		2e4
+	];
+	throttleJitter = () => Math.random();
+	throttleSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+	async sendWithThrottleRetry(label, logicalId, send) {
+		for (let retry = 0;; retry++) try {
+			await send();
+			return;
+		} catch (error) {
+			const ceiling = this.throttleDelaysMs[retry];
+			if (ceiling === void 0 || !isAlarmWriteThrottle(error)) throw error;
+			const delay = Math.round(ceiling / 2 + this.throttleJitter() * ceiling / 2);
+			this.logger.debug(safeMsg`${label} for ${logicalId} was throttled; retrying in ${delay}ms (retry ${retry + 1}/${this.throttleDelaysMs.length})`);
+			await this.throttleSleep(delay);
+		}
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting CloudWatch alarm ${logicalId}: ${physicalId}`);
 		try {
-			await this.cloudWatchClient.send(new DeleteAlarmsCommand({ AlarmNames: [physicalId] }));
+			await this.sendWithThrottleRetry("DeleteAlarms", logicalId, () => this.cloudWatchClient.send(new DeleteAlarmsCommand({ AlarmNames: [physicalId] })));
 			this.logger.debug(`Successfully deleted CloudWatch alarm ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && error.name === "ResourceNotFound") {
@@ -44511,4 +44574,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-C2uFHLt7.js.map
+//# sourceMappingURL=provider-classes-BcSDENeH.js.map