@go-to-k/cdkd 0.302.2 → 0.302.3

package/dist/{provider-classes-CUKmyCQ8.js → provider-classes-CDtquwkU.js}

@@ -2,13 +2,13 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback } from "./aws-failure-text-e_ddrDDo.js";
 import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, kt as isAuxiliaryFailure, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-OtGPguLH.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-B_xWnZ4Q.js";
+import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-D9SDE-Pj.js";
 import { D as markSameGenerationBag, F as redactForState, H as recordReferenceProvenanceEntry, Jt as physicalNameCopiesOf, Tt as dynamicReferenceTokens, W as snapshotPassProvenance, Y as hasMaskableValues, Yt as recordAttributeIdCopy, m as passedNoEchoParametersOf, nn as carriesSecretMask, qt as recoverMaskedOutput, xt as withoutPhysicalNameCopies } from "./secret-redaction-BHWS-PZK.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-TdX7t0Ac.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DDJHp1K3.js";
-import { RDSProvider } from "./rds-provider-Bxh9YW5y.js";
-import { NeptuneProvider } from "./neptune-provider-CUoBJ6Ys.js";
-import { ASGProvider } from "./asg-provider-B5RKfCs2.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Q1sv3tF1.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DSbJoNKe.js";
+import { RDSProvider } from "./rds-provider-ByCpdpUq.js";
+import { NeptuneProvider } from "./neptune-provider-DjVgEWGf.js";
+import { ASGProvider } from "./asg-provider-DCrwgSCZ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -49,8 +49,8 @@ import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPo
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
@@ -59,11 +59,11 @@ import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as Ad
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
-import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$25 } from "@aws-sdk/client-s3vectors";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$26 } from "@aws-sdk/client-s3-control";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, S3TablesClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -117,7 +117,11 @@ var IAMPolicyProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMPolicyProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::Policy", /* @__PURE__ */ new Set([
 		"PolicyName",
@@ -516,7 +520,8 @@ var IAMPolicyProvider = class {
 			this.logger.debug(`Successfully deleted IAM policy ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(describeAwsFailure(error).detail)}`, resourceType, logicalId, physicalId, cause);
+			const opMask = createMaskedLogSinks(this.logger, context?.maskSecrets).mask;
+			const failure = this.wrapMaskedError((text) => mask(opMask(text)), error, (text) => new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
@@ -1213,7 +1218,11 @@ var IAMInstanceProfileProvider = class {
 	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMInstanceProfileProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::InstanceProfile", /* @__PURE__ */ new Set([
 		"InstanceProfileName",
@@ -1346,7 +1355,8 @@ var IAMInstanceProfileProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		log.debug(`Deleting IAM instance profile ${logicalId}: ${physicalId}`);
 		let stripped = false;
 		try {
 			let roles = [];
@@ -1356,7 +1366,7 @@ var IAMInstanceProfileProvider = class {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logGoneOnDelete(logicalId, physicalId, context);
+					this.logGoneOnDelete(logicalId, physicalId, context, log);
 					return;
 				}
 				throw error;
@@ -1367,27 +1377,28 @@ var IAMInstanceProfileProvider = class {
 					RoleName: roleName
 				}));
 				stripped = true;
-				this.logger.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
+				log.debug(`Removed role ${roleName} from instance profile ${physicalId}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
 			await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: physicalId }));
-			this.logger.debug(`Successfully deleted IAM instance profile ${logicalId}`);
+			log.debug(`Successfully deleted IAM instance profile ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
 				const clientRegion = await this.iamClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logGoneOnDelete(logicalId, physicalId, context);
+				this.logGoneOnDelete(logicalId, physicalId, context, log);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const { mask } = log;
+			const failure = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(mask(`Failed to delete IAM instance profile ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
-	logGoneOnDelete(logicalId, physicalId, context) {
+	logGoneOnDelete(logicalId, physicalId, context, log) {
 		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM instance profile ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
