@go-to-k/cdkd 0.301.3 → 0.301.4

package/dist/{provider-classes-59TTNMFB.js → provider-classes-BSUoljqw.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-BkeM7IXi.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ai as getAccountInfo, Ao as requireConfigString, As as recordAttributeIdCopy, Bi as parseWebACLArn, Bl as displayAssemblyPath, C as withApiLimit, Cc as rewriteTemplateAssetReferences, Co as configBooleanRefusal, Do as replayWarn, Eo as readConfigString, Fo as canonicalLambdaFunctionName, Fr as slowCcOperationTimeoutMs, G as deleteBudgetKey, Ga as refuseMalformedResourcesForDestroy, Gt as awaitInFlightSibling, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hl as resolveAssemblyPath, Hr as withIndeterminateGuard, Ht as withNestedStackContext, Io as lambdaFunctionNameForMask, Ir as unchangedBehindSecretReference, J as DELETE_INDEX_WAIT_PROCEED_NOTE, Jr as observeThenDisableInstanceApiTermination, K as resolveDynamoDbDeleteBudgetClock, Kr as ec2InstanceProtectionSite, Lo as sameLambdaFunctionAddress, Lt as revertNestedChildFromJournal, Ns as carriesSecretMask, Ol as canonicalizeRegion, Oo as requireConfigArray, Os as recoverMaskedOutput, Po as withRetry, Pt as getNestedRevertRun, Q as ECR_AUTO_DELETE_IMAGES_TAG, S as lookupEachName, Si as s3BucketWebsiteUrl, So as coerceCfnInteger, Ss as dynamicReferenceTokens, Ta as refuseMalformedNestedChildOutputs, Tl as decodeListingKey, To as configStringRefusal, Tr as waitForLambdaFunctionActive, U as beginDeleteWait, Ui as passedParameterClassesOf, Ur as isWaitAbandonedError, V as DynamoDBGlobalTableProvider, Vl as renderAssemblyPathEscape, Vr as deleteSkipReason, Vt as getCurrentNestedStackContext, W as compensateRemovedDeletionProtection, Wr as markWaitAbandoned, X as deleteTableWithIndexBusyRetry, Xi as accountArgs, Xr as reEnableInstanceApiTermination, Xt as replacedDeleteFailureVerdict, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as passedNoEchoParametersOf, Yr as reDisableInstanceApiTermination, Z as waitForIndexesSettled, _o as coerceWarmThroughput$1, _r as tagPlanWarning, _s as redactSecretsForState, ao as findSilentDropProperties, b as chunks, bi as s3BucketDualStackDomainName, bo as toFiniteNumber, bs as withoutPhysicalNameCopies, c as isAbsoluteAssetPath, cr as acquireIdempotencyToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as DBPROXY_TAGS_WHAT, et as hasCdkAutoDeleteTag, fn as isRedactedRecordedValue, fr as DBPROXY_TAG_OPTIONS, go as WARM_THROUGHPUT_MEMBERS, gr as tagMapAsList, gs as snapshotPassProvenance, hi as outputReferenceProvenanceOf, hr as refuseMalformedDesiredTags, hs as recordReferenceProvenanceEntry, ir as earliestDefined, kl as derivePartitionAndUrlSuffix, ko as requireConfigObject, kr as getCurrentResourceSecrets, ks as physicalNameCopiesOf, l as listNestedTemplateRows, ln as getCurrentProducerRegions, lr as isRefusedByName, mn as redactedDeleteAddressSkip, mr as readTagList, ms as markSameGenerationBag, ns as hasMaskableValues, nt as getPriorAttempts, or as reserveStackCreateToken, pi as isSettledInstanceState, pn as redactedDeleteAddressFields, pr as planTagDiff, q as resolveDynamoDbDeleteBudgetMs, qr as isTerminationProtectionPropagationError, qt as getStackRecords, ro as withheldAccountClause, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, so as withoutSilentDropProperties, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, ur as markDeleteStarted, vc as stringifyValue, vi as s3BucketArn, vo as isWarmThroughputDecrease, vr as definedAttributes, wo as configIntegerRefusal, x as isAccessDeniedError, xi as s3BucketRegionalDomainName, xo as coerceCfnBoolean, yi as s3BucketDomainName, yo as toCfnInteger, yr as stringifyIfAssigned, zl as describeFileReadFailure } from "./deploy-engine-CZaafy9R.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-De0ZPOAF.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CYtSW-WU.js";
