@cdkd/cli 0.323.0 → 0.326.0

package/dist/{deploy-engine-dYZ0v6Kz.js → deploy-engine-l-wZygYT.js}

@@ -1,8 +1,8 @@
-import { c as __exportAll, r as getAwsClients } from "./aws-clients-DWpHZk2l.js";
+import { f as __exportAll, l as s3ClientDefaults, r as getAwsClients } from "./aws-clients-ez_oXu6x.js";
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-DiHodi76.js";
-import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-CmrPwGge.js";
+import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-DMf6WEao.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BLXFsfMa.js";
-import { t as getCdkdVersion } from "./version-kAoaNHQI.js";
+import { t as getCdkdVersion } from "./version-C8PfUSmt.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -64,6 +64,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 		const explicitRegion = opts.region ?? opts.fallbackRegion;
 		let client = new S3Client({
 			...awsClientDefaults({ profile: opts.profile }),
+			...s3ClientDefaults(),
 			...auth,
 			...explicitRegion && { region: explicitRegion }
 		});
@@ -73,6 +74,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 			probeRegion = "us-east-1";
 			client = new S3Client({
 				...awsClientDefaults({ profile: opts.profile }),
+				...s3ClientDefaults(),
 				...auth,
 				region: probeRegion
 			});
@@ -1919,6 +1921,7 @@ async function uploadCfnTemplate(args) {
 	});
 	const s3 = new S3Client({
 		...awsClientDefaults({ profile: s3ClientOpts?.profile }),
+		...s3ClientDefaults(),
 		region,
 		...s3ClientOpts?.profile && { profile: s3ClientOpts.profile },
 		...s3ClientOpts?.credentials && { credentials: s3ClientOpts.credentials }
@@ -2330,7 +2333,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-DWpHZk2l.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-ez_oXu6x.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -2346,6 +2349,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	const stsCredentials = stsClient.config?.credentials;
 	const probe = new S3Client({
 		...awsClientDefaults(),
+		...s3ClientDefaults(),
 		region: "us-east-1",
 		...typeof stsCredentials === "function" && { credentials: stsCredentials }
 	});
@@ -2741,6 +2745,7 @@ var FileAssetPublisher = class {
 			this.logger.debug(`Publishing file asset ${asset.displayName || assetHash} → s3://${bucketName}/${objectKey}`);
 			const client = new S3Client({
 				...ambientClientDefaults(),
+				...s3ClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -3696,7 +3701,7 @@ function ecrRegistryHost(accountId, region) {
 	return `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 }
 function isDockerAuthFailure(errText) {
-	return /no basic auth credentials|unauthorized|authentication required|denied|\b401\b|\b403\b/i.test(errText);
+	return /no basic auth credentials|unauthorized|authentication required|denied|authorization token has expired|is not authorized to perform|\b401\b|\b403\b/i.test(errText);
 }
 var DockerAssetPublisher = class {
 	logger = getLogger().child("DockerAssetPublisher");
@@ -4007,6 +4012,7 @@ async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
 	};
 	const s3Client = new S3Client({
 		...awsClientDefaults({ profile: opts.profile }),
+		...s3ClientDefaults(),
 		...clientOpts
 	});
 	const ecrClient = new ECRClient({
@@ -4245,6 +4251,7 @@ var AssetModeResolver = class {
 		try {
 			s3Client = new S3Client({
 				...awsClientDefaults({ profile: this.profile }),
+				...s3ClientDefaults(),
 				region,
 				...this.profile && { profile: this.profile }
 			});
@@ -5762,6 +5769,7 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	const rebuiltCredentials = opts.credentials ? opts.credentials : opts.reuseClientCredentials ? client.config.credentials : void 0;
 	const replacement = new S3Client({
 		...awsClientDefaults({ profile: opts.profile }),
+		...s3ClientDefaults(),
 		region: bucketRegion,
 		...opts.profile && { profile: opts.profile },
 		...rebuiltCredentials !== void 0 && { credentials: rebuiltCredentials },
@@ -5833,6 +5841,7 @@ var S3StateBackend = class S3StateBackend {
 		const region = await this.s3Client.config.region();
 		this.scanClient = new S3Client({
 			...awsClientDefaults(this.clientOpts.profile ? { profile: this.clientOpts.profile } : {}),
+			...s3ClientDefaults(),
 			region,
 			credentials: this.s3Client.config.credentials
 		});
@@ -12491,6 +12500,18 @@ function instanceSecurityGroupIdsChangeReplaces(oldValue, newValue, siblings) {
 	}
 	return siblings.newProperties["SubnetId"] == null;
 }
+function instanceTenancyChangeReplaces(oldValue, newValue) {
+	if (oldValue == null) return false;
+	if (newValue == null) return true;
+	const text = (v) => typeof v === "string" ? v : JSON.stringify(v);
+	const before = text(oldValue);
+	const after = text(newValue);
+	if (before === after) return false;