-		else this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+		else log.debug(`Instance profile ${log.value(physicalId)} does not exist, skipping deletion`);
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
 		if (resourceType !== INSTANCE_PROFILE_TYPE) return "unknown";
@@ -1825,7 +1836,11 @@ var IAMUserGroupProvider = class {
 	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMUserGroupProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::IAM::User", /* @__PURE__ */ new Set([
@@ -2086,7 +2101,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -2367,7 +2382,7 @@ var IAMUserGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -2651,7 +2666,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM UserToGroupAddition ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(describeAwsFailure(error).detail)}`, resourceType, logicalId, physicalId, cause);
+			const opMask = createMaskedLogSinks(this.logger, context?.maskSecrets).mask;
+			const failure = this.wrapMaskedError((text) => mask(opMask(text)), error, (text) => new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
@@ -24788,7 +24804,7 @@ var ECSProvider = class {
 		const serviceConnectConfigurationInput = JSON.stringify(previousProperties["ServiceConnectConfiguration"] ?? null) !== JSON.stringify(properties["ServiceConnectConfiguration"] ?? null) ? clearOnUpdateRemoval(this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]), previousProperties["ServiceConnectConfiguration"], { enabled: false }) : void 0;
 		const volumeConfigurationsInput = JSON.stringify(previousProperties["VolumeConfigurations"] ?? null) !== JSON.stringify(properties["VolumeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]), previousProperties["VolumeConfigurations"], []) : void 0;
 		const vpcLatticeConfigurationsInput = JSON.stringify(previousProperties["VpcLatticeConfigurations"] ?? null) !== JSON.stringify(properties["VpcLatticeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]), previousProperties["VpcLatticeConfigurations"], []) : void 0;
-		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) && properties["Monitoring"] != null ? this.convertMonitoringConfiguration(properties["Monitoring"]) : void 0;
+		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) ? clearOnUpdateRemoval(this.convertMonitoringConfiguration(properties["Monitoring"]), previousProperties["Monitoring"], { metricConfigurations: [] }) : void 0;
 		const forceNewDeploymentInput = this.resolveForceNewDeployment(properties, previousProperties, log);
 		const deploymentConfigurationInput = this.resolveDeploymentConfiguration(properties, previousProperties);
 		try {
@@ -37428,6 +37444,117 @@ function removableRecorded(kind, items) {
 		Subscribers: e["Subscribers"].filter((s) => !holdsSecretDerivedEntry(s["Address"]))
 	} : e);
 }
+function finiteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+function isoDate(value) {
+	let date;
+	if (typeof value === "number") date = new Date(value < 0xe8d4a51000 ? value * 1e3 : value);
+	else if (typeof value === "string" && /^\d+$/.test(value)) {
+		const n = Number(value);
+		date = new Date(n < 0xe8d4a51000 ? n * 1e3 : n);
+	} else if (typeof value === "string") date = new Date(value);
+	else if (value instanceof Date) date = value;
+	else return void 0;
+	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+}
+function canonicalSpend(spend) {
+	if (!isPlainRecord(spend)) return spend;
+	const amount = finiteNumber(spend["Amount"]);
+	return amount === void 0 || amount === spend["Amount"] ? spend : {
+		...spend,
+		Amount: amount
+	};
+}
+function canonicalizeBudgetDriftBag(side) {
+	let out = side;
+	const budget = side["Budget"];
+	if (isPlainRecord(budget)) {
+		let nextBudget = budget;
+		const set = (key, value) => {
+			if (value === nextBudget[key]) return;
+			if (nextBudget === budget) nextBudget = { ...budget };
+			nextBudget[key] = value;
+		};
+		set("BudgetLimit", canonicalSpend(budget["BudgetLimit"]));
+		const planned = budget["PlannedBudgetLimits"];
+		if (isPlainRecord(planned)) {
+			const entries = Object.entries(planned).map(([key, spend]) => [key, canonicalSpend(spend)]);
+			if (entries.some(([key, spend]) => spend !== planned[key])) set("PlannedBudgetLimits", Object.fromEntries(entries));
+		}
+		const period = budget["TimePeriod"];
+		if (isPlainRecord(period)) {
+			let nextPeriod = period;
+			for (const key of ["Start", "End"]) {
+				if (period[key] === void 0) continue;
+				const iso = isoDate(period[key]);
+				if (iso === void 0 || iso === period[key]) continue;
+				if (nextPeriod === period) nextPeriod = { ...period };
+				nextPeriod[key] = iso;
+			}
+			set("TimePeriod", nextPeriod);
+		}
+		if (nextBudget !== budget) out = {
+			...out,