-import { RDSProvider } from "./rds-provider-Dadp11aB.js";
-import { NeptuneProvider } from "./neptune-provider-DTUriVz3.js";
-import { ASGProvider } from "./asg-provider-Di3xOH3L.js";
+import { $ as markRefusedBeforeApplying, Ao as requireConfigArray, B as compensateRemovedDeletionProtection, Ci as s3BucketRegionalDomainName, Co as coerceCfnBoolean, Cs as withoutPhysicalNameCopies, Da as refuseMalformedNestedChildOutputs, Do as configStringRefusal, Dr as waitForLambdaFunctionActive, Ec as rewriteTemplateAssetReferences, Eo as configIntegerRefusal, G as INDEX_SETTLE_POLL_INTERVAL_MS, Gi as passedParameterClassesOf, Gl as resolveAssemblyPath, Gr as isWaitAbandonedError, Gt as awaitInFlightSibling, H as resolveDynamoDbDeleteBudgetClock, Hi as parseWebACLArn, Hl as describeFileReadFailure, Hn as secretNamedAttributeNamesOf, Ht as withNestedStackContext, Io as withRetry, Is as carriesSecretMask, J as ECR_AUTO_DELETE_IMAGES_TAG, Jr as ec2InstanceProtectionSite, K as deleteTableWithIndexBusyRetry, Kr as markWaitAbandoned, L as DynamoDBGlobalTableProvider, Lo as canonicalLambdaFunctionName, Lr as slowCcOperationTimeoutMs, Lt as revertNestedChildFromJournal, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mo as requireConfigString, Ms as physicalNameCopiesOf, Ns as recordAttributeIdCopy, Ol as decodeListingKey, Oo as readConfigString, Pt as getNestedRevertRun, Q as getPriorAttempts, Qi as accountArgs, Qr as reEnableInstanceApiTermination, R as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ro as lambdaFunctionNameForMask, Rr as unchangedBehindSecretReference, Si as s3BucketDualStackDomainName, So as toFiniteNumber, To as configBooleanRefusal, Ts as dynamicReferenceTokens, U as resolveDynamoDbDeleteBudgetMs, Ul as displayAssemblyPath, Ur as deleteSkipReason, V as deleteBudgetKey, Vt as getCurrentNestedStackContext, W as DELETE_INDEX_WAIT_PROCEED_NOTE, Wl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, X as hasCdkAutoDeleteTag, Xr as observeThenDisableInstanceApiTermination, Xt as replacedDeleteFailureVerdict, Y as S3_AUTO_DELETE_OBJECTS_TAG, Yr as isTerminationProtectionPropagationError, Z as isTruthyCfnBoolean, Zo as passedNoEchoParametersOf, Zr as reDisableInstanceApiTermination, _i as outputReferenceProvenanceOf, _r as refuseMalformedDesiredTags, _s as markSameGenerationBag, a as findNestedTemplateTreeDefect, ao as withheldAccountClause, as as hasMaskableValues, b as lookupEachName, bi as s3BucketArn, bo as isWarmThroughputDecrease, br as definedAttributes, bs as redactSecretsForState, c as renderNestedTemplateTreeDefect, cr as reserveStackCreateToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as isRefusedByName, fn as isRedactedRecordedValue, fr as markDeleteStarted, gr as readTagList, hi as isSettledInstanceState, hr as planTagDiff, jl as canonicalizeRegion, jo as requireConfigObject, jr as getCurrentResourceSecrets, js as recoverMaskedOutput, ko as replayWarn, ln as getCurrentProducerRegions, lo as withoutSilentDropProperties, mn as redactedDeleteAddressSkip, mr as DBPROXY_TAG_OPTIONS, o as isAbsoluteAssetPath, or as earliestDefined, pn as redactedDeleteAddressFields, pr as DBPROXY_TAGS_WHAT, q as waitForIndexesSettled, qa as refuseMalformedResourcesForDestroy, qt as getStackRecords, s as listNestedTemplateRows, so as findSilentDropProperties, t as DeployEngine, ur as acquireIdempotencyToken, v as chunks, vo as WARM_THROUGHPUT_MEMBERS, vr as tagMapAsList, vs as recordReferenceProvenanceEntry, wi as s3BucketWebsiteUrl, wo as coerceCfnInteger, x as withApiLimit, xc as stringifyValue, xi as s3BucketDomainName, xo as toCfnInteger, xr as stringifyIfAssigned, y as isAccessDeniedError, yo as coerceWarmThroughput$1, yr as tagPlanWarning, ys as snapshotPassProvenance, z as beginDeleteWait, zo as sameLambdaFunctionAddress } from "./deploy-engine-BIPU9Xdh.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C58oW5zG.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DYfZCsxM.js";
