@go-to-k/cdkd 0.296.28 → 0.296.30

package/dist/{provider-classes-wbKBBEol.js → provider-classes-DmZ0J68L.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-B61e5_Sk.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Cz2tPxXk.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as tagPlanWarning, $r as getAccountInfo, $t as redactedDeleteAddressSkip, Ac as decodeListingKey, As as rewriteTemplateAssetReferences, At as awaitInFlightSibling, B as INDEX_SETTLE_POLL_INTERVAL_MS, Ba as isWarmThroughputDecrease, Cr as isTerminationProtectionPropagationError, Da as findSilentDropProperties, Er as reEnableInstanceApiTermination, F as compensateRemovedDeletionProtection, Fo as markSameGenerationBag, G as hasCdkAutoDeleteTag, Ga as configBooleanRefusal, Gc as displayAssemblyPath, Go as recoverMaskedOutput, Gr as s3BucketArn, H as waitForIndexesSettled, Ha as toFiniteNumber, Hn as earliestDefined, I as deleteBudgetKey, Io as redactSecretsForState, J as markRefusedBeforeApplying, Ja as readConfigString, Jn as DBPROXY_TAG_OPTIONS, Jr as s3BucketRegionalDomainName, Jt as getCurrentProducerRegions, K as isTruthyCfnBoolean, Ka as configIntegerRefusal, Kc as renderAssemblyPathEscape, Kn as acquireIdempotencyToken, Ko as carriesSecretMask, Kr as s3BucketDomainName, L as resolveDynamoDbDeleteBudgetClock, M as DynamoDBGlobalTableProvider, Mt as getStackRecords, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Nc as canonicalizeRegion, P as beginDeleteWait, Pc as derivePartitionAndUrlSuffix, Qa as requireConfigString, Qn as tagMapAsList, Qt as redactedDeleteAddressFields, R as resolveDynamoDbDeleteBudgetMs, Ra as WARM_THROUGHPUT_MEMBERS, Sr as ec2InstanceProtectionSite, Ta as withheldAccountClause, Tr as reDisableInstanceApiTermination, Ts as stringifyValue, U as ECR_AUTO_DELETE_IMAGES_TAG, Ua as coerceCfnBoolean, V as deleteTableWithIndexBusyRetry, Va as toCfnInteger, W as S3_AUTO_DELETE_OBJECTS_TAG, Wa as coerceCfnInteger, Wc as describeFileReadFailure, Wn as reserveStackCreateToken, Wr as isSettledInstanceState, Xa as requireConfigArray, Xn as readTagList, Xt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ya as replayWarn, Yn as planTagDiff, Yr as s3BucketWebsiteUrl, Za as requireConfigObject, Zn as refuseMalformedDesiredTags, Zt as isRedactedRecordedValue, _o as passedNoEchoParametersOf, _r as deleteSkipReason, a as findNestedTemplateTreeDefect, ao as sameLambdaFunctionAddress, br as markWaitAbandoned, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, er as definedAttributes, fi as passedParameterClassesOf, gt as revertNestedChildFromJournal, io as lambdaFunctionNameForMask, ka as withoutSilentDropProperties, li as parseWebACLArn, mr as unchangedBehindSecretReference, no as withRetry, o as isAbsoluteAssetPath, pa as refuseMalformedResourcesForDestroy, pr as slowCcOperationTimeoutMs, pt as getNestedRevertRun, q as getPriorAttempts, qa as configStringRefusal, qc as resolveAssemblyPath, qi as refuseMalformedNestedChildOutputs, qn as DBPROXY_TAGS_WHAT, qr as s3BucketDualStackDomainName, ro as canonicalLambdaFunctionName, s as listNestedTemplateRows, t as DeployEngine, tr as stringifyIfAssigned, ur as getCurrentResourceSecrets, vi as accountArgs, vr as withIndeterminateGuard, wo as hasMaskableValues, wr as observeThenDisableInstanceApiTermination, yr as isWaitAbandonedError, yt as getCurrentNestedStackContext, z as DELETE_INDEX_WAIT_PROCEED_NOTE, za as coerceWarmThroughput$1, zo as dynamicReferenceTokens } from "./deploy-engine-D4FdwPCi.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-0U4kMuzh.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-v_QNBjtZ.js";
-import { RDSProvider } from "./rds-provider-BfQsw4hw.js";
-import { NeptuneProvider } from "./neptune-provider-DF6Eh4Tl.js";
-import { ASGProvider } from "./asg-provider-B3zcS87C.js";
