@cdkd/cli 0.0.0-stage → 0.323.0

package/dist/neptune-provider-BqtKFZaE.js

@@ -0,0 +1,1470 @@
+import { $ as safeMsg, E as generatedNameFor, n as describeAwsFailure, s as getLogger } from "./aws-failure-text-DiHodi76.js";
+import { B as normalizeAwsTagsToCfn, F as assertRegionMatch, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Nn as ProvisioningError, Nr as wrapMaskedAwsError, P as markNotGone, Q as isTerminalDbWaitStatus, W as resolveExplicitPhysicalId, Y as deleteWithProtectionCompensation, Z as isProceedDbStatus, fn as ambientClientDefaults, g as clearOnUpdateRemoval, hr as relayedNameCollision, i as reportCreatedResource, j as withoutServerErrorRetries, jr as markNonRetryable, nt as protectionFlipKey, rt as rdsFamilyProtectionSite, tt as observeThenDisableProtection, y as removedTemplateKeys } from "./created-resource-sink-CmrPwGge.js";
+import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
+import { $i as stringifyIfAssigned, Dt as enclosingDeadlineRemainingMs, Na as isUsableAttemptedName, Qi as definedAttributes, Vr as refuseRestoreFromItself, Yi as refuseMalformedDesiredTags, Zi as tagPlanWarning, fc as configBooleanRefusal, qi as planTagDiff, uc as coerceCfnBoolean } from "./deploy-engine-dYZ0v6Kz.js";
+import { n as modifyDbInstanceWhenAvailable, t as isModifyNotAvailableRefusal } from "./db-instance-modify-retry-DCLA_p9I.js";
+import { DescribeSecurityGroupsCommand, EC2Client } from "@aws-sdk/client-ec2";
+import { isDeepStrictEqual } from "node:util";
+import { AddRoleToDBClusterCommand, AddTagsToResourceCommand, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBSubnetGroupCommand, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBSubnetGroupCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBSubnetGroupCommand, NeptuneClient, RemoveRoleFromDBClusterCommand, RemoveTagsFromResourceCommand, RestoreDBClusterFromSnapshotCommand, RestoreDBClusterToPointInTimeCommand } from "@aws-sdk/client-neptune";
+
+// src/provisioning/providers/neptune-provider.ts
+function clusterAttributes(cluster) {
+	return definedAttributes({
+		Endpoint: cluster?.Endpoint,
+		Port: stringifyIfAssigned(cluster?.Port),
+		ReadEndpoint: cluster?.ReaderEndpoint,
+		"Endpoint.Address": cluster?.Endpoint,
+		"Endpoint.Port": stringifyIfAssigned(cluster?.Port),
+		"ReadEndpoint.Address": cluster?.ReaderEndpoint,
+		ClusterResourceId: cluster?.DbClusterResourceId
+	});
+}
+function instanceAttributes(instance) {
+	return definedAttributes({
+		Endpoint: instance?.Endpoint?.Address,
+		Port: stringifyIfAssigned(instance?.Endpoint?.Port),
+		"Endpoint.Address": instance?.Endpoint?.Address,
+		"Endpoint.Port": stringifyIfAssigned(instance?.Endpoint?.Port),
+		Arn: instance?.DBInstanceArn
+	});
+}
+function isDbIdentifier(id) {
+	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
+}
+const CLUSTER_KEPT_ON_REMOVAL = [
+	"EngineVersion",
+	"PreferredBackupWindow",
+	"PreferredMaintenanceWindow",
+	"DBClusterParameterGroupName",
+	"DeletionProtection",
+	"IamAuthEnabled",
+	"BackupRetentionPeriod",
+	"DBPort",
+	"Port",
+	"CopyTagsToSnapshot"
+];
+const INSTANCE_KEPT_ON_REMOVAL = [
+	"DBParameterGroupName",
+	"PreferredMaintenanceWindow",
+	"AutoMinorVersionUpgrade"
+];
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clusterRoleKey(role) {
+	return `${role.RoleArn ?? ""}\n${role.FeatureName ?? ""}`;
+}
+function clusterRoleList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	const roles = /* @__PURE__ */ new Map();
+	for (const entry of value) {
+		if (!isPlainObject(entry)) return void 0;
+		const { RoleArn: roleArn, FeatureName: featureName } = entry;
+		if (typeof roleArn !== "string" || roleArn === "") return void 0;
+		if (featureName != null && typeof featureName !== "string") return void 0;
+		const role = {
+			RoleArn: roleArn,
+			...featureName ? { FeatureName: featureName } : {}
+		};
+		roles.set(clusterRoleKey(role), role);
+	}
+	return [...roles.values()];
+}
+function stringList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	return value.every((item) => typeof item === "string") ? value : void 0;
+}
+function logExportChange(desired, previous) {
+	const enable = desired.filter((type) => !previous.includes(type));
+	const disable = previous.filter((type) => !desired.includes(type));
+	if (enable.length === 0 && disable.length === 0) return void 0;
+	return {
+		...enable.length > 0 && { EnableLogTypes: enable },
+		...disable.length > 0 && { DisableLogTypes: disable }
+	};
+}
+function serverlessScalingToSend(value) {
+	if (value == null) return void 0;
+	if (!isPlainObject(value)) return null;
+	const min = cfnCapacity(value["MinCapacity"]);
+	const max = cfnCapacity(value["MaxCapacity"]);
+	if (min === void 0 || max === void 0) return null;
+	return {
+		MinCapacity: min,
+		MaxCapacity: max
+	};
+}
+function cfnCapacity(value) {
+	const capacity = typeof value === "number" || typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	return Number.isFinite(capacity) ? capacity : void 0;
+}
+function isMajorEngineChange(previous, desired) {
+	if (typeof previous !== "string" || typeof desired !== "string") return false;
+	const major = (version) => version.split(".").slice(0, 2).join(".");
+	return major(previous) !== major(desired);
+}
+function holdsPendingValue(value) {
+	if (value === void 0 || value === null) return false;
+	if (typeof value === "object") return Object.values(value).some(holdsPendingValue);
+	return true;
+}
+function isUnmovingDbStatus(status) {
+	return isProceedDbStatus(status) || status === "backing-up";
+}
+function isRoleCallNotAvailableRefusal(error) {
+	return error instanceof Error && error.name === "InvalidDBClusterStateFault" && /is not available for IAM role association, disassociation, or updates/i.test(error.message);
+}
+const SETTLE_MAX_WAIT_MS = 3e5;
+const ROLE_AVAILABLE_MAX_WAIT_MS = 18e5;
+const CLUSTER_AVAILABLE_MAX_WAIT_MS = 18e5;
+function isRestoringClusterRefusal(error) {
+	return error instanceof Error && error.name === "InvalidDBClusterStateFault" && /(?:isn't|is not|isn’t) available for modification with status/i.test(error.message);
+}
+const DEADLINE_MARGIN_MS = 3e4;
+const DEFAULT_CLUSTER_PORT = 8182;
+const DEFAULT_STORAGE_KEY = "alias/aws/rds";
+const DEFAULT_RESTORED_BACKUP_RETENTION = 1;
+function restoreWaitMs() {
+	const remaining = enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS;
+	return Number.isFinite(remaining) ? Math.max(CLUSTER_AVAILABLE_MAX_WAIT_MS, remaining) : CLUSTER_AVAILABLE_MAX_WAIT_MS;
+}
+const RESTORE_VALUE_REFUSALS = /* @__PURE__ */ new Set(["InvalidParameterValue", "InvalidParameterCombination"]);
+function readClusterRestore(properties, resourceType, logicalId) {
+	const refuse = (key, expected) => {
+		throw markNonRetryable(new ProvisioningError(safeMsg`Neptune DBCluster ${logicalId}: ${key} must be ${expected}; nothing was changed.`, resourceType, logicalId));
+	};
+	const identifier = (key) => {
+		const value = properties[key];
+		if (value == null) return void 0;
+		return typeof value === "string" ? value : refuse(key, "a string");
+	};
+	const snapshotIdentifier = identifier("SnapshotIdentifier") || void 0;
+	const sourceDBClusterIdentifier = identifier("SourceDBClusterIdentifier") || void 0;
+	if (sourceDBClusterIdentifier !== void 0) {
+		const declared = properties["RestoreToTime"];
+		const restoreToTime = declared == null ? void 0 : new Date(typeof declared !== "string" ? NaN : /(?:z|[+-]\d{2}:?\d{2})$/i.test(declared) ? declared : `${declared}Z`);
+		if (restoreToTime !== void 0 && Number.isNaN(restoreToTime.getTime())) return refuse("RestoreToTime", "a timestamp");
+		return {
+			kind: "point-in-time",
+			sourceDBClusterIdentifier,
+			restoreToTime
+		};
+	}
+	return snapshotIdentifier === void 0 ? void 0 : {
+		kind: "snapshot",
+		snapshotIdentifier
+	};
+}
+function ignoredRestoreKeys(restore) {
+	if (restore?.kind === "point-in-time") return ["SnapshotIdentifier", "AvailabilityZones"];
+	const pointInTimeKeys = [
+		"RestoreToTime",
+		"RestoreType",
+		"UseLatestRestorableTime"
+	];
+	return restore === void 0 ? [
+		"SnapshotIdentifier",
+		"SourceDBClusterIdentifier",
+		...pointInTimeKeys
+	] : ["SourceDBClusterIdentifier", ...pointInTimeKeys];
+}
+function declaresSnapshot(properties) {
+	return properties["SnapshotIdentifier"] != null && properties["SnapshotIdentifier"] !== "";
+}
+function isRestoredRecord(previous) {
+	return declaresSnapshot(previous) || previous["SourceDBClusterIdentifier"] != null && previous["SourceDBClusterIdentifier"] !== "";
+}
+function sentOnUpdate(properties, previous) {
