@go-to-k/cdkd 0.296.3 → 0.296.5

package/dist/{provider-classes-Ca6o5by0.js → provider-classes-oZ8a4BHE.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-Dvc7ddKe.js";
-import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
+import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
+import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as recoverMaskedOutput, $i as findSilentDropProperties, $n as observeThenDisableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, Aa as lambdaFunctionNameForMask, An as tagMapAsList, B as getPriorAttempts, Bi as refuseMalformedResourcesForDestroy, Br as passedParameterClassesOf, Ca as requireConfigObject, Cr as s3BucketWebsiteUrl, Ct as getStackRecords, D as beginDeleteWait, Dn as planTagDiff, Dr as getAccountInfo, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, En as DBPROXY_TAG_OPTIONS, F as waitForIndexesSettled, Gs as canonicalizeRegion, Gt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ho as rewriteTemplateAssetReferences, Hs as decodeListingKey, I as ECR_AUTO_DELETE_IMAGES_TAG, Jn as isWaitAbandonedError, Jt as redactedDeleteAddressSkip, Kn as deleteSkipReason, Ks as derivePartitionAndUrlSuffix, Kt as isRedactedRecordedValue, L as S3_AUTO_DELETE_OBJECTS_TAG, Lo as stringifyValue, Lr as parseWebACLArn, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as definedAttributes, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as stringifyIfAssigned, O as compensateRemovedDeletionProtection, Oa as withRetry, On as readTagList, P as deleteTableWithIndexBusyRetry, Pt as getCurrentProducerRegions, Qn as isTerminationProtectionPropagationError, R as hasCdkAutoDeleteTag, Sa as requireConfigArray, Sn as reserveStackCreateToken, Sr as s3BucketRegionalDomainName, T as DynamoDBGlobalTableProvider, Tn as DBPROXY_TAGS_WHAT, Un as unchangedBehindSecretReference, V as markRefusedBeforeApplying, Vn as slowCcOperationTimeoutMs, Xa as markSameGenerationBag, Yn as markWaitAbandoned, Za as redactSecretsForState, Zn as ec2InstanceProtectionSite, _a as configBooleanRefusal, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ac as resolveAssemblyPath, ao as carriesSecretMask, ba as readConfigString, bi as refuseMalformedNestedChildOutputs, bn as earliestDefined, br as s3BucketDomainName, c as renderNestedTemplateTreeDefect, da as coerceWarmThroughput$1, dt as getNestedRevertRun, er as reDisableInstanceApiTermination, fa as isWarmThroughputDecrease, ga as coerceCfnInteger, ha as coerceCfnBoolean, ic as renderAssemblyPathEscape, j as resolveDynamoDbDeleteBudgetMs, ja as sameLambdaFunctionAddress, jn as tagPlanWarning, k as deleteBudgetKey, ka as canonicalLambdaFunctionName, kn as refuseMalformedDesiredTags, ma as toFiniteNumber, mt as revertNestedChildFromJournal, nc as describeFileReadFailure, o as isAbsoluteAssetPath, pa as toCfnInteger, qn as withIndeterminateGuard, qt as redactedDeleteAddressFields, rc as displayAssemblyPath, s as listNestedTemplateRows, t as DeployEngine, ta as withoutSilentDropProperties, to as dynamicReferenceTokens, tr as reEnableInstanceApiTermination, ua as WARM_THROUGHPUT_MEMBERS, va as configIntegerRefusal, vr as isSettledInstanceState, vt as withNestedStackContext, wa as requireConfigString, wn as acquireIdempotencyToken, xa as replayWarn, xr as s3BucketDualStackDomainName, xt as awaitInFlightSibling, ya as configStringRefusal, yr as s3BucketArn, z as isTruthyCfnBoolean, za as hasMaskableValues, zn as getCurrentResourceSecrets } from "./deploy-engine-Dre6eDNJ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-D9wk9Bnh.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DFehMfoh.js";
-import { RDSProvider } from "./rds-provider-Dl--9uQU.js";
