@go-to-k/cdkd 0.298.1 → 0.298.3

package/dist/{provider-classes-CuZ-P4gB.js → provider-classes-BTP4rLU6.js}

@@ -2,17 +2,17 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as resolveAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ac as rewriteTemplateAssetReferences, ai as s3BucketArn, al as decodeListingKey, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bl as displayAssemblyPath, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, cl as canonicalizeRegion, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, ec as stringifyValue, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, ho as requireConfigObject, hs as carriesSecretMask, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, ll as derivePartitionAndUrlSuffix, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tt as markRefusedBeforeApplying, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, x as withApiLimit, xl as renderAssemblyPathEscape, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, yl as describeFileReadFailure, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-A-Ys_mhE.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CpqTal4K.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-D5gcmWad.js";
-import { RDSProvider } from "./rds-provider-X4mc-nGw.js";
-import { NeptuneProvider } from "./neptune-provider-C4A86Y7P.js";
-import { ASGProvider } from "./asg-provider-semUK44T.js";
+import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cl as renderAssemblyPathEscape, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as displayAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ai as s3BucketArn, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, dl as derivePartitionAndUrlSuffix, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, gs as carriesSecretMask, ho as requireConfigObject, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oc as rewriteTemplateAssetReferences, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, ps as recordAttributeIdCopy, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sl as decodeListingKey, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tc as stringifyValue, tt as markRefusedBeforeApplying, ul as canonicalizeRegion, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, wl as resolveAssemblyPath, x as withApiLimit, xl as describeFileReadFailure, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-DLGCuN4i.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-B020NDGS.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BQnReLnG.js";
+import { RDSProvider } from "./rds-provider-DcfF-k86.js";
+import { NeptuneProvider } from "./neptune-provider-DDFjTv9k.js";
+import { ASGProvider } from "./asg-provider-CvJsMScM.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
-import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
+import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
@@ -6723,6 +6723,45 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
+const MUTABLE_ATTRIBUTES = [
+	"RawMessageDelivery",
+	"FilterPolicy",
+	"FilterPolicyScope",
+	"RedrivePolicy",
+	"DeliveryPolicy",
+	"ReplayPolicy",
+	"SubscriptionRoleArn"
+];
+const RESET_VALUES = {
+	RawMessageDelivery: "false",
+	FilterPolicy: "",
+	FilterPolicyScope: "MessageAttributes",
+	RedrivePolicy: ""
+};
+const CREATE_ONLY_FIELDS = [
+	"TopicArn",
+	"Protocol",
+	"Endpoint"
+];
+function toAttributeValue(key, value) {
+	if (value === void 0) return void 0;
+	if (key === "FilterPolicy" || key === "RedrivePolicy" || key === "DeliveryPolicy" || key === "ReplayPolicy") return typeof value === "string" ? value : JSON.stringify(value);
+	return stringifyValue(value);
+}
+function sameAttributeValue(name, desired, current) {
+	if (current === void 0) return desired === RESET_VALUES[name];
+	if (desired === current) return true;
+	try {
+		return JSON.stringify(JSON.parse(desired)) === JSON.stringify(JSON.parse(current));
+	} catch {
+		return false;
+	}
+}
+function filterPolicyCleared(plan, current) {
+	const planned = plan.find(([name]) => name === "FilterPolicy");
+	if (planned !== void 0) return planned[1] === "";
+	return current["FilterPolicy"] === void 0 || current["FilterPolicy"] === "";
+}
 var SNSSubscriptionProvider = class {
 	snsClient;
 	logger = getLogger().child("SNSSubscriptionProvider");
@@ -6743,7 +6782,7 @@ var SNSSubscriptionProvider = class {
 		const awsClients = getAwsClients();
 		this.snsClient = awsClients.sns;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS subscription ${logicalId}`);
 		const topicArn = properties["TopicArn"];
 		const protocol = properties["Protocol"];
@@ -6781,16 +6820,71 @@ var SNSSubscriptionProvider = class {
 				attributes: definedAttributes({ Arn: response.SubscriptionArn?.startsWith("arn:") ? response.SubscriptionArn : void 0 })
