@go-to-k/cdkd 0.298.2 → 0.298.4

package/dist/{provider-classes-B74Nt7nS.js → provider-classes-CoJI5423.js}

@@ -2,17 +2,17 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as resolveAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ac as rewriteTemplateAssetReferences, ai as s3BucketArn, al as decodeListingKey, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bl as displayAssemblyPath, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, cl as canonicalizeRegion, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, ec as stringifyValue, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, ho as requireConfigObject, hs as carriesSecretMask, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, ll as derivePartitionAndUrlSuffix, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tt as markRefusedBeforeApplying, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, x as withApiLimit, xl as renderAssemblyPathEscape, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, yl as describeFileReadFailure, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-BgWY0v3K.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-KCSxfQZh.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BzEA5Cka.js";
-import { RDSProvider } from "./rds-provider-D4kq6O-L.js";
-import { NeptuneProvider } from "./neptune-provider-BGAmbyRB.js";
-import { ASGProvider } from "./asg-provider-Ds5ElkGf.js";
+import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cl as renderAssemblyPathEscape, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as displayAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ai as s3BucketArn, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, dl as derivePartitionAndUrlSuffix, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, gs as carriesSecretMask, ho as requireConfigObject, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oc as rewriteTemplateAssetReferences, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, ps as recordAttributeIdCopy, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sl as decodeListingKey, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tc as stringifyValue, tt as markRefusedBeforeApplying, ul as canonicalizeRegion, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, wl as resolveAssemblyPath, x as withApiLimit, xl as describeFileReadFailure, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-C8Fy0Qt4.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BoSkqeaq.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BqJFGIHe.js";
+import { RDSProvider } from "./rds-provider-Bbn1D00T.js";
+import { NeptuneProvider } from "./neptune-provider-23ajlPbJ.js";
+import { ASGProvider } from "./asg-provider-DvX7fChd.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
-import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
+import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
@@ -6723,6 +6723,45 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
+const MUTABLE_ATTRIBUTES = [
+	"RawMessageDelivery",
+	"FilterPolicy",
+	"FilterPolicyScope",
+	"RedrivePolicy",
+	"DeliveryPolicy",
+	"ReplayPolicy",
+	"SubscriptionRoleArn"
+];
+const RESET_VALUES = {
+	RawMessageDelivery: "false",
+	FilterPolicy: "",
+	FilterPolicyScope: "MessageAttributes",
+	RedrivePolicy: ""
+};
+const CREATE_ONLY_FIELDS = [
+	"TopicArn",
+	"Protocol",
+	"Endpoint"
+];
+function toAttributeValue(key, value) {
+	if (value === void 0) return void 0;
+	if (key === "FilterPolicy" || key === "RedrivePolicy" || key === "DeliveryPolicy" || key === "ReplayPolicy") return typeof value === "string" ? value : JSON.stringify(value);
+	return stringifyValue(value);
+}
+function sameAttributeValue(name, desired, current) {
+	if (current === void 0) return desired === RESET_VALUES[name];
+	if (desired === current) return true;
+	try {
+		return JSON.stringify(JSON.parse(desired)) === JSON.stringify(JSON.parse(current));
+	} catch {
+		return false;
+	}
+}
+function filterPolicyCleared(plan, current) {
+	const planned = plan.find(([name]) => name === "FilterPolicy");
+	if (planned !== void 0) return planned[1] === "";
+	return current["FilterPolicy"] === void 0 || current["FilterPolicy"] === "";
+}
 var SNSSubscriptionProvider = class {
 	snsClient;
 	logger = getLogger().child("SNSSubscriptionProvider");
@@ -6743,7 +6782,7 @@ var SNSSubscriptionProvider = class {
 		const awsClients = getAwsClients();
 		this.snsClient = awsClients.sns;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS subscription ${logicalId}`);
 		const topicArn = properties["TopicArn"];
 		const protocol = properties["Protocol"];
@@ -6781,16 +6820,71 @@ var SNSSubscriptionProvider = class {
 				attributes: definedAttributes({ Arn: response.SubscriptionArn?.startsWith("arn:") ? response.SubscriptionArn : void 0 })
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SNS subscription ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapMaskedAwsCallError(maskerOrIdentity(context?.maskSecrets), error, `Failed to create SNS subscription ${logicalId}`, resourceType, logicalId, void 0);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
+		const plan = await this.planInPlaceUpdate(logicalId, physicalId, resourceType, properties, context);