-import { NeptuneProvider } from "./neptune-provider-B1GRQ6UO.js";
-import { ASGProvider } from "./asg-provider-CksS_6jO.js";
+import { $n as isWaitAbandonedError, A as resolveDynamoDbDeleteBudgetClock, An as DBPROXY_TAG_OPTIONS, B as getPriorAttempts, Ca as configIntegerRefusal, Cr as isSettledInstanceState, D as beginDeleteWait, Da as requireConfigArray, Dr as s3BucketRegionalDomainName, Dt as getStackRecords, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as replayWarn, En as reserveStackCreateToken, Er as s3BucketDualStackDomainName, F as waitForIndexesSettled, Fa as lambdaFunctionNameForMask, Fn as tagPlanWarning, Gi as refuseMalformedResourcesForDestroy, Gr as passedParameterClassesOf, Ho as stringifyValue, Hr as parseWebACLArn, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as sameLambdaFunctionAddress, In as definedAttributes, Jn as unchangedBehindSecretReference, Kn as slowCcOperationTimeoutMs, L as S3_AUTO_DELETE_OBJECTS_TAG, Ln as stringifyIfAssigned, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as readTagList, Mr as getAccountInfo, N as INDEX_SETTLE_POLL_INTERVAL_MS, Na as withRetry, Nn as refuseMalformedDesiredTags, O as compensateRemovedDeletionProtection, Oa as requireConfigObject, On as acquireIdempotencyToken, Or as s3BucketWebsiteUrl, P as deleteTableWithIndexBusyRetry, Pa as canonicalLambdaFunctionName, Pn as tagMapAsList, Qn as withIndeterminateGuard, Qt as redactedDeleteAddressSkip, R as hasCdkAutoDeleteTag, Rt as getCurrentProducerRegions, Sa as configBooleanRefusal, St as withNestedStackContext, T as DynamoDBGlobalTableProvider, Ta as readConfigString, Ti as refuseMalformedNestedChildOutputs, Tr as s3BucketDomainName, Tt as awaitInFlightSibling, Un as getCurrentResourceSecrets, V as markRefusedBeforeApplying, Wa as hasMaskableValues, Xs as canonicalizeRegion, Xt as isRedactedRecordedValue, Yt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Zn as deleteSkipReason, Zs as derivePartitionAndUrlSuffix, Zt as redactedDeleteAddressFields, _a as isWarmThroughputDecrease, a as findNestedTemplateTreeDefect, ar as reDisableInstanceApiTermination, ba as coerceCfnBoolean, c as renderNestedTemplateTreeDefect, cc as displayAssemblyPath, er as markWaitAbandoned, ga as coerceWarmThroughput$1, ha as WARM_THROUGHPUT_MEMBERS, ht as getNestedRevertRun, ia as findSilentDropProperties, io as recoverMaskedOutput, ir as observeThenDisableInstanceApiTermination, j as resolveDynamoDbDeleteBudgetMs, jn as planTagDiff, k as deleteBudgetKey, ka as requireConfigString, kn as DBPROXY_TAGS_WHAT, lc as renderAssemblyPathEscape, no as redactSecretsForState, nr as ec2InstanceProtectionSite, o as isAbsoluteAssetPath, oa as withoutSilentDropProperties, oo as dynamicReferenceTokens, or as reEnableInstanceApiTermination, qo as rewriteTemplateAssetReferences, qs as decodeListingKey, rr as isTerminationProtectionPropagationError, s as listNestedTemplateRows, sc as describeFileReadFailure, t as DeployEngine, to as markSameGenerationBag, uc as resolveAssemblyPath, uo as carriesSecretMask, va as toCfnInteger, vt as revertNestedChildFromJournal, wa as configStringRefusal, wn as earliestDefined, wr as s3BucketArn, xa as coerceCfnInteger, xt as getCurrentNestedStackContext, ya as toFiniteNumber, z as isTruthyCfnBoolean } from "./deploy-engine-Cm7z6aQk.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CXGJXY5J.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DPk5db_j.js";
+import { RDSProvider } from "./rds-provider-B0JrOskT.js";
+import { NeptuneProvider } from "./neptune-provider-DCgJR2NX.js";
