@go-to-k/cdkd 0.296.6 → 0.296.7

package/dist/{provider-classes-oRTqcSCp.js → provider-classes-CsF7Ia5F.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
+import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger } from "./logger-DAaB7GFO.js";
 import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as deleteSkipReason, $s as derivePartitionAndUrlSuffix, A as resolveDynamoDbDeleteBudgetClock, Aa as requireConfigObject, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ca as coerceCfnInteger, Ct as getStackRecords, D as beginDeleteWait, Da as readConfigString, Di as refuseMalformedNestedChildOutputs, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configStringRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fa as withRetry, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as canonicalLambdaFunctionName, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Jn as slowCcOperationTimeoutMs, Ka as hasMaskableValues, L as S3_AUTO_DELETE_OBJECTS_TAG, La as lambdaFunctionNameForMask, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as replayWarn, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, Qs as canonicalizeRegion, R as hasCdkAutoDeleteTag, Ra as sameLambdaFunctionAddress, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as coerceCfnBoolean, T as DynamoDBGlobalTableProvider, Ta as configIntegerRefusal, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wo as stringifyValue, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Yo as rewriteTemplateAssetReferences, Ys as decodeListingKey, _a as WARM_THROUGHPUT_MEMBERS, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ar as isTerminationProtectionPropagationError, ba as toCfnInteger, c as renderNestedTemplateTreeDefect, ca as withoutSilentDropProperties, co as dynamicReferenceTokens, cr as reEnableInstanceApiTermination, dc as renderAssemblyPathEscape, dt as getNestedRevertRun, er as withIndeterminateGuard, fc as resolveAssemblyPath, fo as carriesSecretMask, io as redactSecretsForState, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigString, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as requireConfigArray, kr as s3BucketRegionalDomainName, lc as describeFileReadFailure, mt as revertNestedChildFromJournal, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as findSilentDropProperties, oo as recoverMaskedOutput, or as observeThenDisableInstanceApiTermination, qi as refuseMalformedResourcesForDestroy, qr as passedParameterClassesOf, ro as markSameGenerationBag, s as listNestedTemplateRows, sr as reDisableInstanceApiTermination, t as DeployEngine, tr as isWaitAbandonedError, uc as displayAssemblyPath, va as coerceWarmThroughput$1, vt as withNestedStackContext, wa as configBooleanRefusal, xa as toFiniteNumber, xt as awaitInFlightSibling, ya as isWarmThroughputDecrease, z as isTruthyCfnBoolean, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-BPcBCyUE.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CVIClaZV.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CAlg2KEF.js";
-import { RDSProvider } from "./rds-provider-DeGFzOUc.js";
-import { NeptuneProvider } from "./neptune-provider-CvY6ekmg.js";
-import { ASGProvider } from "./asg-provider-C1TlpooI.js";
+import { $n as deleteSkipReason, $s as derivePartitionAndUrlSuffix, A as resolveDynamoDbDeleteBudgetClock, Aa as requireConfigObject, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ca as coerceCfnInteger, Ct as getStackRecords, D as beginDeleteWait, Da as readConfigString, Di as refuseMalformedNestedChildOutputs, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configStringRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fa as withRetry, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as canonicalLambdaFunctionName, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Jn as slowCcOperationTimeoutMs, L as S3_AUTO_DELETE_OBJECTS_TAG, La as lambdaFunctionNameForMask, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as replayWarn, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, Qs as canonicalizeRegion, R as hasCdkAutoDeleteTag, Ra as sameLambdaFunctionAddress, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as coerceCfnBoolean, T as DynamoDBGlobalTableProvider, Ta as configIntegerRefusal, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wa as hasMaskableValues, Wo as stringifyValue, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Yo as rewriteTemplateAssetReferences, Ys as decodeListingKey, _a as WARM_THROUGHPUT_MEMBERS, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ao as dynamicReferenceTokens, ar as isTerminationProtectionPropagationError, ba as toCfnInteger, c as renderNestedTemplateTreeDefect, ca as withoutSilentDropProperties, cr as reEnableInstanceApiTermination, dc as renderAssemblyPathEscape, dt as getNestedRevertRun, er as withIndeterminateGuard, fc as resolveAssemblyPath, fo as carriesSecretMask, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigString, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as