+	return (key) => isRestoredRecord(previous) && isDeepStrictEqual(previous[key], properties[key]) ? void 0 : properties[key];
+}
+function restoreFollowUp(properties, restore, restoredEngineVersion) {
+	const nonEmpty = (members) => Object.keys(members).length > 0 ? members : void 0;
+	const declaredRetention = properties["BackupRetentionPeriod"];
+	const retention = declaredRetention != null ? Number(declaredRetention) : void 0;
+	const snapshotDeclared = declaresSnapshot(properties);
+	const pointInTime = restore.kind === "point-in-time";
+	const engineVersion = properties["EngineVersion"];
+	const engineChange = pointInTime && engineVersion != null && engineVersion !== restoredEngineVersion;
+	const majorUpgrade = engineChange && isMajorEngineChange(restoredEngineVersion, engineVersion);
+	return {
+		parity: nonEmpty({ ...snapshotDeclared && { BackupRetentionPeriod: retention ?? DEFAULT_RESTORED_BACKUP_RETENTION } }),
+		declared: [
+			nonEmpty({ ...!snapshotDeclared && retention !== void 0 && { BackupRetentionPeriod: retention } }),
+			nonEmpty({
+				...properties["PreferredBackupWindow"] != null && { PreferredBackupWindow: properties["PreferredBackupWindow"] },
+				...properties["PreferredMaintenanceWindow"] != null && { PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"] }
+			}),
+			nonEmpty({ ...pointInTime && properties["CopyTagsToSnapshot"] != null && { CopyTagsToSnapshot: properties["CopyTagsToSnapshot"] } }),
+			nonEmpty({
+				...pointInTime && properties["DBClusterParameterGroupName"] != null && { DBClusterParameterGroupName: properties["DBClusterParameterGroupName"] },
+				...engineChange && { EngineVersion: engineVersion },
+				...majorUpgrade && { AllowMajorVersionUpgrade: true },
+				...majorUpgrade && properties["DBInstanceParameterGroupName"] != null && { DBInstanceParameterGroupName: properties["DBInstanceParameterGroupName"] }
+			})
+		].filter((group) => group !== void 0)
+	};
+}
+const CLUSTER_MODIFY_KEYS = [
+	"EngineVersion",
+	"DeletionProtection",
+	"BackupRetentionPeriod",
+	"PreferredBackupWindow",
+	"PreferredMaintenanceWindow",
+	"DBClusterParameterGroupName",
+	"IamAuthEnabled",
+	"VpcSecurityGroupIds",
+	"DBPort",
+	"Port",
+	"CopyTagsToSnapshot",
+	"NetworkType",
+	"ServerlessScalingConfiguration",
+	"EnableCloudwatchLogsExports"
+];
+const INSTANCE_MODIFY_KEYS = [
+	"DBInstanceClass",
+	"DBParameterGroupName",
+	"PreferredMaintenanceWindow",
+	"AutoMinorVersionUpgrade",
+	"DeletionProtection",
+	"PubliclyAccessible"
+];
+function markChangedUnsettled(keys, properties, previousProperties, context) {
+	for (const key of keys) if (!isDeepStrictEqual(properties[key], previousProperties[key])) context?.markUnsettled?.(key);
+}
+const CLUSTER_UNMEASURED_ON_REMOVAL = ["NetworkType", "ServerlessScalingConfiguration"];
+var NeptuneProvider = class {
+	neptuneClient;
+	createClient;
+	ec2Client;
+	providerRegion;
+	logger = getLogger().child("NeptuneProvider");
+	protectionFlips = new ProtectionFlipRegistry();
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::Neptune::DBSubnetGroup", /* @__PURE__ */ new Set([
+			"DBSubnetGroupName",
+			"DBSubnetGroupDescription",
+			"SubnetIds",
+			"Tags"
+		])],
+		["AWS::Neptune::DBCluster", /* @__PURE__ */ new Set([
+			"DBClusterIdentifier",
+			"EngineVersion",
+			"DBPort",
+			"Port",
+			"VpcSecurityGroupIds",
+			"DBSubnetGroupName",
+			"StorageEncrypted",
+			"KmsKeyId",
+			"BackupRetentionPeriod",
+			"PreferredBackupWindow",
+			"PreferredMaintenanceWindow",
+			"DBClusterParameterGroupName",
+			"IamAuthEnabled",
+			"DeletionProtection",
+			"Tags",
+			"AssociatedRoles",
+			"AvailabilityZones",
+			"CopyTagsToSnapshot",
+			"DBInstanceParameterGroupName",
+			"EnableCloudwatchLogsExports",
+			"NetworkType",
+			"ServerlessScalingConfiguration",
+			"RestoreToTime",
+			"RestoreType",
+			"SnapshotIdentifier",
+			"SourceDBClusterIdentifier",
+			"UseLatestRestorableTime"
+		])],
+		["AWS::Neptune::DBInstance", /* @__PURE__ */ new Set([
+			"DBInstanceIdentifier",
+			"DBInstanceClass",
+			"DBClusterIdentifier",
+			"DBSubnetGroupName",
+			"DBParameterGroupName",
+			"AvailabilityZone",
+			"PreferredMaintenanceWindow",
+			"AutoMinorVersionUpgrade",
+			"DeletionProtection",
+			"Tags",
+			"AllowMajorVersionUpgrade",
+			"PubliclyAccessible"
+		])]
+	]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Neptune::DBCluster", /* @__PURE__ */ new Map([["GlobalClusterIdentifier", "Cloud Control owns a global-cluster member: NeptuneProvider has no detach, and a member cannot be deleted while attached (deletesThroughSdkProvider keeps its delete there too)"]])], ["AWS::Neptune::DBInstance", /* @__PURE__ */ new Map([["DBSnapshotIdentifier", "The CloudFormation schema documents it as not supported, and CreateDBInstance has no such member: a Neptune instance is not restored from a snapshot, its cluster is"]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::Neptune::DBCluster", /* @__PURE__ */ new Set([
+		"DBClusterIdentifier",
+		"DBSubnetGroupName",
+		"StorageEncrypted",
+		"KmsKeyId",
+		"AvailabilityZones",
+		"VpcSecurityGroupIds",
+		"Tags",
+		"AssociatedRoles",
+		"EnableCloudwatchLogsExports",
+		"DBInstanceParameterGroupName",
+		"RestoreToTime",
+		"RestoreType",
+		"SnapshotIdentifier",
+		"SourceDBClusterIdentifier",
+		"UseLatestRestorableTime",
+		...CLUSTER_KEPT_ON_REMOVAL,
+		...CLUSTER_UNMEASURED_ON_REMOVAL
+	])], ["AWS::Neptune::DBInstance", /* @__PURE__ */ new Set([
+		"DBInstanceIdentifier",
+		"DBClusterIdentifier",
+		"DBSubnetGroupName",
+		"AvailabilityZone",
+		"DBInstanceClass",
+		"DeletionProtection",
+		"Tags",
+		"AllowMajorVersionUpgrade",
+		"PubliclyAccessible",
+		...INSTANCE_KEPT_ON_REMOVAL
+	])]]);
+	constructor(options) {
+		this.providerRegion = options?.region ?? ambientRegion();
+	}
+	getClient() {
+		if (!this.neptuneClient) {
+			this.neptuneClient = new NeptuneClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new NeptuneClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
+		return this.neptuneClient;
+	}
+	getEc2Client() {
+		if (!this.ec2Client) this.ec2Client = new EC2Client({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
+		return this.ec2Client;
+	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		const mask = context?.maskSecrets;
+		switch (resourceType) {
+			case "AWS::Neptune::DBSubnetGroup": return this.createDBSubnetGroup(logicalId, resourceType, properties, mask);
+			case "AWS::Neptune::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			case "AWS::Neptune::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		switch (resourceType) {
+			case "AWS::Neptune::DBSubnetGroup": return this.updateDBSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::Neptune::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context);
+			case "AWS::Neptune::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		switch (resourceType) {
+			case "AWS::Neptune::DBSubnetGroup": return this.deleteDBSubnetGroup(logicalId, physicalId, resourceType, context);
+			case "AWS::Neptune::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, context);
+			case "AWS::Neptune::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, context);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
+		}
+	}
+	async createDBSubnetGroup(logicalId, resourceType, properties, mask) {
+		this.logger.debug(`Creating Neptune DBSubnetGroup ${logicalId}`);
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generatedNameFor("AWS::Neptune::DBSubnetGroup", logicalId);
+		try {
+			await this.getCreateClient().send(new CreateDBSubnetGroupCommand({
+				DBSubnetGroupName: dbSubnetGroupName,
+				DBSubnetGroupDescription: properties["DBSubnetGroupDescription"] || `Subnet group for ${logicalId}`,
+				SubnetIds: properties["SubnetIds"],
+				...tags.length > 0 && { Tags: tags }
+			}));
+			this.logger.debug(`Successfully created Neptune DBSubnetGroup ${logicalId}: ${dbSubnetGroupName}`);
+			return {
+				physicalId: dbSubnetGroupName,
+				attributes: { DBSubnetGroupName: dbSubnetGroupName }
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Neptune DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, dbSubnetGroupName, cause));
+		}
+	}
+	async updateDBSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+		this.logger.debug(`Updating Neptune DBSubnetGroup ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		try {
+			const subnetIds = properties["SubnetIds"];
+			const sendSubnetIds = subnetIds !== void 0 && subnetIds.length > 0;
+			const modifyInput = {
+				DBSubnetGroupName: physicalId,
+				DBSubnetGroupDescription: clearOnUpdateRemoval(properties["DBSubnetGroupDescription"], previousProperties["DBSubnetGroupDescription"], `Subnet group for ${logicalId}`),