+import { ASGProvider } from "./asg-provider-DhyYUns2.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -5488,8 +5488,144 @@ var SQSQueueProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/policy-document-content.ts
+const MASK = "***";
+const PERMANENT_CDKD_CODES = /* @__PURE__ */ new Set(["ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH"]);
+const MARKED_PERMANENT_CODE_PREFIXES = ["INTRINSIC_RESOLUTION_REFUSAL", "ROLLBACK_SECRET_REGION_AMBIGUOUS"];
+const NOT_FOUND_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"ResourceNotFoundException",
+	"ParameterNotFound",
+	"ParameterVersionNotFound"
+]);
+function holdsUnresolvedValue(document) {
+	let root = document;
+	if (typeof document === "string") try {
+		root = JSON.parse(document);
+	} catch {
+		root = document;
+	}
+	const walk = (v) => {
+		if (typeof v === "string") return v === MASK || v.includes("{{resolve:");
+		if (Array.isArray(v)) return v.some(walk);
+		if (v !== null && typeof v === "object") return Object.values(v).some(walk);
+		return false;
+	};
+	return walk(root);
+}
+function isPermanentResolutionError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const e = current;
+		if (typeof e.name === "string" && NOT_FOUND_ERROR_NAMES.has(e.name)) return true;
+		if (typeof e.code === "string") {
+			if (PERMANENT_CDKD_CODES.has(e.code)) return true;
+			const code = e.code;
+			if (MARKED_PERMANENT_CODE_PREFIXES.some((p) => code.startsWith(p)) && isMarkedNonRetryable(current)) return true;
+		}
+		if (typeof e.message === "string" && e.message.startsWith("Dynamic reference: ")) return true;
+		current = e.cause;
+	}
+	return false;
+}
+function errorName(error) {
+	const name = error?.name;
+	return typeof name === "string" && /^[\w.-]{1,128}$/.test(name) ? name : "error";
+}
+async function attemptedPolicyDocument(recorded, resolve) {
+	let document = recorded;
+	if (resolve) try {
+		document = await resolve();
+	} catch (error) {
+		return isPermanentResolutionError(error) ? {
+			kind: "unusable",
+			why: "a secret it references does not exist or cannot be used"
+		} : {
+			kind: "retry",
+			errorName: errorName(error)
+		};
+	}
+	if (!(typeof document === "string" && document.length > 0 || document !== null && typeof document === "object")) return {
+		kind: "unusable",
+		why: "no policy document it attempted is recorded"
+	};
+	if (holdsUnresolvedValue(document)) return {
+		kind: "unusable",
+		why: "its policy document still holds a secret reference or masked value"
+	};
+	return {
+		kind: "document",
+		document
+	};
+}
+const ACCOUNT_ID = /^\d{12}$/;
+const ACCOUNT_ROOT_ARN = /^arn:[a-z-]+:iam::(\d{12}):root$/;
+const LIST_KEYS = [
+	"Action",
+	"NotAction",
+	"Resource",
+	"NotResource"
+];
+const PRINCIPAL_KEYS = ["Principal", "NotPrincipal"];
+function unwrapSingle(value) {
+	return Array.isArray(value) && value.length === 1 ? value[0] : value;
+}
+function accountKey(value) {
+	if (typeof value !== "string") return value;
+	if (ACCOUNT_ID.test(value)) return `account:${value}`;
+	const m = ACCOUNT_ROOT_ARN.exec(value);
+	return m ? `account:${m[1]}` : value;
+}
+const ANYONE = "anyone:*";
+function normalizePrincipal(principal) {
+	if (principal === "*") return ANYONE;
+	if (principal === null || typeof principal !== "object" || Array.isArray(principal)) return principal;
+	const keys = Object.keys(principal);
+	if (keys.length === 1 && keys[0] === "AWS" && unwrapSingle(principal["AWS"]) === "*") return ANYONE;
+	const out = {};
+	for (const [key, raw] of Object.entries(principal)) out[key] = unwrapSingle(key === "AWS" ? Array.isArray(raw) ? raw.map(accountKey) : accountKey(raw) : raw);
+	return out;
+}
+function normalizeStatement(statement) {