requireConfigArray, kr as s3BucketRegionalDomainName, lc as describeFileReadFailure, mt as revertNestedChildFromJournal, no as redactSecretsForState, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as findSilentDropProperties, or as observeThenDisableInstanceApiTermination, qi as refuseMalformedResourcesForDestroy, qr as passedParameterClassesOf, s as listNestedTemplateRows, sr as reDisableInstanceApiTermination, t as DeployEngine, to as markSameGenerationBag, tr as isWaitAbandonedError, uc as displayAssemblyPath, uo as recoverMaskedOutput, va as coerceWarmThroughput$1, vt as withNestedStackContext, wa as configBooleanRefusal, xa as toFiniteNumber, xt as awaitInFlightSibling, ya as isWarmThroughputDecrease, z as isTruthyCfnBoolean, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-wyaJUA8V.js";
+import { a as AmbiguousCreateLatch, c as isInsideWindow, i as AMBIGUOUS_LATCH_TTL_MS, l as setBounded, n as collectInlinePolicyNamesManagedBySiblings, o as RecentIdSet, r as IamCreateClientCache, s as createAttemptKey, t as IAMRoleProvider, u as withoutServerErrorRetries } from "./iam-role-provider-obY72uH2.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DEnDp4o0.js";
+import { RDSProvider } from "./rds-provider-Cf5P2so_.js";
+import { NeptuneProvider } from "./neptune-provider-C3f-vDOh.js";
+import { ASGProvider } from "./asg-provider-BU0YONBp.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -573,6 +573,7 @@ const PRINCIPAL_NAMES = "group / role / user names";
 const AWS_MANAGED_POLICY_ARN_RE = /^arn:aws[a-z0-9-]*:iam::aws:/;
 var IAMManagedPolicyProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMManagedPolicyProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -611,7 +612,7 @@ var IAMManagedPolicyProvider = class {
 			if (properties["Description"]) createParams.Description = properties["Description"];
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (tags.length > 0) createParams.Tags = tags;
-			const policyArn = (await this.iamClient.send(new CreatePolicyCommand(createParams))).Policy?.Arn;
+			const policyArn = (await (await this.createClient.get()).send(new CreatePolicyCommand(createParams))).Policy?.Arn;
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
@@ -1113,6 +1114,7 @@ function recordedNonRootPath(arn) {
 //#region src/provisioning/providers/iam-instance-profile-provider.ts
 var IAMInstanceProfileProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMInstanceProfileProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -1137,7 +1139,7 @@ var IAMInstanceProfileProvider = class {
 		const roles = principals.lists.Roles;
 		let leftBehind = false;
 		try {
-			const response = await this.iamClient.send(new CreateInstanceProfileCommand({
+			const response = await (await this.createClient.get()).send(new CreateInstanceProfileCommand({
 				InstanceProfileName: instanceProfileName,
 				Path: path
 			}));
@@ -1318,6 +1320,7 @@ var IAMInstanceProfileProvider = class {
 const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
 var IAMAccessKeyProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMAccessKeyProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -1349,7 +1352,7 @@ var IAMAccessKeyProvider = class {
 		const baseline = await this.tryListAccessKeyIds(userName, logicalId, log);
 		let leftBehindKeyId;
 		try {
-			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
+			const response = await (await this.createClient.get()).send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
 			const secretAccessKey = response.AccessKey?.SecretAccessKey;
 			leftBehindKeyId = accessKeyId;
@@ -1632,6 +1635,7 @@ function derivedNamePairs(resourceType, logicalId, properties) {
 }
 var IAMUserGroupProvider = class {
 	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMUserGroupProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -1700,7 +1704,7 @@ var IAMUserGroupProvider = class {
 			const createParams = { UserName: userName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (properties["Tags"] !== void 0 && properties["Tags"] !== null) createParams.Tags = desiredTags;
-			const response = await this.iamClient.send(new CreateUserCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateUserCommand(createParams));
 			leftBehind = true;
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
@@ -2078,7 +2082,7 @@ var IAMUserGroupProvider = class {
 		try {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
-			const response = await this.iamClient.send(new CreateGroupCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateGroupCommand(createParams));
 			leftBehind = true;
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
@@ -8256,93 +8260,6 @@ var LambdaUrlProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ambiguous-create.ts
-const CREATION_DATE_SKEW_MARGIN_MS = 5e3;
-const AMBIGUOUS_LATCH_TTL_MS = 18e5;
-const MAX_TRACKED = 1e4;