+			Budget: nextBudget
+		};
+	}
+	const list = side["NotificationsWithSubscribers"];
+	if (Array.isArray(list)) {
+		let changed = false;
+		const nextList = list.map((entry) => {
+			if (!isPlainRecord(entry) || !isPlainRecord(entry["Notification"])) return entry;
+			const notification = entry["Notification"];
+			const threshold = finiteNumber(notification["Threshold"]);
+			const fillType = notification["ThresholdType"] == null;
+			const fixThreshold = threshold !== void 0 && threshold !== notification["Threshold"];
+			if (!fillType && !fixThreshold) return entry;
+			changed = true;
+			return {
+				...entry,
+				Notification: {
+					...notification,
+					...fixThreshold && { Threshold: threshold },
+					...fillType && { ThresholdType: "PERCENTAGE" }
+				}
+			};
+		});
+		if (changed) out = {
+			...out,
+			NotificationsWithSubscribers: nextList
+		};
+	}
+	return out;
+}
+function declaresLegacyFilterShape(properties) {
+	const budget = properties?.["Budget"];
+	if (!isPlainRecord(budget)) return false;
+	const legacy = budget["CostFilters"] != null || budget["CostTypes"] != null;
+	const current = budget["FilterExpression"] != null || budget["Metrics"] != null;
+	return legacy && !current;
+}
+function dropElapsedPlannedLimits(baseline, aws, nowMs) {
+	const budget = baseline["Budget"];
+	const awsBudget = aws["Budget"];
+	if (!isPlainRecord(budget) || !isPlainRecord(awsBudget)) return baseline;
+	const planned = budget["PlannedBudgetLimits"];
+	if (!isPlainRecord(planned)) return baseline;
+	const awsPlanned = isPlainRecord(awsBudget["PlannedBudgetLimits"]) ? awsBudget["PlannedBudgetLimits"] : {};
+	const elapsed = (key) => !Object.hasOwn(awsPlanned, key) && /^\d+$/.test(key) && Number(key) * 1e3 < nowMs;
+	const kept = Object.entries(planned).filter(([key]) => !elapsed(key));
+	if (kept.length === Object.keys(planned).length) return baseline;
+	return {
+		...baseline,
+		Budget: {
+			...budget,
+			PlannedBudgetLimits: Object.fromEntries(kept)
+		}
+	};
+}
 var BudgetsBudgetProvider = class {
 	client;
 	createClient;
@@ -37820,6 +37947,166 @@ var BudgetsBudgetProvider = class {
 			throw this.wrapMaskedError(maskerOrIdentity(void 0), error, (text) => new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::Budgets::Budget") return void 0;
+		const accountId = await this.resolveAccountId();
+		const client = this.getClient();
+		const describe = async () => {
+			try {
+				return (await client.send(new DescribeBudgetCommand({
+					AccountId: accountId,
+					BudgetName: physicalId,
+					ShowFilterExpression: !declaresLegacyFilterShape(properties)
+				}))).Budget;
+			} catch (error) {
+				if (error instanceof NotFoundException$5) return RESOURCE_NOT_FOUND;
+				throw error;
+			}
+		};
+		const budget = await describe();
+		if (budget === RESOURCE_NOT_FOUND || budget === void 0) return budget;
+		const notifications = await this.listNotifications(accountId, physicalId);
+		if (notifications === void 0 && await describe() === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+		const notificationsWithSubscribers = (await Promise.all((notifications ?? []).map(async (notification) => {
+			const subscribers = await this.listSubscribers(accountId, physicalId, notification);
+			return subscribers === void 0 ? void 0 : {
+				notification,
+				subscribers
+			};
+		}))).filter((e) => e !== void 0).map(({ notification, subscribers }) => ({
+			Notification: {
+				NotificationType: notification.NotificationType,
+				ComparisonOperator: notification.ComparisonOperator,
+				Threshold: notification.Threshold,
+				...notification.ThresholdType !== void 0 && notification.ThresholdType !== "PERCENTAGE" && { ThresholdType: notification.ThresholdType }
+			},
+			Subscribers: subscribers.map((s) => ({
+				SubscriptionType: s.SubscriptionType,
+				Address: s.Address
+			}))
+		}));
+		let tags;
+		try {
+			tags = await client.send(new ListTagsForResourceCommand$15({ ResourceARN: await this.budgetArn(accountId, physicalId) }));
+		} catch (error) {
+			if (error instanceof NotFoundException$5 && await describe() === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		return {
+			Budget: this.budgetFromSdk(budget),
+			NotificationsWithSubscribers: notificationsWithSubscribers,
+			ResourceTags: (tags.ResourceTags ?? []).map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		};
+	}
+	async listNotifications(accountId, budgetName) {
+		const out = [];
+		let token;
+		try {
+			do {
+				const page = await this.getClient().send(new DescribeNotificationsForBudgetCommand({
+					AccountId: accountId,
+					BudgetName: budgetName,
+					MaxResults: 100,
+					...token !== void 0 && { NextToken: token }
+				}));
+				out.push(...page.Notifications ?? []);
+				token = page.NextToken;
+			} while (token);
