@go-to-k/cdkd 0.302.0 → 0.302.1

package/dist/{provider-classes-CXSiWJVn.js → provider-classes-B2_u4Fg0.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { C as generateResourceName, G as displayIdent, J as isPasteableIdent, K as displaySafe, T as generatedNameFor, X as plainIdentOr, Z as safeMsg, a as safeStringify, i as isAwsAuthoredFailure, j as recordedGeneratedNameKept, n as describeAwsFailure, q as displayStackName, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback, z as SECRET_REF_MAX_CODE_POINTS } from "./aws-failure-text-BDZdavf4.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dnk6FCsr.js";
+import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback } from "./aws-failure-text-e_ddrDDo.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-CmHNH1DY.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { Ar as markDeleteStarted, Bo as toCfnInteger, C as hasCdkAutoDeleteTag, Ci as s3BucketDomainName, Cs as redactForState, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Ei as s3BucketWebsiteUrl, Eo as findSilentDropProperties, Er as reserveStackCreateToken, Et as chunks, F as findNestedTemplateTreeDefect, Fn as replacedDeleteFailureVerdict, Fr as refuseMalformedDesiredTags, Go as configIntegerRefusal, Gr as waitForLambdaFunctionActive, Ho as coerceCfnBoolean, Hs as withoutPhysicalNameCopies, I as isAbsoluteAssetPath, Ir as tagMapAsList, Jo as replayWarn, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ka as refuseMalformedNestedChildOutputs, Kl as canonicalizeRegion, Ko as configStringRefusal, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Lo as WARM_THROUGHPUT_MEMBERS, Lr as tagPlanWarning, Mr as DBPROXY_TAG_OPTIONS, Nn as getStackRecords, Nr as planTagDiff, Oo as withoutSilentDropProperties, Or as acquireIdempotencyToken, Os as hasMaskableValues, Ot as lookupEachName, Pr as readTagList, Qs as recordAttributeIdCopy, R as renderNestedTemplateTreeDefect, Ro as coerceWarmThroughput$1, Rr as definedAttributes, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as s3BucketArn, Ss as markSameGenerationBag, T as getPriorAttempts, Ti as s3BucketRegionalDomainName, Ts as snapshotPassProvenance, Ul as decodeListingKey, Uo as coerceCfnInteger, Vo as toFiniteNumber, Wc as rewriteTemplateAssetReferences, Wo as configBooleanRefusal, Ws as dynamicReferenceTokens, Xo as requireConfigObject, Xs as recoverMaskedOutput, Xt as redactedDeleteAddressFields, Yo as requireConfigArray, Yr as getCurrentResourceSecrets, Yt as isRedactedRecordedValue, Zi as getAccountInfo, Zo as requireConfigString, Zs as physicalNameCopiesOf, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _a as accountArgs, au as renderAssemblyPathEscape, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ci as withIndeterminateGuard, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, f as deleteBudgetKey, fi as ec2InstanceProtectionSite, fo as refuseMalformedResourcesForDestroy, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reEnableInstanceApiTermination, gs as passedNoEchoParametersOf, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as reDisableInstanceApiTermination, ht as getCurrentNestedStackContext, is as sameLambdaFunctionAddress, iu as displayAssemblyPath, ji as outputReferenceProvenanceOf, jn as awaitInFlightSibling, jr as DBPROXY_TAGS_WHAT, kr as isRefusedByName, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as isWaitAbandonedError, m as resolveDynamoDbDeleteBudgetMs, mi as observeThenDisableInstanceApiTermination, ni as unchangedBehindSecretReference, ns as canonicalLambdaFunctionName, ou as resolveAssemblyPath, p as resolveDynamoDbDeleteBudgetClock, pi as isTerminationProtectionPropagationError, ql as derivePartitionAndUrlSuffix, qo as readConfigString, rs as lambdaFunctionNameForMask, ru as describeFileReadFailure, sa as parseWebACLArn, si as deleteSkipReason, t as DeployEngine, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, ts as withRetry, u as beginDeleteWait, ua as passedParameterClassesOf, ui as markWaitAbandoned, ur as secretNamedAttributeNamesOf, v as maskedLogger, w as isTruthyCfnBoolean, wi as s3BucketDualStackDomainName, wo as withheldAccountClause, wr as earliestDefined, ws as recordReferenceProvenanceEntry, x as ECR_AUTO_DELETE_IMAGES_TAG, xi as isSettledInstanceState, y as relayedIndexBusyDelete, zc as stringifyValue, zo as isWarmThroughputDecrease, zr as stringifyIfAssigned } from "./deploy-engine-DU0BoQqo.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-WGsb9RxZ.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BVLiidXb.js";
