@go-to-k/cdkd 0.301.15 → 0.302.0

package/dist/{provider-classes-CBbWGsK0.js → provider-classes-CXSiWJVn.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { A as SECRET_REF_MAX_CODE_POINTS, H as safeMsg, I as displayIdent, L as displaySafe, R as displayStackName, S as generateResourceNameWithFallback, V as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, r as describeAwsStatusReason, s as getLogger, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dap4bLyq.js";
+import { C as generateResourceName, G as displayIdent, J as isPasteableIdent, K as displaySafe, T as generatedNameFor, X as plainIdentOr, Z as safeMsg, a as safeStringify, i as isAwsAuthoredFailure, j as recordedGeneratedNameKept, n as describeAwsFailure, q as displayStackName, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback, z as SECRET_REF_MAX_CODE_POINTS } from "./aws-failure-text-BDZdavf4.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dnk6FCsr.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-Dy7N7-Il.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8Icvrf7.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CXvao3wc.js";
-import { RDSProvider } from "./rds-provider-BMQvQTTS.js";
-import { NeptuneProvider } from "./neptune-provider-CtnwSAGM.js";
-import { ASGProvider } from "./asg-provider-ClDYCUia.js";
+import { Ar as markDeleteStarted, Bo as toCfnInteger, C as hasCdkAutoDeleteTag, Ci as s3BucketDomainName, Cs as redactForState, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Ei as s3BucketWebsiteUrl, Eo as findSilentDropProperties, Er as reserveStackCreateToken, Et as chunks, F as findNestedTemplateTreeDefect, Fn as replacedDeleteFailureVerdict, Fr as refuseMalformedDesiredTags, Go as configIntegerRefusal, Gr as waitForLambdaFunctionActive, Ho as coerceCfnBoolean, Hs as withoutPhysicalNameCopies, I as isAbsoluteAssetPath, Ir as tagMapAsList, Jo as replayWarn, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ka as refuseMalformedNestedChildOutputs, Kl as canonicalizeRegion, Ko as configStringRefusal, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Lo as WARM_THROUGHPUT_MEMBERS, Lr as tagPlanWarning, Mr as DBPROXY_TAG_OPTIONS, Nn as getStackRecords, Nr as planTagDiff, Oo as withoutSilentDropProperties, Or as acquireIdempotencyToken, Os as hasMaskableValues, Ot as lookupEachName, Pr as readTagList, Qs as recordAttributeIdCopy, R as renderNestedTemplateTreeDefect, Ro as coerceWarmThroughput$1, Rr as definedAttributes, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as s3BucketArn, Ss as markSameGenerationBag, T as getPriorAttempts, Ti as s3BucketRegionalDomainName, Ts as snapshotPassProvenance, Ul as decodeListingKey, Uo as coerceCfnInteger, Vo as toFiniteNumber, Wc as rewriteTemplateAssetReferences, Wo as configBooleanRefusal, Ws as dynamicReferenceTokens, Xo as requireConfigObject, Xs as recoverMaskedOutput, Xt as redactedDeleteAddressFields, Yo as requireConfigArray, Yr as getCurrentResourceSecrets, Yt as isRedactedRecordedValue, Zi as getAccountInfo, Zo as requireConfigString, Zs as physicalNameCopiesOf, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _a as accountArgs, au as renderAssemblyPathEscape, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ci as withIndeterminateGuard, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, f as deleteBudgetKey, fi as ec2InstanceProtectionSite, fo as refuseMalformedResourcesForDestroy, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reEnableInstanceApiTermination, gs as passedNoEchoParametersOf, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as reDisableInstanceApiTermination, ht as getCurrentNestedStackContext, is as sameLambdaFunctionAddress, iu as displayAssemblyPath, ji as outputReferenceProvenanceOf, jn as awaitInFlightSibling, jr as DBPROXY_TAGS_WHAT, kr as isRefusedByName, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as isWaitAbandonedError, m as resolveDynamoDbDeleteBudgetMs, mi as observeThenDisableInstanceApiTermination, ni as unchangedBehindSecretReference, ns as canonicalLambdaFunctionName, ou as resolveAssemblyPath, p as resolveDynamoDbDeleteBudgetClock, pi as isTerminationProtectionPropagationError, ql as derivePartitionAndUrlSuffix, qo as readConfigString, rs as lambdaFunctionNameForMask, ru as describeFileReadFailure, sa as parseWebACLArn, si as deleteSkipReason, t as DeployEngine, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, ts as withRetry, u as beginDeleteWait, ua as passedParameterClassesOf, ui as markWaitAbandoned, ur as secretNamedAttributeNamesOf, v as maskedLogger, w as isTruthyCfnBoolean, wi as s3BucketDualStackDomainName, wo as withheldAccountClause, wr as earliestDefined, ws as recordReferenceProvenanceEntry, x as ECR_AUTO_DELETE_IMAGES_TAG, xi as isSettledInstanceState, y as relayedIndexBusyDelete, zc as stringifyValue, zo as isWarmThroughputDecrease, zr as stringifyIfAssigned } from "./deploy-engine-DU0BoQqo.