+	if (statement === null || typeof statement !== "object" || Array.isArray(statement)) return statement;
+	const out = { ...statement };
+	for (const key of LIST_KEYS) if (Object.prototype.hasOwnProperty.call(out, key)) out[key] = unwrapSingle(out[key]);
+	for (const key of PRINCIPAL_KEYS) if (Object.prototype.hasOwnProperty.call(out, key)) out[key] = normalizePrincipal(out[key]);
+	return out;
+}
+function canonicalJson$3(value) {
+	const sortKeys = (v) => {
+		if (Array.isArray(v)) return v.map(sortKeys);
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			for (const key of Object.keys(v).sort()) out[key] = sortKeys(v[key]);
+			return out;
+		}
+		return v;
+	};
+	return JSON.stringify(sortKeys(value));
+}
+function policyContentKey(document) {
+	let value = document;
+	if (typeof document === "string") try {
+		value = JSON.parse(document);
+	} catch {
+		return `raw:${document}`;
+	}
+	if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+		const doc = { ...value };
+		if (Object.prototype.hasOwnProperty.call(doc, "Statement")) doc["Statement"] = (Array.isArray(doc["Statement"]) ? doc["Statement"] : [doc["Statement"]]).map(normalizeStatement);
+		value = doc;
+	}
+	return canonicalJson$3(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/sqs-queue-policy-provider.ts
+const QUEUE_POLICY_UNREADABLE_SKIP_REASON = "the policy of a queue it wrote could not be read, so whether that queue still carries it is unknown";
+const QUEUE_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON = "the policy document it attempted could not be resolved right now to compare its queues with";
+const QUEUE_POLICY_MISMATCH_LEFT_REASON = "a queue it wrote carries a policy that does not match the document it attempted, so that queue was not cleared";
+const QUEUE_POLICY_NOT_COMPARED_LEFT_REASON = "the document it attempted is missing, masked, or references a secret that does not exist or cannot be used, so none of its queues was cleared";
 var SQSQueuePolicyProvider = class {
 	sqsClient;
 	logger = getLogger().child("SQSQueuePolicyProvider");
@@ -5560,6 +5696,7 @@ var SQSQueuePolicyProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SQS queue policy ${logicalId}: ${physicalId}`);
+		if (context?.failedCreateOrphan === true) return this.deleteFailedCreateOrphan(logicalId, physicalId, resourceType, properties, context);
 		const named = physicalId.includes(",") ? splitQueueUrls(physicalId) : recordedQueues(physicalId, context?.recordedAttributes);
 		const queueUrls = [...physicalId.includes(",") ? [] : await this.queuesCarryingDocument(listedQueues(properties ?? {}).filter((url) => !named.includes(url)), properties?.["PolicyDocument"], logicalId), ...named];
 		if (queueUrls.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
@@ -5572,6 +5709,63 @@ var SQSQueuePolicyProvider = class {
 		}
 		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
+	async deleteFailedCreateOrphan(logicalId, physicalId, resourceType, properties, context) {
+		const named = splitQueueUrls(physicalId);
+		if (named.length === 0) throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: its physical id names no queue URL`, resourceType, logicalId, physicalId);
+		const resolve = context.resolveAttemptedProperties;
+		const attempted = await attemptedPolicyDocument(properties?.["PolicyDocument"], resolve && (async () => (await resolve())?.["PolicyDocument"]));
+		if (attempted.kind === "retry") {
+			this.logger.warn(safeMsg`The policy document ${logicalId} attempted could not be resolved (${attempted.errorName}), so no queue it wrote is cleared; the entry is kept for a re-run once that is fixed.`);
+			return {
+				outcome: "skipped",
