@go-to-k/cdkd 0.312.0 → 0.313.0

package/dist/{provider-classes-Dz0pYmlJ.js → provider-classes-DefoNqY7.js}

@@ -2,13 +2,13 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
 import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-BT2Dfnpt.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as getPriorAttempts, $s as isWarmThroughputDecrease, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ad as renderAssemblyPathEscape, Ai as acquireIdempotencyToken, Ao as accountArgs, B as deleteTableWithIndexBusyRetry, Bc as markSameGenerationBag, Bi as refuseMalformedDesiredTags, Bn as isRedactedRecordedValue, Bs as findSilentDropProperties, C as planContributorInsightsOp, Co as passedParameterClassesOf, D as reverseMapTableContributorInsights, E as reverseMapIndexContributorInsights, Ei as earliestDefined, F as resolveDynamoDbDeleteBudgetClock, Fa as s3BucketDomainName, Fi as markDeleteStarted, Fr as getStackRecords, G as isTtlRateLimited, H as relayedIndexBusyDelete, Hc as recordReferenceProvenanceEntry, Hi as tagPlanWarning, Hn as redactedDeleteAddressSkip, Hs as withoutSilentDropProperties, I as resolveDynamoDbDeleteBudgetMs, Ia as s3BucketDualStackDomainName, Ii as DBPROXY_TAGS_WHAT, It as getNestedRevertRun, J as sendTtlWaitingOutRateLimit, K as planTimeToLive, Kc as hasMaskableValues, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as s3BucketRegionalDomainName, Li as DBPROXY_TAG_OPTIONS, Ln as getCurrentProducerRegions, Lr as replacedDeleteFailureVerdict, Ls as withheldAccountClause, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Na as isSettledInstanceState, Nr as awaitInFlightSibling, O as stripIndexContributorInsights, Od as describeFileReadFailure, Oi as reserveStackCreateToken, P as deleteBudgetKey, Pa as s3BucketArn, Pc as passedNoEchoParametersOf, Pi as isRefusedByName, Q as isTruthyCfnBoolean, Qs as coerceWarmThroughput$1, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketWebsiteUrl, Ri as planTagDiff, S as indexDeclaresContributorInsights, Sa as reEnableInstanceApiTermination, Sc as sameLambdaFunctionAddress, T as readContributorInsightsSpec, Ta as isUsableAttemptedName, Ts as refuseMalformedResourcesForDestroy, U as waitForIndexesSettled, Ua as outputReferenceProvenanceOf, Uc as snapshotPassProvenance, Ui as definedAttributes, Ut as getCurrentNestedStackContext, V as maskedLogger, Vc as redactForState, Vi as tagMapAsList, Vn as redactedDeleteAddressFields, W as isTtlAlreadyDisabled, Wi as stringifyIfAssigned, Wt as withNestedStackContext, X as S3_AUTO_DELETE_OBJECTS_TAG, Xi as waitForLambdaFunctionActive, Y as ECR_AUTO_DELETE_IMAGES_TAG, Z as hasCdkAutoDeleteTag, Zs as WARM_THROUGHPUT_MEMBERS, _ as streamMemberRefusals, _l as recordAttributeIdCopy, ac as configIntegerRefusal, as as refuseMalformedNestedChildOutputs, b as CONTRIBUTOR_INSIGHTS_KEY, ba as observeThenDisableInstanceApiTermination, bc as canonicalLambdaFunctionName, bl as carriesSecretMask, bo as parseWebACLArn, c as DynamoDBGlobalTableProvider, ca as unchangedBehindSecretReference, cc as replayWarn, cl as dynamicReferenceTokens, d as declaredStreamPolicyMember, dc as requireConfigString, dd as decodeListingKey, dt as listNestedTemplateRows, ea as getCurrentResourceSecrets, ec as toCfnInteger, en as chunks, et as markRefusedBeforeApplying, f as declaredStreamTagsMember, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, g as streamDeclaresTags, ga as markWaitAbandoned, gc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, gl as physicalNameCopiesOf, h as streamDeclaresPolicy, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hl as recoverMaskedOutput, ic as configBooleanRefusal, iu as timePhase, j as DYNAMODB_DELETE_POLL_COST_MS, jd as resolveAssemblyPath, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, kd as displayAssemblyPath, l as STREAM_POLICY_KEY, lc as requireConfigArray, lo as getAccountInfo, lt as findNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as withIndeterminateGuard, md as canonicalizeRegion, nc as coerceCfnBoolean, nn as lookupEachName, oa as slowCcOperationTimeoutMs, oc as