-import { RDSProvider } from "./rds-provider-6RgDTDCV.js";
-import { NeptuneProvider } from "./neptune-provider-WE1O3kXY.js";
-import { ASGProvider } from "./asg-provider-BRr_hsky.js";
+import { Ar as markDeleteStarted, Bo as toCfnInteger, C as hasCdkAutoDeleteTag, Ci as s3BucketDomainName, Cr as reserveStackCreateToken, Cs as redactForState, Dt as withApiLimit, E as markRefusedBeforeApplying, Ei as s3BucketWebsiteUrl, Eo as findSilentDropProperties, Et as lookupEachName, F as findNestedTemplateTreeDefect, Fr as refuseMalformedDesiredTags, Go as configIntegerRefusal, Gr as waitForLambdaFunctionActive, Ho as coerceCfnBoolean, Hs as withoutPhysicalNameCopies, I as isAbsoluteAssetPath, Ir as tagMapAsList, Jo as replayWarn, Jt as redactedDeleteAddressFields, Ka as refuseMalformedNestedChildOutputs, Kl as canonicalizeRegion, Ko as configStringRefusal, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, L as listNestedTemplateRows, Lo as WARM_THROUGHPUT_MEMBERS, Lr as tagPlanWarning, Mr as DBPROXY_TAG_OPTIONS, Nn as replacedDeleteFailureVerdict, Nr as planTagDiff, Oo as withoutSilentDropProperties, Os as hasMaskableValues, Pr as readTagList, Qs as recordAttributeIdCopy, R as renderNestedTemplateTreeDefect, Ro as coerceWarmThroughput$1, Rr as definedAttributes, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as s3BucketArn, Ss as markSameGenerationBag, T as getPriorAttempts, Ti as s3BucketRegionalDomainName, Tr as acquireIdempotencyToken, Ts as snapshotPassProvenance, Tt as isAccessDeniedError, Ul as decodeListingKey, Uo as coerceCfnInteger, Vo as toFiniteNumber, Wc as rewriteTemplateAssetReferences, Wo as configBooleanRefusal, Ws as dynamicReferenceTokens, Wt as getCurrentProducerRegions, Xo as requireConfigObject, Xs as recoverMaskedOutput, Yo as requireConfigArray, Yr as getCurrentResourceSecrets, Yt as redactedDeleteAddressSkip, Zi as getAccountInfo, Zo as requireConfigString, Zs as physicalNameCopiesOf, _ as deleteTableWithIndexBusyRetry, _a as accountArgs, au as renderAssemblyPathEscape, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ci as withIndeterminateGuard, cr as secretNamedAttributeNamesOf, d as compensateRemovedDeletionProtection, f as deleteBudgetKey, fi as ec2InstanceProtectionSite, fo as refuseMalformedResourcesForDestroy, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reEnableInstanceApiTermination, gs as passedNoEchoParametersOf, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as reDisableInstanceApiTermination, is as sameLambdaFunctionAddress, iu as displayAssemblyPath, ji as outputReferenceProvenanceOf, jn as getStackRecords, jr as DBPROXY_TAGS_WHAT, kn as awaitInFlightSibling, kr as isRefusedByName, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as isWaitAbandonedError, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mi as observeThenDisableInstanceApiTermination, mt as withNestedStackContext, ni as unchangedBehindSecretReference, ns as canonicalLambdaFunctionName, ot as getNestedRevertRun, ou as resolveAssemblyPath, p as resolveDynamoDbDeleteBudgetClock, pi as isTerminationProtectionPropagationError, pt as getCurrentNestedStackContext, ql as derivePartitionAndUrlSuffix, qo as readConfigString, qt as isRedactedRecordedValue, rs as lambdaFunctionNameForMask, ru as describeFileReadFailure, sa as parseWebACLArn, si as deleteSkipReason, t as DeployEngine, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, ts as withRetry, u as beginDeleteWait, ua as passedParameterClassesOf, ui as markWaitAbandoned, v as maskedLogger, w as isTruthyCfnBoolean, wi as s3BucketDualStackDomainName, wo as withheldAccountClause, ws as recordReferenceProvenanceEntry, wt as chunks, x as ECR_AUTO_DELETE_IMAGES_TAG, xi as isSettledInstanceState, xr as earliestDefined, y as relayedIndexBusyDelete, zc as stringifyValue, zo as isWarmThroughputDecrease, zr as stringifyIfAssigned } from "./deploy-engine-CYVt2NQR.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-R1GC6KcT.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CvRs5pV_.js";
+import { RDSProvider } from "./rds-provider-CmKbYAvr.js";
+import { NeptuneProvider } from "./neptune-provider-DzTl6-74.js";
+import { ASGProvider } from "./asg-provider-BpRcm_UB.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -17,7 +17,7 @@ import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCo
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