+import { $ as getPriorAttempts, $a as configBooleanRefusal, $n as acquireIdempotencyToken, $o as recoverMaskedOutput, $r as s3BucketArn, Ar as ec2InstanceProtectionSite, B as beginDeleteWait, Dr as isWaitAbandonedError, Dt as withNestedStackContext, Ei as accountArgs, Er as withIndeterminateGuard, Et as getCurrentNestedStackContext, Fa as findSilentDropProperties, G as DELETE_INDEX_WAIT_PROCEED_NOTE, H as deleteBudgetKey, J as waitForIndexesSettled, Ja as isWarmThroughputDecrease, Jc as derivePartitionAndUrlSuffix, K as INDEX_SETTLE_POLL_INTERVAL_MS, Ka as WARM_THROUGHPUT_MEMBERS, La as withoutSilentDropProperties, Lt as awaitInFlightSibling, Mo as hasMaskableValues, Mr as observeThenDisableInstanceApiTermination, Na as withheldAccountClause, Nr as reDisableInstanceApiTermination, Or as markWaitAbandoned, Pr as reEnableInstanceApiTermination, Q as isTruthyCfnBoolean, Qa as coerceCfnInteger, Qr as isSettledInstanceState, R as DynamoDBGlobalTableProvider, St as revertNestedChildFromJournal, To as passedNoEchoParametersOf, Tr as deleteSkipReason, U as resolveDynamoDbDeleteBudgetClock, Uo as markSameGenerationBag, V as compensateRemovedDeletionProtection, W as resolveDynamoDbDeleteBudgetMs, Wc as decodeListingKey, Wo as redactSecretsForState, Ws as rewriteTemplateAssetReferences, X as S3_AUTO_DELETE_OBJECTS_TAG, Xa as toFiniteNumber, Y as ECR_AUTO_DELETE_IMAGES_TAG, Ya as toCfnInteger, Yn as earliestDefined, Z as hasCdkAutoDeleteTag, Za as coerceCfnBoolean, Zn as reserveStackCreateToken, _i as parseWebACLArn, _r as getCurrentResourceSecrets, a as findNestedTemplateTreeDefect, al as displayAssemblyPath, an as redactedDeleteAddressFields, ao as requireConfigObject, ar as tagMapAsList, b as lookupEachName, bi as passedParameterClassesOf, br as slowCcOperationTimeoutMs, c as renderNestedTemplateTreeDefect, cr as stringifyIfAssigned, do as canonicalLambdaFunctionName, ei as s3BucketDomainName, eo as configIntegerRefusal, er as DBPROXY_TAGS_WHAT, es as carriesSecretMask, et as markRefusedBeforeApplying, fo as lambdaFunctionNameForMask, il as describeFileReadFailure, in as isRedactedRecordedValue, io as requireConfigArray, ir as refuseMalformedDesiredTags, jr as isTerminationProtectionPropagationError, ni as s3BucketRegionalDomainName, no as readConfigString, nr as planTagDiff, o as isAbsoluteAssetPath, ol as renderAssemblyPathEscape, on as redactedDeleteAddressSkip, oo as requireConfigString, or as tagPlanWarning, po as sameLambdaFunctionAddress, q as deleteTableWithIndexBusyRetry, qa as coerceWarmThroughput$1, qc as canonicalizeRegion, qo as dynamicReferenceTokens, ri as s3BucketWebsiteUrl, rn as REDACTED_DELETE_ADDRESS_SKIP_REASON, ro as replayWarn, rr as readTagList, s as listNestedTemplateRows, si as getAccountInfo, sl as resolveAssemblyPath, sr as definedAttributes, t as DeployEngine, ta as refuseMalformedNestedChildOutputs, ti as s3BucketDualStackDomainName, tn as getCurrentProducerRegions, to as configStringRefusal, tr as DBPROXY_TAG_OPTIONS, uo as withRetry, v as chunks, x as withApiLimit, xa as refuseMalformedResourcesForDestroy, xr as unchangedBehindSecretReference, y as isAccessDeniedError, yt as getNestedRevertRun, z as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, zs as stringifyValue, zt as getStackRecords } from "./deploy-engine-BuPc2Dfc.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CAiMUBcP.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CIxuz2zX.js";
+import { RDSProvider } from "./rds-provider-IBY6fDvN.js";
+import { NeptuneProvider } from "./neptune-provider-5yc_bOJ-.js";
+import { ASGProvider } from "./asg-provider-BaabA371.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -4375,11 +4375,7 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const explicitBucketName = Boolean(properties["BucketName"]);
-		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true,
-			allowedPattern: /[^a-z0-9.-]/g
-		});
+		const bucketName = properties["BucketName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		let bucketLeftBehind = false;
 		let ambiguousWindow;
 		let windowSpent = false;
@@ -5128,6 +5124,14 @@ var S3BucketProvider = class S3BucketProvider {