-const createAttemptKey = (scope, logicalId) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId);
-const setBounded = (map, key, value) => {
-	if (!map.has(key) && map.size >= MAX_TRACKED) {
-		const oldest = map.keys().next();
-		if (!oldest.done) map.delete(oldest.value);
-	}
-	map.set(key, value);
-};
-const mergeWindow = (existing, next, armedAtMs) => existing === void 0 ? {
-	floorMs: next.floorMs,
-	ceilingMs: next.ceilingMs,
-	armedAtMs
-} : {
-	floorMs: Math.min(existing.floorMs, next.floorMs),
-	ceilingMs: Math.max(existing.ceilingMs, next.ceilingMs),
-	armedAtMs: Math.max(existing.armedAtMs, armedAtMs)
-};
-var AmbiguousCreateLatch = class {
-	entries = /* @__PURE__ */ new Map();
-	scope;
-	constructor(scope) {
-		this.scope = scope;
-	}
-	noteFailure(logicalId, error, attemptStartMs, carried) {
-		if (!isAmbiguousOutcomeError(error)) return;
-		const key = createAttemptKey(this.scope, logicalId);
-		const now = Date.now();
-		let entry = mergeWindow(this.entries.get(key), {
-			floorMs: attemptStartMs - CREATION_DATE_SKEW_MARGIN_MS,
-			ceilingMs: now + CREATION_DATE_SKEW_MARGIN_MS
-		}, now);
-		if (carried !== void 0) entry = mergeWindow(entry, carried, now);
-		setBounded(this.entries, key, entry);
-	}
-	take(logicalId) {
-		const key = createAttemptKey(this.scope, logicalId);
-		const entry = this.entries.get(key);
-		this.entries.delete(key);
-		if (entry === void 0 || Date.now() - entry.armedAtMs > 18e5) return;
-		return {
-			floorMs: entry.floorMs,
-			ceilingMs: entry.ceilingMs
-		};
-	}
-	resetForTests() {
-		this.entries.clear();
-	}
-};
-const isInsideWindow = (date, window) => date !== void 0 && date.getTime() >= window.floorMs && date.getTime() <= window.ceilingMs;
-var RecentIdSet = class {
-	ids = /* @__PURE__ */ new Map();
-	add(id) {
-		setBounded(this.ids, id, true);
-	}
-	has(id) {
-		return this.ids.has(id);
-	}
-	resetForTests() {
-		this.ids.clear();
-	}
-};
-const isRetryStrategyV2 = (value) => typeof value === "object" && value !== null && typeof value.acquireInitialRetryToken === "function" && typeof value.refreshRetryTokenForRetry === "function" && typeof value.recordSuccess === "function";
-function withoutServerErrorRetries(client) {
-	const config = client.config;
-	const base = config?.retryStrategy;
-	if (config === void 0 || typeof base !== "function") return client;
-	const resolveBase = base;
-	config.retryStrategy = async () => {
-		const strategy = await resolveBase();
-		if (!isRetryStrategyV2(strategy)) return strategy;
-		return {
-			acquireInitialRetryToken: (scope) => strategy.acquireInitialRetryToken(scope),
-			refreshRetryTokenForRetry: (token, errorInfo) => {
-				if (isTransientServerError(errorInfo.error) && isAmbiguousOutcomeError(errorInfo.error)) return Promise.reject(/* @__PURE__ */ new Error("cdkd: no SDK retry of a 5xx on a tokenless create"));
-				return strategy.refreshRetryTokenForRetry(token, errorInfo);
-			},
-			recordSuccess: (token) => strategy.recordSuccess(token)
-		};
-	};
-	return client;
-}
-
 //#endregion
 //#region src/provisioning/providers/orphan-report.ts
 async function orphanCommandRegionArg(client, aws) {
@@ -34469,8 +34386,12 @@ function comparableRecordSize(value, mask) {
 }
 const KINESIS_DELETE_POLL_INTERVAL_MS = 2e3;
 const KINESIS_DELETE_MAX_WAIT_MS = 3e5;
+function isStreamName(id) {
+	return /^[a-zA-Z0-9_.-]{1,128}$/.test(id);
+}
 var KinesisStreamProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("KinesisProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::Stream", /* @__PURE__ */ new Set([
@@ -34490,6 +34411,13 @@ var KinesisStreamProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new KinesisClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const warn = (message) => this.logger.warn(mask(message));
@@ -34519,7 +34447,7 @@ var KinesisStreamProvider = class {
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
 			const maxRecordSizeInKiB = maxRecordRead.kind === "usable" ? maxRecordRead.size : void 0;
-			await this.getClient().send(new CreateStreamCommand({
+			await this.getCreateClient().send(new CreateStreamCommand({
 				StreamName: streamName,
 				...shardCount !== void 0 && { ShardCount: shardCount },
 				StreamModeDetails: { StreamMode: streamMode },
@@ -34716,7 +34644,8 @@ var KinesisStreamProvider = class {
 			if (error instanceof ResourceNotFoundException$10) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Kinesis stream ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -34732,6 +34661,28 @@ var KinesisStreamProvider = class {
 		});
 		this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 	}
+	async isSameResource(journaledPhysicalId, record, _resourceType, context) {
+		if (!isStreamName(journaledPhysicalId) || !isStreamName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordArn = await this.readStreamArnIfExists(record.physicalId);
+		if (recordArn === void 0) return "unknown";
+		const journaledArn = await this.readStreamArnIfExists(journaledPhysicalId);