configStringRefusal, ol as withoutPhysicalNameCopies, p as planStreamMemberOps, pa as deleteSkipReason, pi as secretNamedAttributeNamesOf, q as readTtlSpec, rc as coerceCfnInteger, rn as withApiLimit, sa as onlySecretReferencesDiffer, sc as readConfigString, su as stringifyValue, t as DeployEngine, tc as toFiniteNumber, tn as isAccessDeniedError, u as STREAM_TAGS_KEY, uc as requireConfigObject, ut as isAbsoluteAssetPath, v as streamPolicyMatchesDeclared, va as ec2InstanceProtectionSite, vc as ecsServiceLaunchTypeSetOrChanged, vt as enclosingDeadlineExpired, w as planIndexContributorInsightsOps, x as contributorInsightsRefusals, xa as reDisableInstanceApiTermination, xc as lambdaFunctionNameForMask, y as streamTagsMatchDeclared, ya as isTerminationProtectionPropagationError, yc as emrClusterInstancesReplaced, yt as enclosingDeadlineRemainingMs, z as TABLE_INDEX_NOUN, zi as readTagList, zn as REDACTED_DELETE_ADDRESS_SKIP_REASON, zt as revertNestedChildFromJournal } from "./deploy-engine-CVNzK__j.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DM7bN9m1.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Nk_95KKk.js";
+import { $ as getPriorAttempts, $s as isWarmThroughputDecrease, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ad as renderAssemblyPathEscape, Ai as acquireIdempotencyToken, Ao as accountArgs, B as deleteTableWithIndexBusyRetry, Bc as markSameGenerationBag, Bi as refuseMalformedDesiredTags, Bn as isRedactedRecordedValue, Bs as findSilentDropProperties, C as planContributorInsightsOp, Co as passedParameterClassesOf, D as reverseMapTableContributorInsights, E as reverseMapIndexContributorInsights, Ei as earliestDefined, F as resolveDynamoDbDeleteBudgetClock, Fa as s3BucketDomainName, Fi as markDeleteStarted, Fr as getStackRecords, G as isTtlRateLimited, H as relayedIndexBusyDelete, Hc as recordReferenceProvenanceEntry, Hi as tagPlanWarning, Hn as redactedDeleteAddressSkip, Hs as withoutSilentDropProperties, I as resolveDynamoDbDeleteBudgetMs, Ia as s3BucketDualStackDomainName, Ii as DBPROXY_TAGS_WHAT, It as getNestedRevertRun, J as sendTtlWaitingOutRateLimit, K as planTimeToLive, Kc as hasMaskableValues, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as s3BucketRegionalDomainName, Li as DBPROXY_TAG_OPTIONS, Ln as getCurrentProducerRegions, Lr as replacedDeleteFailureVerdict, Ls as withheldAccountClause, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Na as isSettledInstanceState, Nr as awaitInFlightSibling, O as stripIndexContributorInsights, Od as describeFileReadFailure, Oi as reserveStackCreateToken, P as deleteBudgetKey, Pa as s3BucketArn, Pc as passedNoEchoParametersOf, Pi as isRefusedByName, Q as isTruthyCfnBoolean, Qs as coerceWarmThroughput$1, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketWebsiteUrl, Ri as planTagDiff, S as indexDeclaresContributorInsights, Sa as reEnableInstanceApiTermination, Sc as sameLambdaFunctionAddress, T as readContributorInsightsSpec, Ta as isUsableAttemptedName, Ts as refuseMalformedResourcesForDestroy, U as waitForIndexesSettled, Ua as outputReferenceProvenanceOf, Uc as snapshotPassProvenance, Ui as definedAttributes, Ut as getCurrentNestedStackContext, V as maskedLogger, Vc as redactForState, Vi as tagMapAsList, Vn as redactedDeleteAddressFields, W as isTtlAlreadyDisabled, Wi as stringifyIfAssigned, Wt as withNestedStackContext, X as S3_AUTO_DELETE_OBJECTS_TAG, Xi as waitForLambdaFunctionActive, Y as ECR_AUTO_DELETE_IMAGES_TAG, Z as hasCdkAutoDeleteTag, Zs as WARM_THROUGHPUT_MEMBERS, _ as streamMemberRefusals, _l as recordAttributeIdCopy, ac as configIntegerRefusal, as as refuseMalformedNestedChildOutputs, b as CONTRIBUTOR_INSIGHTS_KEY, ba as observeThenDisableInstanceApiTermination, bc as canonicalLambdaFunctionName, bl as carriesSecretMask, bo as parseWebACLArn, c as DynamoDBGlobalTableProvider, ca as unchangedBehindSecretReference, cc as replayWarn, cl as dynamicReferenceTokens, d as declaredStreamPolicyMember, dc as requireConfigString, dd as decodeListingKey, dt as listNestedTemplateRows, ea as getCurrentResourceSecrets, ec as toCfnInteger, en