 			if (created instanceof Date && !Number.isNaN(created.getTime())) return `${physicalId}|${want}|${created.toISOString()}`;
 		}
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["BucketName"]) return void 0;
+		return generateResourceName(logicalId, {
+			maxLength: 63,
+			lowercase: true,
+			allowedPattern: /[^a-z0-9.-]/g
+		});
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
 		if (explicit) try {
@@ -5468,10 +5472,32 @@ var SQSQueueProvider = class {
 		this.sqsClient = awsClients.sqs;
 		this.stsClient = awsClients.sts;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["QueueName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 80 });
+	}
+	async holderCreatedAt(_resourceType, physicalId) {
+		const resp = await this.sqsClient.send(new GetQueueAttributesCommand({
+			QueueUrl: physicalId,
+			AttributeNames: ["CreatedTimestamp"]
+		}));
+		const seconds = Number(resp.Attributes?.["CreatedTimestamp"]);
+		return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+	}
+	async lookupNames(_resourceType, names) {
+		return lookupEachName(names, "sqs:GetQueueUrl", 10, async (name) => {
+			try {
+				return (await this.sqsClient.send(new GetQueueUrlCommand({ QueueName: name }))).QueueUrl;
+			} catch (err) {
+				if (err instanceof QueueDoesNotExist) return void 0;
+				throw err;
+			}
+		});
+	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating SQS queue ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const queueName = properties["QueueName"] || generateResourceName(logicalId, { maxLength: 80 });
+		const queueName = properties["QueueName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		try {
 			const attributes = {};
 			for (const [cdkKey, sqsKey] of Object.entries(CDK_TO_SQS_ATTRIBUTES)) if (properties[cdkKey] !== void 0) {
@@ -6210,7 +6236,7 @@ var SNSTopicProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		this.logger.debug(`Creating SNS topic ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const topicName = properties["TopicName"] || generateResourceName(logicalId, { maxLength: 256 });
+		const topicName = properties["TopicName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		let leftBehindArn;
 		try {
 			const topicAttributes = {};
@@ -6535,6 +6561,10 @@ var SNSTopicProvider = class {
 	getDriftUnknownPaths() {
 		return [];
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["TopicName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 256 });
+	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
 			await this.snsClient.send(new GetTopicAttributesCommand({ TopicArn: input.knownPhysicalId }));
@@ -11811,12 +11841,45 @@ var LogsLogGroupProvider = class {
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
 	}
-	async create(logicalId, resourceType, properties, context) {
-		this.logger.debug(`Creating log group ${logicalId}`);
-		const logGroupName = properties["LogGroupName"] || `/cdkd/${generateResourceName(logicalId, {
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["LogGroupName"]) return void 0;
+		return `/cdkd/${generateResourceName(logicalId, {
 			maxLength: 506,
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
 		})}`;
+	}
+	async holderCreatedAt(_resourceType, physicalId) {
+		const group = (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: physicalId }))).logGroups?.find((g) => g.logGroupName === physicalId);
+		return typeof group?.creationTime === "number" ? group.creationTime : void 0;
+	}
+	async lookupNames(_resourceType, names) {
+		try {
+			const found = /* @__PURE__ */ new Map();
+			const wanted = new Set(names);
+			await Promise.all(chunks(names, 50).map((chunk) => withApiLimit("logs:DescribeLogGroups", 3, async () => {
+				const resp = await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupIdentifiers: chunk }));
+				for (const group of resp.logGroups ?? []) {
+					const name = group.logGroupName;
+					if (name !== void 0 && wanted.has(name)) found.set(name, name);
+				}
+			})));
+			return found;
+		} catch (err) {
+			const name = err?.name;