+				...sendSubnetIds && { SubnetIds: subnetIds }
+			};
+			await this.getClient().send(new ModifyDBSubnetGroupCommand(modifyInput));
+			const arn = (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: physicalId }))).DBSubnetGroups?.[0]?.DBSubnetGroupArn;
+			if (arn) await this.applyTagDiff(arn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			this.logger.debug(`Successfully updated Neptune DBSubnetGroup ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { DBSubnetGroupName: physicalId }
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update Neptune DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async deleteDBSubnetGroup(logicalId, physicalId, resourceType, context) {
+		this.logger.debug(`Deleting Neptune DBSubnetGroup ${logicalId}: ${physicalId}`);
+		try {
+			await this.getClient().send(new DeleteDBSubnetGroupCommand({ DBSubnetGroupName: physicalId }));
+			this.logger.debug(`Successfully deleted Neptune DBSubnetGroup ${logicalId}`);
+		} catch (error) {
+			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Neptune DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Neptune DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async createDBCluster(logicalId, resourceType, properties, mask, replayingState) {
+		this.logger.debug(`Creating Neptune DBCluster ${logicalId}`);
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const { roles, logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, {
+			creating: true,
+			stateBorne: replayingState
+		});
+		const restore = readClusterRestore(properties, resourceType, logicalId);
+		this.warnIgnoredRestoreProperties(logicalId, resourceType, properties, restore);
+		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::Neptune::DBCluster", logicalId);
+		if (!String(properties["SourceDBClusterIdentifier"]).startsWith("arn:")) refuseRestoreFromItself(resourceType, properties, dbClusterIdentifier, logicalId, { region: this.providerRegion });
+		const port = properties["DBPort"] != null ? Number(properties["DBPort"]) : properties["Port"] != null ? Number(properties["Port"]) : void 0;
+		const kmsKeyId = properties["KmsKeyId"];
+		const sharedInput = {
+			DBClusterIdentifier: dbClusterIdentifier,
+			VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
+			DBSubnetGroupName: properties["DBSubnetGroupName"],
+			DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
+			EnableIAMDatabaseAuthentication: properties["IamAuthEnabled"],
+			DeletionProtection: properties["DeletionProtection"],
+			NetworkType: properties["NetworkType"],
+			...logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
+			...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
+			...tags.length > 0 && { Tags: tags }
+		};
+		const restoreInput = {
+			...sharedInput,
+			Port: port ?? DEFAULT_CLUSTER_PORT,
+			KmsKeyId: kmsKeyId ?? (String(properties["StorageEncrypted"]).toLowerCase() === "true" ? DEFAULT_STORAGE_KEY : void 0)
+		};
+		let clusterCreated = false;
+		let createdResourceId;
+		try {
+			const response = await (restore === void 0 ? this.getCreateClient().send(new CreateDBClusterCommand({
+				...sharedInput,
+				Engine: "neptune",
+				EngineVersion: properties["EngineVersion"],
+				Port: port,
+				StorageEncrypted: properties["StorageEncrypted"],
+				KmsKeyId: kmsKeyId,
+				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
+				PreferredBackupWindow: properties["PreferredBackupWindow"],
+				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
+				AvailabilityZones: properties["AvailabilityZones"],
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"]
+			})) : restore.kind === "snapshot" ? this.getCreateClient().send(new RestoreDBClusterFromSnapshotCommand({
+				...restoreInput,
+				SnapshotIdentifier: restore.snapshotIdentifier,
+				Engine: "neptune",
+				EngineVersion: properties["EngineVersion"],
+				AvailabilityZones: properties["AvailabilityZones"],
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"]
+			})) : this.getCreateClient().send(new RestoreDBClusterToPointInTimeCommand({
+				...restoreInput,
+				DBClusterParameterGroupName: void 0,
+				SourceDBClusterIdentifier: restore.sourceDBClusterIdentifier,
+				RestoreType: properties["RestoreType"],
+				...restore.restoreToTime !== void 0 && { RestoreToTime: restore.restoreToTime },
+				UseLatestRestorableTime: properties["UseLatestRestorableTime"]
+			})));
+			clusterCreated = true;
+			createdResourceId = response.DBCluster?.DbClusterResourceId;
+			reportCreatedResource(logicalId, resourceType, dbClusterIdentifier, createdResourceId);
+			const cluster = response.DBCluster;
+			if (!cluster) throw new Error("The create call did not return DBCluster");
+			this.logger.debug(`Successfully created Neptune DBCluster ${logicalId}: ${dbClusterIdentifier}`);
+			const followUp = restore === void 0 ? void 0 : restoreFollowUp(properties, restore, cluster.EngineVersion);
+			const followingUp = followUp !== void 0 && (followUp.parity !== void 0 || followUp.declared.length > 0);
+			if (followingUp || process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier, void 0, restore === void 0 ? void 0 : restoreWaitMs());
+			try {
+				if (followUp !== void 0 && followingUp) await this.sendRestoreFollowUp(logicalId, resourceType, dbClusterIdentifier, followUp, mask);
+				await this.applyClusterRoles(logicalId, dbClusterIdentifier, roles, [], [], mask, void 0);
+			} catch (error) {
+				markAuxiliaryFailure(error, logicalId);
+				throw error;
+			}
+			return {
+				physicalId: dbClusterIdentifier,
+				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
+			};
+		} catch (error) {
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Neptune DBCluster ${logicalId}: ${text}`, resourceType, logicalId, dbClusterIdentifier, error instanceof Error ? error : void 0));
+			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbClusterIdentifier, createdResourceId);
+			throw thrown;
+		}
+	}
+	async sendRestoreFollowUp(logicalId, resourceType, physicalId, followUp, mask) {
+		const send = (members) => modifyDbInstanceWhenAvailable({
+			send: () => this.getClient().send(new ModifyDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				...members,
+				ApplyImmediately: true
+			})),
+			readStatus: async () => (await this.describeDBCluster(physicalId))?.Status,
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			label: "Neptune DBCluster",
+			subject: "cluster",
+			isRefusal: (error) => isModifyNotAvailableRefusal(error) || isRestoringClusterRefusal(error),
+			logicalId,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+		if (followUp.parity !== void 0) await send(followUp.parity);
+		const refused = async (members) => {
+			try {
+				await send(members);
+				return false;
+			} catch (error) {
+				if (error instanceof Error && RESTORE_VALUE_REFUSALS.has(error.name)) {
+					this.logger.debug(safeMsg`${error.name} after restoring ${logicalId}: ${(mask ?? String)(error.message)}`);
+					return true;
+				}
+				throw error;
+			}
+		};
+		const { declared } = followUp;
+		if (declared.length > 0 && await refused(Object.assign({}, ...declared))) {
+			const keys = [];
+			for (const group of declared) if (declared.length === 1 || await refused(group)) keys.push(...Object.keys(group));
+			const refusedKeys = keys.filter((key) => key !== "AllowMajorVersionUpgrade");
+			if (refusedKeys.length > 0) this.logger.warn(safeMsg`${logicalId} (${resourceType}): AWS refused ${refusedKeys.join(", ")} after the restore, so the cluster keeps its restored values. The record holds the declared ones, so drift does not report the difference. An update leaves an unchanged window or EngineVersion out, as CloudFormation does; a refused BackupRetentionPeriod, CopyTagsToSnapshot or DBClusterParameterGroupName is sent again, so every update of this cluster fails until the template changes it.`);
+		}
+		if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, physicalId, "being configured after a restore", restoreWaitMs());
+	}
+	warnIgnoredRestoreProperties(logicalId, resourceType, properties, restore) {
+		const ignored = ignoredRestoreKeys(restore).filter((key) => properties[key] != null && properties[key] !== false);
+		if (ignored.length === 0) return;
+		const call = restore === void 0 ? "create" : restore.kind === "snapshot" ? "snapshot restore" : "point-in-time restore";
+		const retention = restore?.kind === "point-in-time" && declaresSnapshot(properties) ? " A declared SnapshotIdentifier still sets BackupRetentionPeriod, 1 when none is declared." : "";
