@go-to-k/cdkd 0.290.23 → 0.290.24

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $i as isCdkdError, $r as Synthesizer, Ai as setAwsClients, Ci as AssemblyReader, Di as AwsClients, Ei as resolveBucketRegion, Fi as DependencyError, Fn as DagBuilder, Gi as ProvisioningError, In as TemplateParser, Mi as CdkdError, Ni as ConfigError, Oi as getAwsClients, Qi as formatError, Ti as clearBucketRegionCache, Vi as LockError, Xi as StateError, Zi as SynthesisError, ea as normalizeAwsError, er as LockManager, gt as CloudControlProvider, ji as AssetError, ki as resetAwsClients, ot as ProviderRegistry, r as DeployEngine, rt as IAMRoleProvider, sn as DiffCalculator, tr as S3StateBackend, vr as AssetPublisher } from "./deploy-engine-CBzq85r6.js";
+import { $i as isCdkdError, $r as Synthesizer, Ai as setAwsClients, Ci as AssemblyReader, Di as AwsClients, Ei as resolveBucketRegion, Fi as DependencyError, Fn as DagBuilder, Gi as ProvisioningError, In as TemplateParser, Mi as CdkdError, Ni as ConfigError, Oi as getAwsClients, Qi as formatError, Ti as clearBucketRegionCache, Vi as LockError, Xi as StateError, Zi as SynthesisError, ea as normalizeAwsError, er as LockManager, gt as CloudControlProvider, ji as AssetError, ki as resetAwsClients, ot as ProviderRegistry, r as DeployEngine, rt as IAMRoleProvider, sn as DiffCalculator, tr as S3StateBackend, vr as AssetPublisher } from "./deploy-engine-BcNBidfy.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-CkHVgzLx.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-BgbPkrcx.js → program-DaoJ7P4H.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as scrubResourceRecord, $r as Synthesizer, $t as s3BucketArn, A as extractDeploymentEventError, Ai as setAwsClients, An as repairMalformedResourcesForReadOnly, Ar as isCrossRegionRedirect, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalStartServiceError, Bn as TEMPLATE_SOURCED_RULES, Br as describeDockerExecFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as AssemblyReader, Cn as refuseMalformedOutputs, Cr as loadPublishableAssetManifest, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as AwsClients, Dn as refuseMalformedState, Dr as assertAssetBucketRegion, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as resolveBucketRegion, En as refuseMalformedResourcesForDestroy, Er as BOOTSTRAP_MARKER_PREFIX, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as DagBuilder, Fr as buildDenyExternalAccessPolicy, Ft as isSettledInstanceState, G as gray, Gi as ProvisioningError, Gn as identityKeyFor, Gr as partitionSensitiveEnv, Gt as readConfigString, H as formatResourceLine, Hi as MalformedProducerRecordRefusalError, Hn as createSecretMasker, Hr as dockerSpawnEnvWithSensitive, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DeployCancelledError, In as TemplateParser, Ir as describeAwsFailure, It as WAFv2WebACLProvider, J as yellow, Ji as StackHasActiveImportsError, Jn as maskSecretsInError, Jr as runDockerStreaming, Jt as requireConfigObject, K as green, Ki as ResourceTimeoutError, Kn as isSingleDynamicReferenceToken, Kr as redactDockerArgvValues, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DynamicReferenceRegionAmbiguousError, Ln as STATE_SOURCED_BASELINE_RULES, Lr as safeStringify, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as CdkdError, Mn as findSilentDropProperties, Mr as readBootstrapMarkerBody, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as describeTypeWithThrottleRetry, Nr as validateAssetBucketName, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as getAwsClients, On as repairMalformedOutputsForReadOnly, Or as ensureAssetStorage, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CrossAccountSecretRefusalError, Pn as withRetry, Pr as validateContainerRepoName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as redactSecretsForState, Qr as getDockerImageBySourceHash, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as IntrinsicResolutionRefusalError, Rn as STATE_SOURCED_CROSS_GENERATION_RULES, Rr as buildDockerImage, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as derivePartitionAndUrlSuffix, Sn as refuseMalformedNestedChildOutputs, Sr as createAssetRedirectResolver, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Tn as refuseMalformedResourcePropertiesForOrphan, Tr as AssetModeResolver, Tt as carriesDynamicReference, U as bold, Ui as NestedStackChildDirectDestroyError, Un as dynamicReferenceTokens, Ur as formatDockerLoginError, Ut as configIntegerRefusal, V as toFiniteNumber, Vn as carriesSecretMask, Vr as describeDockerFailure, Vt as coerceCfnInteger, W as cyan, Wi as PartialFailureError, Wn as errorCauseChain, Wr as getDockerCmd, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as recordMaskOnlyValue, Xr as stripControlChars, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackTerminationProtectionError, Yn as maskSecretsInText, Yr as escapeRegExp, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recoverMaskedOutput, Zr as AssetManifestLoader, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _n as