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SNS subscription ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapMaskedAwsCallError(maskerOrIdentity(context?.maskSecrets), error, `Failed to create SNS subscription ${logicalId}`, resourceType, logicalId, void 0);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
+		const plan = await this.planInPlaceUpdate(logicalId, physicalId, resourceType, properties, context);
+		if (plan === void 0) return this.replace(logicalId, physicalId, resourceType, properties, context);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		for (const [name, value] of plan) try {
+			await this.snsClient.send(new SetSubscriptionAttributesCommand({
+				SubscriptionArn: physicalId,
+				AttributeName: name,
+				AttributeValue: value
+			}));
+		} catch (error) {
+			throw this.wrapMaskedAwsCallError(mask, error, `Failed to update SNS subscription ${logicalId} (attribute ${name})`, resourceType, logicalId, physicalId);
+		}
+		const changed = plan.map(([name]) => name).join(", ") || "no attribute differed";
+		this.logger.debug(safeMsg`Updated SNS subscription ${logicalId} in place: ${changed}`);
+		return {
+			physicalId,
+			wasReplaced: false,
+			attributes: definedAttributes({ Arn: physicalId.startsWith("arn:") ? physicalId : void 0 })
+		};
+	}
+	async planInPlaceUpdate(logicalId, physicalId, resourceType, properties, context) {
+		if (physicalId === "PendingConfirmation" || physicalId === "pending confirmation") return;
+		let current;
+		try {
+			current = (await this.snsClient.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: physicalId })))?.Attributes;
+		} catch (error) {
+			if (error instanceof NotFoundException) return void 0;
+			throw this.wrapMaskedAwsCallError(maskerOrIdentity(context?.maskSecrets), error, `Failed to update SNS subscription ${logicalId}: could not read its attributes`, resourceType, logicalId, physicalId);
+		}
+		if (current === void 0 || current["PendingConfirmation"] === "true") return void 0;
+		for (const field of CREATE_ONLY_FIELDS) {
+			const desired = properties[field];
+			if (desired !== void 0 && stringifyValue(desired) !== current[field]) return void 0;
+		}
+		const plan = [];
+		for (const name of MUTABLE_ATTRIBUTES) {
+			const desired = toAttributeValue(name, properties[name]);
+			const now = current[name];
+			if (desired !== void 0) {
+				if (!sameAttributeValue(name, desired, now)) plan.push([name, desired]);
+				continue;
+			}
+			if (now === void 0 || now === "") continue;
+			if (name === "FilterPolicyScope" && filterPolicyCleared(plan, current)) continue;
+			const reset = RESET_VALUES[name];
+			if (reset === void 0) return void 0;
+			if (now !== reset) plan.push([name, reset]);
+		}
+		const policy = plan.find(([name]) => name === "FilterPolicy");
+		if (policy !== void 0 && policy[1] !== "" && plan.some(([name]) => name === "FilterPolicyScope")) return;
+		return plan;
+	}
+	wrapMaskedAwsCallError(mask, error, prefix, resourceType, logicalId, physicalId) {
+		return wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`${prefix}: ${text}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
+	}
+	async replace(logicalId, physicalId, resourceType, properties, context) {
 		let deleteResult = void 0;
 		let deleteThrew = false;
 		try {
-			deleteResult = await this.delete(logicalId, physicalId, resourceType);
+			deleteResult = await this.delete(logicalId, physicalId, resourceType, void 0, { expectedRegion: context?.expectedRegion });
 		} catch (error) {
 			deleteThrew = true;
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${safeStringify(error)}`);
@@ -6800,7 +6894,7 @@ var SNSSubscriptionProvider = class {
 			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${notDeletedReason}`);
 			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Usually the Unsubscribe itself failed (a throttle, a denied sns:Unsubscribe) and the state record is FINE — clear that cause and re-run, or remove the old subscription in AWS by hand. Repair the state record only when the warning says the recorded physical id is malformed, which is the latent skip arm rather than this one.`, resourceType, logicalId, physicalId));
 		}
-		const createResult = await this.create(logicalId, resourceType, properties);
+		const createResult = await this.create(logicalId, resourceType, properties, context?.maskSecrets === void 0 ? void 0 : { maskSecrets: context.maskSecrets });
 		return {
 			physicalId: createResult.physicalId,
 			wasReplaced: true,
@@ -11639,13 +11733,14 @@ var DynamoDBTableProvider = class {
 				const wt = readbackWarmThroughput(table.WarmThroughput, properties !== void 0 && desiredBagIsInformative(properties) ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0);
 				if (wt !== void 0) result["WarmThroughput"] = wt;
 			}