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): this ${call} does not use ${ignored.join(", ")}, as in CloudFormation.${retention}`);
+	}
+	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		this.logger.debug(`Updating Neptune DBCluster ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const { roles, logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, {
+			creating: false,
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		});
+		const logExportConfig = logExportChange(logTypes, stringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
+		try {
+			const unrecorded = (key) => properties[key] != null && previousProperties[key] == null;
+			const live = unrecorded("EngineVersion") || unrecorded("NetworkType") || logExportConfig?.EnableLogTypes !== void 0 ? await this.describeDBCluster(physicalId) : void 0;
+			const majorUpgrade = isMajorEngineChange(previousProperties["EngineVersion"] ?? live?.EngineVersion, properties["EngineVersion"]);
+			const networkType = properties["NetworkType"];
+			const networkChange = networkType != null && networkType !== (previousProperties["NetworkType"] ?? live?.NetworkType);
+			markChangedUnsettled(CLUSTER_MODIFY_KEYS, properties, previousProperties, context);
+			const send = sentOnUpdate(properties, previousProperties);
+			const vpcSgIds = await this.dbClusterSecurityGroupsToSend(logicalId, physicalId, resourceType, properties, previousProperties, context);
+			await this.getClient().send(new ModifyDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				EngineVersion: send("EngineVersion"),
+				DeletionProtection: properties["DeletionProtection"],
+				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
+				PreferredBackupWindow: send("PreferredBackupWindow"),
+				PreferredMaintenanceWindow: send("PreferredMaintenanceWindow"),
+				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
+				EnableIAMDatabaseAuthentication: properties["IamAuthEnabled"],
+				...vpcSgIds !== void 0 && { VpcSecurityGroupIds: vpcSgIds },
+				Port: properties["DBPort"] != null ? Number(properties["DBPort"]) : properties["Port"] != null ? Number(properties["Port"]) : void 0,
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				...networkChange && { NetworkType: networkType },
+				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
+				...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig },
+				...majorUpgrade && { AllowMajorVersionUpgrade: true },
+				...majorUpgrade && properties["DBInstanceParameterGroupName"] != null && { DBInstanceParameterGroupName: properties["DBInstanceParameterGroupName"] },
+				ApplyImmediately: true
+			}));
+			const addedLogTypes = (logExportConfig?.EnableLogTypes ?? []).filter((type) => !live?.EnabledCloudwatchLogsExports?.includes(type));
+			if (addedLogTypes.length > 0) context?.markAttempted?.("EnableCloudwatchLogsExports", addedLogTypes);
+			this.logger.debug(`Successfully updated Neptune DBCluster ${logicalId}`);
+			const described = await this.describeDBCluster(physicalId);
+			if (logExportConfig !== void 0 && process.env["CDKD_NO_WAIT"] !== "true") {
+				const { EnableLogTypes: enabled = [], DisableLogTypes: disabled = [] } = logExportConfig;
+				await this.waitForApplied(logicalId, "EnableCloudwatchLogsExports", async () => {
+					const live = (await this.describeDBCluster(physicalId))?.EnabledCloudwatchLogsExports;
+					return enabled.every((type) => live?.includes(type)) && !disabled.some((type) => live?.includes(type));
+				});
+			}
+			if (networkChange && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForApplied(logicalId, "NetworkType", async () => (await this.describeDBCluster(physicalId))?.NetworkType === networkType);
+			await this.applyClusterRoles(logicalId, physicalId, roles, clusterRoleList(previousProperties["AssociatedRoles"]) ?? [], described?.AssociatedRoles ?? [], context?.maskSecrets, context);
+			if (process.env["CDKD_NO_WAIT"] !== "true" && securityGroupListChanged(vpcSgIds, previousProperties["VpcSecurityGroupIds"])) {
+				await this.waitForSecurityGroupsApplied(physicalId, logicalId, vpcSgIds ?? []);
+				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterSecurityGroupChange(member.DBInstanceIdentifier, logicalId);
+			}
+			if (described?.DBClusterArn) {
+				markChangedUnsettled(["Tags"], properties, previousProperties, context);
+				await this.applyTagDiff(described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			}
+			this.warnKeptRemovals(logicalId, resourceType, properties, previousProperties, CLUSTER_KEPT_ON_REMOVAL, context);
+			this.warnKeptRemovals(logicalId, resourceType, properties, previousProperties, CLUSTER_UNMEASURED_ON_REMOVAL, context, false);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: clusterAttributes(described)
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update Neptune DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async deleteDBCluster(logicalId, physicalId, resourceType, context) {
+		await deleteWithProtectionCompensation({
+			registry: this.protectionFlips,
+			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
+			run: (flip) => this.deleteDBClusterOnce(logicalId, physicalId, resourceType, context, flip),
+			compensation: {
+				logicalId,
+				physicalId,
+				logger: this.logger,
+				site: rdsFamilyProtectionSite({
+					cliService: "neptune",
+					serviceLabel: "Neptune",
+					kind: "cluster",
+					physicalId,
+					region: context?.expectedRegion,
+					notFoundFault: "DBClusterNotFoundFault",
+					isNotFound: (error) => this.isNotFoundError(error, "DBClusterNotFoundFault")
+				}),
+				reEnable: async () => {
+					await this.getClient().send(new ModifyDBClusterCommand({
+						DBClusterIdentifier: physicalId,
+						DeletionProtection: true,
+						ApplyImmediately: true
+					}));
+				}
+			}
+		});
+	}
+	async deleteDBClusterOnce(logicalId, physicalId, resourceType, context, flip) {
+		this.logger.debug(`Deleting Neptune DBCluster ${logicalId}`);
+		try {
+			if (context?.removeProtection === true) try {
+				await observeThenDisableProtection({
+					flip,
+					logger: this.logger,
+					physicalId,
+					mask: context?.maskSecrets,
+					guardName: "DeletionProtection",
+					observe: async () => (await this.describeDBCluster(physicalId))?.DeletionProtection === true,
+					disable: async () => {
+						await this.getClient().send(new ModifyDBClusterCommand({
+							DBClusterIdentifier: physicalId,
+							DeletionProtection: false,
+							ApplyImmediately: true
+						}));
+					}
+				});
+				this.logger.debug(`Disabled DeletionProtection on Neptune DBCluster ${logicalId} before delete`);
+			} catch (disableError) {
+				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for Neptune DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
+			}
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
+			const sendDelete = () => this.getClient().send(new DeleteDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true }
+			}));
+			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.deleteAfterProtectionFlip(logicalId, physicalId, sendDelete);
+			else await sendDelete();
+			flip.deleteAccepted = true;
+			if (finalSnapshotId) this.logger.info(`Deleting Neptune DBCluster ${logicalId} with a final snapshot (DeletionPolicy: Snapshot)`);
+			this.logger.debug(`Successfully initiated deletion of Neptune DBCluster ${logicalId}`);
+			await this.waitForClusterDeleted(logicalId, physicalId);
+		} catch (error) {
+			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Neptune DB cluster ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`Neptune DBCluster ${logicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Neptune DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
+		this.logger.debug(`Creating Neptune DBInstance ${logicalId}`);
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const publiclyAccessible = this.readPublicAccess(properties, resourceType, logicalId, void 0, replayingState);
+		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::Neptune::DBInstance", logicalId);
+		let instanceCreated = false;
+		let createdResourceId;
+		try {
+			const response = await this.getCreateClient().send(new CreateDBInstanceCommand({
+				DBInstanceIdentifier: dbInstanceIdentifier,
+				DBInstanceClass: properties["DBInstanceClass"],
+				Engine: "neptune",
+				DBClusterIdentifier: properties["DBClusterIdentifier"],
+				DBSubnetGroupName: properties["DBSubnetGroupName"],
+				DBParameterGroupName: properties["DBParameterGroupName"],
+				AvailabilityZone: properties["AvailabilityZone"],
+				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