+import { RDSProvider } from "./rds-provider-DI_O0_iG.js";
+import { NeptuneProvider } from "./neptune-provider-DoKgbZCz.js";
+import { ASGProvider } from "./asg-provider--GY-B-zI.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -5707,10 +5707,7 @@ const SQS_ATTRIBUTE_REMOVAL_RESET = {
 	DelaySeconds: "0",
 	ReceiveMessageWaitTimeSeconds: "0",
 	KmsDataKeyReusePeriodSeconds: "300",
-	ContentBasedDeduplication: "false",
-	SqsManagedSseEnabled: "true",
-	DeduplicationScope: "queue",
-	FifoThroughputLimit: "perQueue"
+	ContentBasedDeduplication: "false"
 };
 const CDK_TO_SQS_ATTRIBUTES = {
 	VisibilityTimeout: "VisibilityTimeout",
@@ -5824,13 +5821,7 @@ var SQSQueueProvider = class {
 					if (cdkKey === "RedrivePolicy" && typeof value === "object") attributes[sqsKey] = serializeRedrivePolicy(value);
 					else if (cdkKey === "RedriveAllowPolicy") attributes[sqsKey] = serializeRedriveAllowPolicy(value);
 					else attributes[sqsKey] = stringifyValue(value);
-				} else if (previousProperties[cdkKey] !== void 0 && cdkKey in SQS_ATTRIBUTE_REMOVAL_RESET) {
-					if (cdkKey === "SqsManagedSseEnabled") {
-						const desiredKmsKey = properties["KmsMasterKeyId"];
-						if (desiredKmsKey !== void 0 && desiredKmsKey !== "") continue;
-					}
-					attributes[sqsKey] = SQS_ATTRIBUTE_REMOVAL_RESET[cdkKey];
-				}
+				} else if (previousProperties[cdkKey] !== void 0 && cdkKey in SQS_ATTRIBUTE_REMOVAL_RESET) attributes[sqsKey] = SQS_ATTRIBUTE_REMOVAL_RESET[cdkKey];
 			}
 			if (Object.keys(attributes).length > 0) {
 				await this.sqsClient.send(new SetQueueAttributesCommand({
@@ -8875,7 +8866,7 @@ var LambdaUrlProvider = class {
 			FunctionName: physicalId,
 			...authType !== void 0 && { AuthType: authType }
 		};
-		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
+		const invokeMode = properties["InvokeMode"];
 		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
 		const newCorsRaw = properties["Cors"];
 		const prevCorsRaw = previousProperties["Cors"];
@@ -14377,7 +14368,6 @@ var SecretsManagerSecretProvider = class {
 		"ReplicaRegions",
 		"Type"
 	])]]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::SecretsManager::Secret", /* @__PURE__ */ new Map([["Description", ""]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.smClient = awsClients.secretsManager;
@@ -14422,7 +14412,6 @@ var SecretsManagerSecretProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const log = this.operationSinks(context?.maskSecrets, [
 			[properties["Name"], properties["Name"]],
 			[properties["Name"], physicalId],
@@ -14447,7 +14436,7 @@ var SecretsManagerSecretProvider = class {
 			if (description !== void 0) updateParams.Description = description;
 			const newKmsKeyId = properties["KmsKeyId"];
 			const prevKmsKeyId = previousProperties["KmsKeyId"];
-			const kmsKeyId = clearOnUpdateRemoval(newKmsKeyId === "" ? void 0 : newKmsKeyId, prevKmsKeyId === "" ? void 0 : prevKmsKeyId, "");
+			const kmsKeyId = newKmsKeyId === void 0 ? void 0 : newKmsKeyId === "" ? prevKmsKeyId !== void 0 && prevKmsKeyId !== "" ? "" : void 0 : newKmsKeyId;
 			if (kmsKeyId !== void 0) updateParams.KmsKeyId = kmsKeyId;
 			if (properties["Type"]) updateParams.Type = properties["Type"];
 			await this.smClient.send(new UpdateSecretCommand(updateParams));
@@ -20758,9 +20747,9 @@ var ApiGatewayV2Provider = class {
 		const log = resourceType === "AWS::ApiGatewayV2::Stage" ? stageSinks(this.logger, context, [[properties["StageName"], physicalId], [previousProperties["StageName"], physicalId]]) : createMaskedLogSinks(this.logger, context?.maskSecrets);