+			if (!isAccessDeniedError(err) && name !== "InvalidParameterException" && name !== "ValidationException") throw err;
+		}
+		return lookupEachName(names, "logs:DescribeLogGroups", 3, async (logGroupName) => {
+			try {
+				return (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: logGroupName }))).logGroups?.some((g) => g.logGroupName === logGroupName) ? logGroupName : void 0;
+			} catch (err) {
+				if (err instanceof ResourceNotFoundException$5) return void 0;
+				throw err;
+			}
+		});
+	}
+	async create(logicalId, resourceType, properties, context) {
+		this.logger.debug(`Creating log group ${logicalId}`);
+		const logGroupName = properties["LogGroupName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		let leftBehind = false;
 		try {
@@ -12216,7 +12279,7 @@ var CloudWatchAlarmProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CloudWatch alarm ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const alarmName = properties["AlarmName"] || generateResourceName(logicalId, { maxLength: 256 });
+		const alarmName = properties["AlarmName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		try {
 			const createParams = this.buildAlarmParams(alarmName, properties);
 			if (desiredTags.length > 0) createParams.Tags = desiredTags.map(({ Key, Value }) => ({
@@ -12234,8 +12297,9 @@ var CloudWatchAlarmProvider = class {
 			throw new ProvisioningError(`Failed to create CloudWatch alarm ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating CloudWatch alarm ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.cloudWatchClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			await this.sendWithThrottleRetry("PutMetricAlarm", logicalId, () => this.cloudWatchClient.send(new PutMetricAlarmCommand(this.buildAlarmParams(physicalId, properties))));
@@ -12428,6 +12492,26 @@ var CloudWatchAlarmProvider = class {
 		}
 		return result;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["AlarmName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 256 });
+	}
+	async lookupNames(_resourceType, names) {
+		const wanted = new Set(names);
+		const found = /* @__PURE__ */ new Map();
+		await Promise.all(chunks(names, 100).map((chunk) => withApiLimit("cloudwatch:DescribeAlarms", 3, async () => {
+			const resp = await this.cloudWatchClient.send(new DescribeAlarmsCommand({
+				AlarmNames: chunk,
+				AlarmTypes: ["MetricAlarm", "CompositeAlarm"],
+				MaxRecords: 100
+			}));
+			for (const alarm of [...resp.MetricAlarms ?? [], ...resp.CompositeAlarms ?? []]) {
+				const name = alarm.AlarmName;
+				if (name !== void 0 && wanted.has(name)) found.set(name, name);
+			}
+		})));
+		return found;
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "AlarmName");
 		if (explicit) try {
@@ -13417,7 +13501,7 @@ var EventBridgeRuleProvider = class {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(`Creating EventBridge rule ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
+		const ruleName = properties["Name"] || this.generatedCreateName(resourceType, logicalId, properties);
 		const targets = properties["Targets"];
 		let leftLiveArn;
 		try {
@@ -13646,6 +13730,43 @@ var EventBridgeRuleProvider = class {
 		}
 		return result;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["Name"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 64 });
+	}
+	lookupNeedsResolvedProperties(_resourceType, properties) {
+		const bus = properties["EventBusName"];
+		return bus !== void 0 && bus !== null && bus !== "" && typeof bus !== "string";
+	}
+	async lookupNames(_resourceType, names, context) {
+		const busOf = (name) => {
+			const bus = context.propertiesByName.get(name)?.["EventBusName"];
+			if (bus === void 0 || bus === null || bus === "") return void 0;
+			if (typeof bus !== "string") throw new Error(`EventBusName of rule ${name} is not resolved`);
+			return bus;
+		};
+		const byBus = /* @__PURE__ */ new Map();
+		for (const name of names) {
+			const bus = busOf(name);
+			byBus.set(bus, [...byBus.get(bus) ?? [], name]);