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-WGsb9RxZ.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BVLiidXb.js";
+import { RDSProvider } from "./rds-provider-6RgDTDCV.js";
+import { NeptuneProvider } from "./neptune-provider-WE1O3kXY.js";
+import { ASGProvider } from "./asg-provider-BRr_hsky.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -133,7 +133,7 @@ var IAMPolicyProvider = class {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const { value: v } = log;
 		log.debug(`Creating IAM policy ${logicalId}`);
-		const policyName = properties["PolicyName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const policyName = properties["PolicyName"] || generatedNameFor("AWS::IAM::Policy", logicalId);
 		const policyDocument = properties["PolicyDocument"];
 		const targets = readPolicyTargetLists(properties);
 		if ("malformed" in targets) throw new ProvisioningError(`${targets.malformed.join(" / ")} of IAM policy ${logicalId} is not a list of IAM names — no inline policy was attached`, resourceType, logicalId);
@@ -239,7 +239,15 @@ var IAMPolicyProvider = class {
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["PolicyName"], oldPolicyName]]);
 		const { value: v } = log;
 		log.debug(`Updating IAM policy ${logicalId}: ${v(physicalId)}`);
-		const newPolicyName = properties["PolicyName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const derivedPolicyName = properties["PolicyName"] || generatedNameFor("AWS::IAM::Policy", logicalId);
+		const newPolicyName = oldPolicyName !== void 0 && recordedGeneratedNameKept({
+			recorded: oldPolicyName,
+			derived: derivedPolicyName,
+			declaredName: properties["PolicyName"],
+			previousDeclaredName: previousProperties["PolicyName"],
+			logicalId,
+			options: { maxLength: 64 }
+		}) ? oldPolicyName : derivedPolicyName;
 		const recordedPolicyName = previousProperties["PolicyName"];
 		const oldPolicyNames = [...new Set([oldPolicyName, recordedPolicyName].filter((name) => typeof name === "string" && IAM_POLICY_NAME.test(name)))];
 		const newTargets = readPolicyTargetLists(properties);
@@ -675,7 +683,16 @@ var IAMManagedPolicyProvider = class {
 		log.debug(`Updating IAM managed policy ${logicalId}: ${v(physicalId)}`);
 		const revertKeepsName = context?.desiredFromAwsReadback === true && derivedPolicyName !== oldPolicyName;
 		if (revertKeepsName) log.warn(`IAM managed policy ${logicalId}: ManagedPolicyName is not reverted — the policy ${v(oldPolicyName)} keeps its name (the reverted properties derive ${v(derivedPolicyName)}), since a drift revert never replaces a policy. 'cdkd drift' keeps reporting the name until 'cdkd drift --accept' records the live one; only a deploy renames the policy.`);
-		const newPolicyName = revertKeepsName ? oldPolicyName : derivedPolicyName;
+		const generatedNameKept = recordedGeneratedNameKept({
+			recorded: oldPolicyName,
+			derived: derivedPolicyName,
+			declaredName: properties["ManagedPolicyName"],
+			previousDeclaredName: previousProperties["ManagedPolicyName"],
+			logicalId,
+			options: { maxLength: 128 }
+		});
+		if (generatedNameKept) log.debug(`IAM managed policy ${logicalId}: keeping its generated name ${v(oldPolicyName)} (the template names no policy)`);
+		const newPolicyName = revertKeepsName || generatedNameKept ? oldPolicyName : derivedPolicyName;
 		const newPrincipals = principalsOf(properties);
 		const oldPrincipals = principalsOf(previousProperties);
 		const liveKinds = !("malformed" in newPrincipals) && onlySecretDerived(oldPrincipals) ? oldPrincipals.malformed : [];
@@ -5403,11 +5420,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["BucketName"]) return void 0;
-		return generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true,
-			allowedPattern: /[^a-z0-9.-]/g
-		});
+		return generatedNameFor("AWS::S3::Bucket", logicalId);