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
 			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
 		}
@@ -21366,49 +21355,34 @@ var ApiGatewayV2Provider = class {
 			input.Name = properties["Name"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Description"], previousProperties["Description"], "");
-			if (r.changed) {
-				input.Description = r.value;
-				changed = true;
-			}
+		if (properties["Description"] !== void 0 && properties["Description"] !== previousProperties["Description"]) {
+			input.Description = properties["Description"];
+			changed = true;
 		}
 		if (properties["CorsConfiguration"] !== void 0 && !this.deepEqual(properties["CorsConfiguration"], previousProperties["CorsConfiguration"])) {
 			input.CorsConfiguration = properties["CorsConfiguration"];
 			changed = true;
 		}
 		const corsRemoved = properties["CorsConfiguration"] === void 0 && previousProperties["CorsConfiguration"] !== void 0;
-		{
-			const r = this.clearableUpdate(properties["DisableExecuteApiEndpoint"], previousProperties["DisableExecuteApiEndpoint"], false);
-			if (r.changed) {
-				input.DisableExecuteApiEndpoint = r.value;
-				changed = true;
-			}
+		if (properties["DisableExecuteApiEndpoint"] !== void 0 && properties["DisableExecuteApiEndpoint"] !== previousProperties["DisableExecuteApiEndpoint"]) {
+			input.DisableExecuteApiEndpoint = properties["DisableExecuteApiEndpoint"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Version"], previousProperties["Version"], "");
-			if (r.changed) {
-				input.Version = r.value;
-				changed = true;
-			}
+		if (properties["Version"] !== void 0 && properties["Version"] !== previousProperties["Version"]) {
+			input.Version = properties["Version"];
+			changed = true;
 		}
 		if (properties["RouteSelectionExpression"] !== void 0 && properties["RouteSelectionExpression"] !== previousProperties["RouteSelectionExpression"]) {
 			input.RouteSelectionExpression = properties["RouteSelectionExpression"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["ApiKeySelectionExpression"], previousProperties["ApiKeySelectionExpression"], "$request.header.x-api-key");
-			if (r.changed) {
-				input.ApiKeySelectionExpression = r.value;
-				changed = true;
-			}
+		if (properties["ApiKeySelectionExpression"] !== void 0 && properties["ApiKeySelectionExpression"] !== previousProperties["ApiKeySelectionExpression"]) {
+			input.ApiKeySelectionExpression = properties["ApiKeySelectionExpression"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["IpAddressType"], previousProperties["IpAddressType"], "ipv4");
-			if (r.changed) {
-				input.IpAddressType = r.value;
-				changed = true;
-			}
+		if (properties["IpAddressType"] !== void 0 && properties["IpAddressType"] !== previousProperties["IpAddressType"]) {
+			input.IpAddressType = properties["IpAddressType"];
+			changed = true;
 		}
 		if (!changed && !corsRemoved) {
 			log.debug(`No mutable Api fields changed for ${logicalId}; skipping UpdateApi`);
@@ -21447,7 +21421,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Api ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Stage ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Stage; re-deploy with cdkd deploy --replace");
@@ -21474,12 +21448,15 @@ var ApiGatewayV2Provider = class {
 			input.Description = properties["Description"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["StageVariables"], previousProperties["StageVariables"]);
 			if (merged !== void 0) {
 				input.StageVariables = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["StageVariables"], previousProperties["StageVariables"])) {
+			input.StageVariables = properties["StageVariables"];
+			changed = true;
 		}
 		if (properties["DefaultRouteSettings"] !== void 0 && !this.deepEqual(properties["DefaultRouteSettings"], previousProperties["DefaultRouteSettings"])) {