+		}
+		const found = /* @__PURE__ */ new Map();
+		await Promise.all([...byBus].map(async ([bus, group]) => {
+			const each = await lookupEachName(group, "events:DescribeRule", 5, async (name) => {
+				try {
+					return (await this.eventBridgeClient.send(new DescribeRuleCommand({
+						Name: name,
+						...bus !== void 0 && { EventBusName: bus }
+					}))).Arn;
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$2) return void 0;
+					throw err;
+				}
+			});
+			for (const [name, arn] of each) found.set(name, arn);
+		}));
+		return found;
+	}
 	async import(input) {
 		const eventBusName = input.properties["EventBusName"];
 		if (input.knownPhysicalId) try {
@@ -21670,7 +21791,7 @@ var StepFunctionsProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating Step Functions state machine ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const stateMachineName = properties["StateMachineName"] || generateResourceName(logicalId, { maxLength: 80 });
+		const stateMachineName = properties["StateMachineName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for Step Functions state machine ${logicalId}`, resourceType, logicalId);
 		try {
@@ -21809,9 +21930,18 @@ var StepFunctionsProvider = class {
 		}
 		return result;
 	}
+	generatedCreateName(_resourceType, logicalId, properties) {
+		if (properties["StateMachineName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 80 });
+	}
+	async holderCreatedAt(_resourceType, physicalId) {
+		const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: physicalId }));
+		return resp.creationDate instanceof Date ? resp.creationDate.getTime() : void 0;
+	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
 			const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: input.knownPhysicalId }));
+			if (resp.status === "DELETING") return null;
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes: definedAttributes({
@@ -22217,7 +22347,7 @@ var ECSProvider = class {
 		log.debug(`Creating ECS cluster ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
-		const clusterName = properties["ClusterName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const clusterName = properties["ClusterName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		try {
 			const cluster = (await client.send(new CreateClusterCommand({
 				clusterName,
@@ -23320,6 +23450,25 @@ var ECSProvider = class {
 		result["Tags"] = normalizeAwsTagsToCfn(resp.tags);
 		return result;
 	}
+	generatedCreateName(resourceType, logicalId, properties) {
+		if (resourceType !== "AWS::ECS::Cluster" || properties["ClusterName"]) return void 0;
+		return generateResourceName(logicalId, { maxLength: 255 });
+	}
+	async lookupNames(resourceType, names) {
+		const found = /* @__PURE__ */ new Map();
+		if (resourceType !== "AWS::ECS::Cluster") return found;
+		const wanted = new Set(names);
+		await Promise.all(chunks(names, 100).map((chunk) => withApiLimit("ecs:DescribeClusters", 5, async () => {
+			const resp = await this.getClient().send(new DescribeClustersCommand({ clusters: chunk }));
+			const unanswered = (resp.failures ?? []).find((f) => f.reason !== "MISSING");
+			if (unanswered !== void 0) throw new Error(`DescribeClusters did not answer: ${displaySafe(unanswered.reason ?? "no reason given")}`);
+			for (const cluster of resp.clusters ?? []) {
+				const name = cluster.clusterName;
+				if (name !== void 0 && wanted.has(name) && cluster.status !== "INACTIVE") found.set(name, name);
+			}
+		})));
+		return found;
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::ECS::Cluster": return this.importCluster(input);
@@ -24625,6 +24774,31 @@ var ELBv2Provider = class {
 			this.logger.debug(`ELBv2 DescribeTags(${arn}) failed: ${describeAwsFailure(err).detail}`);
 		}
 	}
+	generatedCreateName(resourceType, logicalId, properties) {
+		if (resourceType !== "AWS::ElasticLoadBalancingV2::LoadBalancer" && resourceType !== "AWS::ElasticLoadBalancingV2::TargetGroup") return;
+		const declared = properties["Name"];