+				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+				DeletionProtection: properties["DeletionProtection"],
+				PubliclyAccessible: publiclyAccessible,
+				...tags.length > 0 && { Tags: tags }
+			}));
+			instanceCreated = true;
+			createdResourceId = response.DBInstance?.DbiResourceId;
+			reportCreatedResource(logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
+			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
+			this.logger.debug(`Successfully created Neptune DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
+			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(logicalId, dbInstanceIdentifier);
+			return {
+				physicalId: dbInstanceIdentifier,
+				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
+			};
+		} catch (error) {
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Neptune DBInstance ${logicalId}: ${text}`, resourceType, logicalId, dbInstanceIdentifier, error instanceof Error ? error : void 0));
+			if (instanceCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
+			throw thrown;
+		}
+	}
+	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = context?.maskSecrets;
+		this.logger.debug(`Updating Neptune DBInstance ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const publiclyAccessible = this.readPublicAccess(properties, resourceType, logicalId, physicalId, context?.replayingState === true || context?.desiredFromAwsReadback === true);
+		try {
+			markChangedUnsettled(INSTANCE_MODIFY_KEYS, properties, previousProperties, context);
+			await modifyDbInstanceWhenAvailable({
+				send: () => this.getClient().send(new ModifyDBInstanceCommand({
+					DBInstanceIdentifier: physicalId,
+					DBInstanceClass: properties["DBInstanceClass"],
+					DBParameterGroupName: properties["DBParameterGroupName"],
+					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
+					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+					DeletionProtection: properties["DeletionProtection"],
+					PubliclyAccessible: publiclyAccessible,
+					AllowMajorVersionUpgrade: properties["AllowMajorVersionUpgrade"],
+					ApplyImmediately: true
+				})),
+				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
+				sleep: (ms) => this.sleep(ms),
+				logger: this.logger,
+				label: "Neptune DBInstance",
+				logicalId,
+				remainingMs: enclosingDeadlineRemainingMs()
+			});
+			this.logger.debug(`Successfully updated Neptune DBInstance ${logicalId}`);
+			if (publiclyAccessible !== void 0 && publiclyAccessible !== coerceCfnBoolean(previousProperties["PubliclyAccessible"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForApplied(logicalId, "PubliclyAccessible", async () => (await this.describeDBInstance(physicalId))?.PubliclyAccessible === publiclyAccessible);
+			const described = await this.describeDBInstance(physicalId);
+			if (described?.DBInstanceArn) {
+				markChangedUnsettled(["Tags"], properties, previousProperties, context);
+				await this.applyTagDiff(described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			}
+			this.warnKeptRemovals(logicalId, resourceType, properties, previousProperties, INSTANCE_KEPT_ON_REMOVAL, context);
+			this.warnPublicAccessKept(logicalId, resourceType, properties, previousProperties, context);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: instanceAttributes(described)
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update Neptune DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async deleteDBInstance(logicalId, physicalId, resourceType, context) {
+		await deleteWithProtectionCompensation({
+			registry: this.protectionFlips,
+			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
+			run: (flip) => this.deleteDBInstanceOnce(logicalId, physicalId, resourceType, context, flip),
+			compensation: {
+				logicalId,
+				physicalId,
+				logger: this.logger,
+				site: rdsFamilyProtectionSite({
+					cliService: "neptune",
+					serviceLabel: "Neptune",
+					kind: "instance",
+					physicalId,
+					region: context?.expectedRegion,
+					notFoundFault: "DBInstanceNotFoundFault",
+					isNotFound: (error) => this.isNotFoundError(error, "DBInstanceNotFoundFault")
+				}),
+				reEnable: async () => {
+					await this.getClient().send(new ModifyDBInstanceCommand({
+						DBInstanceIdentifier: physicalId,
+						DeletionProtection: true,
+						ApplyImmediately: true
+					}));
+				}
+			}
+		});
+	}
+	async deleteDBInstanceOnce(logicalId, physicalId, resourceType, context, flip) {
+		this.logger.debug(`Deleting Neptune DBInstance ${logicalId}: ${physicalId}`);
+		try {
+			if (context?.removeProtection === true) try {
+				await observeThenDisableProtection({
+					flip,
+					logger: this.logger,
+					physicalId,
+					mask: context?.maskSecrets,
+					guardName: "DeletionProtection",
+					observe: async () => (await this.describeDBInstance(physicalId))?.DeletionProtection === true,
+					disable: async () => {
+						await this.getClient().send(new ModifyDBInstanceCommand({
+							DBInstanceIdentifier: physicalId,
+							DeletionProtection: false,
+							ApplyImmediately: true
+						}));
+					}
+				});
+				this.logger.debug(`Disabled DeletionProtection on Neptune DBInstance ${logicalId} before delete`);
+			} catch (disableError) {
+				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for ${physicalId}: ${describeAwsFailure(disableError).detail}`));
+			}
+			await this.getClient().send(new DeleteDBInstanceCommand({
+				DBInstanceIdentifier: physicalId,
+				SkipFinalSnapshot: true
+			}));
+			flip.deleteAccepted = true;
+			this.logger.debug(`Successfully initiated deletion of Neptune DBInstance ${logicalId}`);
+			await this.waitForInstanceDeleted(physicalId);
+		} catch (error) {
+			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Neptune DB instance ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`Neptune DBInstance ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Neptune DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
+	wrapDeleteError(mask, error, build) {
+		const thrown = this.wrapCaughtError(mask, error, build);
+		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
+	}
+	async applyTagDiff(arn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
+		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
+		if (tagWarning !== void 0) this.logger.warn(tagWarning);
+		const tagsToAdd = [...plan.set].map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0) {
+			await this.getClient().send(new RemoveTagsFromResourceCommand({
+				ResourceName: arn,
+				TagKeys: tagsToRemove
+			}));
+			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Neptune resource ${arn}`);
+		}
+		if (tagsToAdd.length > 0) {
+			await this.getClient().send(new AddTagsToResourceCommand({
+				ResourceName: arn,
+				Tags: tagsToAdd
+			}));
+			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on Neptune resource ${arn}`);
+		}
+	}
+	isNotFoundError(error, faultName) {
+		if (!(error instanceof Error)) return false;
+		const name = error.name ?? "";
+		const message = error.message.toLowerCase();
+		return name === faultName || message.includes("not found") || message.includes("does not exist");
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::Neptune::DBCluster" && resourceType !== "AWS::Neptune::DBInstance") return "unknown";
+		if (!isDbIdentifier(journaledPhysicalId) || !isDbIdentifier(record.physicalId)) return "unknown";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordResourceId = await this.readDbResourceIdIfExists(resourceType, record.physicalId);
+		if (recordResourceId === void 0) return "unknown";
+		const journaledResourceId = await this.readDbResourceIdIfExists(resourceType, journaledPhysicalId);
+		if (journaledResourceId === void 0) return "different";
+		return journaledResourceId === recordResourceId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::Neptune::DBCluster" && resourceType !== "AWS::Neptune::DBInstance") return;
+		if (!isDbIdentifier(physicalId)) return void 0;
+		if (await this.getClient().config.region() !== context.expectedRegion) return void 0;
+		const live = await this.readDbResourceIdIfExists(resourceType, physicalId);
+		return live === void 0 ? RESOURCE_NOT_FOUND : live;
+	}
+	async readDbResourceIdIfExists(resourceType, identifier) {
+		const isCluster = resourceType === "AWS::Neptune::DBCluster";
+		let found;
+		try {
+			if (isCluster) {
+				const cluster = await this.describeDBCluster(identifier);
+				found = cluster && {
+					identifier: cluster.DBClusterIdentifier,
+					engine: cluster.Engine,
+					resourceId: cluster.DbClusterResourceId
+				};
+			} else {
+				const instance = await this.describeDBInstance(identifier);
