@go-to-k/cdkd 0.296.28 → 0.296.29

package/dist/{provider-classes-wbKBBEol.js → provider-classes-eEgFT-Vt.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-B61e5_Sk.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Cz2tPxXk.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as tagPlanWarning, $r as getAccountInfo, $t as redactedDeleteAddressSkip, Ac as decodeListingKey, As as rewriteTemplateAssetReferences, At as awaitInFlightSibling, B as INDEX_SETTLE_POLL_INTERVAL_MS, Ba as isWarmThroughputDecrease, Cr as isTerminationProtectionPropagationError, Da as findSilentDropProperties, Er as reEnableInstanceApiTermination, F as compensateRemovedDeletionProtection, Fo as markSameGenerationBag, G as hasCdkAutoDeleteTag, Ga as configBooleanRefusal, Gc as displayAssemblyPath, Go as recoverMaskedOutput, Gr as s3BucketArn, H as waitForIndexesSettled, Ha as toFiniteNumber, Hn as earliestDefined, I as deleteBudgetKey, Io as redactSecretsForState, J as markRefusedBeforeApplying, Ja as readConfigString, Jn as DBPROXY_TAG_OPTIONS, Jr as s3BucketRegionalDomainName, Jt as getCurrentProducerRegions, K as isTruthyCfnBoolean, Ka as configIntegerRefusal, Kc as renderAssemblyPathEscape, Kn as acquireIdempotencyToken, Ko as carriesSecretMask, Kr as s3BucketDomainName, L as resolveDynamoDbDeleteBudgetClock, M as DynamoDBGlobalTableProvider, Mt as getStackRecords, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Nc as canonicalizeRegion, P as beginDeleteWait, Pc as derivePartitionAndUrlSuffix, Qa as requireConfigString, Qn as tagMapAsList, Qt as redactedDeleteAddressFields, R as resolveDynamoDbDeleteBudgetMs, Ra as WARM_THROUGHPUT_MEMBERS, Sr as ec2InstanceProtectionSite, Ta as withheldAccountClause, Tr as reDisableInstanceApiTermination, Ts as stringifyValue, U as ECR_AUTO_DELETE_IMAGES_TAG, Ua as coerceCfnBoolean, V as deleteTableWithIndexBusyRetry, Va as toCfnInteger, W as S3_AUTO_DELETE_OBJECTS_TAG, Wa as coerceCfnInteger, Wc as describeFileReadFailure, Wn as reserveStackCreateToken, Wr as isSettledInstanceState, Xa as requireConfigArray, Xn as readTagList, Xt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ya as replayWarn, Yn as planTagDiff, Yr as s3BucketWebsiteUrl, Za as requireConfigObject, Zn as refuseMalformedDesiredTags, Zt as isRedactedRecordedValue, _o as passedNoEchoParametersOf, _r as deleteSkipReason, a as findNestedTemplateTreeDefect, ao as sameLambdaFunctionAddress, br as markWaitAbandoned, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, er as definedAttributes, fi as passedParameterClassesOf, gt as revertNestedChildFromJournal, io as lambdaFunctionNameForMask, ka as withoutSilentDropProperties, li as parseWebACLArn, mr as unchangedBehindSecretReference, no as withRetry, o as isAbsoluteAssetPath, pa as refuseMalformedResourcesForDestroy, pr as slowCcOperationTimeoutMs, pt as getNestedRevertRun, q as getPriorAttempts, qa as configStringRefusal, qc as resolveAssemblyPath, qi as refuseMalformedNestedChildOutputs, qn as DBPROXY_TAGS_WHAT, qr as s3BucketDualStackDomainName, ro as canonicalLambdaFunctionName, s as listNestedTemplateRows, t as DeployEngine, tr as stringifyIfAssigned, ur as getCurrentResourceSecrets, vi as accountArgs, vr as withIndeterminateGuard, wo as hasMaskableValues, wr as observeThenDisableInstanceApiTermination, yr as isWaitAbandonedError, yt as getCurrentNestedStackContext, z as DELETE_INDEX_WAIT_PROCEED_NOTE, za as coerceWarmThroughput$1, zo as dynamicReferenceTokens } from "./deploy-engine-D4FdwPCi.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-0U4kMuzh.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-v_QNBjtZ.js";
-import { RDSProvider } from "./rds-provider-BfQsw4hw.js";
-import { NeptuneProvider } from "./neptune-provider-DF6Eh4Tl.js";
-import { ASGProvider } from "./asg-provider-B3zcS87C.js";
