@go-to-k/cdkd 0.296.7 → 0.296.8

package/dist/{provider-classes-CsF7Ia5F.js → provider-classes-CxXTKgEM.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger } from "./logger-DAaB7GFO.js";
 import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as deleteSkipReason, $s as derivePartitionAndUrlSuffix, A as resolveDynamoDbDeleteBudgetClock, Aa as requireConfigObject, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ca as coerceCfnInteger, Ct as getStackRecords, D as beginDeleteWait, Da as readConfigString, Di as refuseMalformedNestedChildOutputs, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configStringRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fa as withRetry, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as canonicalLambdaFunctionName, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Jn as slowCcOperationTimeoutMs, L as S3_AUTO_DELETE_OBJECTS_TAG, La as lambdaFunctionNameForMask, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as replayWarn, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, Qs as canonicalizeRegion, R as hasCdkAutoDeleteTag, Ra as sameLambdaFunctionAddress, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as coerceCfnBoolean, T as DynamoDBGlobalTableProvider, Ta as configIntegerRefusal, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wa as hasMaskableValues, Wo as stringifyValue, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Yo as rewriteTemplateAssetReferences, Ys as decodeListingKey, _a as WARM_THROUGHPUT_MEMBERS, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ao as dynamicReferenceTokens, ar as isTerminationProtectionPropagationError, ba as toCfnInteger, c as renderNestedTemplateTreeDefect, ca as withoutSilentDropProperties, cr as reEnableInstanceApiTermination, dc as renderAssemblyPathEscape, dt as getNestedRevertRun, er as withIndeterminateGuard, fc as resolveAssemblyPath, fo as carriesSecretMask, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigString, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as requireConfigArray, kr as s3BucketRegionalDomainName, lc as describeFileReadFailure, mt as revertNestedChildFromJournal, no as redactSecretsForState, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as findSilentDropProperties, or as observeThenDisableInstanceApiTermination, qi as refuseMalformedResourcesForDestroy, qr as passedParameterClassesOf, s as listNestedTemplateRows, sr as reDisableInstanceApiTermination, t as DeployEngine, to as markSameGenerationBag, tr as isWaitAbandonedError, uc as displayAssemblyPath, uo as recoverMaskedOutput, va as coerceWarmThroughput$1, vt as withNestedStackContext, wa as configBooleanRefusal, xa as toFiniteNumber, xt as awaitInFlightSibling, ya as isWarmThroughputDecrease, z as isTruthyCfnBoolean, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-wyaJUA8V.js";
-import { a as AmbiguousCreateLatch, c as isInsideWindow, i as AMBIGUOUS_LATCH_TTL_MS, l as setBounded, n as collectInlinePolicyNamesManagedBySiblings, o as RecentIdSet, r as IamCreateClientCache, s as createAttemptKey, t as IAMRoleProvider, u as withoutServerErrorRetries } from "./iam-role-provider-obY72uH2.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DEnDp4o0.js";
-import { RDSProvider } from "./rds-provider-Cf5P2so_.js";
-import { NeptuneProvider } from "./neptune-provider-C3f-vDOh.js";
-import { ASGProvider } from "./asg-provider-BU0YONBp.js";
+import { $n as deleteSkipReason, $s as derivePartitionAndUrlSuffix, A as resolveDynamoDbDeleteBudgetClock, Aa as requireConfigObject, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ca as coerceCfnInteger, Ct as getStackRecords, D as beginDeleteWait, Da as readConfigString, Di as refuseMalformedNestedChildOutputs, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configStringRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fa as withRetry, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, Ia as canonicalLambdaFunctionName, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Jn as slowCcOperationTimeoutMs, L as S3_AUTO_DELETE_OBJECTS_TAG, La as lambdaFunctionNameForMask, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as