+				found = instance && {
+					identifier: instance.DBInstanceIdentifier,
+					engine: instance.Engine,
+					resourceId: instance.DbiResourceId
+				};
+			}
+		} catch (error) {
+			const notFound = isCluster ? "DBClusterNotFoundFault" : "DBInstanceNotFoundFault";
+			if (error?.name === notFound) return void 0;
+			throw error;
+		}
+		if (found === void 0) return void 0;
+		const api = isCluster ? "DescribeDBClusters" : "DescribeDBInstances";
+		if (found.identifier?.toLowerCase() !== identifier.toLowerCase()) throw new Error(`${api} answered for another identifier`);
+		if (found.engine !== "neptune") throw new Error(`${api} answered for a resource of another engine`);
+		if (typeof found.resourceId !== "string" || found.resourceId === "") throw new Error(`${api} returned no resource id`);
+		return found.resourceId;
+	}
+	readClusterBlocks(properties, resourceType, logicalId, origin) {
+		const refuse = (key, expected) => {
+			throw markNonRetryable(new ProvisioningError(safeMsg`Neptune DBCluster ${logicalId}: ${key} must be ${expected}; nothing was changed.`, resourceType, logicalId, origin.physicalId));
+		};
+		const leaveOut = (key) => {
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+		};
+		const unusableList = (key, expected) => {
+			if (!(origin.creating && origin.stateBorne)) return refuse(key, expected);
+			leaveOut(key);
+			return [];
+		};
+		const roles = clusterRoleList(properties["AssociatedRoles"]) ?? unusableList("AssociatedRoles", "a list of objects with a RoleArn");
+		const logTypes = stringList(properties["EnableCloudwatchLogsExports"]) ?? unusableList("EnableCloudwatchLogsExports", "a list of strings");
+		const scaling = serverlessScalingToSend(properties["ServerlessScalingConfiguration"]);
+		if (scaling === null) {
+			if (!origin.stateBorne) return refuse("ServerlessScalingConfiguration", "an object with both a numeric MinCapacity and a numeric MaxCapacity");
+			leaveOut("ServerlessScalingConfiguration");
+		}
+		return {
+			roles,
+			logTypes,
+			scaling
+		};
+	}
+	async applyClusterRoles(logicalId, physicalId, desired, previous, live, mask, marks) {
+		const liveKeys = new Set(live.map(clusterRoleKey));
+		const desiredKeys = new Set(desired.map(clusterRoleKey));
+		const toAdd = desired.filter((role) => !liveKeys.has(clusterRoleKey(role)));
+		const toRemove = previous.filter((role) => {
+			const key = clusterRoleKey(role);
+			return !desiredKeys.has(key) && liveKeys.has(key);
+		});
+		if (toAdd.length === 0 && toRemove.length === 0) return;
+		const waitBudgetMs = Math.min(ROLE_AVAILABLE_MAX_WAIT_MS, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		if (waitBudgetMs <= 0) throw new Error("the resource timeout leaves no more time to change the roles of the cluster; re-run the deploy, or with a longer --resource-timeout");
+		await this.waitForClusterAvailable(logicalId, physicalId, "changing its roles", waitBudgetMs);
+		marks?.markUnsettled?.("AssociatedRoles");
+		const whenAvailable = (send) => modifyDbInstanceWhenAvailable({
+			send,
+			readStatus: async () => (await this.describeDBCluster(physicalId))?.Status,
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			label: "Neptune DBCluster",
+			subject: "cluster",
+			isRefusal: (error) => isRoleCallNotAvailableRefusal(error) || isModifyNotAvailableRefusal(error),
+			logicalId,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+		for (const role of toRemove) await whenAvailable(() => this.getClient().send(new RemoveRoleFromDBClusterCommand({
+			DBClusterIdentifier: physicalId,
+			...role
+		})));
+		for (const role of toAdd) {
+			await whenAvailable(() => this.getClient().send(new AddRoleToDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				...role
+			})));
+			marks?.markAttempted?.("AssociatedRoles", [clusterRoleKey(role)]);
+		}
+		if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterRolesSettled(logicalId, physicalId, new Set(toAdd.map(clusterRoleKey)), new Set(toRemove.map(clusterRoleKey)), mask);
+	}
+	async waitForClusterRolesSettled(logicalId, physicalId, attached, detached, mask) {
+		const shown = (keys) => maskerOrIdentity(mask)(keys.map((key) => key.split("\n")[0] ?? "").join(", "));
+		let unsettled = [];
+		if (!await this.pollUntilSettled(async () => {
+			const roles = (await this.describeDBCluster(physicalId))?.AssociatedRoles ?? [];
+			const byKey = new Map(roles.map((role) => [clusterRoleKey(role), role]));
+			unsettled = [...[...attached].filter((key) => (byKey.get(key)?.Status ?? "PENDING") === "PENDING"), ...[...detached].filter((key) => byKey.has(key))];
+			if (unsettled.length > 0) return false;
+			const invalid = [...attached].filter((key) => byKey.get(key)?.Status === "INVALID");
+			if (invalid.length > 0) this.logger.warn(safeMsg`${logicalId}: Neptune reports ${shown(invalid)} as INVALID: the role is attached, but the cluster cannot assume it. Check the role's trust policy.`);
+			return true;
+		})) this.logger.warn(safeMsg`${logicalId}: the IAM roles of the Neptune cluster had not settled when cdkd stopped waiting (${shown(unsettled)}).`);
+	}
+	async waitForApplied(logicalId, what, applied) {
+		if (await this.pollUntilSettled(applied)) return;
+		this.logger.warn(safeMsg`${logicalId}: the new ${what} did not read back when cdkd stopped waiting; AWS accepted it, so cdkd drift may report the old value as the baseline. Once it applies, run cdkd drift --accept.`);
+	}
+	async pollUntilSettled(settled) {
+		const capMs = Math.min(SETTLE_MAX_WAIT_MS, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		const startTime = Date.now();
+		let delay = 2e3;
+		for (;;) {
+			if (await settled()) return true;
+			if (Date.now() - startTime + delay >= capMs) return false;
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+	}
+	async describeDBCluster(dbClusterIdentifier) {
+		return (await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: dbClusterIdentifier }))).DBClusters?.[0];
+	}
+	warnKeptRemovals(logicalId, resourceType, properties, previousProperties, kept, context, measured = true) {
+		if (context?.desiredFromAwsReadback === true) return;
+		const removed = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
+		const portStays = properties["DBPort"] != null || properties["Port"] != null;
+		const names = kept.filter((key) => removed.has(key) && !((key === "DBPort" || key === "Port") && portStays));
+		if (names.length === 0) return;
+		const one = names.length === 1;
+		const modify = resourceType === "AWS::Neptune::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
+		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place${measured ? ", as CloudFormation does" : ""}. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`);
+	}
+	readPublicAccess(properties, resourceType, logicalId, physicalId, stateBorne) {
+		const refusal = configBooleanRefusal(properties, "PubliclyAccessible", logicalId);
+		if (refusal === void 0) return coerceCfnBoolean(properties["PubliclyAccessible"]);
+		if (!stateBorne) throw markNonRetryable(new ProvisioningError(safeMsg`Neptune DBInstance ${refusal}; nothing was changed.`, resourceType, logicalId, physicalId));
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded PubliclyAccessible is unusable, so it is not sent.`);
+	}
+	warnPublicAccessKept(logicalId, resourceType, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback === true) return;
+		if (!(context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties))).has("PubliclyAccessible")) return;
+		if (coerceCfnBoolean(previousProperties["PubliclyAccessible"]) !== true) return;
+		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): PubliclyAccessible is absent from the state being restored, and ModifyDBInstance keeps a setting it is not sent, so the instance stays publicly accessible after this rollback, as CloudFormation leaves it. Set PubliclyAccessible: false to close it.` : safeMsg`${logicalId} (${resourceType}): PubliclyAccessible was removed from the template; the instance stays publicly accessible, as CloudFormation leaves it. Set PubliclyAccessible: false to close it.`);
+	}
+	async dbClusterSecurityGroupsToSend(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const desired = properties["VpcSecurityGroupIds"];
+		if (desired !== void 0) return desired.length > 0 ? desired : void 0;
+		const previous = previousProperties["VpcSecurityGroupIds"];
+		if (context?.desiredFromAwsReadback === true) return void 0;
+		if (!Array.isArray(previous) || previous.length === 0) return void 0;
+		let groupId;
+		let missing;
+		let awsError;
+		try {
+			const subnetGroupName = (await this.describeDBCluster(physicalId))?.DBSubnetGroup;
