@go-to-k/cdkd 0.298.0 → 0.298.2

package/dist/{provider-classes-1EHrZ847.js → provider-classes-B74Nt7nS.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, $s as stringifyValue, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, b as lookupEachName, bl as renderAssemblyPathEscape, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketArn, cl as derivePartitionAndUrlSuffix, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, di as s3BucketRegionalDomainName, do as configStringRefusal, dr as stringifyIfAssigned, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fi as s3BucketWebsiteUrl, fo as readConfigString, fs as recoverMaskedOutput, gi as getAccountInfo, go as requireConfigString, ho as requireConfigObject, ic as rewriteTemplateAssetReferences, il as decodeListingKey, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketDomainName, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, ms as carriesSecretMask, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, os as dynamicReferenceTokens, po as replayWarn, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as isSettledInstanceState, sl as canonicalizeRegion, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tt as markRefusedBeforeApplying, ui as s3BucketDualStackDomainName, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, vl as describeFileReadFailure, x as withApiLimit, xl as resolveAssemblyPath, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, yl as displayAssemblyPath, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-CJTG3tft.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-qxfS4sDT.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BivXyHmd.js";
-import { RDSProvider } from "./rds-provider-J40R0ysf.js";
-import { NeptuneProvider } from "./neptune-provider-CU_1O2FR.js";
-import { ASGProvider } from "./asg-provider-B1xRE8do.js";
+import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as resolveAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ac as rewriteTemplateAssetReferences, ai as s3BucketArn, al as decodeListingKey, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bl as displayAssemblyPath, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, cl as canonicalizeRegion, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, ec as stringifyValue, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, ho as requireConfigObject, hs as carriesSecretMask, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, ll as derivePartitionAndUrlSuffix, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tt as markRefusedBeforeApplying, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, x as withApiLimit, xl as renderAssemblyPathEscape, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, yl as describeFileReadFailure, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-BgWY0v3K.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-KCSxfQZh.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BzEA5Cka.js";
+import { RDSProvider } from "./rds-provider-D4kq6O-L.js";
+import { NeptuneProvider } from "./neptune-provider-BGAmbyRB.js";
+import { ASGProvider } from "./asg-provider-Ds5ElkGf.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -11639,13 +11639,14 @@ var DynamoDBTableProvider = class {
 				const wt = readbackWarmThroughput(table.WarmThroughput, properties !== void 0 && desiredBagIsInformative(properties) ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0);
 				if (wt !== void 0) result["WarmThroughput"] = wt;
 			}
+			let streamMembersRead = Promise.resolve();
 			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) {
 				const streamBlock = {
 					StreamEnabled: true,
 					StreamViewType: table.StreamSpecification.StreamViewType
 				};
 				result["StreamSpecification"] = streamBlock;
-				await this.readStreamMembers(physicalId, table.LatestStreamArn, properties?.["StreamSpecification"], streamBlock, context?.afterOwnWrite === true);
+				streamMembersRead = this.readStreamMembers(physicalId, table.LatestStreamArn, properties?.["StreamSpecification"], streamBlock, context?.afterOwnWrite === true);
 			}
 			const bagInformative = desiredBagIsInformative(properties);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
@@ -11664,88 +11665,121 @@ var DynamoDBTableProvider = class {
 			}
 			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
-			if (table.TableArn) try {
-				const tagsResp = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }));
-				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
-			} catch (err) {
-				if (err instanceof ResourceNotFoundException$1) return RESOURCE_NOT_FOUND;
-				throw err;
-			}
-			try {
-				const pitrDesc = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: physicalId }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