replayWarn, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, Qs as canonicalizeRegion, R as hasCdkAutoDeleteTag, Ra as sameLambdaFunctionAddress, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as coerceCfnBoolean, T as DynamoDBGlobalTableProvider, Ta as configIntegerRefusal, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wa as hasMaskableValues, Wo as stringifyValue, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Yo as rewriteTemplateAssetReferences, Ys as decodeListingKey, _a as WARM_THROUGHPUT_MEMBERS, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ao as dynamicReferenceTokens, ar as isTerminationProtectionPropagationError, ba as toCfnInteger, c as renderNestedTemplateTreeDefect, ca as withoutSilentDropProperties, cr as reEnableInstanceApiTermination, dc as renderAssemblyPathEscape, dt as getNestedRevertRun, er as withIndeterminateGuard, fc as resolveAssemblyPath, fo as carriesSecretMask, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigString, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as requireConfigArray, kr as s3BucketRegionalDomainName, lc as describeFileReadFailure, mt as revertNestedChildFromJournal, no as redactSecretsForState, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as findSilentDropProperties, or as observeThenDisableInstanceApiTermination, qi as refuseMalformedResourcesForDestroy, qr as passedParameterClassesOf, s as listNestedTemplateRows, sr as reDisableInstanceApiTermination, t as DeployEngine, to as markSameGenerationBag, tr as isWaitAbandonedError, uc as displayAssemblyPath, uo as recoverMaskedOutput, va as coerceWarmThroughput$1, vt as withNestedStackContext, wa as configBooleanRefusal, xa as toFiniteNumber, xt as awaitInFlightSibling, ya as isWarmThroughputDecrease, z as isTruthyCfnBoolean, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-iXgQFHYR.js";
+import { a as AmbiguousCreateLatch, c as isInsideWindow, i as AMBIGUOUS_LATCH_TTL_MS, l as setBounded, n as collectInlinePolicyNamesManagedBySiblings, o as RecentIdSet, r as IamCreateClientCache, s as createAttemptKey, t as IAMRoleProvider, u as withoutServerErrorRetries } from "./iam-role-provider-B1Ma2zVK.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CPziYRDp.js";
+import { RDSProvider } from "./rds-provider-C193wAF8.js";
+import { NeptuneProvider } from "./neptune-provider-C-WMp2hQ.js";
+import { ASGProvider } from "./asg-provider-BDJ1qN0J.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -6947,6 +6947,28 @@ function canonicalPolicy(text) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/providers/lambda-create-client.ts
+var LambdaCreateClientCache = class {
+	client;
+	shared;
+	constructor(shared) {
+		this.shared = shared;
+	}
+	get() {
+		const shared = this.shared();
+		if (!(shared instanceof LambdaClient)) return Promise.resolve(shared);
+		this.client ??= shared.config.region().then((region) => withoutServerErrorRetries(new LambdaClient({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.client = void 0;
+			throw error;
+		});
+		return this.client;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/lambda-function-provider.ts
 const SELF_NEEDLE_MIN_LENGTH$1 = 3;
@@ -7094,6 +7116,7 @@ function inlineCodeFileNameForRuntime(runtime) {
 }
 var LambdaFunctionProvider = class {
 	lambdaClient;
+	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
 	ec2Client;
 	logger = getLogger().child("LambdaFunctionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Set([
@@ -7213,7 +7236,7 @@ var LambdaFunctionProvider = class {
 				CodeSigningConfigArn: properties["CodeSigningConfigArn"],
 				Tags: tags
 			};
-			const response = await this.lambdaClient.send(new CreateFunctionCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateFunctionCommand(createParams));
 			functionCreated = true;
 			createdFunctionName = response.FunctionName || functionName;
 			const recursiveLoop = properties["RecursiveLoop"];
@@ -7851,6 +7874,7 @@ function functionNamePairs(value) {
 }
 var LambdaPermissionProvider = class {
 	lambdaClient;
+	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
 	logger = getLogger().child("LambdaPermissionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Permission", /* @__PURE__ */ new Set([