as chunks, et as markRefusedBeforeApplying, f as declaredStreamTagsMember, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, g as streamDeclaresTags, ga as markWaitAbandoned, gc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, gl as physicalNameCopiesOf, h as streamDeclaresPolicy, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hl as recoverMaskedOutput, ic as configBooleanRefusal, iu as timePhase, j as DYNAMODB_DELETE_POLL_COST_MS, jd as resolveAssemblyPath, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, kd as displayAssemblyPath, l as STREAM_POLICY_KEY, lc as requireConfigArray, lo as getAccountInfo, lt as findNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as withIndeterminateGuard, md as canonicalizeRegion, nc as coerceCfnBoolean, nn as lookupEachName, oa as slowCcOperationTimeoutMs, oc as configStringRefusal, ol as withoutPhysicalNameCopies, p as planStreamMemberOps, pa as deleteSkipReason, pi as secretNamedAttributeNamesOf, q as readTtlSpec, rc as coerceCfnInteger, rn as withApiLimit, sa as onlySecretReferencesDiffer, sc as readConfigString, su as stringifyValue, t as DeployEngine, tc as toFiniteNumber, tn as isAccessDeniedError, u as STREAM_TAGS_KEY, uc as requireConfigObject, ut as isAbsoluteAssetPath, v as streamPolicyMatchesDeclared, va as ec2InstanceProtectionSite, vc as ecsServiceLaunchTypeSetOrChanged, vt as enclosingDeadlineExpired, w as planIndexContributorInsightsOps, x as contributorInsightsRefusals, xa as reDisableInstanceApiTermination, xc as lambdaFunctionNameForMask, y as streamTagsMatchDeclared, ya as isTerminationProtectionPropagationError, yc as emrClusterInstancesReplaced, yt as enclosingDeadlineRemainingMs, z as TABLE_INDEX_NOUN, zi as readTagList, zn as REDACTED_DELETE_ADDRESS_SKIP_REASON, zt as revertNestedChildFromJournal } from "./deploy-engine-CwpnkMCZ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ARR3C50J.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CMP_YVVn.js";
 import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D7wXWxVo.js";
-import { RDSProvider } from "./rds-provider-CXSZq1c8.js";
-import { NeptuneProvider } from "./neptune-provider-qdoLunCh.js";
-import { ASGProvider } from "./asg-provider-CVLTQtQr.js";
+import { RDSProvider } from "./rds-provider-Dn-7U1CR.js";
+import { NeptuneProvider } from "./neptune-provider-DfPOAG0q.js";
+import { ASGProvider } from "./asg-provider-CqPtIngx.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -9379,13 +9379,17 @@ function toCfnSelfManagedEventSource(selfManagedEventSource) {
 	return renameEndpointsKey(selfManagedEventSource, SDK_KAFKA_ENDPOINTS_KEY, CFN_KAFKA_ENDPOINTS_KEY);
 }
 const KAFKA_CONSUMPTION_MODE_KEY = "ConsumptionMode";
-function declaredConsumptionMode(properties) {
+const KAFKA_DEFAULT_CONSUMPTION_MODE = "Stream";
+function consumptionModeOf(properties) {
 	const config = properties["SelfManagedKafkaEventSourceConfig"];
-	if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
-	return config[KAFKA_CONSUMPTION_MODE_KEY];
+	if (typeof config !== "object" || config === null || Array.isArray(config)) return KAFKA_DEFAULT_CONSUMPTION_MODE;
+	return config[KAFKA_CONSUMPTION_MODE_KEY] ?? KAFKA_DEFAULT_CONSUMPTION_MODE;
 }
-function consumptionModeRefusalMessage(logicalId, mode) {
-	return `AWS::Lambda::EventSourceMapping ${logicalId}: SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript does not model the member, so it would be dropped from the ${mode === "create" ? "CreateEventSourceMapping" : "UpdateEventSourceMapping"} request without an error. Remove ${KAFKA_CONSUMPTION_MODE_KEY} from SelfManagedKafkaEventSourceConfig to deploy the mapping without it.`;
+function replayableKafkaConfig(properties) {
+	if (consumptionModeOf(properties) !== "Queue") return void 0;
+	if (properties["StartingPosition"] === void 0 && properties["StartingPositionTimestamp"] === void 0 && properties["MaximumBatchingWindowInSeconds"] === void 0) return;
+	const { [KAFKA_CONSUMPTION_MODE_KEY]: _dropped, ...rest } = properties["SelfManagedKafkaEventSourceConfig"];
+	return rest;
 }