 			input.DefaultRouteSettings = properties["DefaultRouteSettings"];
@@ -21495,12 +21472,9 @@ var ApiGatewayV2Provider = class {
 			changed = true;
 		}
 		const droppedRouteSettingKeys = this.droppedKeys(properties["RouteSettings"], previousProperties["RouteSettings"]);
-		{
-			const r = this.clearableUpdate(properties["ClientCertificateId"], previousProperties["ClientCertificateId"], "");
-			if (r.changed) {
-				input.ClientCertificateId = r.value;
-				changed = true;
-			}
+		if (properties["ClientCertificateId"] !== void 0 && properties["ClientCertificateId"] !== previousProperties["ClientCertificateId"]) {
+			input.ClientCertificateId = properties["ClientCertificateId"];
+			changed = true;
 		}
 		if (properties["DeploymentId"] !== void 0 && properties["DeploymentId"] !== previousProperties["DeploymentId"]) {
 			input.DeploymentId = properties["DeploymentId"];
@@ -21538,7 +21512,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -21567,19 +21541,19 @@ var ApiGatewayV2Provider = class {
 			input.TimeoutInMillis = properties["TimeoutInMillis"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestParameters"], previousProperties["RequestParameters"]);
 			if (merged !== void 0) {
 				input.RequestParameters = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+			input.RequestParameters = properties["RequestParameters"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Description"], previousProperties["Description"], "");
-			if (r.changed) {
-				input.Description = r.value;
-				changed = true;
-			}
+		if (properties["Description"] !== void 0 && properties["Description"] !== previousProperties["Description"]) {
+			input.Description = properties["Description"];
+			changed = true;
 		}
 		if (properties["ConnectionId"] != null && properties["ConnectionId"] !== previousProperties["ConnectionId"]) {
 			input.ConnectionId = properties["ConnectionId"];
@@ -21645,7 +21619,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Integration ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Route ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Route; re-deploy with cdkd deploy --replace");
@@ -21662,19 +21636,13 @@ var ApiGatewayV2Provider = class {
 			input.Target = properties["Target"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizationType"], previousProperties["AuthorizationType"], "NONE");
-			if (r.changed) {
-				input.AuthorizationType = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizationType"] !== void 0 && properties["AuthorizationType"] !== previousProperties["AuthorizationType"]) {
+			input.AuthorizationType = properties["AuthorizationType"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerId"], previousProperties["AuthorizerId"], "");
-			if (r.changed) {
-				input.AuthorizerId = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerId"] !== void 0 && properties["AuthorizerId"] !== previousProperties["AuthorizerId"]) {
+			input.AuthorizerId = properties["AuthorizerId"];
+			changed = true;
 		}
 		{
 			const r = this.clearableUpdate(properties["AuthorizationScopes"], previousProperties["AuthorizationScopes"], []);
@@ -21683,12 +21651,9 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
-		{
-			const r = this.clearableUpdate(properties["OperationName"], previousProperties["OperationName"], "");
-			if (r.changed) {
-				input.OperationName = r.value;
-				changed = true;
-			}
+		if (properties["OperationName"] !== void 0 && properties["OperationName"] !== previousProperties["OperationName"]) {
+			input.OperationName = properties["OperationName"];
+			changed = true;
 		}
 		{
 			const r = this.clearableUpdate(properties["ApiKeyRequired"], previousProperties["ApiKeyRequired"], false);