+			const vpcId = subnetGroupName ? (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: subnetGroupName }))).DBSubnetGroups?.[0]?.VpcId : void 0;
+			if (!subnetGroupName) missing = "the cluster reports no DB subnet group";
+			else if (!vpcId) missing = `DB subnet group ${subnetGroupName} reports no VPC`;
+			else {
+				groupId = (await this.getEc2Client().send(new DescribeSecurityGroupsCommand({ Filters: [{
+					Name: "vpc-id",
+					Values: [vpcId]
+				}, {
+					Name: "group-name",
+					Values: ["default"]
+				}] }))).SecurityGroups?.[0]?.GroupId;
+				if (!groupId) missing = `VPC ${vpcId} has no security group named default`;
+			}
+		} catch (error) {
+			awsError = error;
+		}
+		if (groupId === void 0) {
+			const mask = context?.maskSecrets ?? ((text) => text);
+			const failure = missing === void 0 ? describeAwsFailure(awsError) : void 0;
+			if (failure?.redacted === true) this.logger.debug(safeMsg`${logicalId}: the VPC default security group lookup failed: ${mask(failure.detail)}`);
+			const shown = mask(failure?.summary ?? "");
+			const refusal = new ProvisioningError(`Failed to update Neptune DBCluster ${logicalId}: VpcSecurityGroupIds was removed from the template, so the cluster moves to its VPC's default security group (as CloudFormation does), but cdkd could not find that group: ${missing ?? shown}. Declare VpcSecurityGroupIds in the template to choose the cluster's security groups.`, resourceType, logicalId, physicalId, awsError instanceof Error ? awsError : void 0);
+			if (missing !== void 0) throw markNonRetryable(refusal);
+			throw awsError instanceof Error && (failure?.redacted === true || shown !== (failure?.summary ?? "")) ? markRedactedCause(refusal) : refusal;
+		}
+		this.logger.warn(safeMsg`${logicalId}: VpcSecurityGroupIds was removed from the template; attaching the VPC's default security group ${groupId}, as CloudFormation does.`);
+		return [groupId];
+	}
+	async describeDBInstance(dbInstanceIdentifier) {
+		return (await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: dbInstanceIdentifier }))).DBInstances?.[0];
+	}
+	async waitForMemberAfterSecurityGroupChange(dbInstanceIdentifier, clusterLogicalId, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			let status;
+			try {
+				status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
+			} catch (error) {
+				if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) return;
+				throw error;
+			}
+			if (status !== "modifying") return;
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(safeMsg`Timed out waiting for a member instance of Neptune DBCluster ${clusterLogicalId} to finish applying its new VPC security groups`);
+	}
+	requireClusterWhileWaiting(cluster, logicalId) {
+		if (cluster === void 0) throw new Error(safeMsg`DescribeDBClusters returned no cluster for Neptune DBCluster ${logicalId} while waiting for its new VPC security groups`);
+		if (isTerminalDbWaitStatus(cluster.Status)) throw new Error(safeMsg`Neptune DBCluster ${logicalId} entered status ${cluster.Status ?? ""} while applying its new VPC security groups`);
+		return cluster;
+	}
+	async waitForSecurityGroupsApplied(dbClusterIdentifier, logicalId, expected, maxWaitMs = 18e5) {
+		const want = [...new Set(expected)].sort().join(" ");
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const cluster = this.requireClusterWhileWaiting(await this.describeDBCluster(dbClusterIdentifier), logicalId);
+			const groups = cluster.VpcSecurityGroups ?? [];
+			const ids = groups.map((group) => group.VpcSecurityGroupId ?? "").sort().join(" ");
+			if (cluster.Status !== "modifying" && groups.every((group) => group.Status === "active") && ids === want) return;
+			this.logger.debug(safeMsg`Neptune DBCluster ${logicalId} security groups not settled yet (status ${cluster.Status ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for Neptune DBCluster ${logicalId} to apply its new VPC security groups`);
+	}
+	async deleteAfterProtectionFlip(logicalId, physicalId, send) {
+		await deleteAfterProtectionFlipWithFinalSnapshot({
+			stateFault: "InvalidDBClusterStateFault",
+			send,
+			noun: "cluster",
+			label: "Neptune DBCluster",
+			logicalId,
+			read: async () => {
+				const current = await this.describeDBCluster(physicalId);
+				return current === void 0 ? void 0 : {
+					deletionProtection: current.DeletionProtection,
+					status: current.Status
+				};
+			},
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+	}
+	async waitForClusterAvailable(logicalId, dbClusterIdentifier, during = "being created", maxWaitMs = CLUSTER_AVAILABLE_MAX_WAIT_MS) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const status = (await this.describeDBCluster(dbClusterIdentifier))?.Status;
+			this.logger.debug(`Neptune DBCluster ${dbClusterIdentifier} status: ${status}`);
+			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`Neptune DBCluster ${logicalId} entered status ${status ?? ""} while ${during}, which it does not leave on its own`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for Neptune DBCluster ${dbClusterIdentifier} to become available`);
+	}
+	async waitForClusterDeleted(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			try {
+				const cluster = await this.describeDBCluster(dbClusterIdentifier);
+				const status = cluster?.Status;
+				this.logger.debug(`Neptune DBCluster ${logicalId} status: ${status}`);
+				if (!cluster) return;
+			} catch (error) {
+				if (this.isNotFoundError(error, "DBClusterNotFoundFault")) return;
+				throw error;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for Neptune DBCluster ${logicalId} to be deleted`);
+	}
+	async waitForInstanceAvailable(logicalId, dbInstanceIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 1e4;
+		while (Date.now() - startTime < maxWaitMs) {
+			const status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
+			this.logger.debug(`Neptune DBInstance ${dbInstanceIdentifier} status: ${status}`);
+			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`Neptune DBInstance ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for Neptune DBInstance ${dbInstanceIdentifier} to become available`);
+	}
+	async waitForInstanceDeleted(dbInstanceIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 1e4;
+		while (Date.now() - startTime < maxWaitMs) {
+			try {
+				const instance = await this.describeDBInstance(dbInstanceIdentifier);
+				const status = instance?.DBInstanceStatus;
+				this.logger.debug(`Neptune DBInstance ${dbInstanceIdentifier} status: ${status}`);
+				if (!instance) return;
+			} catch (error) {
+				if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) return;
+				throw error;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for Neptune DBInstance ${dbInstanceIdentifier} to be deleted`);
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::Neptune::DBCluster") return [
+			"AvailabilityZones",
+			"DBInstanceParameterGroupName",
+			"RestoreToTime",
+			"RestoreType",
+			"SnapshotIdentifier",
+			"SourceDBClusterIdentifier",
+			"UseLatestRestorableTime"
+		];
+		if (resourceType === "AWS::Neptune::DBInstance") return ["AllowMajorVersionUpgrade"];
+		return [];
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::Neptune::DBCluster" ? [
+			"AssociatedRoles",
+			"EnableCloudwatchLogsExports",
+			"VpcSecurityGroupIds"
+		] : [];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::Neptune::DBCluster") return properties;
+		const out = { ...properties };
+		if (Array.isArray(out["AssociatedRoles"])) out["AssociatedRoles"] = clusterRoleList(out["AssociatedRoles"]) ?? out["AssociatedRoles"];
+		const logs = out["EnableCloudwatchLogsExports"];
+		if (Array.isArray(logs) && stringList(logs) !== void 0) out["EnableCloudwatchLogsExports"] = [...new Set(logs)];
+		return out;
+	}
+	canonicalizeUnsettledProperties(resourceType, properties) {
+		return this.canonicalizeDriftProperties(resourceType, properties);
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (resourceType !== "AWS::Neptune::DBCluster") return live;
+		if (live === void 0 || live === RESOURCE_NOT_FOUND) return live;
+		const attempted = (key) => [...attemptedItems?.get(key) ?? []].filter(isUsableAttemptedName);
+		const out = { ...live };
+		if (names.has("AssociatedRoles")) {
+			const named = /* @__PURE__ */ new Set([
+				...(clusterRoleList(recordedProperties?.["AssociatedRoles"]) ?? []).map(clusterRoleKey),
+				...(clusterRoleList(desiredProperties?.["AssociatedRoles"]) ?? []).map(clusterRoleKey),
+				...attempted("AssociatedRoles")
+			]);