 function kafkaConfigForUpdate(desired, previous, options) {
 	const asObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
@@ -9573,11 +9577,6 @@ var LambdaEventSourceMappingProvider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const functionName = properties["FunctionName"];
 		if (!functionName) throw new ProvisioningError(`FunctionName is required for event source mapping ${logicalId}`, resourceType, logicalId);
-		if (declaredConsumptionMode(properties) !== void 0) {
-			const message = consumptionModeRefusalMessage(logicalId, "create");
-			if (context?.replayingState !== true) throw new ProvisioningError(message, resourceType, logicalId);
-			log.warn(safeMsg`${message} Proceeding without it: this create replays a cdkd state record.`);
-		}
 		try {
 			const params = { FunctionName: functionName };
 			if (properties["EventSourceArn"]) params.EventSourceArn = properties["EventSourceArn"];
@@ -9596,6 +9595,11 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["SourceAccessConfigurations"]) params.SourceAccessConfigurations = properties["SourceAccessConfigurations"];
 			if (properties["SelfManagedEventSource"]) params.SelfManagedEventSource = toSdkSelfManagedEventSource(properties["SelfManagedEventSource"]);
 			if (properties["SelfManagedKafkaEventSourceConfig"]) params.SelfManagedKafkaEventSourceConfig = properties["SelfManagedKafkaEventSourceConfig"];
+			const replayableKafka = context?.replayingState === true ? replayableKafkaConfig(properties) : void 0;
+			if (replayableKafka !== void 0) {
+				log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: the state record holds ConsumptionMode Queue beside a member Lambda refuses with it, so the mapping it records never ran in Queue mode. Proceeding without ConsumptionMode: this create replays a cdkd state record.`);
+				params.SelfManagedKafkaEventSourceConfig = replayableKafka;
+			}
 			if (properties["AmazonManagedKafkaEventSourceConfig"]) params.AmazonManagedKafkaEventSourceConfig = properties["AmazonManagedKafkaEventSourceConfig"];
 			if (properties["DocumentDBEventSourceConfig"]) params.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
 			if (properties["ScalingConfig"]) params.ScalingConfig = properties["ScalingConfig"];
@@ -9632,7 +9636,11 @@ var LambdaEventSourceMappingProvider = class {
 				attributes: {
 					Id: uuid,
 					EventSourceMappingArn: response.EventSourceMappingArn
-				}
+				},
+				...replayableKafka !== void 0 && { effectiveProperties: {
+					...properties,
+					SelfManagedKafkaEventSourceConfig: replayableKafka
+				} }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -9666,18 +9674,15 @@ var LambdaEventSourceMappingProvider = class {
 		const log = this.operationSinks(context?.maskSecrets, properties, previousProperties);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const restoring = context?.replayingState === true || context?.desiredFromAwsReadback === true;
-		for (const key of ["Queues", "Topics"]) {
-			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
-			const reason = `${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`;
+		const refuseChange = (reason) => {
 			if (!restoring) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${reason}; deploy with --replace to delete and recreate the mapping`);
 			log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: ${reason}. Proceeding without it: this update restores a recorded or read-back configuration.`);
+		};
+		for (const key of ["Queues", "Topics"]) {
+			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
+			refuseChange(`${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`);
 		}
-		const desiredMode = declaredConsumptionMode(properties);
-		if (desiredMode !== void 0 && JSON.stringify(desiredMode) !== JSON.stringify(declaredConsumptionMode(previousProperties))) {
-			const message = consumptionModeRefusalMessage(logicalId, "update");
-			if (!restoring) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
-			log.warn(safeMsg`${message} Proceeding without it: this update restores a recorded or read-back configuration.`);
