@go-to-k/cdkd 0.319.0 → 0.320.0

package/dist/{provider-classes-DOr3JVGp.js → provider-classes-BTOXS3cs.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWpHZk2l.js";
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
-import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-BpB3iPvn.js";
+import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-CmrPwGge.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, B as deleteTableWithIndexBusyRetry, Ba as s3BucketArn, Bc as passedNoEchoParametersOf, Bi as isRefusedByName, C as planContributorInsightsOp, Cl as recordAttributeIdCopy, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reDisableInstanceApiTermination, Dc as lambdaFunctionNameForMask, E as reverseMapIndexContributorInsights, Ea as observeThenDisableInstanceApiTermination, Ec as canonicalLambdaFunctionName, El as carriesSecretMask, Eo as parseWebACLArn, F as resolveDynamoDbDeleteBudgetClock, Fd as displayAssemblyPath, G as readbackVectorIndexes, Gi as readTagList, Gn as isRedactedRecordedValue, H as relayedIndexBusyDelete, Ha as s3BucketDualStackDomainName, Hi as DBPROXY_TAGS_WHAT, Hn as getCurrentProducerRegions, I as resolveDynamoDbDeleteBudgetMs, Id as renderAssemblyPathEscape, Ii as acquireIdempotencyToken, Io as accountArgs, J as vectorIndexesShapeDetail, Jc as recordReferenceProvenanceEntry, Ji as tagPlanWarning, Js as withoutSilentDropProperties, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as markSameGenerationBag, Ki as refuseMalformedDesiredTags, Kn as redactedDeleteAddressFields, Ks as findSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, Ld as resolveAssemblyPath, M as beginDeleteWait, Mi as earliestDefined, N as compensateRemovedDeletionProtection, O as stripIndexContributorInsights, Oa as reEnableInstanceApiTermination, Oc as sameLambdaFunctionAddress, P as deleteBudgetKey, Pd as describeFileReadFailure, Pi as reserveStackCreateToken, Q as readTtlSpec, Qc as hasMaskableValues, R as INDEX_SETTLE_POLL_INTERVAL_MS, S as indexDeclaresContributorInsights, Sa as markWaitAbandoned, Sc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, Sl as physicalNameCopiesOf, T as readContributorInsightsSpec, Ta as isTerminationProtectionPropagationError, Tc as emrClusterInstancesReplaced, U as waitForIndexesSettled, Ua as s3BucketRegionalDomainName, Ui as DBPROXY_TAG_OPTIONS, Ur as replacedDeleteFailureVerdict, Us as withheldAccountClause, V as maskedLogger, Va as s3BucketDomainName, Vi as markDeleteStarted, Vr as getStackRecords, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wa as s3BucketWebsiteUrl, Wi as planTagDiff, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Xi as stringifyIfAssigned, Y as isTtlAlreadyDisabled, Ya as outputReferenceProvenanceOf, Yc as snapshotPassProvenance, Yi as definedAttributes, Yt as withNestedStackContext, Z as planTimeToLive, _ as streamMemberRefusals, _c as requireConfigString, _d as decodeListingKey, _t as renderNestedTemplateTreeDefect, ac as isWarmThroughputDecrease, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as withIndeterminateGuard, bd as canonicalizeRegion, c as DynamoDBGlobalTableProvider, cc as coerceCfnBoolean, cn as withApiLimit, d as declaredStreamPolicyMember, dc as configIntegerRefusal, ds as refuseMalformedNestedChildOutputs, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as slowCcOperationTimeoutMs, fc as configStringRefusal, fl as withoutPhysicalNameCopies, g as streamDeclaresTags, gc as requireConfigObject, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigArray, ho as getAccountInfo, ht as isAbsoluteAssetPath, ic as coerceWarmThroughput$1, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ja as isUsableAttemptedName, js