malformedRenderedContainersWarning, _r as shouldRetainResource, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isTransientServerError, ai as resolveCaptureObservedState, an as applyCallerIdentityCredentials, ar as forceQuitRecoveryClause, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as PARTITION_TABLE, bn as malformedStateRefusalMessage, br as WorkGraph, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as retryClassificationText, ci as resolveStateBucketWithDefaultAndSource, cn as INTRINSIC_KEYS, cr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ct as createMaskedRetryLogger, d as updatePartialReason, di as warnDeprecatedNoPrefixCliFlag, dn as hasReadableResources, dr as hasReadableExportSet, dt as beginCommandInterruptScope, ea as normalizeAwsError, ei as synthesisStatusMessage, en as s3BucketDomainName, er as LockManager, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_BODY_LIMIT, fn as malformedExportNamesWarning, fr as importableOutputKeys, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as uploadCfnTemplate, gn as malformedOutputsWarning, gr as orphansCarriedFrom, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as findLargeInlineResources, hn as malformedOutputsRefusalMessage, hr as orphansAfterRollback, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isThrottlingError, ii as resolveAutoAssetStorage, in as applyRoleArnIfSet, ir as buildLockContentionMessage, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as findActionableSilentDrops, jr as parseBootstrapMarker, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as resetAwsClients, kn as repairMalformedResourcePropertiesForReadOnly, kr as getBootstrapMarkerKey, kt as getAccountInfo, l as replayRollback, li as resolveUseCdkBootstrapAssets, ln as STATE_RESOURCES_MALFORMED, lr as DEFAULT_STATE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as MIGRATE_TMP_PREFIX, mn as malformedLocalOutputsWarning, mr as isReadableBag, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isMarkedNonRetryable, ni as getLegacyStateBucketName, nn as s3BucketRegionalDomainName, nr as rebuildClientForBucketRegion, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markNonRetryable, oi as resolveSkipPrefix, on as callerEnvCredentials, or as formatLockExpiry, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_URL_LIMIT, pn as malformedExportSourceWarning, pr as importableOutputs, pt as interruptWatchListenerCount, q as red, qi as ResourceUpdateNotSupportedError, qn as markSameGenerationBag, qr as runDockerForeground, qt as requireConfigArray, r as DeployEngine, ra as isRetryableTransientError, ri as resolveApp, rn as s3BucketWebsiteUrl, rr as buildForceUnlockCommand, rt as IAMRoleProvider, s as planRollback, sa as markRedactedCause, si as resolveStateBucketWithDefault, sn as DiffCalculator, sr as shellQuote, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as withErrorHandling, ti as getDefaultStateBucketName, tn as s3BucketDualStackDomainName, tr as S3StateBackend, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as stateBucketExistenceConfirmed, un as hasReadableOutputs, ur as exportNamesCarriedFrom, ut as maskerOrIdentity, v as keptWholeReasonText, vi as decodeListingKey, vn as malformedResourcePropertiesWarning, vr as AssetPublisher, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as processStackMessages, wn as refuseMalformedOutputsForDestroy, wr as rewriteTemplateAssetReferences, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as canonicalizeRegion, xn as producerRecordKey, xr as buildAssetRedirectMap, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as expectedOwnerParam, yn as malformedResourcesWarning, yr as stringifyValue, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalInvokeBuildError$1, zn as STATE_SOURCED_READBACK_RULES, zr as describeDockerCapturedOutput, zt as assertRegionMatch } from "./deploy-engine-CBzq85r6.js";
+import { $ as secretBearing, $n as scrubResourceRecord, $r as Synthesizer, $t as s3BucketArn, A as extractDeploymentEventError, Ai as setAwsClients, An as repairMalformedResourcesForReadOnly, Ar as isCrossRegionRedirect, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalStartServiceError, Bn as TEMPLATE_SOURCED_RULES, Br as describeDockerExecFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as AssemblyReader, Cn as refuseMalformedOutputs, Cr as loadPublishableAssetManifest, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as AwsClients, Dn as refuseMalformedState, Dr as assertAssetBucketRegion, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as resolveBucketRegion, En as refuseMalformedResourcesForDestroy, Er as BOOTSTRAP_MARKER_PREFIX, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as DagBuilder, Fr as buildDenyExternalAccessPolicy, Ft as isSettledInstanceState, G as gray, Gi as ProvisioningError, Gn as identityKeyFor, Gr as partitionSensitiveEnv, Gt as readConfigString, H as formatResourceLine, Hi as MalformedProducerRecordRefusalError, Hn as createSecretMasker, Hr as dockerSpawnEnvWithSensitive, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DeployCancelledError, In