 	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
@@ -5754,7 +5767,7 @@ var SQSQueueProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["QueueName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 80 });
+		return generatedNameFor("AWS::SQS::Queue", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const resp = await this.sqsClient.send(new GetQueueAttributesCommand({
@@ -5835,7 +5848,7 @@ var SQSQueueProvider = class {
 				QueueUrl: physicalId,
 				AttributeNames: ["QueueArn"]
 			}));
-			const queueName = properties["QueueName"] || generateResourceName(logicalId, { maxLength: 80 });
+			const queueName = properties["QueueName"] || physicalId.split("/").pop() || generatedNameFor("AWS::SQS::Queue", logicalId);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -6845,7 +6858,7 @@ var SNSTopicProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["TopicName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 256 });
+		return generatedNameFor("AWS::SNS::Topic", logicalId);
 	}
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7837,7 +7850,7 @@ var LambdaFunctionProvider = class {
 		this.ec2Client = awsClients.ec2;
 	}
 	async create(logicalId, resourceType, properties, context) {
-		const functionName = properties["FunctionName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const functionName = properties["FunctionName"] || generatedNameFor("AWS::Lambda::Function", logicalId);
 		const log = lambdaOperationSinks(this.logger, context?.maskSecrets, [[properties["FunctionName"], functionName]], properties);
 		log.debug(`Creating Lambda function ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -9576,7 +9589,7 @@ var LambdaLayerVersionProvider = class {
 		});
 	}
 	async create(logicalId, resourceType, properties, context) {
-		const layerName = properties["LayerName"] || generateResourceName(logicalId, { maxLength: 64 });
+		const layerName = properties["LayerName"] || generatedNameFor("AWS::Lambda::LayerVersion", logicalId);
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[properties["LayerName"], layerName], [properties["LayerName"], layerNameSegment(layerName)]]);
 		log.debug(`Creating Lambda layer version ${logicalId}`);
 		const content = properties["Content"];
@@ -11080,7 +11093,7 @@ var LambdaNetworkConnectorProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(safeMsg`Creating Lambda network connector ${logicalId}`);
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generateResourceName(logicalId, { maxLength: 64 });
+		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generatedNameFor("AWS::Lambda::NetworkConnector", logicalId);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
 		const createToken = acquireIdempotencyToken({
 			scope: "CreateNetworkConnector",
@@ -11964,6 +11977,10 @@ const deleteTableRetryDelays = {};
 function maskLeafValue(value, maskSecrets) {
 	return maskDeep(value, maskSecrets);
 }
+const tableNameReleaseWait = {
+	maxPolls: 600,
+	intervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
+};
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	createClient;
@@ -12024,7 +12041,7 @@ var DynamoDBTableProvider = class {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		this.logger.debug(`Creating DynamoDB table ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const tableName = properties["TableName"] || generatedNameFor("AWS::DynamoDB::Table", logicalId);
 		const keySchema = properties["KeySchema"];
 		const attributeDefinitions = properties["AttributeDefinitions"];
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
@@ -12372,6 +12389,22 @@ var DynamoDBTableProvider = class {
 			throw this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async waitForNameReleased(logicalId, physicalId, _resourceType, context) {
+		const mask = context.maskSecrets ?? ((text) => text);
+		this.logger.info(mask(`  Waiting for the deleted DynamoDB table ${physicalId} to release its name...`));
+		for (let poll = 0; poll < tableNameReleaseWait.maxPolls; poll++) {
+			if (context.isInterrupted()) return;
+			try {
+				await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$1) return;
+				this.logger.debug(mask(`DynamoDB table ${logicalId}: name-release check failed: ${describeAwsFailure(error).detail}`));