as refuseMalformedResourcesForDestroy, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ko as passedParameterClassesOf, l as STREAM_POLICY_KEY, lc as coerceCfnInteger, m as reverseMapStreamPolicy, ma as unchangedBehindSecretReference, mc as replayWarn, ml as dynamicReferenceTokens, mt as findNestedTemplateTreeDefect, na as waitForLambdaFunctionActive, nt as hasCdkAutoDeleteTag, oa as getCurrentResourceSecrets, oc as toCfnInteger, on as isAccessDeniedError, p as planStreamMemberOps, pa as onlySecretReferencesDiffer, pc as readConfigString, pu as stringifyValue, q as vectorIndexesSettled, qc as redactForState, qi as tagMapAsList, qn as redactedDeleteAddressSkip, rc as WARM_THROUGHPUT_MEMBERS, rt as isTruthyCfnBoolean, sc as toFiniteNumber, sn as lookupEachName, t as DeployEngine, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configBooleanRefusal, uu as timePhase, v as streamPolicyMatchesDeclared, vu as rewriteTemplateAssetReferences, w as planIndexContributorInsightsOps, wa as ec2InstanceProtectionSite, wc as ecsServiceLaunchTypeSetOrChanged, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as isWaitAbandonedError, xc as withRetry, xd as derivePartitionAndUrlSuffix, xl as recoverMaskedOutput, y as streamTagsMatchDeclared, ya as deleteSkipReason, yi as secretNamedAttributeNamesOf, z as TABLE_INDEX_NOUN, za as isSettledInstanceState, zr as awaitInFlightSibling } from "./deploy-engine-CVYhHEgq.js";
-import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-qTIqSmlf.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DyYTFxF-.js";
-import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-CspmK57I.js";
-import { RDSProvider } from "./rds-provider-CIjO2Do5.js";
-import { NeptuneProvider } from "./neptune-provider-BsA7jGiV.js";
-import { ASGProvider } from "./asg-provider-T9K-NVi8.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, B as deleteTableWithIndexBusyRetry, Ba as s3BucketArn, Bc as passedNoEchoParametersOf, Bi as isRefusedByName, C as planContributorInsightsOp, Cl as recordAttributeIdCopy, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reDisableInstanceApiTermination, Dc as lambdaFunctionNameForMask, E as reverseMapIndexContributorInsights, Ea as observeThenDisableInstanceApiTermination, Ec as canonicalLambdaFunctionName, El as carriesSecretMask, Eo as parseWebACLArn, F as resolveDynamoDbDeleteBudgetClock, Fd as displayAssemblyPath, G as readbackVectorIndexes, Gi as readTagList, Gn as isRedactedRecordedValue, H as relayedIndexBusyDelete, Ha as s3BucketDualStackDomainName, Hi as DBPROXY_TAGS_WHAT, Hn as getCurrentProducerRegions, I as resolveDynamoDbDeleteBudgetMs, Id as renderAssemblyPathEscape, Ii as acquireIdempotencyToken, Io as accountArgs, J as vectorIndexesShapeDetail, Jc as recordReferenceProvenanceEntry, Ji as tagPlanWarning, Js as withoutSilentDropProperties, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as markSameGenerationBag, Ki as refuseMalformedDesiredTags, Kn as redactedDeleteAddressFields, Ks as findSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, Ld as resolveAssemblyPath, M as beginDeleteWait, Mi as earliestDefined, N as compensateRemovedDeletionProtection, O as stripIndexContributorInsights, Oa as reEnableInstanceApiTermination, Oc as sameLambdaFunctionAddress, P as deleteBudgetKey, Pd as describeFileReadFailure, Pi as reserveStackCreateToken, Q as readTtlSpec, Qc as hasMaskableValues, R as INDEX_SETTLE_POLL_INTERVAL_MS, S as indexDeclaresContributorInsights, Sa as markWaitAbandoned, Sc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, Sl as physicalNameCopiesOf, T as readContributorInsightsSpec, Ta as isTerminationProtectionPropagationError, Tc as