+			let streamMembersRead = Promise.resolve();
 			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) {
 				const streamBlock = {
 					StreamEnabled: true,
 					StreamViewType: table.StreamSpecification.StreamViewType
 				};
 				result["StreamSpecification"] = streamBlock;
-				await this.readStreamMembers(physicalId, table.LatestStreamArn, properties?.["StreamSpecification"], streamBlock, context?.afterOwnWrite === true);
+				streamMembersRead = this.readStreamMembers(physicalId, table.LatestStreamArn, properties?.["StreamSpecification"], streamBlock, context?.afterOwnWrite === true);
 			}
 			const bagInformative = desiredBagIsInformative(properties);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
@@ -11664,88 +11759,121 @@ var DynamoDBTableProvider = class {
 			}
 			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
-			if (table.TableArn) try {
-				const tagsResp = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }));
-				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
-			} catch (err) {
-				if (err instanceof ResourceNotFoundException$1) return RESOURCE_NOT_FOUND;
-				throw err;
-			}
-			try {
-				const pitrDesc = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: physicalId }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
-				const pitrStatus = pitrDesc?.PointInTimeRecoveryStatus;
-				if (pitrStatus) {
-					const pitr = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
-					if (pitrStatus === "ENABLED" && pitrDesc?.RecoveryPeriodInDays !== void 0) pitr["RecoveryPeriodInDays"] = pitrDesc.RecoveryPeriodInDays;
-					result["PointInTimeRecoverySpecification"] = pitr;
-				}
-			} catch (err) {
-				this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			try {
-				const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
-				if (ttlDesc?.TimeToLiveStatus === "ENABLED" && ttlDesc.AttributeName) result["TimeToLiveSpecification"] = {
-					AttributeName: ttlDesc.AttributeName,
-					Enabled: true
-				};
-			} catch (err) {
-				this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			if (table.TableArn) try {
-				const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: table.TableArn }));
-				if (rpResp.Policy) {
-					let doc = rpResp.Policy;
-					try {
-						doc = JSON.parse(rpResp.Policy);
-					} catch {}
-					result["ResourcePolicy"] = { PolicyDocument: doc };
-				}
-			} catch (err) {
-				if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			try {
-				const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
-				if (active?.StreamArn) {
-					const kspec = { StreamArn: active.StreamArn };
-					if (active.ApproximateCreationDateTimePrecision !== void 0) kspec["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
-					result["KinesisStreamSpecification"] = kspec;
-				}
-			} catch (err) {
-				this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			try {
-				const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
-				const cspec = reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
-				if (cspec !== void 0) result["ContributorInsightsSpecification"] = cspec;
-			} catch (err) {
-				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
-			}
-			const emittedGsis = result["GlobalSecondaryIndexes"];
-			if (bagInformative && Array.isArray(emittedGsis)) {
-				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
-				for (const emitted of emittedGsis) {
-					const indexName = emitted["IndexName"];
-					if (typeof indexName !== "string") continue;
-					const desiredEntry = desiredByName.get(indexName);
-					if (!indexDeclaresContributorInsights(desiredEntry)) continue;
-					try {
-						const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
-							TableName: physicalId,
-							IndexName: indexName
-						}));
-						const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
-						if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
-					} catch (err) {
-						this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
-					}
-				}
-			}
+			const tableArn = table.TableArn;
+			const [tags, pitr, ttl, resourcePolicy, kinesis, contributorInsights] = await Promise.all([
+				tableArn ? this.readTableTags(tableArn) : Promise.resolve(void 0),
+				this.readPointInTimeRecovery(physicalId),
+				this.readTimeToLive(physicalId),
+				tableArn ? this.readTableResourcePolicy(physicalId, tableArn) : Promise.resolve(void 0),
+				this.readKinesisStreamSpecification(physicalId),
+				this.readTableContributorInsights(physicalId),
+				this.readIndexContributorInsights(physicalId, result, properties, bagInformative),
+				streamMembersRead
+			]);
+			if (tags === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+			if (tags !== void 0) result["Tags"] = tags;
+			if (pitr !== void 0) result["PointInTimeRecoverySpecification"] = pitr;