+				if (!isThrottlingError(error) && !isTransientServerError(error)) return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, tableNameReleaseWait.intervalMs));
+		}
+		this.logger.debug(mask(`DynamoDB table ${logicalId} (${physicalId}) still held its name after the wait`));
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
 		try {
@@ -13433,10 +13466,7 @@ var LogsLogGroupProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["LogGroupName"]) return void 0;
-		return `/cdkd/${generateResourceName(logicalId, {
-			maxLength: 506,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`;
+		return generatedNameFor("AWS::Logs::LogGroup", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const group = (await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: physicalId }))).logGroups?.find((g) => g.logGroupName === physicalId);
@@ -14127,7 +14157,7 @@ var CloudWatchAlarmProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["AlarmName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 256 });
+		return generatedNameFor("AWS::CloudWatch::Alarm", logicalId);
 	}
 	async lookupNames(_resourceType, names) {
 		const wanted = new Set(names);
@@ -14446,10 +14476,7 @@ var SecretsManagerSecretProvider = class {
 		const { value: v } = log;
 		log.debug(`Creating secret ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = properties["Name"] || generateResourceName(logicalId, {
-			maxLength: 512,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		});
+		const name = properties["Name"] || generatedNameFor("AWS::SecretsManager::Secret", logicalId);
 		try {
 			let secretString;
 			const rawGenerate = properties["GenerateSecretString"];
@@ -14800,10 +14827,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 		const ssmTags = SSMParameterProvider.desiredSsmTags(properties["Tags"], resourceType, logicalId);
 		const debug = (message) => this.logger.debug(mask(message));
 		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
-		const name = properties["Name"] || `/${generateResourceName(logicalId, {
-			maxLength: 1023,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`;
+		const name = properties["Name"] || generatedNameFor("AWS::SSM::Parameter", logicalId);
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
@@ -15191,7 +15215,8 @@ var EventBridgeRuleProvider = class {
 		this.logger.debug(`Updating EventBridge rule ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
-		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
+		const recordedRuleName = physicalId.split("/").pop() ?? "";
+		const ruleName = properties["Name"] || recordedRuleName || generatedNameFor("AWS::Events::Rule", logicalId);
 		const newTargets = properties["Targets"];
 		const oldTargets = previousProperties["Targets"];
 		try {
@@ -15354,7 +15379,7 @@ var EventBridgeRuleProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["Name"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 64 });
+		return generatedNameFor("AWS::Events::Rule", logicalId);
 	}
 	lookupNeedsResolvedProperties(_resourceType, properties) {
 		const bus = properties["EventBusName"];
@@ -17289,7 +17314,7 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "security-group", desiredTags, (TagSpecifications) => createClient.send(new CreateSecurityGroupCommand({
-				GroupName: properties["GroupName"] ?? logicalId,
+				GroupName: properties["GroupName"] ?? generatedNameFor("AWS::EC2::SecurityGroup", logicalId),
 				Description: groupDescription,
 				VpcId: properties["VpcId"] ?? void 0,
 				...TagSpecifications && { TagSpecifications }
@@ -23852,7 +23877,7 @@ var StepFunctionsProvider = class {
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["StateMachineName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 80 });
+		return generatedNameFor("AWS::StepFunctions::StateMachine", logicalId);
 	}
 	async holderCreatedAt(_resourceType, physicalId) {
 		const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: physicalId }));
@@ -24355,7 +24380,7 @@ var ECSProvider = class {
 	async createTaskDefinition(logicalId, resourceType, properties, log) {
 		log.debug(`Creating ECS task definition ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const family = properties["Family"] || generateResourceName(logicalId, { maxLength: 255 });
+		const family = properties["Family"] || generatedNameFor("AWS::ECS::TaskDefinition", logicalId);
 		try {