emrClusterInstancesReplaced, U as waitForIndexesSettled, Ua as s3BucketRegionalDomainName, Ui as DBPROXY_TAG_OPTIONS, Ur as replacedDeleteFailureVerdict, Us as withheldAccountClause, V as maskedLogger, Va as s3BucketDomainName, Vi as markDeleteStarted, Vr as getStackRecords, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wa as s3BucketWebsiteUrl, Wi as planTagDiff, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Xi as stringifyIfAssigned, Y as isTtlAlreadyDisabled, Ya as outputReferenceProvenanceOf, Yc as snapshotPassProvenance, Yi as definedAttributes, Yt as withNestedStackContext, Z as planTimeToLive, _ as streamMemberRefusals, _c as requireConfigString, _d as decodeListingKey, _t as renderNestedTemplateTreeDefect, ac as isWarmThroughputDecrease, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as withIndeterminateGuard, bd as canonicalizeRegion, c as DynamoDBGlobalTableProvider, cc as coerceCfnBoolean, cn as withApiLimit, d as declaredStreamPolicyMember, dc as configIntegerRefusal, ds as refuseMalformedNestedChildOutputs, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as slowCcOperationTimeoutMs, fc as configStringRefusal, fl as withoutPhysicalNameCopies, g as streamDeclaresTags, gc as requireConfigObject, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigArray, ho as getAccountInfo, ht as isAbsoluteAssetPath, ic as coerceWarmThroughput$1, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ja as isUsableAttemptedName, js as refuseMalformedResourcesForDestroy, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ko as passedParameterClassesOf, l as STREAM_POLICY_KEY, lc as coerceCfnInteger, m as reverseMapStreamPolicy, ma as unchangedBehindSecretReference, mc as replayWarn, ml as dynamicReferenceTokens, mt as findNestedTemplateTreeDefect, na as waitForLambdaFunctionActive, nt as hasCdkAutoDeleteTag, oa as getCurrentResourceSecrets, oc as toCfnInteger, on as isAccessDeniedError, p as planStreamMemberOps, pa as onlySecretReferencesDiffer, pc as readConfigString, pu as stringifyValue, q as vectorIndexesSettled, qc as redactForState, qi as tagMapAsList, qn as redactedDeleteAddressSkip, rc as WARM_THROUGHPUT_MEMBERS, rt as isTruthyCfnBoolean, sc as toFiniteNumber, sn as lookupEachName, t as DeployEngine, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configBooleanRefusal, uu as timePhase, v as streamPolicyMatchesDeclared, vu as rewriteTemplateAssetReferences, w as planIndexContributorInsightsOps, wa as ec2InstanceProtectionSite, wc as ecsServiceLaunchTypeSetOrChanged, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as isWaitAbandonedError, xc as withRetry, xd as derivePartitionAndUrlSuffix, xl as recoverMaskedOutput, y as streamTagsMatchDeclared, ya as deleteSkipReason, yi as secretNamedAttributeNamesOf, z as TABLE_INDEX_NOUN, za as isSettledInstanceState, zr as awaitInFlightSibling } from "./deploy-engine-BiJyU4j1.js";
+import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-FsEgUieT.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Dm0hn2Sn.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DCLA_p9I.js";
+import { RDSProvider } from "./rds-provider-C_r5q9NM.js";
+import { NeptuneProvider } from "./neptune-provider-DjjNodrS.js";
+import { ASGProvider } from "./asg-provider-B4XVfH0S.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -17402,6 +17402,7 @@ function routeTargetParams(properties) {
 		EgressOnlyInternetGatewayId: properties["EgressOnlyInternetGatewayId"] ?? void 0,
 		InstanceId: properties["InstanceId"] ?? void 0,
 		NetworkInterfaceId: properties["NetworkInterfaceId"] ?? void 0,
+		OdbNetworkArn: properties["OdbNetworkArn"] ?? void 0,
 		TransitGatewayId: properties["TransitGatewayId"] ?? void 0,