+import { $ as getPriorAttempts, $a as configStringRefusal, $i as refuseMalformedNestedChildOutputs, $n as DBPROXY_TAGS_WHAT, $r as s3BucketDualStackDomainName, Ao as hasMaskableValues, Ar as observeThenDisableInstanceApiTermination, B as beginDeleteWait, Co as passedNoEchoParametersOf, Cr as deleteSkipReason, Er as markWaitAbandoned, Et as withNestedStackContext, Fa as withoutSilentDropProperties, G as DELETE_INDEX_WAIT_PROCEED_NOTE, Ga as coerceWarmThroughput$1, Gc as canonicalizeRegion, Go as dynamicReferenceTokens, H as deleteBudgetKey, Hc as decodeListingKey, Ho as redactSecretsForState, Hs as rewriteTemplateAssetReferences, It as awaitInFlightSibling, J as waitForIndexesSettled, Ja as toFiniteNumber, Jn as earliestDefined, K as INDEX_SETTLE_POLL_INTERVAL_MS, Ka as isWarmThroughputDecrease, Kc as derivePartitionAndUrlSuffix, Ls as stringifyValue, Mr as reEnableInstanceApiTermination, Na as findSilentDropProperties, Or as ec2InstanceProtectionSite, Q as isTruthyCfnBoolean, Qa as configIntegerRefusal, Qn as acquireIdempotencyToken, Qo as carriesSecretMask, Qr as s3BucketDomainName, R as DynamoDBGlobalTableProvider, Rt as getStackRecords, St as revertNestedChildFromJournal, Tr as isWaitAbandonedError, Tt as getCurrentNestedStackContext, U as resolveDynamoDbDeleteBudgetClock, V as compensateRemovedDeletionProtection, Vo as markSameGenerationBag, W as resolveDynamoDbDeleteBudgetMs, Wa as WARM_THROUGHPUT_MEMBERS, X as S3_AUTO_DELETE_OBJECTS_TAG, Xa as coerceCfnInteger, Xn as reserveStackCreateToken, Xr as isSettledInstanceState, Y as ECR_AUTO_DELETE_IMAGES_TAG, Ya as coerceCfnBoolean, Z as hasCdkAutoDeleteTag, Za as configBooleanRefusal, Zo as recoverMaskedOutput, Zr as s3BucketArn, a as findNestedTemplateTreeDefect, ai as getAccountInfo, al as resolveAssemblyPath, an as redactedDeleteAddressSkip, ar as tagPlanWarning, b as lookupEachName, br as unchangedBehindSecretReference, c as renderNestedTemplateTreeDefect, co as withRetry, do as sameLambdaFunctionAddress, ei as s3BucketRegionalDomainName, en as getCurrentProducerRegions, eo as readConfigString, er as DBPROXY_TAG_OPTIONS, et as markRefusedBeforeApplying, gr as getCurrentResourceSecrets, hi as parseWebACLArn, il as renderAssemblyPathEscape, in as redactedDeleteAddressFields, io as requireConfigString, ir as tagMapAsList, ja as withheldAccountClause, jr as reDisableInstanceApiTermination, kr as isTerminationProtectionPropagationError, lo as canonicalLambdaFunctionName, nl as describeFileReadFailure, nn as REDACTED_DELETE_ADDRESS_SKIP_REASON, no as requireConfigArray, nr as readTagList, o as isAbsoluteAssetPath, or as definedAttributes, q as deleteTableWithIndexBusyRetry, qa as toCfnInteger, rl as displayAssemblyPath, rn as isRedactedRecordedValue, ro as requireConfigObject, rr as refuseMalformedDesiredTags, s as listNestedTemplateRows, sr as stringifyIfAssigned, t as DeployEngine, ti as s3BucketWebsiteUrl, to as replayWarn, tr as planTagDiff, uo as lambdaFunctionNameForMask, v as chunks, vi as passedParameterClassesOf, wi as accountArgs, wr as withIndeterminateGuard, x as withApiLimit, y as isAccessDeniedError, ya as refuseMalformedResourcesForDestroy, yr as slowCcOperationTimeoutMs, yt as getNestedRevertRun, z as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS } from "./deploy-engine-Bt-8KvUj.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BBFYFBLx.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CN7Dqb3j.js";
+import { RDSProvider } from "./rds-provider-DgbVxaPP.js";
+import { NeptuneProvider } from "./neptune-provider-B9InVgs6.js";
+import { ASGProvider } from "./asg-provider-UKRukGI_.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -4375,11 +4375,7 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const explicitBucketName = Boolean(properties["BucketName"]);
-		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true,
-			allowedPattern: /[^a-z0-9.-]/g
-		});
+		const bucketName = properties["BucketName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		let bucketLeftBehind = false;
 		let ambiguousWindow;
 		let windowSpent = false;
@@ -5128,6 +5124,14 @@ var S3BucketProvider = class S3BucketProvider {
 			if (created instanceof Date && !Number.isNaN(created.getTime())) return `${physicalId}|${want}|${created.toISOString()}`;
 		}
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["BucketName"]) return void 0;
+		return generateResourceName(logicalId, {
+			maxLength: 63,
+			lowercase: true,
+			allowedPattern: /[^a-z0-9.-]/g
+		});
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
 		if (explicit) try {
@@ -5468,10 +5472,32 @@ var SQSQueueProvider = class {
 		this.sqsClient = awsClients.sqs;
 		this.stsClient = awsClients.sts;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["QueueName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 80 });