+			out["AssociatedRoles"] = (live["AssociatedRoles"] ?? []).filter((role) => named.has(clusterRoleKey(role)));
+		}
+		if (names.has("EnableCloudwatchLogsExports")) {
+			const named = /* @__PURE__ */ new Set([
+				...stringList(recordedProperties?.["EnableCloudwatchLogsExports"]) ?? [],
+				...stringList(desiredProperties?.["EnableCloudwatchLogsExports"]) ?? [],
+				...attempted("EnableCloudwatchLogsExports")
+			]);
+			out["EnableCloudwatchLogsExports"] = (live["EnableCloudwatchLogsExports"] ?? []).filter((type) => named.has(type));
+		}
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, resourceType, names, _recordedProperties, desiredProperties) {
+		if (desiredProperties !== void 0) return /* @__PURE__ */ new Set();
+		try {
+			if (resourceType === "AWS::Neptune::DBCluster") {
+				const cluster = await this.describeDBCluster(physicalId);
+				return isUnmovingDbStatus(cluster?.Status) && !holdsPendingValue(cluster?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			if (resourceType === "AWS::Neptune::DBInstance") {
+				const instance = await this.describeDBInstance(physicalId);
+				return isUnmovingDbStatus(instance?.DBInstanceStatus) && !holdsPendingValue(instance?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			return /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
+	async import(input) {
+		switch (input.resourceType) {
+			case "AWS::Neptune::DBInstance": return this.importDBInstance(input);
+			case "AWS::Neptune::DBCluster": return this.importDBCluster(input);
+			case "AWS::Neptune::DBSubnetGroup": return this.importDBSubnetGroup(input);
+			default: return null;
+		}
+	}
+	async readCurrentState(physicalId, _logicalId, resourceType) {
+		switch (resourceType) {
+			case "AWS::Neptune::DBInstance": return this.readCurrentStateDBInstance(physicalId);
+			case "AWS::Neptune::DBCluster": return this.readCurrentStateDBCluster(physicalId);
+			case "AWS::Neptune::DBSubnetGroup": return this.readCurrentStateDBSubnetGroup(physicalId);
+			default: return;
+		}
+	}
+	async readCurrentStateDBInstance(physicalId) {
+		let inst;
+		try {
+			inst = await this.describeDBInstance(physicalId);
+		} catch (err) {
+			if (err?.name === "DBInstanceNotFoundFault") return RESOURCE_NOT_FOUND;
+			if (this.isNotFoundError(err, "DBInstanceNotFoundFault")) return void 0;
+			throw err;
+		}
+		if (!inst) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (inst.DBInstanceIdentifier !== void 0) result["DBInstanceIdentifier"] = inst.DBInstanceIdentifier;
+		if (inst.DBInstanceClass !== void 0) result["DBInstanceClass"] = inst.DBInstanceClass;
+		if (inst.DBClusterIdentifier !== void 0) result["DBClusterIdentifier"] = inst.DBClusterIdentifier;
+		if (inst.DBSubnetGroup?.DBSubnetGroupName !== void 0) result["DBSubnetGroupName"] = inst.DBSubnetGroup.DBSubnetGroupName;
+		if (inst.AvailabilityZone !== void 0) result["AvailabilityZone"] = inst.AvailabilityZone;
+		if (inst.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = inst.PreferredMaintenanceWindow;
+		if (inst.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = inst.AutoMinorVersionUpgrade;
+		if (inst.DeletionProtection !== void 0) result["DeletionProtection"] = inst.DeletionProtection;
+		if (inst.PubliclyAccessible !== void 0) result["PubliclyAccessible"] = inst.PubliclyAccessible;
+		const pg = inst.DBParameterGroups?.[0]?.DBParameterGroupName;
+		if (pg !== void 0) result["DBParameterGroupName"] = pg;
+		if (inst.DBInstanceArn) await this.attachTags(result, inst.DBInstanceArn);
+		return result;
+	}
+	async readCurrentStateDBCluster(physicalId) {
+		let cluster;
+		try {
+			cluster = await this.describeDBCluster(physicalId);
+		} catch (err) {
+			if (err?.name === "DBClusterNotFoundFault") return RESOURCE_NOT_FOUND;
+			if (this.isNotFoundError(err, "DBClusterNotFoundFault")) return void 0;
+			throw err;
+		}
+		if (!cluster) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (cluster.DBClusterIdentifier !== void 0) result["DBClusterIdentifier"] = cluster.DBClusterIdentifier;
+		if (cluster.EngineVersion !== void 0) result["EngineVersion"] = cluster.EngineVersion;
+		if (cluster.Port !== void 0) {
+			result["Port"] = cluster.Port;
+			result["DBPort"] = cluster.Port;
+		}
+		result["VpcSecurityGroupIds"] = (cluster.VpcSecurityGroups ?? []).map((sg) => sg.VpcSecurityGroupId).filter((id) => !!id);
+		if (cluster.DBSubnetGroup !== void 0) result["DBSubnetGroupName"] = cluster.DBSubnetGroup;
+		if (cluster.StorageEncrypted !== void 0) result["StorageEncrypted"] = cluster.StorageEncrypted;
+		if (cluster.KmsKeyId !== void 0) result["KmsKeyId"] = cluster.KmsKeyId;
+		if (cluster.BackupRetentionPeriod !== void 0) result["BackupRetentionPeriod"] = cluster.BackupRetentionPeriod;
+		if (cluster.PreferredBackupWindow !== void 0) result["PreferredBackupWindow"] = cluster.PreferredBackupWindow;
+		if (cluster.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = cluster.PreferredMaintenanceWindow;
+		if (cluster.DBClusterParameterGroup !== void 0) result["DBClusterParameterGroupName"] = cluster.DBClusterParameterGroup;
+		if (cluster.IAMDatabaseAuthenticationEnabled !== void 0) result["IamAuthEnabled"] = cluster.IAMDatabaseAuthenticationEnabled;
+		if (cluster.DeletionProtection !== void 0) result["DeletionProtection"] = cluster.DeletionProtection;
+		if (cluster.CopyTagsToSnapshot !== void 0) result["CopyTagsToSnapshot"] = cluster.CopyTagsToSnapshot;
+		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
+		const { MinCapacity: min, MaxCapacity: max } = cluster.ServerlessV2ScalingConfiguration ?? {};
+		if (min !== void 0 || max !== void 0) result["ServerlessScalingConfiguration"] = {
+			...min !== void 0 && { MinCapacity: min },
+			...max !== void 0 && { MaxCapacity: max }
+		};
+		result["EnableCloudwatchLogsExports"] = cluster.EnabledCloudwatchLogsExports ?? [];
+		result["AssociatedRoles"] = (cluster.AssociatedRoles ?? []).map((role) => ({
+			RoleArn: role.RoleArn,
+			...role.FeatureName ? { FeatureName: role.FeatureName } : {}
+		}));
+		if (cluster.DBClusterArn) await this.attachTags(result, cluster.DBClusterArn);
+		return result;
+	}
+	async readCurrentStateDBSubnetGroup(physicalId) {
+		let resp;
+		try {
+			resp = await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: physicalId }));
+		} catch (err) {
+			if (err?.name === "DBSubnetGroupNotFoundFault") return RESOURCE_NOT_FOUND;
+			if (this.isNotFoundError(err, "DBSubnetGroupNotFoundFault")) return void 0;
+			throw err;
+		}
+		const sg = resp.DBSubnetGroups?.[0];
+		if (!sg) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (sg.DBSubnetGroupName !== void 0) result["DBSubnetGroupName"] = sg.DBSubnetGroupName;
+		if (sg.DBSubnetGroupDescription !== void 0) result["DBSubnetGroupDescription"] = sg.DBSubnetGroupDescription;
+		result["SubnetIds"] = (sg.Subnets ?? []).map((s) => s.SubnetIdentifier).filter((id) => !!id);
+		if (sg.DBSubnetGroupArn) await this.attachTags(result, sg.DBSubnetGroupArn);
+		return result;
+	}
+	async attachTags(result, arn) {
+		try {
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
+		} catch (err) {
+			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
+		}
+	}
+	async importDBInstance(input) {
+		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
+		if (explicit) try {
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
+			return {
+				physicalId: explicit,
+				attributes: instanceAttributes(described)
+			};
+		} catch (err) {
+			if (err.name === "DBInstanceNotFoundFault") return null;
+			throw err;
+		}
+		return null;
+	}
+	async importDBCluster(input) {
+		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
+		if (explicit) try {
+			return {
+				physicalId: explicit,
+				attributes: clusterAttributes((await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: explicit }))).DBClusters?.[0])
+			};
+		} catch (err) {
+			if (err.name === "DBClusterNotFoundFault") return null;
+			throw err;
+		}
+		return null;
+	}
+	async importDBSubnetGroup(input) {
+		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
+		if (explicit) try {
+			await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: explicit }));
+			return {
+				physicalId: explicit,
+				attributes: {}
+			};
+		} catch (err) {
+			if (err.name === "DBSubnetGroupNotFoundFault") return null;
+			throw err;
+		}
+		return null;
+	}
+};
+function securityGroupListChanged(sent, previous) {
+	if (sent === void 0) return false;
+	const before = Array.isArray(previous) ? previous.filter((id) => typeof id === "string") : [];
+	return [...sent].sort().join(" ") !== [...before].sort().join(" ");
+}
+
+export { NeptuneProvider };
+//# sourceMappingURL=neptune-provider-BqtKFZaE.js.map