+				reason: QUEUE_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON
+			};
+		}
+		if (attempted.kind === "unusable") {
+			this.logger.warn(safeMsg`${logicalId} is not cleared from any queue it wrote (${attempted.why}); check each by hand and remove its policy where it still grants what ${logicalId} declared: ${named.join(", ")}.`);
+			return {
+				outcome: "deleted",
+				leftInPlace: QUEUE_POLICY_NOT_COMPARED_LEFT_REASON
+			};
+		}
+		const reference = policyContentKey(attempted.document);
+		const fresh = new Set((context.writtenThisRun ?? []).flatMap((r) => r.resourceType === resourceType && typeof r.physicalId === "string" ? [...recordedQueues(r.physicalId, r.attributes !== null && typeof r.attributes === "object" ? r.attributes : void 0), ...listedQueues(r.properties !== null && typeof r.properties === "object" ? r.properties : {})] : []));
+		let unreadable = false;
+		let mismatched = false;
+		for (const queueUrl of named) {
+			if (fresh.has(queueUrl)) {
+				mismatched = true;
+				this.logger.warn(safeMsg`Queue ${queueUrl} was written by a QueuePolicy of this deploy, so it is not cleared: its policy may not read back current yet; if it still grants what ${logicalId} declared, remove it manually.`);
+				continue;
+			}
+			const current = await this.readPolicyForWidening(queueUrl);
+			if (current.kind === "gone") {
+				const clientRegion = await this.sqsClient.config.region();
+				assertRegionMatch(clientRegion, context.expectedRegion, resourceType, logicalId, queueUrl, "not-found");
+				this.logger.debug(safeMsg`Queue ${queueUrl} does not exist; nothing to clear`);
+			} else if (current.kind === "unreadable") {
+				unreadable = true;
+				this.logger.warn(safeMsg`Could not read the policy of queue ${queueUrl} (${current.reason}), so it is not cleared: it may still carry the policy of ${logicalId}.`);
+			} else if (current.kind === "none" || policyContentKey(current.policy) === reference) try {
+				await this.clearQueuePolicy(queueUrl, resourceType, logicalId, context.expectedRegion);
+			} catch (error) {
+				if (error instanceof ProvisioningError) throw error;
+				throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+			}
+			else {
+				mismatched = true;
+				this.logger.warn(safeMsg`Queue ${queueUrl} carries a policy that does not match the document ${logicalId} attempted (a later write, or AWS stored it in another form), so it is not cleared; if it still grants what ${logicalId} declared, remove it manually.`);
+			}
+		}
+		if (unreadable) return {
+			outcome: "skipped",
+			reason: QUEUE_POLICY_UNREADABLE_SKIP_REASON
+		};
+		if (mismatched) return {
+			outcome: "deleted",
+			leftInPlace: QUEUE_POLICY_MISMATCH_LEFT_REASON
+		};
+	}
 	async clearQueuePolicy(queueUrl, resourceType, logicalId, expectedRegion, phase = "not-found") {
 		try {
 			await this.sqsClient.send(new SetQueueAttributesCommand({
@@ -5589,15 +5783,13 @@ var SQSQueuePolicyProvider = class {
 		}
 	}
 	async queuesCarryingDocument(candidates, document, logicalId) {
-		if (candidates.length === 0) return [];
-		let reference;
-		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy$1(document);
-		else if (document !== null && typeof document === "object") reference = canonicalJson$2(document);
+		const carrying = [];
+		if (candidates.length === 0) return carrying;
+		const reference = policyReference(document);
 		if (reference === void 0) {
 			this.logger.warn(safeMsg`The queues ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`);
-			return [];
+			return carrying;
 		}
-		const carrying = [];
 		for (const queueUrl of candidates) {
 			const current = await this.readPolicyForWidening(queueUrl);
