1/**
2 * Derives a deterministic AppRegistry client token from the resource's
3 * instance ID so retried creates never double-provision.
4 */
5export const clientToken = (instanceId: string): string =>
6 instanceId.replaceAll(/[^a-zA-Z0-9]/g, "").slice(0, 64) || "alchemy";
7
8/**
9 * Drops AWS-managed system tags (`aws:*`, case-insensitive) from an
10 * observed tag map. AppRegistry stamps resources with system tags (e.g.
11 * `aws:servicecatalog:applicationName`) that customers cannot remove —
12 * including them in the diff baseline makes untagResource fail with
13 * "Customers cannot remove tag keys starting with aws:".
14 */
15export const stripAwsSystemTags = (
16 tags: Record<string, string>,
17): Record<string, string> =>
18 Object.fromEntries(
19 Object.entries(tags).filter(
20 ([key]) => !key.toLowerCase().startsWith("aws:"),
21 ),
22 );