as TemplateParser, Ir as describeAwsFailure, It as WAFv2WebACLProvider, J as yellow, Ji as StackHasActiveImportsError, Jn as maskSecretsInError, Jr as runDockerStreaming, Jt as requireConfigObject, K as green, Ki as ResourceTimeoutError, Kn as isSingleDynamicReferenceToken, Kr as redactDockerArgvValues, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DynamicReferenceRegionAmbiguousError, Ln as STATE_SOURCED_BASELINE_RULES, Lr as safeStringify, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as CdkdError, Mn as findSilentDropProperties, Mr as readBootstrapMarkerBody, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as describeTypeWithThrottleRetry, Nr as validateAssetBucketName, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as getAwsClients, On as repairMalformedOutputsForReadOnly, Or as ensureAssetStorage, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CrossAccountSecretRefusalError, Pn as withRetry, Pr as validateContainerRepoName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as redactSecretsForState, Qr as getDockerImageBySourceHash, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as IntrinsicResolutionRefusalError, Rn as STATE_SOURCED_CROSS_GENERATION_RULES, Rr as buildDockerImage, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as derivePartitionAndUrlSuffix, Sn as refuseMalformedNestedChildOutputs, Sr as createAssetRedirectResolver, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Tn as refuseMalformedResourcePropertiesForOrphan, Tr as AssetModeResolver, Tt as carriesDynamicReference, U as bold, Ui as NestedStackChildDirectDestroyError, Un as dynamicReferenceTokens, Ur as formatDockerLoginError, Ut as configIntegerRefusal, V as toFiniteNumber, Vn as carriesSecretMask, Vr as describeDockerFailure, Vt as coerceCfnInteger, W as cyan, Wi as PartialFailureError, Wn as errorCauseChain, Wr as getDockerCmd, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as recordMaskOnlyValue, Xr as stripControlChars, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackTerminationProtectionError, Yn as maskSecretsInText, Yr as escapeRegExp, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recoverMaskedOutput, Zr as AssetManifestLoader, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _n as malformedRenderedContainersWarning, _r as shouldRetainResource, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isTransientServerError, ai as resolveCaptureObservedState, an as applyCallerIdentityCredentials, ar as forceQuitRecoveryClause, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as PARTITION_TABLE, bn as malformedStateRefusalMessage, br as WorkGraph, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as retryClassificationText, ci as resolveStateBucketWithDefaultAndSource, cn as INTRINSIC_KEYS, cr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ct as createMaskedRetryLogger, d as updatePartialReason, di as warnDeprecatedNoPrefixCliFlag, dn as hasReadableResources, dr as hasReadableExportSet, dt as beginCommandInterruptScope, ea as normalizeAwsError, ei as synthesisStatusMessage, en as s3BucketDomainName, er as LockManager, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_BODY_LIMIT, fn as malformedExportNamesWarning, fr as importableOutputKeys, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as uploadCfnTemplate, gn as malformedOutputsWarning, gr as orphansCarriedFrom, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as findLargeInlineResources, hn as malformedOutputsRefusalMessage, hr as orphansAfterRollback, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isThrottlingError, ii as resolveAutoAssetStorage, in as applyRoleArnIfSet, ir as buildLockContentionMessage, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as findActionableSilentDrops, jr as parseBootstrapMarker, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as resetAwsClients, kn as repairMalformedResourcePropertiesForReadOnly, kr as getBootstrapMarkerKey, kt as getAccountInfo, l as replayRollback, li as resolveUseCdkBootstrapAssets, ln as STATE_RESOURCES_MALFORMED, lr as DEFAULT_STATE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as MIGRATE_TMP_PREFIX, mn as malformedLocalOutputsWarning, mr as isReadableBag, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isMarkedNonRetryable, ni as getLegacyStateBucketName, nn as s3BucketRegionalDomainName, nr as rebuildClientForBucketRegion, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markNonRetryable, oi as resolveSkipPrefix, on as callerEnvCredentials, or as formatLockExpiry, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_URL_LIMIT, pn as malformedExportSourceWarning, pr as importableOutputs, pt as interruptWatchListenerCount, q as red, qi as ResourceUpdateNotSupportedError, qn as markSameGenerationBag, qr as runDockerForeground, qt as requireConfigArray, r as DeployEngine, ra as isRetryableTransientError, ri as resolveApp, rn as s3BucketWebsiteUrl, rr as buildForceUnlockCommand, rt as IAMRoleProvider, s as planRollback, sa as markRedactedCause, si as resolveStateBucketWithDefault, sn