-import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
+import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
@@ -39,7 +39,7 @@ import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepository
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
 import * as zlib from "node:zlib";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
@@ -8609,13 +8609,7 @@ var LambdaPermissionProvider = class {
 		if (!action) throw new ProvisioningError(`Action is required for Lambda permission ${logicalId}`, resourceType, logicalId);
 		const principal = properties["Principal"];
 		if (!principal) throw new ProvisioningError(`Principal is required for Lambda permission ${logicalId}`, resourceType, logicalId);
-		let statementId = logicalId.replace(/[^a-zA-Z0-9_-]/g, "");
-		if (statementId.length > 100) {
-			let hashNum = 0;
-			for (let i = 0; i < logicalId.length; i++) hashNum = (hashNum << 5) - hashNum + logicalId.charCodeAt(i) | 0;
-			const hash = Math.abs(hashNum).toString(16).padStart(8, "0").substring(0, 8);
-			statementId = `${statementId.substring(0, 91)}-${hash}`;
-		}
+		const statementId = permissionStatementId(logicalId);
 		try {
 			const addParams = {
 				FunctionName: functionName,
@@ -8781,6 +8775,20 @@ var LambdaPermissionProvider = class {
 		return null;
 	}
 };
+function permissionStatementId(logicalId) {
+	if (getCurrentStackInstanceId() !== void 0 || isBeforeStateRead()) return generateResourceName(logicalId, {
+		maxLength: 100,
+		allowedPattern: /[^a-zA-Z0-9_-]/g
+	});
+	let statementId = logicalId.replace(/[^a-zA-Z0-9_-]/g, "");
+	if (statementId.length > 100) {
+		let hashNum = 0;
+		for (let i = 0; i < logicalId.length; i++) hashNum = (hashNum << 5) - hashNum + logicalId.charCodeAt(i) | 0;
+		const hash = Math.abs(hashNum).toString(16).padStart(8, "0").substring(0, 8);
+		statementId = `${statementId.substring(0, 91)}-${hash}`;
+	}
+	return statementId;
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-url-provider.ts
@@ -20355,53 +20363,24 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			}));
 			try {
 				const integration = properties["Integration"];
-				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand({
+				if (integration) await this.apiGatewayClient.send(new PutIntegrationCommand(putIntegrationInput({
 					restApiId,
 					resourceId,
-					httpMethod,
-					type: integration["Type"],
-					integrationHttpMethod: integration["IntegrationHttpMethod"],
-					uri: integration["Uri"],
-					connectionType: integration["ConnectionType"],
-					connectionId: integration["ConnectionId"],
-					credentials: integration["Credentials"],
-					requestParameters: integration["RequestParameters"],
-					requestTemplates: integration["RequestTemplates"],
-					passthroughBehavior: integration["PassthroughBehavior"],
-					contentHandling: integration["ContentHandling"],
-					timeoutInMillis: integration["TimeoutInMillis"],
-					cacheNamespace: integration["CacheNamespace"],
-					cacheKeyParameters: integration["CacheKeyParameters"],
-					tlsConfig: integration["TlsConfig"] ? { insecureSkipVerification: integration["TlsConfig"]["InsecureSkipVerification"] } : void 0,
-					responseTransferMode: integration["ResponseTransferMode"]
-				}));
+					httpMethod
+				}, integration)));
 				const methodResponses = properties["MethodResponses"];
-				if (methodResponses) for (const resp of methodResponses) {
-					const statusCode = String(resp["StatusCode"]);
-					await this.apiGatewayClient.send(new PutMethodResponseCommand({
-						restApiId,
-						resourceId,
-						httpMethod,
-						statusCode,
-						responseModels: resp["ResponseModels"],
-						responseParameters: resp["ResponseParameters"]
-					}));
-				}
+				if (methodResponses) for (const resp of methodResponses) await this.apiGatewayClient.send(new PutMethodResponseCommand(putMethodResponseInput({
+					restApiId,
+					resourceId,
+					httpMethod
+				}, resp)));
 				if (integration) {
 					const integrationResponses = integration["IntegrationResponses"];
-					if (integrationResponses) for (const ir of integrationResponses) {
-						const statusCode = String(ir["StatusCode"]);
-						await this.apiGatewayClient.send(new PutIntegrationResponseCommand({
-							restApiId,
-							resourceId,
-							httpMethod,
-							statusCode,
-							selectionPattern: ir["SelectionPattern"],
-							responseParameters: ir["ResponseParameters"],