 		VpcEndpointId: properties["VpcEndpointId"] ?? void 0,
 		VpcPeeringConnectionId: properties["VpcPeeringConnectionId"] ?? void 0
@@ -17723,6 +17724,7 @@ var EC2Provider = class {
 			"EgressOnlyInternetGatewayId",
 			"InstanceId",
 			"NetworkInterfaceId",
+			"OdbNetworkArn",
 			"TransitGatewayId",
 			"VpcEndpointId",
 			"VpcPeeringConnectionId"
@@ -21428,6 +21430,7 @@ var EC2Provider = class {
 		if (route.LocalGatewayId !== void 0) result["LocalGatewayId"] = route.LocalGatewayId;
 		if (route.CarrierGatewayId !== void 0) result["CarrierGatewayId"] = route.CarrierGatewayId;
 		if (route.CoreNetworkArn !== void 0) result["CoreNetworkArn"] = route.CoreNetworkArn;
+		if (route.OdbNetworkArn !== void 0) result["OdbNetworkArn"] = route.OdbNetworkArn;
 		return result;
 	}
 	async readSubnetRouteTableAssociationCurrentState(physicalId) {
@@ -27226,6 +27229,10 @@ function isEcsErrorNamed(error, names) {
 	return typeof name === "string" && names.includes(name);
 }
 const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+const serviceInactiveWait = {
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	now: () => Date.now()
+};
 function requestedRolloutOf(service) {
 	if (!service) return void 0;
 	const primary = service.deployments?.find((d) => d.status === "PRIMARY");
@@ -27283,6 +27290,23 @@ function rolloutSupersededBy(requested, settled) {
 function markNotGoneOnNotFoundClass$1(error, wrapped) {
 	return error instanceof Error && error.name.includes("NotFound") ? markNotGone(wrapped) : wrapped;
 }
+function gatewayConnectorsGateKey(value) {
+	if (!Array.isArray(value)) return JSON.stringify(value ?? null);
+	return JSON.stringify(value.map((connector) => {
+		if (typeof connector !== "object" || connector === null || Array.isArray(connector)) return connector;
+		const filters = connector["Filters"];
+		if (typeof filters !== "object" || filters === null || Array.isArray(filters)) return connector;
+		const accessTypes = filters["AccessTypes"];
+		if (!Array.isArray(accessTypes)) return connector;
+		return {
+			...connector,
+			Filters: {
+				...filters,
+				AccessTypes: accessTypes.map((v) => JSON.stringify(v) ?? "undefined").sort()
+			}
+		};
+	}));
+}
 var ECSProvider = class {
 	ecsClient;
 	taskDefinitionCreateClient;
@@ -27345,7 +27369,8 @@ var ECSProvider = class {
 			"Role",
 			"ServiceConnectConfiguration",
 			"VolumeConfigurations",
-			"VpcLatticeConfigurations"
+			"VpcLatticeConfigurations",
+			"GatewayConnectors"
 		])]
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
@@ -27701,7 +27726,8 @@ var ECSProvider = class {
 				serviceConnectConfiguration: this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]),
 				volumeConfigurations: this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]),
 				vpcLatticeConfigurations: this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]),
-				monitoring: this.convertMonitoringConfiguration(properties["Monitoring"])
+				monitoring: this.convertMonitoringConfiguration(properties["Monitoring"]),
+				gatewayConnectors: this.convertGatewayConnectors(properties["GatewayConnectors"])
 			}))).service;
 			if (!service || !service.serviceArn) throw new Error("CreateService did not return service ARN");
 			log.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
@@ -27908,6 +27934,7 @@ var ECSProvider = class {
 		const volumeConfigurationsInput = JSON.stringify(previousProperties["VolumeConfigurations"] ?? null) !== JSON.stringify(properties["VolumeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]), previousProperties["VolumeConfigurations"], []) : void 0;