-		}
+		if (JSON.stringify(consumptionModeOf(properties)) !== JSON.stringify(consumptionModeOf(previousProperties))) refuseChange(`SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be changed on an existing event source mapping (UpdateEventSourceMapping refuses it)`);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, restoring);
 		} catch (error) {
@@ -9905,6 +9910,24 @@ var LambdaEventSourceMappingProvider = class {
 		result["Tags"] = tags;
 		return result;
 	}
+	async canonicalizeDriftPair(_resourceType, baseline, aws, properties) {
+		const key = "SelfManagedKafkaEventSourceConfig";
+		const block = baseline[key];
+		if (typeof block !== "object" || block === null || Array.isArray(block) || KAFKA_CONSUMPTION_MODE_KEY in block || consumptionModeOf(aws) !== KAFKA_DEFAULT_CONSUMPTION_MODE || consumptionModeOf(properties ?? {}) !== KAFKA_DEFAULT_CONSUMPTION_MODE || aws[key]?.[KAFKA_CONSUMPTION_MODE_KEY] === void 0) return {
+			baseline,
+			aws
+		};
+		return {
+			baseline: {
+				...baseline,
+				[key]: {
+					...block,
+					[KAFKA_CONSUMPTION_MODE_KEY]: KAFKA_DEFAULT_CONSUMPTION_MODE
+				}
+			},
+			aws
+		};
+	}
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
 		let resp;
@@ -44461,7 +44484,7 @@ const cfnKeepsOnRemoval = (name, shape, removed) => {
 	if (narrow) return narrow(shape, removed);
 	return !cfnRefusesRemoval(name, shape) && !shape.storageTypes.includes("INTELLIGENT_TIERING") && (CFN_KEEPS_ON_REMOVAL.has(name) || typeof shape.fileSystemType === "string" && CFN_KEEPS_TOP_LEVEL_ON_REMOVAL.get(shape.fileSystemType)?.has(name) === true);
 };
-const leftInPlaceWarning$2 = (logicalId, names, caller, shape) => {
+const leftInPlaceWarning$3 = (logicalId, names, caller, shape) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -44825,7 +44848,7 @@ var FSxFileSystemProvider = class {
 		const leftInPlaceNames = [...TOP_LEVEL_LEFT_IN_PLACE_PROPS.filter((key) => properties[key] === void 0 && previousProperties[key] !== void 0), ...leftInPlace.map((key) => `${variantConfigKey}.${key}`)];
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning$2(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy", {
+			this.logger.warn(leftInPlaceWarning$3(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy", {
 				fileSystemType: properties["FileSystemType"] ?? previousProperties["FileSystemType"],
 				storageTypes: [previousProperties["StorageType"], properties["StorageType"]],
 				deploymentTypes: [previousProperties, properties].map((side) => variantConfigKey ? side[variantConfigKey]?.["DeploymentType"] : void 0),
@@ -45981,7 +46004,7 @@ const toNumber$1 = (v) => {
 };
 const jsonEqual$1 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const LEFT_IN_PLACE_ON_REMOVAL$1 = ["ResizeSpecifications", "InstanceTypeConfigs"];
-const leftInPlaceWarning$1 = (logicalId, names, caller) => {
+const leftInPlaceWarning$2 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -46170,7 +46193,7 @@ var EMRInstanceFleetConfigProvider = class {
 		const leftInPlaceNames = LEFT_IN_PLACE_ON_REMOVAL$1.filter((key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0);
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning$1(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
+			this.logger.warn(leftInPlaceWarning$2(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 		};
 		const leftInPlace = new Set(LEFT_IN_PLACE_ON_REMOVAL$1);
 		if (![...MUTABLE].some((k) => changed(k) && !(leftInPlace.has(k) && properties[k] === void 0))) {
@@ -46331,7 +46354,7 @@ const MUTABLE_TOP_LEVEL_PROPS = /* @__PURE__ */ new Set([
 	"AutoTerminationPolicy"
 ]);
 const LEFT_IN_PLACE_ON_REMOVAL = ["StepConcurrencyLevel"];
-const leftInPlaceWarning = (logicalId, names, caller) => {
+const leftInPlaceWarning$1 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -46892,7 +46915,7 @@ var EMRClusterProvider = class {
 		const leftInPlaceNames = LEFT_IN_PLACE_ON_REMOVAL.filter((key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0);
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