+	}
+	async holderCreatedAt(_resourceType, physicalId) {
+		const resp = await this.sqsClient.send(new GetQueueAttributesCommand({
+			QueueUrl: physicalId,
+			AttributeNames: ["CreatedTimestamp"]
+		}));
+		const seconds = Number(resp.Attributes?.["CreatedTimestamp"]);
+		return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+	}
+	async lookupNames(_resourceType, names) {
+		return lookupEachName(names, "sqs:GetQueueUrl", 10, async (name) => {
+			try {
+				return (await this.sqsClient.send(new GetQueueUrlCommand({ QueueName: name }))).QueueUrl;
+			} catch (err) {
+				if (err instanceof QueueDoesNotExist) return void 0;
+				throw err;
+			}
+		});
+	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating SQS queue ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const queueName = properties["QueueName"] || generateResourceName(logicalId, { maxLength: 80 });
+		const queueName = properties["QueueName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		try {
 			const attributes = {};
 			for (const [cdkKey, sqsKey] of Object.entries(CDK_TO_SQS_ATTRIBUTES)) if (properties[cdkKey] !== void 0) {
@@ -6210,7 +6236,7 @@ var SNSTopicProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		this.logger.debug(`Creating SNS topic ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const topicName = properties["TopicName"] || generateResourceName(logicalId, { maxLength: 256 });
+		const topicName = properties["TopicName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		let leftBehindArn;
 		try {
 			const topicAttributes = {};
@@ -6535,6 +6561,10 @@ var SNSTopicProvider = class {
 	getDriftUnknownPaths() {
 		return [];
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["TopicName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 256 });
+	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
 			await this.snsClient.send(new GetTopicAttributesCommand({ TopicArn: input.knownPhysicalId }));
@@ -11811,12 +11841,45 @@ var LogsLogGroupProvider = class {
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
 	}
-	async create(logicalId, resourceType, properties, context) {
-		this.logger.debug(`Creating log group ${logicalId}`);
-		const logGroupName = properties["LogGroupName"] || `/cdkd/${generateResourceName(logicalId, {
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["LogGroupName"]) return void 0;
+		return `/cdkd/${generateResourceName(logicalId, {
 			maxLength: 506,
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
 		})}`;
+	}
+	async holderCreatedAt(_resourceType, physicalId) {
+		const group = (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: physicalId }))).logGroups?.find((g) => g.logGroupName === physicalId);
+		return typeof group?.creationTime === "number" ? group.creationTime : void 0;
+	}
+	async lookupNames(_resourceType, names) {
+		try {
+			const found = /* @__PURE__ */ new Map();
+			const wanted = new Set(names);
+			await Promise.all(chunks(names, 50).map((chunk) => withApiLimit("logs:DescribeLogGroups", 3, async () => {
+				const resp = await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupIdentifiers: chunk }));
+				for (const group of resp.logGroups ?? []) {
+					const name = group.logGroupName;
+					if (name !== void 0 && wanted.has(name)) found.set(name, name);
+				}
+			})));
+			return found;
+		} catch (err) {
+			const name = err?.name;
+			if (!isAccessDeniedError(err) && name !== "InvalidParameterException" && name !== "ValidationException") throw err;
+		}
+		return lookupEachName(names, "logs:DescribeLogGroups", 3, async (logGroupName) => {
+			try {
+				return (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: logGroupName }))).logGroups?.some((g) => g.logGroupName === logGroupName) ? logGroupName : void 0;
+			} catch (err) {
+				if (err instanceof ResourceNotFoundException$5) return void 0;
+				throw err;
+			}
+		});
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(`Creating log group ${logicalId}`);
+		const logGroupName = properties["LogGroupName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		let leftBehind = false;
 		try {
@@ -12216,7 +12279,7 @@ var CloudWatchAlarmProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CloudWatch alarm ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const alarmName = properties["AlarmName"] || generateResourceName(logicalId, { maxLength: 256 });