as DiffCalculator, sr as shellQuote, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as withErrorHandling, ti as getDefaultStateBucketName, tn as s3BucketDualStackDomainName, tr as S3StateBackend, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as stateBucketExistenceConfirmed, un as hasReadableOutputs, ur as exportNamesCarriedFrom, ut as maskerOrIdentity, v as keptWholeReasonText, vi as decodeListingKey, vn as malformedResourcePropertiesWarning, vr as AssetPublisher, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as processStackMessages, wn as refuseMalformedOutputsForDestroy, wr as rewriteTemplateAssetReferences, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as canonicalizeRegion, xn as producerRecordKey, xr as buildAssetRedirectMap, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as expectedOwnerParam, yn as malformedResourcesWarning, yr as stringifyValue, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalInvokeBuildError$1, zn as STATE_SOURCED_READBACK_RULES, zr as describeDockerCapturedOutput, zt as assertRegionMatch } from "./deploy-engine-BcNBidfy.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DxUVmvM5.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BOYln2Tw.js";
+import { t as getCdkdVersion } from "./version-PsB8OjhM.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CHeJf5zw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12974,6 +12974,88 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 	return result;
 }
 
+//#endregion
+//#region src/provisioning/attribute-map.ts
+/**
+* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
+* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
+* shape `docs/provider-development.md` forbids under "Never store an
+* empty-string placeholder"):
+*
+*   an attribute cdkd could not read back is ABSENT from the map — never
+*   recorded as the empty string, and never as a present-but-`undefined` key.
+*
+* The consumers of `ResourceState.attributes` all key off exactly that
+* distinction, and a sentinel puts every one of them on the wrong branch:
+*
+*  - the deploy engine persists the map as-is, so `''` becomes the recorded
+*    value of a field AWS never assigned;
+*  - the intrinsic resolver serves a stored attribute whenever it is not
+*    `undefined`, so `''` shadows `constructAttribute` forever — the
+*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
+*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
+*    only on a MISS;
+*  - the Outputs export pass publishes whatever the resolver returned, so a
+*    stored `''` is exported to every `Fn::ImportValue` consumer.
+*
+* It exists as a MODULE rather than a per-provider idiom because the rule was
+* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
+* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
+* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
+* that DROPS the key is the one form a provider cannot spell wrong by habit.
+*
+* Two values are treated as "not read back":
+*
+*  - `undefined`: the SDK's spelling of an unassigned optional member.
+*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
+*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
+*    like `''` does.
+*
+* Every other value is kept verbatim — INCLUDING an empty string AWS itself
+* reported (`false`, `0`, an empty array and an object likewise). The helper
+* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
+* off the wire is a known value with a meaning the provider owns. The EC2
+* Instance provider is where that distinction is load-bearing: a `running`
+* instance with no public address is described with `PublicDnsName: ''` and
+* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
+* empty, recorded as such so a reference does not degrade to the instance id
+* on every resolution — while the same `''` on a `pending` instance means
+* "not yet", which that provider maps to `undefined` BEFORE calling this
+* helper (its `describedInstanceAttributes`). A caller that knows a `''`
+* means "unknown" is the one that must say so; this helper cannot tell.
+*
+* Deliberately NOT a general "compact this record" utility: it is scoped to
+* attribute maps. A property bag keeps its `undefined`-valued keys out by other
+* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
+* than setting it to `undefined`").
+*
+* A LEAF module (imports nothing) so every provider can take it without adding
+* an edge to the provider import ring.
+*/
+/**
+* Build an attribute map from read-back values, omitting every key whose value
+* is `undefined` or `null`.
+*/
+function definedAttributes(entries) {
+	const out = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (value === void 0 || value === null) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* `String(value)` for a numeric read-back whose CloudFormation attribute is a
+* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
+* `definedAttributes` drops the key instead of recording the literal
+* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
+* `?? ''` is merely deleted.