+		if (journaledArn === void 0) return "different";
+		return journaledArn === recordArn ? "same" : "different";
+	}
+	async readStreamArnIfExists(streamName) {
+		let response;
+		try {
+			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return void 0;
+			throw error;
+		}
+		const arn = response.StreamDescriptionSummary?.StreamARN;
+		if (typeof arn !== "string" || arn === "") throw new Error("DescribeStreamSummary returned no StreamARN");
+		return arn;
+	}
 	async readStreamStatusForDelete(streamName) {
 		try {
 			return (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }))).StreamDescriptionSummary?.StreamStatus ?? "UNKNOWN";
@@ -42974,7 +42925,7 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} under parent ${displayStackName(ctx.parentStackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
+		if (!childTemplatePath) throw markNonRetryable(/* @__PURE__ */ new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} under parent ${displayStackName(ctx.parentStackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`));
 		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
 		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
@@ -43009,7 +42960,7 @@ var NestedStackProvider = class {
 		if (context?.replayingState === true) return this.revertFromChildJournal(ctx, logicalId, physicalId);
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} on update.`);
+		if (!childTemplatePath) throw markNonRetryable(/* @__PURE__ */ new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} on update.`));
 		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
 		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
@@ -43103,7 +43054,7 @@ var NestedStackProvider = class {
 				opts: { plainIdent: true }
 			}]);
 			const failure = new Error(nestedStackChildFailureMessage(plainOrDescribed(childStackName, "stack name"), childResult.errorCount, childResult.skippedCount, childResult.interrupted, inspect.command, withheldTargetClause(inspect, "stack", "cdkd state show", "The child stack's name")));
-			throw childResult.interrupted ? markNonRetryable(failure) : failure;
+			throw markNonRetryable(failure);
 		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
 			const causes = [];
@@ -43116,7 +43067,7 @@ var NestedStackProvider = class {
 		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
-		throw new Error(`AWS::CloudFormation::Stack: attribute ${displayIdent(attributeName)} is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`AWS::CloudFormation::Stack: attribute ${displayIdent(attributeName)} is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`));
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
 		const inheritedSecrets = getCurrentResourceSecrets();
@@ -43150,7 +43101,7 @@ var NestedStackProvider = class {
 	}
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
-		if (!childStateData) throw new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`);
+		if (!childStateData) throw markNonRetryable(/* @__PURE__ */ new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`));
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
@@ -43174,7 +43125,7 @@ var NestedStackProvider = class {
 		return ctx;
 	}
 	requireDeployContext(ctx, op) {
-		if (!ctx.nestedTemplates || !ctx.dagBuilder || !ctx.diffCalculator) throw new Error(`NestedStackProvider.${op}: deploy-mode context fields (nestedTemplates / dagBuilder / diffCalculator) are missing. This usually means a destroy-mode entry point called into create/update by mistake.`);
+		if (!ctx.nestedTemplates || !ctx.dagBuilder || !ctx.diffCalculator) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider.${op}: deploy-mode context fields (nestedTemplates / dagBuilder / diffCalculator) are missing. This usually means a destroy-mode entry point called into create/update by mistake.`));
 	}
 	refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath) {
 		const defect = findNestedTemplateTreeDefect({ [logicalId]: childTemplatePath });
@@ -43201,7 +43152,7 @@ var NestedStackProvider = class {
 		return result;
 	}
 	refuseNonScalarParameter(k, offender, where) {
-		throw new Error(`NestedStackProvider: child Parameter ${displayIdent(k)}${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: child Parameter ${displayIdent(k)}${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`));
 	}
 	readChildTemplate(templatePath, assetRedirect) {
 		let raw;
@@ -43214,7 +43165,7 @@ var NestedStackProvider = class {
 		try {
 			template = JSON.parse(raw);
 		} catch (err) {
-			throw new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`);
+			throw markNonRetryable(/* @__PURE__ */ new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`));
 		}
 		const grandchildTemplates = this.indexGrandchildTemplates(template, templatePath);
 		if (assetRedirect) {
@@ -43625,4 +43576,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-oRTqcSCp.js.map
+//# sourceMappingURL=provider-classes-CsF7Ia5F.js.map