+		} catch (error) {
+			if (error instanceof NotFoundException$5) return void 0;
+			throw error;
+		}
+		return out;
+	}
+	async listSubscribers(accountId, budgetName, notification) {
+		const out = [];
+		let token;
+		try {
+			do {
+				const page = await this.getClient().send(new DescribeSubscribersForNotificationCommand({
+					AccountId: accountId,
+					BudgetName: budgetName,
+					Notification: {
+						NotificationType: notification.NotificationType,
+						ComparisonOperator: notification.ComparisonOperator,
+						Threshold: notification.Threshold,
+						...notification.ThresholdType !== void 0 && { ThresholdType: notification.ThresholdType }
+					},
+					MaxResults: 100,
+					...token !== void 0 && { NextToken: token }
+				}));
+				out.push(...page.Subscribers ?? []);
+				token = page.NextToken;
+			} while (token);
+		} catch (error) {
+			if (error instanceof NotFoundException$5) return void 0;
+			throw error;
+		}
+		return out;
+	}
+	budgetFromSdk(budget) {
+		const raw = budget;
+		const spend = (s) => s === void 0 ? void 0 : {
+			Amount: finiteNumber(s.Amount) ?? s.Amount,
+			Unit: s.Unit
+		};
+		const out = {
+			BudgetName: budget.BudgetName,
+			BudgetType: raw["BudgetType"],
+			TimeUnit: budget.TimeUnit
+		};
+		if (budget.BudgetLimit) out["BudgetLimit"] = spend(budget.BudgetLimit);
+		if (budget.PlannedBudgetLimits && Object.keys(budget.PlannedBudgetLimits).length > 0) out["PlannedBudgetLimits"] = Object.fromEntries(Object.entries(budget.PlannedBudgetLimits).map(([key, s]) => [key, spend(s)]));
+		if (budget.TimePeriod) out["TimePeriod"] = {
+			...budget.TimePeriod.Start && { Start: isoDate(budget.TimePeriod.Start) },
+			...budget.TimePeriod.End && { End: isoDate(budget.TimePeriod.End) }
+		};
+		if (budget.CostFilters && Object.keys(budget.CostFilters).length > 0) out["CostFilters"] = budget.CostFilters;
+		if (budget.CostTypes) out["CostTypes"] = { ...budget.CostTypes };
+		const autoAdjust = raw["AutoAdjustData"];
+		if (isPlainRecord(autoAdjust)) {
+			const historical = autoAdjust["HistoricalOptions"];
+			out["AutoAdjustData"] = {
+				AutoAdjustType: autoAdjust["AutoAdjustType"],
+				...isPlainRecord(historical) && { HistoricalOptions: { BudgetAdjustmentPeriod: historical["BudgetAdjustmentPeriod"] } }
+			};
+		}
+		if (raw["FilterExpression"] !== void 0) out["FilterExpression"] = raw["FilterExpression"];
+		if (Array.isArray(raw["Metrics"]) && raw["Metrics"].length > 0) out["Metrics"] = raw["Metrics"];
+		if (raw["BillingViewArn"] !== void 0) out["BillingViewArn"] = raw["BillingViewArn"];
+		return out;
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::Budgets::Budget" ? ["NotificationsWithSubscribers"] : [];
+	}
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType !== "AWS::Budgets::Budget") return [];
+		const budget = properties?.["Budget"];
+		if (!isPlainRecord(budget)) return [];
+		const paths = [];
+		if (budget["AutoAdjustData"] != null || budget["PlannedBudgetLimits"] != null) paths.push("Budget.BudgetLimit");
+		if (budget["FilterExpression"] != null || budget["Metrics"] != null) {
+			if (budget["CostTypes"] != null) paths.push("Budget.CostTypes");
+			if (budget["CostFilters"] != null) paths.push("Budget.CostFilters");
+		}
+		return paths;
+	}
+	canonicalizeDriftProperties(resourceType, side) {
+		return resourceType === "AWS::Budgets::Budget" ? canonicalizeBudgetDriftBag(side) : side;
+	}
+	async canonicalizeDriftPair(resourceType, baseline, aws) {
+		if (resourceType !== "AWS::Budgets::Budget") return {
+			baseline,
+			aws
+		};
+		return {
+			baseline: dropElapsedPlannedLimits(baseline, aws, Date.now()),
+			aws
+		};
+	}
 	async import(input) {
 		const rawBudget = input.properties["Budget"] ?? {};
 		const explicit = input.knownPhysicalId ?? (typeof rawBudget["BudgetName"] === "string" && rawBudget["BudgetName"].length > 0 ? rawBudget["BudgetName"] : void 0);
@@ -38595,7 +38882,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
@@ -45097,7 +45384,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }));
 			tags = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return RESOURCE_NOT_FOUND;
@@ -45613,7 +45900,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${describeAwsFailure(err).detail}`);
@@ -45885,7 +46172,7 @@ var S3DirectoryBucketProvider = class {
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
-		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
+		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$19({
 			AccountId: accountId,
 			ResourceArn: resourceArn
 		}));
@@ -46540,7 +46827,7 @@ var S3TablesProvider = class {
 	}
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -47665,4 +47952,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CUKmyCQ8.js.map
+//# sourceMappingURL=provider-classes-CDtquwkU.js.map