+*/
+function stringifyIfAssigned(value) {
+	if (value === void 0 || value === null) return void 0;
+	return String(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 /**
@@ -13046,17 +13128,18 @@ var SNSSubscriptionProvider = class {
 			if (replayPolicy !== void 0) attributes["ReplayPolicy"] = typeof replayPolicy === "string" ? replayPolicy : JSON.stringify(replayPolicy);
 			const subscriptionRoleArn = properties["SubscriptionRoleArn"];
 			if (subscriptionRoleArn !== void 0) attributes["SubscriptionRoleArn"] = stringifyValue(subscriptionRoleArn);
-			const subscriptionArn = (await this.snsClient.send(new SubscribeCommand({
+			const response = await this.snsClient.send(new SubscribeCommand({
 				TopicArn: topicArn,
 				Protocol: protocol,
 				Endpoint: endpoint,
 				ReturnSubscriptionArn: true,
 				...Object.keys(attributes).length > 0 && { Attributes: attributes }
-			}))).SubscriptionArn || `${topicArn}:${logicalId}`;
+			}));
+			const subscriptionArn = response.SubscriptionArn || `${topicArn}:${logicalId}`;
 			this.logger.debug(`Successfully created SNS subscription ${logicalId}: ${subscriptionArn}`);
 			return {
 				physicalId: subscriptionArn,
-				attributes: {}
+				attributes: definedAttributes({ Arn: response.SubscriptionArn?.startsWith("arn:") ? response.SubscriptionArn : void 0 })
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -26468,88 +26551,6 @@ var EventBridgeRuleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
-/**
-* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
-* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
-* shape `docs/provider-development.md` forbids under "Never store an
-* empty-string placeholder"):
-*
-*   an attribute cdkd could not read back is ABSENT from the map — never
-*   recorded as the empty string, and never as a present-but-`undefined` key.
-*
-* The consumers of `ResourceState.attributes` all key off exactly that
-* distinction, and a sentinel puts every one of them on the wrong branch:
-*
-*  - the deploy engine persists the map as-is, so `''` becomes the recorded
-*    value of a field AWS never assigned;
-*  - the intrinsic resolver serves a stored attribute whenever it is not
-*    `undefined`, so `''` shadows `constructAttribute` forever — the
-*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
-*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
-*    only on a MISS;
-*  - the Outputs export pass publishes whatever the resolver returned, so a
-*    stored `''` is exported to every `Fn::ImportValue` consumer.
-*
-* It exists as a MODULE rather than a per-provider idiom because the rule was
-* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
-* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
-* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
-* that DROPS the key is the one form a provider cannot spell wrong by habit.
-*
-* Two values are treated as "not read back":
-*
-*  - `undefined`: the SDK's spelling of an unassigned optional member.
-*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
-*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
-*    like `''` does.
-*
-* Every other value is kept verbatim — INCLUDING an empty string AWS itself
-* reported (`false`, `0`, an empty array and an object likewise). The helper
-* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
-* off the wire is a known value with a meaning the provider owns. The EC2
-* Instance provider is where that distinction is load-bearing: a `running`
-* instance with no public address is described with `PublicDnsName: ''` and
-* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
-* empty, recorded as such so a reference does not degrade to the instance id
-* on every resolution — while the same `''` on a `pending` instance means
-* "not yet", which that provider maps to `undefined` BEFORE calling this
-* helper (its `describedInstanceAttributes`). A caller that knows a `''`
-* means "unknown" is the one that must say so; this helper cannot tell.
-*
-* Deliberately NOT a general "compact this record" utility: it is scoped to
-* attribute maps. A property bag keeps its `undefined`-valued keys out by other
-* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
-* than setting it to `undefined`").
-*
-* A LEAF module (imports nothing) so every provider can take it without adding
-* an edge to the provider import ring.
-*/
-/**
-* Build an attribute map from read-back values, omitting every key whose value
-* is `undefined` or `null`.
-*/
-function definedAttributes(entries) {
-	const out = {};
-	for (const [key, value] of Object.entries(entries)) {
-		if (value === void 0 || value === null) continue;
-		out[key] = value;
-	}
-	return out;
-}
-/**
-* `String(value)` for a numeric read-back whose CloudFormation attribute is a
-* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
-* `definedAttributes` drops the key instead of recording the literal
-* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
-* `?? ''` is merely deleted.
-*/
-function stringifyIfAssigned(value) {
-	if (value === void 0 || value === null) return void 0;
-	return String(value);
-}
-
 //#endregion
 //#region src/provisioning/providers/eventbridge-bus-provider.ts
 /**
@@ -94394,4 +94395,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BgbPkrcx.js.map
+//# sourceMappingURL=program-DaoJ7P4H.js.map