 			const orphanWindow = registerTaskDefinitionLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleOrphanTaskDefinitions(logicalId, family, orphanWindow, log);
@@ -24432,7 +24457,7 @@ var ECSProvider = class {
 		log.debug(`Creating ECS service ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
-		const serviceName = properties["ServiceName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const serviceName = properties["ServiceName"] || generatedNameFor("AWS::ECS::Service", logicalId);
 		let survivorArn;
 		try {
 			const heldBefore = process.env["CDKD_FULL_WAIT"] === "true" ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
@@ -25368,7 +25393,7 @@ var ECSProvider = class {
 	}
 	generatedCreateName(resourceType, logicalId, properties) {
 		if (resourceType !== "AWS::ECS::Cluster" || properties["ClusterName"]) return void 0;
-		return generateResourceName(logicalId, { maxLength: 255 });
+		return generatedNameFor("AWS::ECS::Cluster", logicalId);
 	}
 	async lookupNames(resourceType, names) {
 		const found = /* @__PURE__ */ new Map();
@@ -26930,7 +26955,7 @@ var RDSDBProxyProvider = class {
 	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
-		const dbProxyName = properties["DBProxyName"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const dbProxyName = properties["DBProxyName"] ?? generatedNameFor("AWS::RDS::DBProxy", logicalId);
 		const engineFamily = properties["EngineFamily"];
 		if (!engineFamily) throw new ProvisioningError(`EngineFamily is required for AWS::RDS::DBProxy ${logicalId}`, resourceType, logicalId);
 		const auth = properties["Auth"];
@@ -27253,7 +27278,7 @@ var RDSDBProxyEndpointProvider = class {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyEndpoint ${logicalId}`, resourceType, logicalId);
-		const dbProxyEndpointName = properties["DBProxyEndpointName"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const dbProxyEndpointName = properties["DBProxyEndpointName"] ?? generatedNameFor("AWS::RDS::DBProxyEndpoint", logicalId);
 		const vpcSubnetIds = properties["VpcSubnetIds"];
 		if (!vpcSubnetIds || vpcSubnetIds.length === 0) throw new ProvisioningError(`VpcSubnetIds (at least one) is required for AWS::RDS::DBProxyEndpoint ${logicalId}`, resourceType, logicalId);
 		const client = this.getClient();
@@ -28145,10 +28170,7 @@ var DocDBProvider = class {
 	async createDBCluster(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating DocDB DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true
-		});
+		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
 		try {
@@ -28294,10 +28316,7 @@ var DocDBProvider = class {
 	async createDBInstance(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating DocDB DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generateResourceName(logicalId, {
-			maxLength: 63,
-			lowercase: true
-		});
+		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::DocDB::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
 		try {
@@ -28613,10 +28632,7 @@ var DocDBSubnetGroupProvider = class {
 		this.assertType(resourceType, logicalId);
 		this.logger.debug(safeMsg`Creating DocDB DBSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generateResourceName(logicalId, {
-			maxLength: 255,
-			lowercase: true
-		});
+		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generatedNameFor("AWS::DocDB::DBSubnetGroup", logicalId);
 		try {
 			await this.getCreateClient().send(new CreateDBSubnetGroupCommand$1({
 				DBSubnetGroupName: dbSubnetGroupName,
@@ -30024,7 +30040,7 @@ var WAFv2WebACLProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const name = properties["Name"] || generatedNameFor("AWS::WAFv2::WebACL", logicalId);
 		const scope = requireConfigString(properties["Scope"], "REGIONAL", "AWS::WAFv2::WebACL Scope", replayWarn(this.logger, context));
 		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
@@ -30563,7 +30579,7 @@ var CognitoUserPoolProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Cognito User Pool ${logicalId}`);
-		const poolName = properties["UserPoolName"] || generateResourceName(logicalId, { maxLength: 128 });
+		const poolName = properties["UserPoolName"] || generatedNameFor("AWS::Cognito::UserPool", logicalId);
 		let mfaConfiguration;
 		try {
 			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], replayWarn(this.logger, context));
@@ -31326,10 +31342,7 @@ var ElastiCacheProvider = class {