 			if (current.kind === "policy" && canonicalPolicy$1(current.policy) === reference) carrying.push(queueUrl);
@@ -5618,7 +5810,7 @@ var SQSQueuePolicyProvider = class {
 			} : { kind: "none" };
 		} catch (err) {
 			const name = err.name;
-			if (name === "QueueDoesNotExist" || name === "AWS.SimpleQueueService.NonExistentQueue") return { kind: "none" };
+			if (name === "QueueDoesNotExist" || name === "AWS.SimpleQueueService.NonExistentQueue") return { kind: "gone" };
 			return {
 				kind: "unreadable",
 				reason: name ?? "error"
@@ -5716,6 +5908,10 @@ function canonicalPolicy$1(text) {
 		return `raw:${text}`;
 	}
 }
+function policyReference(document) {
+	if (typeof document === "string" && document.length > 0) return canonicalPolicy$1(document);
+	if (document !== null && typeof document === "object") return canonicalJson$2(document);
+}
 function splitQueueUrls(physicalId) {
 	return physicalId.split(",").filter((url) => url.length > 0);
 }
@@ -6440,6 +6636,10 @@ function isPendingConfirmationError(error) {
 
 //#endregion
 //#region src/provisioning/providers/sns-topic-policy-provider.ts
+const TOPIC_POLICY_UNREADABLE_SKIP_REASON = "the policy of a topic it wrote could not be read, so whether that topic still carries it is unknown";
+const TOPIC_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON = "the policy document it attempted could not be resolved right now to compare its topics with";
+const TOPIC_POLICY_MISMATCH_LEFT_REASON = "a topic it wrote carries a policy that does not match the document it attempted, so that topic was not reset";
+const TOPIC_POLICY_NOT_COMPARED_LEFT_REASON = "the document it attempted is missing, masked, or references a secret that does not exist or cannot be used, so none of its topics was reset";
 var SNSTopicPolicyProvider = class {
 	logger = getLogger().child("SNSTopicPolicyProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::SNS::TopicPolicy", /* @__PURE__ */ new Set(["Topics", "PolicyDocument"])]]);
@@ -6502,6 +6702,7 @@ var SNSTopicPolicyProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SNS topic policy ${logicalId}: ${physicalId}`);
+		if (context?.failedCreateOrphan === true) return this.deleteFailedCreateOrphan(logicalId, physicalId, resourceType, properties, context);
 		const named = splitTopicArns(physicalId);
 		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id is empty, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
 		const topicArns = named.every((arn) => isSnsTopicArn(arn)) ? named : [.../* @__PURE__ */ new Set([...named.filter((arn) => isSnsTopicArn(arn)), ...listedTopics(properties ?? {})])];
@@ -6515,6 +6716,75 @@ var SNSTopicPolicyProvider = class {
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
+	async deleteFailedCreateOrphan(logicalId, physicalId, resourceType, properties, context) {
+		const named = splitTopicArns(physicalId);
+		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id names no topic`, resourceType, logicalId, physicalId));
+		const resolve = context.resolveAttemptedProperties;
+		const attempted = await attemptedPolicyDocument(properties?.["PolicyDocument"], resolve && (async () => (await resolve())?.["PolicyDocument"]));
+		if (attempted.kind === "retry") {
+			this.logger.warn(safeMsg`The policy document ${logicalId} attempted could not be resolved (${attempted.errorName}), so no topic it wrote is reset; the entry is kept for a re-run once that is fixed.`);
+			return {
+				outcome: "skipped",
+				reason: TOPIC_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON
+			};
+		}
+		if (attempted.kind === "unusable") {