+		const alarmName = properties["AlarmName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		try {
 			const createParams = this.buildAlarmParams(alarmName, properties);
 			if (desiredTags.length > 0) createParams.Tags = desiredTags.map(({ Key, Value }) => ({
@@ -12428,6 +12491,26 @@ var CloudWatchAlarmProvider = class {
 		}
 		return result;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["AlarmName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 256 });
+	}
+	async lookupNames(_resourceType, names) {
+		const wanted = new Set(names);
+		const found = /* @__PURE__ */ new Map();
+		await Promise.all(chunks(names, 100).map((chunk) => withApiLimit("cloudwatch:DescribeAlarms", 3, async () => {
+			const resp = await this.cloudWatchClient.send(new DescribeAlarmsCommand({
+				AlarmNames: chunk,
+				AlarmTypes: ["MetricAlarm", "CompositeAlarm"],
+				MaxRecords: 100
+			}));
+			for (const alarm of [...resp.MetricAlarms ?? [], ...resp.CompositeAlarms ?? []]) {
+				const name = alarm.AlarmName;
+				if (name !== void 0 && wanted.has(name)) found.set(name, name);
+			}
+		})));
+		return found;
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "AlarmName");
 		if (explicit) try {
@@ -13417,7 +13500,7 @@ var EventBridgeRuleProvider = class {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(`Creating EventBridge rule ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
+		const ruleName = properties["Name"] || this.generatedCreateName(resourceType, logicalId, properties);
 		const targets = properties["Targets"];
 		let leftLiveArn;
 		try {
@@ -13646,6 +13729,43 @@ var EventBridgeRuleProvider = class {
 		}
 		return result;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["Name"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 64 });
+	}
+	lookupNeedsResolvedProperties(_resourceType, properties) {
+		const bus = properties["EventBusName"];
+		return bus !== void 0 && bus !== null && bus !== "" && typeof bus !== "string";
+	}
+	async lookupNames(_resourceType, names, context) {
+		const busOf = (name) => {
+			const bus = context.propertiesByName.get(name)?.["EventBusName"];
+			if (bus === void 0 || bus === null || bus === "") return void 0;
+			if (typeof bus !== "string") throw new Error(`EventBusName of rule ${name} is not resolved`);
+			return bus;
+		};
+		const byBus = /* @__PURE__ */ new Map();
+		for (const name of names) {
+			const bus = busOf(name);
+			byBus.set(bus, [...byBus.get(bus) ?? [], name]);
+		}
+		const found = /* @__PURE__ */ new Map();
+		await Promise.all([...byBus].map(async ([bus, group]) => {
+			const each = await lookupEachName(group, "events:DescribeRule", 5, async (name) => {
+				try {
+					return (await this.eventBridgeClient.send(new DescribeRuleCommand({
+						Name: name,
+						...bus !== void 0 && { EventBusName: bus }
+					}))).Arn;
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$2) return void 0;
+					throw err;
+				}
+			});
+			for (const [name, arn] of each) found.set(name, arn);
+		}));
+		return found;
+	}
 	async import(input) {
 		const eventBusName = input.properties["EventBusName"];
 		if (input.knownPhysicalId) try {
@@ -21670,7 +21790,7 @@ var StepFunctionsProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating Step Functions state machine ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const stateMachineName = properties["StateMachineName"] || generateResourceName(logicalId, { maxLength: 80 });
+		const stateMachineName = properties["StateMachineName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for Step Functions state machine ${logicalId}`, resourceType, logicalId);
 		try {
@@ -21809,9 +21929,18 @@ var StepFunctionsProvider = class {
 		}
 		return result;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["StateMachineName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 80 });
+	}
+	async holderCreatedAt(_resourceType, physicalId) {
+		const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: physicalId }));
+		return resp.creationDate instanceof Date ? resp.creationDate.getTime() : void 0;
+	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
 			const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: input.knownPhysicalId }));
+			if (resp.status === "DELETING") return null;