-							responseTemplates: ir["ResponseTemplates"],
-							contentHandling: ir["ContentHandling"]
-						}));
-					}
+					if (integrationResponses) for (const ir of integrationResponses) await this.apiGatewayClient.send(new PutIntegrationResponseCommand(putIntegrationResponseInput({
+						restApiId,
+						resourceId,
+						httpMethod
+					}, ir)));
 				}
 			} catch (innerError) {
 				try {
@@ -20474,7 +20453,12 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			path: "/authorizationScopes",
 			value: (newScopes ?? []).join(",")
 		});
-		if (patchOperations.length === 0) {
+		const childCalls = methodChildCalls({
+			restApiId,
+			resourceId,
+			httpMethod
+		}, properties, previousProperties);
+		if (patchOperations.length === 0 && childCalls.length === 0) {
 			log.debug(`No changes detected for API Gateway Method ${logicalId}`);
 			return {
 				physicalId,
@@ -20482,13 +20466,18 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			};
 		}
 		try {
-			await this.apiGatewayClient.send(new UpdateMethodCommand({
+			if (patchOperations.length > 0) await this.apiGatewayClient.send(new UpdateMethodCommand({
 				restApiId,
 				resourceId,
 				httpMethod,
 				patchOperations
 			}));
-			log.debug(`Successfully updated API Gateway Method ${logicalId} (${patchOperations.length} patch ops)`);
+			for (const call of childCalls) try {
+				await this.apiGatewayClient.send(call.command);
+			} catch (error) {
+				if (!(call.kind === "delete" && error instanceof NotFoundException$1)) throw error;
+			}
+			log.debug(`Successfully updated API Gateway Method ${logicalId} (${patchOperations.length} patch ops, ${childCalls.length} sub-resource calls)`);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -20848,6 +20837,127 @@ function appendMapPatchOps(ops, basePath, next, prev) {
 		path: `${basePath}/${escape(key)}`
 	});
 }
+function putIntegrationInput(ids, integration) {
+	return {
+		...ids,
+		type: integration["Type"],
+		integrationHttpMethod: integration["IntegrationHttpMethod"],
+		uri: integration["Uri"],
+		connectionType: integration["ConnectionType"],
+		connectionId: integration["ConnectionId"],
+		credentials: integration["Credentials"],
+		requestParameters: integration["RequestParameters"],
+		requestTemplates: integration["RequestTemplates"],
+		passthroughBehavior: integration["PassthroughBehavior"],
+		contentHandling: integration["ContentHandling"],
+		timeoutInMillis: integration["TimeoutInMillis"],
+		cacheNamespace: integration["CacheNamespace"],
+		cacheKeyParameters: integration["CacheKeyParameters"],
+		tlsConfig: integration["TlsConfig"] ? { insecureSkipVerification: integration["TlsConfig"]["InsecureSkipVerification"] } : void 0,
+		responseTransferMode: integration["ResponseTransferMode"]
+	};
+}
+function putMethodResponseInput(ids, resp) {
+	return {
+		...ids,
+		statusCode: String(resp["StatusCode"]),
+		responseModels: resp["ResponseModels"],
+		responseParameters: resp["ResponseParameters"]
+	};
+}
+function putIntegrationResponseInput(ids, ir) {
+	return {
+		...ids,
+		statusCode: String(ir["StatusCode"]),
+		selectionPattern: ir["SelectionPattern"],
+		responseParameters: ir["ResponseParameters"],
+		responseTemplates: ir["ResponseTemplates"],
+		contentHandling: ir["ContentHandling"]
+	};
+}
+function isCfnMethodChildShape(props) {
+	const integration = integrationBlock(props["Integration"]);
+	if (integration !== void 0 && !("Type" in integration)) return false;
+	const responses = props["MethodResponses"];
+	return responses === void 0 || Array.isArray(responses);
+}
+function responsesByStatus(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const entry of value) if (entry !== null && typeof entry === "object" && !Array.isArray(entry)) {
+		const record = entry;
+		out.set(String(record["StatusCode"]), record);
+	}
+	return out;
+}
+function integrationBlock(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0 ? value : void 0;
+}
+function methodChildCalls(ids, desired, previous) {
+	if (!isCfnMethodChildShape(desired) || !isCfnMethodChildShape(previous)) return [];
+	const newInt = integrationBlock(desired["Integration"]);
+	const oldInt = integrationBlock(previous["Integration"]);
+	const newMr = responsesByStatus(desired["MethodResponses"]);
+	const oldMr = responsesByStatus(previous["MethodResponses"]);
+	const newIr = responsesByStatus(newInt?.["IntegrationResponses"]);
+	const oldIr = responsesByStatus(oldInt?.["IntegrationResponses"]);