+			if (ttl !== void 0) result["TimeToLiveSpecification"] = ttl;
+			if (resourcePolicy !== void 0) result["ResourcePolicy"] = resourcePolicy;
+			if (kinesis !== void 0) result["KinesisStreamSpecification"] = kinesis;
+			if (contributorInsights !== void 0) result["ContributorInsightsSpecification"] = contributorInsights;
 			return result;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 	}
+	async readTableTags(tableArn) {
+		try {
+			const tagsResp = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: tableArn }));
+			return normalizeAwsTagsToCfn(tagsResp.Tags);
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$1) return RESOURCE_NOT_FOUND;
+			throw err;
+		}
+	}
+	async readPointInTimeRecovery(physicalId) {
+		try {
+			const pitrDesc = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: physicalId }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const pitrStatus = pitrDesc?.PointInTimeRecoveryStatus;
+			if (!pitrStatus) return void 0;
+			const pitr = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
+			if (pitrStatus === "ENABLED" && pitrDesc?.RecoveryPeriodInDays !== void 0) pitr["RecoveryPeriodInDays"] = pitrDesc.RecoveryPeriodInDays;
+			return pitr;
+		} catch (err) {
+			this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readTimeToLive(physicalId) {
+		try {
+			const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
+			if (ttlDesc?.TimeToLiveStatus === "ENABLED" && ttlDesc.AttributeName) return {
+				AttributeName: ttlDesc.AttributeName,
+				Enabled: true
+			};
+			return;
+		} catch (err) {
+			this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readTableResourcePolicy(physicalId, tableArn) {
+		try {
+			const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: tableArn }));
+			if (!rpResp.Policy) return void 0;
+			let doc = rpResp.Policy;
+			try {
+				doc = JSON.parse(rpResp.Policy);
+			} catch {}
+			return { PolicyDocument: doc };
+		} catch (err) {
+			if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readKinesisStreamSpecification(physicalId) {
+		try {
+			const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
+			if (!active?.StreamArn) return void 0;
+			const kspec = { StreamArn: active.StreamArn };
+			if (active.ApproximateCreationDateTimePrecision !== void 0) kspec["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
+			return kspec;
+		} catch (err) {
+			this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readTableContributorInsights(physicalId) {
+		try {
+			const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
+			return reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
+		} catch (err) {
+			this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
+			return;
+		}
+	}
+	async readIndexContributorInsights(physicalId, result, properties, bagInformative) {
+		const emittedGsis = result["GlobalSecondaryIndexes"];
+		if (!bagInformative || !Array.isArray(emittedGsis)) return;
+		const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+		for (const emitted of emittedGsis) {
+			const indexName = emitted["IndexName"];
+			if (typeof indexName !== "string") continue;
+			const desiredEntry = desiredByName.get(indexName);
+			if (!indexDeclaresContributorInsights(desiredEntry)) continue;
+			try {
+				const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
+					TableName: physicalId,
+					IndexName: indexName
+				}));
+				const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
+				if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
+			} catch (err) {
+				this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
+			}
+		}
+	}
 	streamMemberRereadDelaysMs = [
 		500,
 		1e3,
@@ -44348,6 +44476,15 @@ var NestedStackProvider = class {
 		if (!childStateData) throw markNonRetryable(/* @__PURE__ */ new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`));
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion, runAccountOf(ctx));
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const rowSecrets = getCurrentResourceSecrets();
+		if (rowSecrets !== void 0) {
+			const childResources = childStateData.state.resources;
+			const ids = childResources !== null && typeof childResources === "object" ? Object.values(childResources).map((record) => record?.physicalId).filter((id) => typeof id === "string" && id !== "") : [];
+			for (const value of Object.values(attributes)) {
+				if (typeof value !== "string") continue;
+				for (const id of ids) if (value.includes(id)) recordAttributeIdCopy(rowSecrets, id);
+			}
+		}
 		const noEchoAttributeNames = [];
 		const identity = credentialFingerprint(ambientCredentialConfig());
 		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
@@ -44831,4 +44968,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CuZ-P4gB.js.map
+//# sourceMappingURL=provider-classes-BTP4rLU6.js.map