@@ -21697,18 +21662,21 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestModels"], previousProperties["RequestModels"]);
 			if (merged !== void 0) {
 				input.RequestModels = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["RequestModels"], previousProperties["RequestModels"])) {
+			input.RequestModels = properties["RequestModels"];
+			changed = true;
 		}
-		if (properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+		if (restoreFromAws ? properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"]) : this.mapEntryAddedOrChanged(properties["RequestParameters"], previousProperties["RequestParameters"])) {
 			input.RequestParameters = properties["RequestParameters"];
 			changed = true;
 		}
-		const droppedRequestParameterKeys = this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]);
+		const droppedRequestParameterKeys = restoreFromAws ? this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]) : [];
 		if (properties["ModelSelectionExpression"] !== void 0 && properties["ModelSelectionExpression"] !== previousProperties["ModelSelectionExpression"]) {
 			input.ModelSelectionExpression = properties["ModelSelectionExpression"];
 			changed = true;
@@ -21782,37 +21750,25 @@ var ApiGatewayV2Provider = class {
 			input.AuthorizerUri = properties["AuthorizerUri"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerCredentialsArn"], previousProperties["AuthorizerCredentialsArn"], "");
-			if (r.changed) {
-				input.AuthorizerCredentialsArn = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerCredentialsArn"] !== void 0 && properties["AuthorizerCredentialsArn"] !== previousProperties["AuthorizerCredentialsArn"]) {
+			input.AuthorizerCredentialsArn = properties["AuthorizerCredentialsArn"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerPayloadFormatVersion"], previousProperties["AuthorizerPayloadFormatVersion"], "");
-			if (r.changed) {
-				input.AuthorizerPayloadFormatVersion = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerPayloadFormatVersion"] !== void 0 && properties["AuthorizerPayloadFormatVersion"] !== previousProperties["AuthorizerPayloadFormatVersion"]) {
+			input.AuthorizerPayloadFormatVersion = properties["AuthorizerPayloadFormatVersion"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerResultTtlInSeconds"], previousProperties["AuthorizerResultTtlInSeconds"], 0);
-			if (r.changed) {
-				input.AuthorizerResultTtlInSeconds = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerResultTtlInSeconds"] !== void 0 && properties["AuthorizerResultTtlInSeconds"] !== previousProperties["AuthorizerResultTtlInSeconds"]) {
+			input.AuthorizerResultTtlInSeconds = properties["AuthorizerResultTtlInSeconds"];
+			changed = true;
 		}
 		if (properties["EnableSimpleResponses"] !== void 0 && properties["EnableSimpleResponses"] !== previousProperties["EnableSimpleResponses"]) {
 			input.EnableSimpleResponses = properties["EnableSimpleResponses"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["IdentityValidationExpression"], previousProperties["IdentityValidationExpression"], "");
-			if (r.changed) {
-				input.IdentityValidationExpression = r.value;
-				changed = true;
-			}
+		if (properties["IdentityValidationExpression"] !== void 0 && properties["IdentityValidationExpression"] !== previousProperties["IdentityValidationExpression"]) {
+			input.IdentityValidationExpression = properties["IdentityValidationExpression"];
+			changed = true;
 		}
 		if (!changed) {
 			log.debug(`No mutable Authorizer fields changed for ${logicalId}; skipping UpdateAuthorizer`);
@@ -21880,6 +21836,11 @@ var ApiGatewayV2Provider = class {
 		for (const key of Object.keys(prevMap)) if (!Object.hasOwn(nextMap, key)) merged[key] = "";
 		return merged;
 	}
+	mapEntryAddedOrChanged(next, previous) {
+		if (next == null || typeof next !== "object" || Array.isArray(next)) return false;