 		const vpcLatticeConfigurationsInput = JSON.stringify(previousProperties["VpcLatticeConfigurations"] ?? null) !== JSON.stringify(properties["VpcLatticeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]), previousProperties["VpcLatticeConfigurations"], []) : void 0;
 		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) ? clearOnUpdateRemoval(this.convertMonitoringConfiguration(properties["Monitoring"]), previousProperties["Monitoring"], { metricConfigurations: [] }) : void 0;
+		const gatewayConnectorsInput = gatewayConnectorsGateKey(previousProperties["GatewayConnectors"]) !== gatewayConnectorsGateKey(properties["GatewayConnectors"]) ? this.convertGatewayConnectors(properties["GatewayConnectors"]) : void 0;
 		const forceNewDeploymentInput = this.resolveForceNewDeployment(properties, previousProperties, log);
 		const deploymentConfigurationInput = this.resolveDeploymentConfiguration(properties, previousProperties);
 		try {
@@ -27934,6 +27961,7 @@ var ECSProvider = class {
 				volumeConfigurations: volumeConfigurationsInput,
 				vpcLatticeConfigurations: vpcLatticeConfigurationsInput,
 				monitoring: monitoringInput,
+				gatewayConnectors: gatewayConnectorsInput,
 				forceNewDeployment: forceNewDeploymentInput
 			}))).service;
 			if (service?.serviceArn) await this.applyTagDiff(service.serviceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
@@ -27969,6 +27997,7 @@ var ECSProvider = class {
 			}
 		} else cluster = recordedCluster;
 		let stripped = false;
+		let alreadyDeleted = false;
 		try {
 			try {
 				await client.send(new UpdateServiceCommand({
@@ -27984,27 +28013,57 @@ var ECSProvider = class {
 					const clientRegion = await client.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`ECS service ${physicalId} not found during scale down, skipping deletion`);
-					return;
-				}
-				throw error;
+					if (!this.isServiceNotActiveException(error)) return;
+					alreadyDeleted = true;
+				} else throw error;
+			}
+			if (!alreadyDeleted) {
+				await client.send(new DeleteServiceCommand({
+					cluster,
+					service: physicalId,
+					force: true
+				}));
+				this.logger.debug(`Successfully deleted ECS service ${logicalId}`);
 			}
-			await client.send(new DeleteServiceCommand({
-				cluster,
-				service: physicalId,
-				force: true
-			}));
-			this.logger.debug(`Successfully deleted ECS service ${logicalId}`);
 		} catch (error) {
 			if (this.isServiceNotFoundException(error)) {
 				const clientRegion = await client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS service ${physicalId} not found, skipping deletion`);
-				return;
+				if (!this.isServiceNotActiveException(error)) return;
+			} else {
+				const cause = error instanceof Error ? error : void 0;
+				const wrapped = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+				const failure = this.isClusterNotFoundException(error) ? wrapped : markNotGoneOnNotFoundClass$1(error, wrapped);
+				throw stripped ? markDeleteStarted(failure) : failure;
 			}
-			const cause = error instanceof Error ? error : void 0;
-			const wrapped = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
-			const failure = this.isClusterNotFoundException(error) ? wrapped : markNotGoneOnNotFoundClass$1(error, wrapped);
-			throw stripped ? markDeleteStarted(failure) : failure;
+		}
+		await this.waitForServiceInactive(logicalId, physicalId, cluster, resourceType);
+	}
+	async waitForServiceInactive(logicalId, physicalId, cluster, resourceType) {
+		const client = this.getClient();
+		const maxWaitSeconds = Math.max(600, (resolvedResourceTimeoutMs("AWS::ECS::Service") ?? 0) / 1e3);
+		const deadline = serviceInactiveWait.now() + maxWaitSeconds * 1e3;
+		let delay = 2e3;
+		let lastStatus = "unknown";
+		for (;;) {