 	async createSubnetGroup(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CacheSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generateResourceName(logicalId, {
-			maxLength: 255,
-			lowercase: true
-		});
+		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generatedNameFor("AWS::ElastiCache::SubnetGroup", logicalId);
 		try {
 			await this.getCreateClient().send(new CreateCacheSubnetGroupCommand({
 				CacheSubnetGroupName: cacheSubnetGroupName,
@@ -31393,10 +31406,7 @@ var ElastiCacheProvider = class {
 	async createCacheCluster(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CacheCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const cacheClusterId = properties["ClusterName"] || generateResourceName(logicalId, {
-			maxLength: 40,
-			lowercase: true
-		});
+		const cacheClusterId = properties["ClusterName"] || generatedNameFor("AWS::ElastiCache::CacheCluster", logicalId);
 		let clusterCreated = false;
 		try {
 			await this.getCreateClient().send(new CreateCacheClusterCommand({
@@ -35557,7 +35567,7 @@ var GlueJobProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Job ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Job", logicalId);
 		const role = properties["Role"];
 		const command = properties["Command"];
 		if (!role) throw new ProvisioningError(`Role is required for Glue Job ${logicalId}`, resourceType, logicalId);
@@ -35845,7 +35855,7 @@ var GlueCrawlerProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Crawler ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Crawler", logicalId);
 		const role = properties["Role"];
 		const targets = properties["Targets"];
 		if (!role) throw new ProvisioningError(`Role is required for Glue Crawler ${logicalId}`, resourceType, logicalId);
@@ -36095,7 +36105,7 @@ var GlueConnectionProvider = class {
 		log.debug(`Creating Glue Connection ${logicalId}`);
 		const connectionInput = properties["ConnectionInput"];
 		if (!connectionInput) throw new ProvisioningError(`ConnectionInput is required for Glue Connection ${logicalId}`, resourceType, logicalId);
-		const name = connectionInput["Name"] ?? logicalId;
+		const name = connectionInput["Name"] ?? generatedNameFor("AWS::Glue::Connection", logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getCreateClient().send(new CreateConnectionCommand({
@@ -36300,7 +36310,7 @@ var GlueTriggerProvider = class {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
 		log.debug(`Creating Glue Trigger ${logicalId}`);
-		const name = properties["Name"] ?? logicalId;
+		const name = properties["Name"] ?? generatedNameFor("AWS::Glue::Trigger", logicalId);
 		const type = properties["Type"];
 		const actions = properties["Actions"];
 		if (!type) throw new ProvisioningError(`Type is required for Glue Trigger ${logicalId}`, resourceType, logicalId);
@@ -37709,7 +37719,7 @@ var KinesisStreamProvider = class {
 		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const streamName = properties["Name"] || generatedNameFor("AWS::Kinesis::Stream", logicalId);
 		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 		if (desiredRead.kind === "unusable") {
 			if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
@@ -38455,7 +38465,7 @@ var SchedulerScheduleProvider = class {
 		return result;
 	}
 	async create(logicalId, resourceType, properties) {
-		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const name = properties["Name"] ?? generatedNameFor("AWS::Scheduler::Schedule", logicalId);
 		const groupName = this.groupNameOf(properties);
 		this.logger.debug(`Creating Schedule ${logicalId}: ${name}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
@@ -38995,7 +39005,7 @@ var PipesPipeProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
-		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
+		const name = properties["Name"] ?? generatedNameFor("AWS::Pipes::Pipe", logicalId);
 		const tags = desiredTagMap(properties["Tags"], logicalId);
 		this.logger.debug(mask(`Creating Pipe ${logicalId}: ${name}`));
 		let createdIdentity;
@@ -41165,7 +41175,7 @@ const leftInPlaceWarning$1 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyCluster keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyCluster keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyCluster keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::Cluster): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyCluster keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 const toNumber$2 = (v) => {