+		const prevMap = previous != null && typeof previous === "object" && !Array.isArray(previous) ? previous : {};
+		return Object.entries(next).some(([key, value]) => !Object.prototype.hasOwnProperty.call(prevMap, key) || !this.deepEqual(value, prevMap[key]));
+	}
 	warnTlsConfigIgnoredIfPublic(logicalId, properties, log) {
 		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") log.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS.`);
 	}
@@ -27819,7 +27780,6 @@ var DocDBProvider = class {
 	logger = getLogger().child("DocDBProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Map([["DeletionProtection", false]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
 		"DBClusterIdentifier",
 		"EngineVersion",
@@ -27869,8 +27829,7 @@ var DocDBProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
 		switch (resourceType) {
 			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -27937,7 +27896,7 @@ var DocDBProvider = class {
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
 				DeletionProtection: properties["DeletionProtection"],
-				BackupRetentionPeriod: clearOnUpdateRemoval(properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0, previousProperties["BackupRetentionPeriod"] != null ? Number(previousProperties["BackupRetentionPeriod"]) : void 0, 1),
+				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
 				PreferredBackupWindow: properties["PreferredBackupWindow"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
@@ -30969,7 +30928,6 @@ var ElastiCacheProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ElastiCacheProvider");
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["AutoMinorVersionUpgrade", true]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
 		"CacheSubnetGroupName",
 		"CacheSubnetGroupDescription",
@@ -31026,8 +30984,7 @@ var ElastiCacheProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
 		switch (resourceType) {
 			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -31174,7 +31131,6 @@ var ElastiCacheProvider = class {
 			const rawSgIds = properties["VpcSecurityGroupIds"];
 			const sgIds = rawSgIds && rawSgIds.length > 0 ? rawSgIds : void 0;
 			const notificationTopicArn = properties["NotificationTopicArn"];
-			const notificationRemoved = notificationTopicArn === void 0 && previousProperties["NotificationTopicArn"] != null;
 			await this.getClient().send(new ModifyCacheClusterCommand({
 				CacheClusterId: physicalId,
 				NumCacheNodes: properties["NumCacheNodes"] != null ? Number(properties["NumCacheNodes"]) : void 0,
@@ -31182,11 +31138,10 @@ var ElastiCacheProvider = class {
 				CacheParameterGroupName: properties["CacheParameterGroupName"],
 				EngineVersion: properties["EngineVersion"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
-				SnapshotRetentionLimit: clearOnUpdateRemoval(properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0, previousProperties["SnapshotRetentionLimit"] != null ? Number(previousProperties["SnapshotRetentionLimit"]) : void 0, 0),
+				SnapshotRetentionLimit: properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0,
 				SnapshotWindow: properties["SnapshotWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				NotificationTopicArn: notificationTopicArn,
-				...notificationRemoved && { NotificationTopicStatus: "inactive" },
 				...notificationTopicArn !== void 0 && { NotificationTopicStatus: "active" },
 				LogDeliveryConfigurations: this.buildLogDeliveryConfigurationsForUpdate(properties["LogDeliveryConfigurations"], previousProperties["LogDeliveryConfigurations"]),
 				IpDiscovery: properties["IpDiscovery"],
@@ -44382,30 +44337,6 @@ var DLMLifecyclePolicyProvider = class {
 			...properties["Exclusions"] != null && { Exclusions: properties["Exclusions"] }
 		};
 	}
-	buildRemovalResets(properties, previousProperties) {