-				const pitrStatus = pitrDesc?.PointInTimeRecoveryStatus;
-				if (pitrStatus) {
-					const pitr = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
-					if (pitrStatus === "ENABLED" && pitrDesc?.RecoveryPeriodInDays !== void 0) pitr["RecoveryPeriodInDays"] = pitrDesc.RecoveryPeriodInDays;
-					result["PointInTimeRecoverySpecification"] = pitr;
-				}
-			} catch (err) {
-				this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			try {
-				const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
-				if (ttlDesc?.TimeToLiveStatus === "ENABLED" && ttlDesc.AttributeName) result["TimeToLiveSpecification"] = {
-					AttributeName: ttlDesc.AttributeName,
-					Enabled: true
-				};
-			} catch (err) {
-				this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			if (table.TableArn) try {
-				const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: table.TableArn }));
-				if (rpResp.Policy) {
-					let doc = rpResp.Policy;
-					try {
-						doc = JSON.parse(rpResp.Policy);
-					} catch {}
-					result["ResourcePolicy"] = { PolicyDocument: doc };
-				}
-			} catch (err) {
-				if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			try {
-				const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
-				if (active?.StreamArn) {
-					const kspec = { StreamArn: active.StreamArn };
-					if (active.ApproximateCreationDateTimePrecision !== void 0) kspec["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
-					result["KinesisStreamSpecification"] = kspec;
-				}
-			} catch (err) {
-				this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			try {
-				const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
-				const cspec = reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
-				if (cspec !== void 0) result["ContributorInsightsSpecification"] = cspec;
-			} catch (err) {
-				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			const emittedGsis = result["GlobalSecondaryIndexes"];
-			if (bagInformative && Array.isArray(emittedGsis)) {
-				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
-				for (const emitted of emittedGsis) {
-					const indexName = emitted["IndexName"];
-					if (typeof indexName !== "string") continue;
-					const desiredEntry = desiredByName.get(indexName);
-					if (!indexDeclaresContributorInsights(desiredEntry)) continue;
-					try {
-						const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
-							TableName: physicalId,
-							IndexName: indexName
-						}));
-						const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
-						if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
-					} catch (err) {
-						this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
-					}
-				}
-			}
+			const tableArn = table.TableArn;
+			const [tags, pitr, ttl, resourcePolicy, kinesis, contributorInsights] = await Promise.all([
+				tableArn ? this.readTableTags(tableArn) : Promise.resolve(void 0),
+				this.readPointInTimeRecovery(physicalId),
+				this.readTimeToLive(physicalId),
+				tableArn ? this.readTableResourcePolicy(physicalId, tableArn) : Promise.resolve(void 0),
+				this.readKinesisStreamSpecification(physicalId),
+				this.readTableContributorInsights(physicalId),
+				this.readIndexContributorInsights(physicalId, result, properties, bagInformative),
+				streamMembersRead
+			]);
+			if (tags === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+			if (tags !== void 0) result["Tags"] = tags;
+			if (pitr !== void 0) result["PointInTimeRecoverySpecification"] = pitr;
+			if (ttl !== void 0) result["TimeToLiveSpecification"] = ttl;
+			if (resourcePolicy !== void 0) result["ResourcePolicy"] = resourcePolicy;
+			if (kinesis !== void 0) result["KinesisStreamSpecification"] = kinesis;
+			if (contributorInsights !== void 0) result["ContributorInsightsSpecification"] = contributorInsights;
 			return result;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 	}
+	async readTableTags(tableArn) {
+		try {
+			const tagsResp = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: tableArn }));
+			return normalizeAwsTagsToCfn(tagsResp.Tags);
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$1) return RESOURCE_NOT_FOUND;
+			throw err;
+		}
+	}
+	async readPointInTimeRecovery(physicalId) {
+		try {
+			const pitrDesc = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: physicalId }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const pitrStatus = pitrDesc?.PointInTimeRecoveryStatus;
+			if (!pitrStatus) return void 0;
+			const pitr = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
+			if (pitrStatus === "ENABLED" && pitrDesc?.RecoveryPeriodInDays !== void 0) pitr["RecoveryPeriodInDays"] = pitrDesc.RecoveryPeriodInDays;
+			return pitr;
+		} catch (err) {