+			this.logger.warn(safeMsg`${logicalId} is not reset on any topic it wrote (${attempted.why}); check each by hand and reset its policy where it still grants what ${logicalId} declared: ${named.join(", ")}.`);
+			return {
+				outcome: "deleted",
+				leftInPlace: TOPIC_POLICY_NOT_COMPARED_LEFT_REASON
+			};
+		}
+		const document = attempted.document;
+		const reference = policyContentKey(document);
+		const fresh = new Set((context.writtenThisRun ?? []).flatMap((r) => r.resourceType === resourceType && typeof r.physicalId === "string" ? [...splitTopicArns(r.physicalId), ...listedTopics(r.properties !== null && typeof r.properties === "object" ? r.properties : {})] : []));
+		let unreadable = false;
+		let mismatched = false;
+		for (const topicArn of named) {
+			if (fresh.has(topicArn)) {
+				mismatched = true;
+				this.logger.warn(safeMsg`Topic ${topicArn} was written by a TopicPolicy of this deploy, so it is not reset: its policy may not read back current yet; if it still grants what ${logicalId} declared, reset it manually.`);
+				continue;
+			}
+			const current = await this.readPolicyForWidening(topicArn);
+			if (current.kind === "gone") {
+				const clientRegion = await getAwsClients().sns.config.region();
+				assertRegionMatch(clientRegion, context.expectedRegion, resourceType, logicalId, topicArn, "not-found");
+				this.logger.debug(safeMsg`Topic ${topicArn} does not exist; nothing to reset`);
+				continue;
+			}
+			if (current.kind === "unreadable") {
+				unreadable = true;
+				this.logger.warn(safeMsg`Could not read the policy of topic ${topicArn} (${current.reason}), so it is not reset: it may still carry the policy of ${logicalId}.`);
+				continue;
+			}
+			const live = current.kind === "none" ? void 0 : policyContentKey(current.policy);
+			if (live === void 0 || live === reference) {
+				try {
+					await this.resetTopicPolicy(topicArn, resourceType, logicalId, context.expectedRegion);
+				} catch (error) {
+					if (error instanceof ProvisioningError) throw error;
+					throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+				}
+				continue;
+			}
+			const defaultPolicy = defaultTopicPolicy(topicArn);
+			if (defaultPolicy !== void 0 && live === policyContentKey(defaultPolicy)) {
+				this.logger.debug(safeMsg`Topic ${topicArn} already carries its default policy`);
+				continue;
+			}
+			mismatched = true;
+			this.logger.warn(safeMsg`Topic ${topicArn} carries a policy that does not match the document ${logicalId} attempted (a later write, or AWS stored it in another form), so it is not reset; if it still grants what ${logicalId} declared, reset it manually.`);
+		}
+		if (unreadable) return {
+			outcome: "skipped",
+			reason: TOPIC_POLICY_UNREADABLE_SKIP_REASON
+		};
+		if (mismatched) return {
+			outcome: "deleted",
+			leftInPlace: TOPIC_POLICY_MISMATCH_LEFT_REASON
+		};
+	}
 	async resetTopicPolicy(topicArn, resourceType, logicalId, expectedRegion, phase = "not-found", mask = (t) => t) {
 		const defaultPolicy = defaultTopicPolicy(topicArn);
 		if (defaultPolicy === void 0) throw new ProvisioningError(`Cannot remove SNS topic policy ${logicalId} from ${topicArn}: not an SNS topic ARN`, resourceType, logicalId, topicArn);
@@ -6559,7 +6829,7 @@ var SNSTopicPolicyProvider = class {
 			} : { kind: "none" };
 		} catch (err) {
 			const name = err.name;
-			if (name === "NotFoundException" || name === "NotFound") return { kind: "none" };
+			if (name === "NotFoundException" || name === "NotFound") return { kind: "gone" };
 			return {
 				kind: "unreadable",
 				reason: name ?? "error"
@@ -43355,4 +43625,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Ca6o5by0.js.map
+//# sourceMappingURL=provider-classes-oZ8a4BHE.js.map