 	if (v === void 0) return void 0;
@@ -42297,7 +42307,7 @@ const leftInPlaceWarning = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyInstanceFleet keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; ModifyInstanceFleet keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; ModifyInstanceFleet keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::EMR::InstanceFleetConfig): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyInstanceFleet keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
 const addInstanceFleetLatch = new AmbiguousCreateLatch("emr:AddInstanceFleet");
 const fleetsCreatedByThisProcess = new RecentIdSet();
@@ -42682,7 +42692,7 @@ var FirehoseProvider = class {
 		let createdStreamName;
 		try {
 			const input = {
-				DeliveryStreamName: deliveryStreamName || logicalId,
+				DeliveryStreamName: deliveryStreamName || generatedNameFor("AWS::KinesisFirehose::DeliveryStream", logicalId),
 				DeliveryStreamType: deliveryStreamType
 			};
 			if (properties["S3DestinationConfiguration"]) {
@@ -43578,7 +43588,7 @@ var CloudTrailProvider = class {
 		let createdTrailArn;
 		try {
 			const result = await this.getCreateClient().send(new CreateTrailCommand({
-				Name: trailName ?? logicalId,
+				Name: trailName ?? generatedNameFor("AWS::CloudTrail::Trail", logicalId),
 				S3BucketName: s3BucketName,
 				S3KeyPrefix: s3KeyPrefix,
 				IsMultiRegionTrail: isMultiRegionTrail,
@@ -43923,8 +43933,8 @@ var CodeBuildProvider = class {
 			artifactIdentifier: artifacts["ArtifactIdentifier"]
 		};
 	}
-	mapProperties(logicalId, properties) {
-		const name = properties["Name"] ?? logicalId;
+	mapProperties(undeclaredName, properties) {
+		const name = properties["Name"] ?? undeclaredName();
 		const source = properties["Source"];
 		const environment = properties["Environment"];
 		const sanitizeOptionalString = (value) => {
@@ -44053,7 +44063,7 @@ var CodeBuildProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CodeBuild Project ${logicalId}`);
 		try {
-			const input = this.mapProperties(logicalId, properties);
+			const input = this.mapProperties(() => generatedNameFor("AWS::CodeBuild::Project", logicalId), properties);
 			const result = await this.getCreateClient().send(new CreateProjectCommand(input));
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
@@ -44071,7 +44081,7 @@ var CodeBuildProvider = class {
 		this.logger.debug(`Updating CodeBuild Project ${logicalId}: ${physicalId}`);
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		try {
-			const input = this.mapProperties(logicalId, properties);
+			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
 			await this.getClient().send(new UpdateProjectCommand(input));
@@ -44425,7 +44435,7 @@ var CodeCommitRepositoryProvider = class {
 	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CodeCommit Repository ${logicalId}`);
-		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 100 });
+		const repositoryName = properties["RepositoryName"] || generatedNameFor("AWS::CodeCommit::Repository", logicalId);
 		const lists = this.readDesiredLists(logicalId, resourceType, {
 			Triggers: properties["Triggers"],
 			Tags: properties["Tags"]
@@ -45367,10 +45377,7 @@ var S3DirectoryBucketProvider = class {
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
 		let bucketName = properties["BucketName"];
-		if (!bucketName) bucketName = `${generateResourceName(logicalId, {
-			maxLength: 64,
-			lowercase: true
-		})}--${azId}--x-s3`;
+		if (!bucketName) bucketName = generatedNameFor("AWS::S3Express::DirectoryBucket", logicalId, { zoneId: azId });
 		const tags = desiredTags;
 		const includeTags = tags.length > 0;
 		try {
@@ -46304,7 +46311,7 @@ var ECRProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating ECR Repository ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 256 }).toLowerCase();
+		const repositoryName = properties["RepositoryName"] || generatedNameFor("AWS::ECR::Repository", logicalId);
 		let repositoryCreated = false;
 		try {
 			const tags = properties["Tags"] !== void 0 && properties["Tags"] !== null ? desiredTags : void 0;
@@ -47292,4 +47299,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CBbWGsK0.js.map
+//# sourceMappingURL=provider-classes-CXSiWJVn.js.map