 		"FunctionName",
@@ -7903,7 +7927,7 @@ var LambdaPermissionProvider = class {
 			if (properties["EventSourceToken"]) addParams.EventSourceToken = properties["EventSourceToken"];
 			if (properties["FunctionUrlAuthType"]) addParams.FunctionUrlAuthType = properties["FunctionUrlAuthType"];
 			if (properties["InvokedViaFunctionUrl"] !== void 0) addParams.InvokedViaFunctionUrl = properties["InvokedViaFunctionUrl"];
-			await this.lambdaClient.send(new AddPermissionCommand(addParams));
+			await (await this.createClient.get()).send(new AddPermissionCommand(addParams));
 			log.debug(`Successfully created Lambda permission ${logicalId}: ${statementId}`);
 			return {
 				physicalId: statementId,
@@ -8060,6 +8084,7 @@ var LambdaPermissionProvider = class {
 //#region src/provisioning/providers/lambda-url-provider.ts
 var LambdaUrlProvider = class {
 	lambdaClient;
+	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
 	logger = getLogger().child("LambdaUrlProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Url", /* @__PURE__ */ new Set([
 		"TargetFunctionArn",
@@ -8094,7 +8119,7 @@ var LambdaUrlProvider = class {
 			if (properties["Qualifier"]) createParams.Qualifier = properties["Qualifier"];
 			if (properties["InvokeMode"]) createParams.InvokeMode = properties["InvokeMode"];
 			if (cors) createParams.Cors = this.buildCorsConfig(cors);
-			const response = await this.lambdaClient.send(new CreateFunctionUrlConfigCommand(createParams));
+			const response = await (await this.createClient.get()).send(new CreateFunctionUrlConfigCommand(createParams));
 			const functionUrl = response.FunctionUrl;
 			const functionArn = response.FunctionArn;
 			log.debug(`Successfully created Lambda URL ${logicalId}: ${functionUrl}`);
@@ -13377,6 +13402,19 @@ var EventBridgeBusProvider = class {
 	constructor() {
 		this.eventBridgeClient = getAwsClients().eventBridge;
 	}
+	createClient;
+	getCreateClient() {
+		const shared = this.eventBridgeClient;
+		if (!(shared instanceof EventBridgeClient)) return Promise.resolve(shared);
+		this.createClient ??= shared.config.region().then((region) => withoutServerErrorRetries(new EventBridgeClient({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const name = properties["Name"];
@@ -13391,7 +13429,7 @@ var EventBridgeBusProvider = class {
 			const dlcCreate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
 			if (dlcCreate) createParams.DeadLetterConfig = dlcCreate;
 			if (properties["LogConfig"] !== void 0) createParams.LogConfig = properties["LogConfig"];
-			const response = await this.eventBridgeClient.send(new CreateEventBusCommand(createParams));
+			const response = await (await this.getCreateClient()).send(new CreateEventBusCommand(createParams));
 			if (properties["Policy"]) {}
 			return {
 				physicalId: name,
@@ -13683,6 +13721,22 @@ function isEc2NotFoundCode(error) {
 	const name = error?.name;
 	return typeof name === "string" && name.endsWith(".NotFound");
 }
+function isNamedError(error, names) {
+	const name = error?.name;
+	return typeof name === "string" && names.has(name);
+}
+const NAT_GATEWAY_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["NatGatewayNotFound"]);
+const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
+const NAT_GATEWAY_ID_PATTERN = /^nat-[0-9a-f]+$/;
+const EIP_ALLOCATION_ID_PATTERN = /^eipalloc-[0-9a-f]+$/;
+function natGatewayIdentity(physicalId) {
+	return NAT_GATEWAY_ID_PATTERN.test(physicalId) ? physicalId : void 0;
+}
+function eipAllocationIdentity(physicalId) {
+	const segments = physicalId.split("|");
+	const allocationId = segments.length === 1 ? segments[0] : segments.length === 2 ? segments[1] : void 0;
+	return allocationId !== void 0 && EIP_ALLOCATION_ID_PATTERN.test(allocationId) ? allocationId : void 0;
+}
 const createVpcLatch = new AmbiguousCreateLatch("ec2:CreateVpc");
 const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
 const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
@@ -14014,6 +14068,51 @@ var EC2Provider = class {
 			default: return;
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		let read;
+		let journaledId;
+		let recordId;