+			try {
+				const out = await client.send(new DescribeServicesCommand({
+					cluster,
+					services: [physicalId]
+				}));
+				if ((out?.failures ?? []).some((failure) => failure.reason === "MISSING")) return;
+				const status = out?.services?.[0]?.status;
+				if (status === "INACTIVE") return;
+				lastStatus = status ?? "unknown";
+			} catch (error) {
+				if (this.isClusterNotFoundException(error)) return;
+				const readFailure = new ProvisioningError(`Failed to confirm ECS service ${logicalId} deletion: ${error instanceof Error ? error.name : "unknown error"}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+				throw markDeleteStarted(readFailure);
+			}
+			if (serviceInactiveWait.now() >= deadline) throw markNonRetryable(markDeleteStarted(new ProvisioningError(`ECS service ${logicalIdShown(logicalId)} was deleted but did not reach INACTIVE within ${maxWaitSeconds}s (last status: ${lastStatus}). Re-run once the service is INACTIVE, or raise the limit with --resource-timeout AWS::ECS::Service=${commandHole("duration")}.`, resourceType, logicalId, physicalId)));
+			await serviceInactiveWait.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
 		}
 	}
 	async getServiceAttribute(physicalId, attributeName) {
@@ -28477,6 +28536,10 @@ var ECSProvider = class {
 		if (!items) return void 0;
 		return pascalToCamelCaseKeys(items);
 	}
+	convertGatewayConnectors(items) {
+		if (!items) return void 0;
+		return pascalToCamelCaseKeys(items);
+	}
 	convertMonitoringConfiguration(config) {
 		if (!config) return void 0;
 		return pascalToCamelCaseKeys(config);
@@ -28546,6 +28609,9 @@ var ECSProvider = class {
 		if (error instanceof Error) return error.name === "ServiceNotFoundException" || error.name === "ServiceNotActiveException" || error.message.includes("service not found") || error.message.includes("Service not found");
 		return false;
 	}
+	isServiceNotActiveException(error) {
+		return error instanceof Error && error.name === "ServiceNotActiveException";
+	}
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::ECS::Service") return [
 			"ServiceConnectConfiguration",
@@ -28553,7 +28619,8 @@ var ECSProvider = class {
 			"VpcLatticeConfigurations",
 			"Monitoring",
 			"ForceNewDeployment",
-			"Role"
+			"Role",
+			"GatewayConnectors"
 		];
 		return [];
 	}
@@ -48568,7 +48635,8 @@ var FirehoseProvider = class {
 		"SplunkDestinationConfiguration",
 		"AmazonOpenSearchServerlessDestinationConfiguration",
 		"DeliveryStreamEncryptionConfigurationInput",
-		"IcebergDestinationConfiguration"
+		"IcebergDestinationConfiguration",
+		"MSKSourceConfiguration"
 	])]]);
 	getClient() {
 		if (!this.client) {
@@ -48592,12 +48660,14 @@ var FirehoseProvider = class {
 		const deliveryStreamName = properties["DeliveryStreamName"];
 		const deliveryStreamType = properties["DeliveryStreamType"] || "DirectPut";
 		if (!isReadableTagList(properties["Tags"])) throw markNonRetryable(new ProvisioningError(`Tags of Firehose delivery stream ${logicalId} is not a list of tags with a Key — the delivery stream was not created`, resourceType, logicalId));
+		const mskSource = properties["MSKSourceConfiguration"] === void 0 ? void 0 : mapMskSourceConfiguration(properties["MSKSourceConfiguration"], maskerOrIdentity(context?.maskSecrets), resourceType, logicalId);
 		let createdStreamName;
 		try {
 			const input = {
 				DeliveryStreamName: deliveryStreamName || generatedNameFor("AWS::KinesisFirehose::DeliveryStream", logicalId),
 				DeliveryStreamType: deliveryStreamType
 			};
+			if (mskSource !== void 0) input.MSKSourceConfiguration = mskSource;
 			if (properties["S3DestinationConfiguration"]) {