+		if (plan === void 0) return this.replace(logicalId, physicalId, resourceType, properties, context);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		for (const [name, value] of plan) try {
+			await this.snsClient.send(new SetSubscriptionAttributesCommand({
+				SubscriptionArn: physicalId,
+				AttributeName: name,
+				AttributeValue: value
+			}));
+		} catch (error) {
+			throw this.wrapMaskedAwsCallError(mask, error, `Failed to update SNS subscription ${logicalId} (attribute ${name})`, resourceType, logicalId, physicalId);
+		}
+		const changed = plan.map(([name]) => name).join(", ") || "no attribute differed";
+		this.logger.debug(safeMsg`Updated SNS subscription ${logicalId} in place: ${changed}`);
+		return {
+			physicalId,
+			wasReplaced: false,
+			attributes: definedAttributes({ Arn: physicalId.startsWith("arn:") ? physicalId : void 0 })
+		};
+	}
+	async planInPlaceUpdate(logicalId, physicalId, resourceType, properties, context) {
+		if (physicalId === "PendingConfirmation" || physicalId === "pending confirmation") return;
+		let current;
+		try {
+			current = (await this.snsClient.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: physicalId })))?.Attributes;
+		} catch (error) {
+			if (error instanceof NotFoundException) return void 0;
+			throw this.wrapMaskedAwsCallError(maskerOrIdentity(context?.maskSecrets), error, `Failed to update SNS subscription ${logicalId}: could not read its attributes`, resourceType, logicalId, physicalId);
+		}
+		if (current === void 0 || current["PendingConfirmation"] === "true") return void 0;
+		for (const field of CREATE_ONLY_FIELDS) {
+			const desired = properties[field];
+			if (desired !== void 0 && stringifyValue(desired) !== current[field]) return void 0;
+		}
+		const plan = [];
+		for (const name of MUTABLE_ATTRIBUTES) {
+			const desired = toAttributeValue(name, properties[name]);
+			const now = current[name];
+			if (desired !== void 0) {
+				if (!sameAttributeValue(name, desired, now)) plan.push([name, desired]);
+				continue;
+			}
+			if (now === void 0 || now === "") continue;
+			if (name === "FilterPolicyScope" && filterPolicyCleared(plan, current)) continue;
+			const reset = RESET_VALUES[name];
+			if (reset === void 0) return void 0;
+			if (now !== reset) plan.push([name, reset]);
+		}
+		const policy = plan.find(([name]) => name === "FilterPolicy");
+		if (policy !== void 0 && policy[1] !== "" && plan.some(([name]) => name === "FilterPolicyScope")) return;
+		return plan;
+	}
+	wrapMaskedAwsCallError(mask, error, prefix, resourceType, logicalId, physicalId) {
+		return wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`${prefix}: ${text}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
+	}
+	async replace(logicalId, physicalId, resourceType, properties, context) {
 		let deleteResult = void 0;
 		let deleteThrew = false;
 		try {
-			deleteResult = await this.delete(logicalId, physicalId, resourceType);
+			deleteResult = await this.delete(logicalId, physicalId, resourceType, void 0, { expectedRegion: context?.expectedRegion });
 		} catch (error) {
 			deleteThrew = true;
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${safeStringify(error)}`);
@@ -6800,7 +6894,7 @@ var SNSSubscriptionProvider = class {
 			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${notDeletedReason}`);
 			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Usually the Unsubscribe itself failed (a throttle, a denied sns:Unsubscribe) and the state record is FINE — clear that cause and re-run, or remove the old subscription in AWS by hand. Repair the state record only when the warning says the recorded physical id is malformed, which is the latent skip arm rather than this one.`, resourceType, logicalId, physicalId));
 		}
-		const createResult = await this.create(logicalId, resourceType, properties);
+		const createResult = await this.create(logicalId, resourceType, properties, context?.maskSecrets === void 0 ? void 0 : { maskSecrets: context.maskSecrets });
 		return {
 			physicalId: createResult.physicalId,
 			wasReplaced: true,
@@ -7215,6 +7309,16 @@ var LambdaCreateClientCache = class {
 
 //#endregion
 //#region src/provisioning/providers/lambda-function-provider.ts
+function isFunctionName(id) {
+	return /^[A-Za-z0-9_-]{1,64}$/.test(id);
+}
+function functionIdentityToken(arn, lastModified) {
+	if (typeof arn !== "string" || arn === "") return void 0;
+	if (typeof lastModified !== "string" || lastModified === "") return void 0;
+	const ms = Date.parse(lastModified);
+	if (Number.isNaN(ms)) return void 0;
+	return `${arn}@${ms}`;
+}
 const SELF_NEEDLE_MIN_LENGTH$1 = 3;
 function lambdaOperationSinks(logger, maskSecrets, namePairs, bag) {
 	const base = createMaskedLogSinks(logger, maskSecrets);
@@ -7450,6 +7554,7 @@ var LambdaFunctionProvider = class {
 		refuseImageFunctionUnsupported(logicalId, resourceType, properties);
 		let functionCreated = false;
 		let createdFunctionName;
+		let createdFunctionIdentity;
 		const postCreateCleanup = { deleted: false };
 		try {
 			const tags = properties["Tags"] ? Object.fromEntries(desiredTags.map((tag) => [tag.Key, tag.Value])) : void 0;
@@ -7483,6 +7588,7 @@ var LambdaFunctionProvider = class {
 			const response = await (await this.createClient.get()).send(new CreateFunctionCommand(createParams));