+	const withoutResponses = (b) => {
+		if (b === void 0) return void 0;
+		const { IntegrationResponses: _dropped, ...rest } = b;
+		return rest;
+	};
+	const integrationChanged = !isDeepStrictEqual(withoutResponses(newInt), withoutResponses(oldInt));
+	const mrGoing = [...oldMr.keys()].filter((code) => !newMr.has(code) || !isDeepStrictEqual(newMr.get(code), oldMr.get(code)));
+	const mrComing = [...newMr.keys()].filter((code) => !oldMr.has(code) || !isDeepStrictEqual(newMr.get(code), oldMr.get(code)));
+	const calls = [];
+	const liveIr = new Map(oldInt === void 0 ? [] : oldIr);
+	if (oldInt !== void 0 && newInt === void 0) {
+		calls.push({
+			kind: "delete",
+			command: new DeleteIntegrationCommand(ids)
+		});
+		liveIr.clear();
+	} else if (oldInt !== void 0) {
+		for (const code of oldIr.keys()) if (!newIr.has(code) || mrGoing.includes(code)) {
+			calls.push({
+				kind: "delete",
+				command: new DeleteIntegrationResponseCommand({
+					...ids,
+					statusCode: code
+				})
+			});
+			liveIr.delete(code);
+		}
+	}
+	for (const code of mrGoing) calls.push({
+		kind: "delete",
+		command: new DeleteMethodResponseCommand({
+			...ids,
+			statusCode: code
+		})
+	});
+	for (const code of mrComing) calls.push({
+		kind: "put",
+		command: new PutMethodResponseCommand(putMethodResponseInput(ids, newMr.get(code)))
+	});
+	if (newInt !== void 0) {
+		if (integrationChanged) {
+			calls.push({
+				kind: "put",
+				command: new PutIntegrationCommand(putIntegrationInput(ids, newInt))
+			});
+			liveIr.clear();
+		}
+		for (const [code, ir] of newIr) {
+			if (liveIr.has(code) && isDeepStrictEqual(liveIr.get(code), ir)) continue;
+			calls.push({
+				kind: "put",
+				command: new PutIntegrationResponseCommand(putIntegrationResponseInput(ids, ir))
+			});
+		}
+	}
+	return calls;
+}
 
 //#endregion
 //#region src/provisioning/providers/apigatewayv2-provider.ts
@@ -21272,7 +21382,7 @@ var ApiGatewayV2Provider = class {
 		const apiId = properties?.["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to delete Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		try {
-			await this.getClient().send(new DeleteIntegrationCommand({
+			await this.getClient().send(new DeleteIntegrationCommand$1({
 				ApiId: apiId,
 				IntegrationId: physicalId
 			}));
@@ -31871,7 +31981,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
-			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.changedProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -32206,11 +32316,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw thrown;
 		}
 	}
-	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets, changedProperties) {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const client = this.getClient();
-		const servicePlan = this.planServiceChange(properties, previousProperties);
+		const servicePlan = this.planServiceChange(properties, previousProperties, changedProperties);
 		const serviceChange = servicePlan?.change ?? {};
 		const newAttrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 		const oldAttrs = this.normalizeServiceAttributes(previousProperties["ServiceAttributes"]);
@@ -32296,8 +32406,9 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	planServiceChange(properties, previousProperties) {
-		const declaredDiffers = (key) => properties[key] !== void 0 && !sameAsRecorded(properties[key], previousProperties[key]);
+	planServiceChange(properties, previousProperties, changedProperties) {
+		const changed = (key) => changedProperties !== void 0 ? changedProperties.has(key) : !sameAsRecorded(properties[key], previousProperties[key]);
+		const declaredDiffers = (key) => properties[key] !== void 0 && changed(key);
 		const change = {};
 		if (properties["Description"] !== void 0) change.Description = properties["Description"];
 		const desiredRecords = properties["DnsConfig"]?.DnsRecords;
@@ -32308,7 +32419,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			change,
 			keepRemovedFromLive: false
 		};
-		if (desiredRecords !== void 0 && !sameAsRecorded(desiredRecords, previousRecords)) return {
+		if (desiredRecords !== void 0 && (changedProperties === void 0 || changedProperties.has("DnsConfig")) && !sameAsRecorded(desiredRecords, previousRecords)) return {
 			change,
 			keepRemovedFromLive: true
 		};
@@ -47299,4 +47410,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CXSiWJVn.js.map
+//# sourceMappingURL=provider-classes-B2_u4Fg0.js.map