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes: definedAttributes({
@@ -22217,7 +22346,7 @@ var ECSProvider = class {
 		log.debug(`Creating ECS cluster ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
-		const clusterName = properties["ClusterName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const clusterName = properties["ClusterName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		try {
 			const cluster = (await client.send(new CreateClusterCommand({
 				clusterName,
@@ -23320,6 +23449,25 @@ var ECSProvider = class {
 		result["Tags"] = normalizeAwsTagsToCfn(resp.tags);
 		return result;
 	}
+	generatedCreateName(resourceType, logicalId, properties) {
+		if (resourceType !== "AWS::ECS::Cluster" || properties["ClusterName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 255 });
+	}
+	async lookupNames(resourceType, names) {
+		const found = /* @__PURE__ */ new Map();
+		if (resourceType !== "AWS::ECS::Cluster") return found;
+		const wanted = new Set(names);
+		await Promise.all(chunks(names, 100).map((chunk) => withApiLimit("ecs:DescribeClusters", 5, async () => {
+			const resp = await this.getClient().send(new DescribeClustersCommand({ clusters: chunk }));
+			const unanswered = (resp.failures ?? []).find((f) => f.reason !== "MISSING");
+			if (unanswered !== void 0) throw new Error(`DescribeClusters did not answer: ${displaySafe(unanswered.reason ?? "no reason given")}`);
+			for (const cluster of resp.clusters ?? []) {
+				const name = cluster.clusterName;
+				if (name !== void 0 && wanted.has(name) && cluster.status !== "INACTIVE") found.set(name, name);
+			}
+		})));
+		return found;
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::ECS::Cluster": return this.importCluster(input);
@@ -24625,6 +24773,31 @@ var ELBv2Provider = class {
 			this.logger.debug(`ELBv2 DescribeTags(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
+	generatedCreateName(resourceType, logicalId, properties) {
+		if (resourceType !== "AWS::ElasticLoadBalancingV2::LoadBalancer" && resourceType !== "AWS::ElasticLoadBalancingV2::TargetGroup") return;
+		const declared = properties["Name"];
+		if (declared !== void 0 && declared !== null && declared !== "") return void 0;
+		return sentElbv2Name(properties, logicalId);
+	}
+	async holderCreatedAt(resourceType, physicalId) {
+		if (resourceType !== "AWS::ElasticLoadBalancingV2::LoadBalancer") return void 0;
+		const created = (await this.getClient().send(new DescribeLoadBalancersCommand({ LoadBalancerArns: [physicalId] }))).LoadBalancers?.[0]?.CreatedTime;
+		return created instanceof Date ? created.getTime() : void 0;
+	}
+	async lookupNames(resourceType, names) {
+		const lb = resourceType === "AWS::ElasticLoadBalancingV2::LoadBalancer";
+		if (!lb && resourceType !== "AWS::ElasticLoadBalancingV2::TargetGroup") return /* @__PURE__ */ new Map();
+		return lookupEachName(names, lb ? "elbv2:DescribeLoadBalancers" : "elbv2:DescribeTargetGroups", 3, async (name) => {
+			try {
+				if (lb) return onlyNamedMatch((await this.getClient().send(new DescribeLoadBalancersCommand({ Names: [name] }))).LoadBalancers, (l) => l.LoadBalancerArn, "load balancer").arn;
+				return onlyNamedMatch((await this.getClient().send(new DescribeTargetGroupsCommand({ Names: [name] }))).TargetGroups, (t) => t.TargetGroupArn, "target group").arn;
+			} catch (err) {
+				const errName = err.name;
+				if (errName === "LoadBalancerNotFoundException" || errName === "TargetGroupNotFoundException") return;
+				throw err;
+			}
+		});
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.importLoadBalancer(input);
@@ -44065,6 +44238,7 @@ var NestedStackProvider = class {
 		const childEngine = new DeployEngine(parentCtx.stateBackend, parentCtx.lockManager, parentCtx.dagBuilder, parentCtx.diffCalculator, parentCtx.providerRegistry, {
 			...parentCtx.options ?? {},
 			parameters: childParameters,
+			onDestructivePlan: void 0,
 			...inheritedSecrets && hasMaskableValues(inheritedSecrets) && { inheritedSecrets },
 			...passedClasses && { passedParameterClasses: passedClasses },
 			passedNoEchoParameters: passedNoEchoParametersOf(inheritedSecrets),
@@ -44574,4 +44748,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-wbKBBEol.js.map
+//# sourceMappingURL=provider-classes-eEgFT-Vt.js.map