+			this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readTimeToLive(physicalId) {
+		try {
+			const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
+			if (ttlDesc?.TimeToLiveStatus === "ENABLED" && ttlDesc.AttributeName) return {
+				AttributeName: ttlDesc.AttributeName,
+				Enabled: true
+			};
+			return;
+		} catch (err) {
+			this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readTableResourcePolicy(physicalId, tableArn) {
+		try {
+			const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: tableArn }));
+			if (!rpResp.Policy) return void 0;
+			let doc = rpResp.Policy;
+			try {
+				doc = JSON.parse(rpResp.Policy);
+			} catch {}
+			return { PolicyDocument: doc };
+		} catch (err) {
+			if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readKinesisStreamSpecification(physicalId) {
+		try {
+			const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
+			if (!active?.StreamArn) return void 0;
+			const kspec = { StreamArn: active.StreamArn };
+			if (active.ApproximateCreationDateTimePrecision !== void 0) kspec["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
+			return kspec;
+		} catch (err) {
+			this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readTableContributorInsights(physicalId) {
+		try {
+			const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
+			return reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
+		} catch (err) {
+			this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readIndexContributorInsights(physicalId, result, properties, bagInformative) {
+		const emittedGsis = result["GlobalSecondaryIndexes"];
+		if (!bagInformative || !Array.isArray(emittedGsis)) return;
+		const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+		for (const emitted of emittedGsis) {
+			const indexName = emitted["IndexName"];
+			if (typeof indexName !== "string") continue;
+			const desiredEntry = desiredByName.get(indexName);
+			if (!indexDeclaresContributorInsights(desiredEntry)) continue;
+			try {
+				const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
+					TableName: physicalId,
+					IndexName: indexName
+				}));
+				const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
+				if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
+			} catch (err) {
+				this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
+			}
+		}
+	}
 	streamMemberRereadDelaysMs = [
 		500,
 		1e3,
@@ -28264,15 +28298,27 @@ const USER_POOL_ECHO_MEMBERS = [
 	"DeviceConfiguration",
 	"SmsVerificationMessage",
 	"EmailVerificationMessage",
-	"EmailVerificationSubject"
+	"EmailVerificationSubject",
+	"AcrConfiguration"
 ];
 function userPoolDeletionProtectionUpdate(physicalId, pool, value, opts = {}) {
 	const input = { UserPoolId: physicalId };
 	for (const member of USER_POOL_ECHO_MEMBERS) if (pool[member] !== void 0) Object.assign(input, { [member]: pool[member] });
+	const acr = customAcrLevels(pool.AcrConfiguration);
+	if (acr === void 0) delete input.AcrConfiguration;
+	else input.AcrConfiguration = acr;
 	if (echoesDeveloperEmail(pool) && opts.withoutDeveloperEmail !== true) input.EmailConfiguration = pool.EmailConfiguration;
 	input.DeletionProtection = value;
 	return input;
 }
+function customAcrLevels(acr) {
+	if (acr === void 0) return void 0;
+	const custom = Object.fromEntries(Object.entries(acr).filter(([level, cfg]) => {
+		const n = /^Level([1-4])$/.exec(level)?.[1];
+		return n === void 0 || cfg?.AcrValue !== `urn:cognito:loa:${n}`;
+	}));
+	return Object.keys(custom).length > 0 ? custom : void 0;
+}
 const sentWithoutEmail = /* @__PURE__ */ new WeakSet();
 const createUserPoolLatch = new AmbiguousCreateLatch("CreateUserPool");
 const userPoolsCreatedByThisProcess = new RecentIdSet();
@@ -44306,6 +44352,7 @@ var NestedStackProvider = class {
 			parameters: childParameters,
 			onDestructivePlan: void 0,
 			...inheritedSecrets && hasMaskableValues(inheritedSecrets) && { inheritedSecrets },
+			inheritedPhysicalNameCopies: inheritedPhysicalNameCopiesOf(inheritedSecrets),
 			...passedClasses && { passedParameterClasses: passedClasses },
 			passedNoEchoParameters: passedNoEchoParametersOf(inheritedSecrets),
 			inheritedProducerRegions: getCurrentProducerRegions(),
@@ -44435,6 +44482,10 @@ function runAccountOf(ctx) {
 		statePrefix: ctx.destroyOptions?.statePrefix
 	};
 }
+function inheritedPhysicalNameCopiesOf(bag) {
+	const copies = bag === void 0 ? void 0 : physicalNameCopiesOf.get(bag);
+	return copies === void 0 || copies.size === 0 ? void 0 : new Set(copies);
+}
 
 //#endregion
 //#region src/provisioning/providers/wait-condition-handle-provider.ts
@@ -44814,4 +44865,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-1EHrZ847.js.map
+//# sourceMappingURL=provider-classes-B74Nt7nS.js.map