 			functionCreated = true;
 			createdFunctionName = response.FunctionName || functionName;
+			createdFunctionIdentity = functionIdentityToken(response.FunctionArn, response.LastModified);
 			const recursiveLoop = properties["RecursiveLoop"];
 			if (recursiveLoop !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 				FunctionName: functionName,
@@ -7518,6 +7624,7 @@ var LambdaFunctionProvider = class {
 					maxDelay: 5
 				}, { FunctionName: functionName });
 				await this.putRuntimeManagementConfig(functionName, runtimeManagementConfig);
+				createdFunctionIdentity = void 0;
 			}, {
 				apiName: "PutRuntimeManagementConfig",
 				propertyName: "RuntimeManagementConfig",
@@ -7539,7 +7646,7 @@ var LambdaFunctionProvider = class {
 			if (functionCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(String(error))));
-			if (createdFunctionName !== void 0 && !postCreateCleanup.deleted) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFunctionName);
+			if (createdFunctionName !== void 0 && !postCreateCleanup.deleted) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
 			throw thrown;
 		}
 	}
@@ -7736,6 +7843,7 @@ var LambdaFunctionProvider = class {
 				if (error instanceof ResourceNotFoundException) {
 					const clientRegion = await this.lambdaClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logFunctionGone(logicalId, physicalId, context);
 					return;
 				}
 				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${describeAwsFailure(error).detail} — continuing with delete`);
@@ -7749,7 +7857,7 @@ var LambdaFunctionProvider = class {
 			if (error instanceof ResourceNotFoundException) {
 				const clientRegion = await this.lambdaClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Lambda function ${physicalId} does not exist, skipping deletion`);
+				this.logFunctionGone(logicalId, physicalId, context);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -7974,6 +8082,45 @@ var LambdaFunctionProvider = class {
 		}
 		return (crc ^ 4294967295) >>> 0;
 	}
+	logFunctionGone(logicalId, physicalId, context) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Lambda function ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(`Lambda function ${physicalId} does not exist, skipping deletion`);
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::Lambda::Function") return "unknown";
+		if (!isFunctionName(journaledPhysicalId) || !isFunctionName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.lambdaClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordFn = await this.readFunctionIfExists(record.physicalId);
+		if (recordFn === void 0) return "unknown";
+		const journaledFn = await this.readFunctionIfExists(journaledPhysicalId);
+		if (journaledFn === void 0) return "different";
+		return journaledFn.arn === recordFn.arn ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::Lambda::Function" || !isFunctionName(physicalId)) return;
+		if (await this.lambdaClient.config.region() !== context.expectedRegion) return void 0;
+		const live = await this.readFunctionIfExists(physicalId);
+		if (live === void 0) return RESOURCE_NOT_FOUND;
+		return functionIdentityToken(live.arn, live.lastModified);
+	}
+	async readFunctionIfExists(functionName) {
+		let response;
+		try {
+			response = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: functionName }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException) return void 0;
+			throw error;
+		}
+		if (response.Configuration?.FunctionName !== functionName) throw new Error("GetFunction answered for another function than the one asked for");
+		const arn = response.Configuration.FunctionArn;
+		if (typeof arn !== "string" || arn === "") throw new Error("GetFunction returned no FunctionArn");
+		return {
+			arn,
+			lastModified: response.Configuration.LastModified
+		};
+	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		if (attributeName !== "Arn" && attributeName !== "SnapStartResponse.ApplyOn" && attributeName !== "SnapStartResponse.OptimizationStatus") return;
 		try {
@@ -44382,6 +44529,15 @@ var NestedStackProvider = class {
 		if (!childStateData) throw markNonRetryable(/* @__PURE__ */ new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`));
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion, runAccountOf(ctx));
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const rowSecrets = getCurrentResourceSecrets();
+		if (rowSecrets !== void 0) {
+			const childResources = childStateData.state.resources;
+			const ids = childResources !== null && typeof childResources === "object" ? Object.values(childResources).map((record) => record?.physicalId).filter((id) => typeof id === "string" && id !== "") : [];
+			for (const value of Object.values(attributes)) {
+				if (typeof value !== "string") continue;
+				for (const id of ids) if (value.includes(id)) recordAttributeIdCopy(rowSecrets, id);
+			}
+		}
 		const noEchoAttributeNames = [];
 		const identity = credentialFingerprint(ambientCredentialConfig());
 		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
@@ -44865,4 +45021,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-B74Nt7nS.js.map
+//# sourceMappingURL=provider-classes-CoJI5423.js.map