+		if (declared !== void 0 && declared !== null && declared !== "") return void 0;
+		return sentElbv2Name(properties, logicalId);
+	}
+	async holderCreatedAt(resourceType, physicalId) {
+		if (resourceType !== "AWS::ElasticLoadBalancingV2::LoadBalancer") return void 0;
+		const created = (await this.getClient().send(new DescribeLoadBalancersCommand({ LoadBalancerArns: [physicalId] }))).LoadBalancers?.[0]?.CreatedTime;
+		return created instanceof Date ? created.getTime() : void 0;
+	}
+	async lookupNames(resourceType, names) {
+		const lb = resourceType === "AWS::ElasticLoadBalancingV2::LoadBalancer";
+		if (!lb && resourceType !== "AWS::ElasticLoadBalancingV2::TargetGroup") return /* @__PURE__ */ new Map();
+		return lookupEachName(names, lb ? "elbv2:DescribeLoadBalancers" : "elbv2:DescribeTargetGroups", 3, async (name) => {
+			try {
+				if (lb) return onlyNamedMatch((await this.getClient().send(new DescribeLoadBalancersCommand({ Names: [name] }))).LoadBalancers, (l) => l.LoadBalancerArn, "load balancer").arn;
+				return onlyNamedMatch((await this.getClient().send(new DescribeTargetGroupsCommand({ Names: [name] }))).TargetGroups, (t) => t.TargetGroupArn, "target group").arn;
+			} catch (err) {
+				const errName = err.name;
+				if (errName === "LoadBalancerNotFoundException" || errName === "TargetGroupNotFoundException") return;
+				throw err;
+			}
+		});
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return this.importLoadBalancer(input);
@@ -34077,7 +34251,8 @@ var KMSProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		switch (resourceType) {
 			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties);
 			case "AWS::KMS::Alias": return this.updateAlias(logicalId, physicalId, resourceType, properties);
@@ -41399,8 +41574,9 @@ var CodeBuildProvider = class {
 			throw new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
 			const input = this.mapProperties(logicalId, properties);
 			input.name = physicalId;
@@ -43690,8 +43866,9 @@ var ECRProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating ECR Repository ${logicalId} (${physicalId})`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const newScanConfig = properties["ImageScanningConfiguration"];
@@ -44046,6 +44223,18 @@ var NestedStackProvider = class {
 			const failure = new Error(nestedStackChildFailureMessage(plainOrDescribed(childStackName, "stack name"), childResult.errorCount, childResult.skippedCount, childResult.interrupted, inspect.command, withheldTargetClause(inspect, "stack", "cdkd state show", "The child stack's name") + (accountClause === "" ? "" : ` ${accountClause}`)));
 			throw markNonRetryable(failure);
 		}
+		const orphanSkips = childResult.journaledOrphanSkips;
+		if (deleteContext?.stackDestroy === true && childResult.stateDeleted && orphanSkips > 0) {
+			const slot = ctx.childUnaddressed;
+			if (slot) slot.last = {
+				deleteSkipped: orphanSkips,
+				updatePartial: 0
+			};
+			return {
+				outcome: "deleted",
+				leftInPlace: `nested stack ${plainOrDescribed(childStackName, "stack name")} left ${orphanSkips} resource(s) a failed deploy created in AWS`
+			};
+		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
 			const causes = [];
 			if (childResult.skippedCount > 0) causes.push(`skipped ${childResult.skippedCount} resource(s)`);
@@ -44065,6 +44254,7 @@ var NestedStackProvider = class {
 		const childEngine = new DeployEngine(parentCtx.stateBackend, parentCtx.lockManager, parentCtx.dagBuilder, parentCtx.diffCalculator, parentCtx.providerRegistry, {
 			...parentCtx.options ?? {},
 			parameters: childParameters,
+			onDestructivePlan: void 0,
 			...inheritedSecrets && hasMaskableValues(inheritedSecrets) && { inheritedSecrets },
 			...passedClasses && { passedParameterClasses: passedClasses },
 			passedNoEchoParameters: passedNoEchoParametersOf(inheritedSecrets),
@@ -44574,4 +44764,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-wbKBBEol.js.map
+//# sourceMappingURL=provider-classes-DmZ0J68L.js.map