+		if (resourceType === "AWS::EC2::NatGateway") {
+			journaledId = natGatewayIdentity(journaledPhysicalId);
+			recordId = natGatewayIdentity(record.physicalId);
+			read = (id) => this.readNatGatewayIdIfLive(id);
+		} else if (resourceType === "AWS::EC2::EIP") {
+			journaledId = eipAllocationIdentity(journaledPhysicalId);
+			recordId = eipAllocationIdentity(record.physicalId);
+			read = (id) => this.readEipAllocationIdIfExists(id);
+		} else return "unknown";
+		if (journaledId === void 0 || recordId === void 0) return "unknown";
+		if (journaledId === recordId) return "same";
+		if (resourceType === "AWS::EC2::EIP" && journaledPhysicalId === journaledId) return "unknown";
+		if (await this.ec2Client.config.region() !== context.expectedRegion) return "unknown";
+		if (await read(recordId) !== recordId) return "unknown";
+		return await read(journaledId) === recordId ? "same" : "different";
+	}
+	async readNatGatewayIdIfLive(natGatewayId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [natGatewayId] }));
+		} catch (error) {
+			if (isNamedError(error, NAT_GATEWAY_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const gateways = response.NatGateways ?? [];
+		if (gateways.length !== 1 || typeof gateways[0]?.NatGatewayId !== "string") throw new Error("DescribeNatGateways did not return exactly the gateway asked for");
+		const gateway = gateways[0];
+		return gateway.State === "pending" || gateway.State === "available" ? gateway.NatGatewayId : void 0;
+	}
+	async readEipAllocationIdIfExists(allocationId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }));
+		} catch (error) {
+			if (isNamedError(error, EIP_ALLOCATION_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const addresses = response.Addresses ?? [];
+		if (addresses.length !== 1 || typeof addresses[0]?.AllocationId !== "string") throw new Error("DescribeAddresses did not return exactly the address asked for");
+		return addresses[0].AllocationId;
+	}
 	async createVpc(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating VPC ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -14527,7 +14626,8 @@ var EC2Provider = class {
 			if (this.isNotFoundError(error)) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Elastic IP ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -14659,7 +14759,8 @@ var EC2Provider = class {
 			if (this.isNotFoundError(error)) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`NatGateway ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  NAT gateway ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`NatGateway ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -42607,6 +42708,7 @@ var S3TablesProvider = class {
 //#region src/provisioning/providers/ecr-provider.ts
 var ECRProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ECRProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ECR::Repository", /* @__PURE__ */ new Set([
@@ -42627,6 +42729,13 @@ var ECRProvider = class {
 		});
 		return this.client;
 	}
+	getCreateClient() {
+		if (!this.createClient) this.createClient = withoutServerErrorRetries(new ECRClient({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		}));
+		return this.createClient;
+	}
 	toSdkScanningConfig(cfn) {
 		if (!cfn) return void 0;
 		return { scanOnPush: Boolean(cfn["ScanOnPush"]) };
@@ -42666,7 +42775,7 @@ var ECRProvider = class {
 			const scanningConfig = this.toSdkScanningConfig(properties["ImageScanningConfiguration"]);
 			const encryptionConfig = this.toSdkEncryptionConfig(properties["EncryptionConfiguration"]);
 			const exclusionFilters = this.toSdkTagMutabilityExclusionFilters(properties["ImageTagMutabilityExclusionFilters"]);
-			const response = await this.getClient().send(new CreateRepositoryCommand({
+			const response = await this.getCreateClient().send(new CreateRepositoryCommand({
 				repositoryName,
 				...scanningConfig ? { imageScanningConfiguration: scanningConfig } : {},
 				...properties["ImageTagMutability"] ? { imageTagMutability: properties["ImageTagMutability"] } : {},
@@ -43576,4 +43685,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CsF7Ia5F.js.map
+//# sourceMappingURL=provider-classes-CxXTKgEM.js.map