 				const s3Config = properties["S3DestinationConfiguration"];
 				input.S3DestinationConfiguration = this.mapS3DestinationConfiguration(s3Config);
@@ -49390,7 +49460,7 @@ var FirehoseProvider = class {
 			return /* @__PURE__ */ new Set([ENCRYPTION_KEY]);
 		}
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		let desc;
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
@@ -49411,6 +49481,8 @@ var FirehoseProvider = class {
 		}
 		const directPut = desc.Source?.DirectPutSourceDescription;
 		if (directPut?.ThroughputHintInMBs !== void 0) result["DirectPutSourceConfiguration"] = { ThroughputHintInMBs: directPut.ThroughputHintInMBs };
+		const msk = desc.Source?.MSKSourceDescription;
+		if (msk) result["MSKSourceConfiguration"] = mapMskSourceDescriptionToCfn(msk, properties?.["MSKSourceConfiguration"]);
 		const dest = desc.Destinations?.[0];
 		if (dest?.ExtendedS3DestinationDescription) result["ExtendedS3DestinationConfiguration"] = mapExtendedS3DescriptionToCfn(dest.ExtendedS3DestinationDescription);
 		else if (dest?.IcebergDestinationDescription) result["IcebergDestinationConfiguration"] = mapIcebergDescriptionToCfn(dest.IcebergDestinationDescription);
@@ -49576,6 +49648,47 @@ function mapRedshiftDescriptionToCfn(desc) {
 	if (desc["S3BackupDescription"]) out["S3BackupConfiguration"] = mapS3DescriptionToCfn(desc["S3BackupDescription"]);
 	return out;
 }
+const EPOCH_MILLIS = /^[+-]?\d+$/;
+function epochMillisTimestamp(value) {
+	if (typeof value === "number" && Number.isSafeInteger(value)) value = String(value);
+	if (typeof value !== "string" || !EPOCH_MILLIS.test(value)) return void 0;
+	const date = new Date(Number(value));
+	return Number.isNaN(date.getTime()) ? void 0 : date;
+}
+function mapMskSourceConfiguration(config, mask, resourceType, logicalId) {
+	const auth = config["AuthenticationConfiguration"];
+	const result = {
+		MSKClusterARN: config["MSKClusterARN"],
+		TopicName: config["TopicName"],
+		AuthenticationConfiguration: auth && {
+			RoleARN: auth["RoleARN"],
+			Connectivity: auth["Connectivity"]
+		}
+	};
+	const raw = config["ReadFromTimestamp"];
+	if (raw !== void 0) {
+		const parsed = epochMillisTimestamp(raw);
+		if (parsed === void 0) throw markNonRetryable(new ProvisioningError(`MSKSourceConfiguration.ReadFromTimestamp of Firehose delivery stream ${logicalId} is not a string of epoch milliseconds: ${JSON.stringify(maskDeep(raw, mask))} — CloudFormation reads it as one and refuses any other spelling, an ISO 8601 date included; write e.g. '1767225600000' for 2026-01-01T00:00:00Z. The delivery stream was not created`, resourceType, logicalId));
+		result.ReadFromTimestamp = parsed;
+	}
+	return result;
+}
+function mapMskSourceDescriptionToCfn(desc, recorded) {
+	const out = {};
+	if (desc.MSKClusterARN !== void 0) out["MSKClusterARN"] = desc.MSKClusterARN;
+	if (desc.TopicName !== void 0) out["TopicName"] = desc.TopicName;
+	const auth = desc.AuthenticationConfiguration;
+	if (auth) out["AuthenticationConfiguration"] = {
+		...auth.RoleARN !== void 0 && { RoleARN: auth.RoleARN },
+		...auth.Connectivity !== void 0 && { Connectivity: auth.Connectivity }
+	};
+	const live = desc.ReadFromTimestamp;
+	if (live instanceof Date && !Number.isNaN(live.getTime())) {
+		const spelled = isPlainRecord(recorded) ? recorded["ReadFromTimestamp"] : void 0;
+		out["ReadFromTimestamp"] = epochMillisTimestamp(spelled)?.getTime() === live.getTime() ? spelled : String(live.getTime());
+	}
+	return out;
+}
 function mapIcebergDescriptionToCfn(desc) {
 	const out = {};
 	for (const k of [
@@ -55045,4 +55158,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DOr3JVGp.js.map
+//# sourceMappingURL=provider-classes-BTOXS3cs.js.map