-		const resets = {};
-		const createInterval = clearOnUpdateRemoval(properties["CreateInterval"] != null ? Number(properties["CreateInterval"]) : void 0, previousProperties["CreateInterval"] != null ? Number(previousProperties["CreateInterval"]) : void 0, 1);
-		if (createInterval !== void 0) resets.CreateInterval = createInterval;
-		const retainInterval = clearOnUpdateRemoval(properties["RetainInterval"] != null ? Number(properties["RetainInterval"]) : void 0, previousProperties["RetainInterval"] != null ? Number(previousProperties["RetainInterval"]) : void 0, 7);
-		if (retainInterval !== void 0) resets.RetainInterval = retainInterval;
-		const copyTags = clearOnUpdateRemoval(properties["CopyTags"] ?? void 0, previousProperties["CopyTags"] ?? void 0, false);
-		if (copyTags !== void 0) resets.CopyTags = copyTags;
-		const extendDeletion = clearOnUpdateRemoval(properties["ExtendDeletion"] ?? void 0, previousProperties["ExtendDeletion"] ?? void 0, false);
-		if (extendDeletion !== void 0) resets.ExtendDeletion = extendDeletion;
-		const crossRegionCopyTargets = clearOnUpdateRemoval(properties["CrossRegionCopyTargets"] ?? void 0, previousProperties["CrossRegionCopyTargets"] ?? void 0, []);
-		if (crossRegionCopyTargets !== void 0) resets.CrossRegionCopyTargets = crossRegionCopyTargets;
-		const defaultPolicy = properties["DefaultPolicy"] ?? previousProperties["DefaultPolicy"];
-		const exclusionsClear = defaultPolicy === "VOLUME" ? {
-			ExcludeBootVolumes: false,
-			ExcludeVolumeTypes: [],
-			ExcludeTags: []
-		} : defaultPolicy === "INSTANCE" ? { ExcludeTags: [] } : void 0;
-		if (exclusionsClear !== void 0) {
-			const exclusions = clearOnUpdateRemoval(properties["Exclusions"] ?? void 0, previousProperties["Exclusions"] ?? void 0, exclusionsClear);
-			if (exclusions !== void 0) resets.Exclusions = exclusions;
-		}
-		return resets;
-	}
 	async fetchPolicyArn(policyId) {
 		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
 	}
@@ -44459,7 +44390,8 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
 				PolicyId: physicalId,
 				...this.toSdkFields(properties),
-				...this.buildRemovalResets(properties, previousProperties)
+				...properties["CreateInterval"] != null && { CreateInterval: Number(properties["CreateInterval"]) },
+				...properties["RetainInterval"] != null && { RetainInterval: Number(properties["RetainInterval"]) }
 			}));
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
@@ -46090,6 +46022,7 @@ var NestedStackProvider = class {
 				physicalId,
 				attributes: childOutputs.attributes,
 				...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames },
+				secretNamedAttributeNames: childOutputs.secretNamedAttributeNames,
 				...pendingRecord && { effectiveProperties: pendingRecord }
 			};
 		} catch (error) {
@@ -46117,6 +46050,7 @@ var NestedStackProvider = class {
 			wasReplaced: false,
 			attributes: updatedOutputs.attributes,
 			...updatedOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: updatedOutputs.noEchoAttributeNames },
+			secretNamedAttributeNames: updatedOutputs.secretNamedAttributeNames,
 			...pendingRecord && { effectiveProperties: pendingRecord }
 		};
 	}
@@ -46300,9 +46234,11 @@ var NestedStackProvider = class {
 			attributes[attributeName] = recovered;
 			noEchoAttributeNames.push(attributeName);
 		}
+		const childResources = childStateData.state.resources;
 		return {
 			attributes,
-			noEchoAttributeNames
+			noEchoAttributeNames,
+			secretNamedAttributeNames: childResources !== null && typeof childResources === "object" ? secretNamedAttributeNamesOf(attributes, childResources, rowSecrets) : []
 		};
 	}
 	requireContext() {
@@ -46780,4 +46716,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-59TTNMFB.js.map
+//# sourceMappingURL=provider-classes-BSUoljqw.js.map