+			this.logger.warn(leftInPlaceWarning$1(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 		};
 		const visibleChanged = changed("VisibleToAllUsers");
 		const stepConcurrencyChanged = changed("StepConcurrencyLevel") && properties["StepConcurrencyLevel"] !== void 0;
@@ -48551,6 +48574,19 @@ function withoutTrailIdentifiers(text, physicalId) {
 	}
 	return out;
 }
+function removalsLeftInPlace(properties, previousProperties, context, globalEventsResetSkipped) {
+	if (context?.desiredFromAwsReadback) return [];
+	const removed = context?.removedProperties;
+	const wasRemoved = (key) => previousProperties[key] != null && properties[key] == null && (removed === void 0 || removed.has(key));
+	const org = previousProperties["IsOrganizationTrail"];
+	const globalEvents = previousProperties["IncludeGlobalServiceEvents"];
+	return [...wasRemoved("IsOrganizationTrail") && org !== false && org !== "false" ? ["IsOrganizationTrail"] : [], ...globalEventsResetSkipped && wasRemoved("IncludeGlobalServiceEvents") && globalEvents !== false && globalEvents !== "false" ? ["IncludeGlobalServiceEvents"] : []];
+}
+function leftInPlaceWarning(logicalId, names, caller) {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::CloudTrail::Trail): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateTrail keeps a field it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::CloudTrail::Trail): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS value in place (whether CloudFormation resets it is unmeasured). Declare the intended value explicitly to change it.`;
+}
 var CloudTrailProvider = class {
 	client;
 	createClient;
@@ -48566,6 +48602,23 @@ var CloudTrailProvider = class {
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([["IsMultiRegionTrail", false], ["EnableLogFileValidation", false]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
+		"S3BucketName",
+		"IsLogging",
+		"TrailName",
+		"S3KeyPrefix",
+		"SnsTopicName",
+		"KMSKeyId",
+		"CloudWatchLogsLogGroupArn",
+		"CloudWatchLogsRoleArn",
+		"EventSelectors",
+		"AdvancedEventSelectors",
+		"InsightSelectors",
+		"AggregationConfigurations",
+		"Tags",
+		"IncludeGlobalServiceEvents",
+		"IsOrganizationTrail"
+	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
 		"S3BucketName",
 		"TrailName",
@@ -48695,7 +48748,8 @@ var CloudTrailProvider = class {
 		const s3BucketName = properties["S3BucketName"];
 		const s3KeyPrefix = clearOnUpdateRemoval(emptyToUndefined(properties["S3KeyPrefix"]), emptyToUndefined(previousProperties["S3KeyPrefix"]), "");
 		const isMultiRegionTrail = properties["IsMultiRegionTrail"];
-		const includeGlobalServiceEvents = isMultiRegionTrail === false ? clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false) : properties["IncludeGlobalServiceEvents"];
+		const globalEventsResetSkipped = isMultiRegionTrail !== false;
+		const includeGlobalServiceEvents = globalEventsResetSkipped ? properties["IncludeGlobalServiceEvents"] : clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false);
 		const enableLogFileValidation = properties["EnableLogFileValidation"];
 		const isLogging = properties["IsLogging"];
 		const cwPair = resolveCloudWatchLogsPair(properties);
@@ -48720,6 +48774,8 @@ var CloudTrailProvider = class {
 				SnsTopicName: snsTopicName,
 				IsOrganizationTrail: isOrganizationTrail
 			}));
+			const keptNames = removalsLeftInPlace(properties, previousProperties, context, globalEventsResetSkipped);
+			if (keptNames.length > 0) this.logger.warn(leftInPlaceWarning(logicalId, keptNames, context?.replayingState ? "rollback" : "deploy"));
 			const basicRead = readListBlock(properties["EventSelectors"], "AWS::CloudTrail::Trail EventSelectors");
 			const advancedRead = readListBlock(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors");
 			for (const read of [basicRead, advancedRead]) if (read.kind === "unusable") this.logger.warn(safeMsg`${read.detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
@@ -53678,4 +53734,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dz0pYmlJ.js.map
+//# sourceMappingURL=provider-classes-DefoNqY7.js.map