+	return before === "default" || after === "default";
+}
+function instancePrivateDnsNameOptionsChangeReplaces(oldValue, newValue) {
+	return oldValue != null && newValue == null;
+}
 function instanceBlockDeviceMappingsChangeReplaces(oldValue, newValue) {
 	return !blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue);
 }
@@ -13016,9 +13037,20 @@ var ReplacementRulesRegistry = class {
 				"ImageId",
 				"SubnetId",
 				"KeyName",
-				"NetworkInterfaces"
+				"NetworkInterfaces",
+				"CpuOptions",
+				"HibernationOptions",
+				"PlacementGroupName",
+				"PrivateIpAddress",
+				"Ipv6AddressCount",
+				"Ipv6Addresses"
 			]),
-			conditionalReplacements: /* @__PURE__ */ new Map([["SecurityGroupIds", instanceSecurityGroupIdsChangeReplaces], ["BlockDeviceMappings", instanceBlockDeviceMappingsChangeReplaces]])
+			conditionalReplacements: /* @__PURE__ */ new Map([
+				["SecurityGroupIds", instanceSecurityGroupIdsChangeReplaces],
+				["BlockDeviceMappings", instanceBlockDeviceMappingsChangeReplaces],
+				["Tenancy", instanceTenancyChangeReplaces],
+				["PrivateDnsNameOptions", instancePrivateDnsNameOptionsChangeReplaces]
+			])
 		});
 		this.rules.set("AWS::EC2::NatGateway", {
 			replacementProperties: /* @__PURE__ */ new Set(),
@@ -16689,63 +16721,57 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::EC2::Instance", {
 		handled: /* @__PURE__ */ new Set([
+			"AdditionalInfo",
 			"AvailabilityZone",
 			"BlockDeviceMappings",
+			"CpuOptions",
 			"CreditSpecification",
 			"DisableApiTermination",
 			"EbsOptimized",
+			"HibernationOptions",
 			"IamInstanceProfile",
 			"ImageId",
+			"InstanceInitiatedShutdownBehavior",
 			"InstanceType",
+			"Ipv6AddressCount",
+			"Ipv6Addresses",
 			"KeyName",
 			"MetadataOptions",
 			"Monitoring",
 			"NetworkInterfaces",
+			"PlacementGroupName",
+			"PrivateDnsNameOptions",
+			"PrivateIpAddress",
+			"PropagateTagsToVolumeOnCreation",
 			"SecurityGroupIds",
 			"SecurityGroups",
+			"SourceDestCheck",
 			"SubnetId",
 			"Tags",
+			"Tenancy",
 			"UserData"
 		]),
 		sdkUnwired: /* @__PURE__ */ new Map([
-			["AdditionalInfo", "not yet implemented by cdkd"],
 			["Affinity", "not yet implemented by cdkd"],
-			["CpuOptions", "not yet implemented by cdkd"],
 			["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"],
 			["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"],
 			["EnclaveOptions", "not yet implemented by cdkd"],
-			["HibernationOptions", "not yet implemented by cdkd"],
 			["HostId", "not yet implemented by cdkd"],
 			["HostResourceGroupArn", "not yet implemented by cdkd"],
-			["InstanceInitiatedShutdownBehavior", "not yet implemented by cdkd"],
-			["Ipv6AddressCount", "not yet implemented by cdkd"],
-			["Ipv6Addresses", "not yet implemented by cdkd"],
 			["KernelId", "not yet implemented by cdkd"],
 			["LaunchTemplate", "not yet implemented by cdkd"],
 			["LicenseSpecifications", "not yet implemented by cdkd"],
-			["PlacementGroupName", "not yet implemented by cdkd"],
-			["PrivateDnsNameOptions", "not yet implemented by cdkd"],
-			["PrivateIpAddress", "not yet implemented by cdkd"],
-			["PropagateTagsToVolumeOnCreation", "not yet implemented by cdkd"],
 			["RamdiskId", "not yet implemented by cdkd"],
-			["SourceDestCheck", "not yet implemented by cdkd"],
 			["SsmAssociations", "not yet implemented by cdkd"],
-			["Tenancy", "not yet implemented by cdkd"],
 			["Volumes", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
-			"CpuOptions",
 			"ElasticGpuSpecifications",
 			"ElasticInferenceAccelerators",
 			"EnclaveOptions",
-			"HibernationOptions",
 			"HostResourceGroupArn",
-			"Ipv6AddressCount",
-			"Ipv6Addresses",
 			"LaunchTemplate",
-			"LicenseSpecifications",
-			"PlacementGroupName",
-			"PrivateIpAddress"
+			"LicenseSpecifications"
 		]),
 		readOnly: /* @__PURE__ */ new Set([
 			"InstanceId",
@@ -16936,18 +16962,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EnableDnsHostnames",
 			"EnableDnsSupport",
 			"InstanceTenancy",
-			"Tags"
-		]),
-		sdkUnwired: /* @__PURE__ */ new Map([
-			["Ipv4IpamPoolId", "not yet implemented by cdkd"],
-			["Ipv4NetmaskLength", "not yet implemented by cdkd"],
-			["VpcEncryptionControl", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
 			"Ipv4IpamPoolId",
 			"Ipv4NetmaskLength",
+			"Tags",
 			"VpcEncryptionControl"
 		]),
+		sdkUnwired: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"CidrBlockAssociations",
 			"DefaultNetworkAcl",
@@ -18032,6 +18053,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"AutoMinorVersionUpgrade",
 			"BackupRetentionPeriod",
 			"CopyTagsToSnapshot",
+			"DatabaseInsightsMode",
 			"DatabaseName",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
@@ -18041,9 +18063,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EnableHttpEndpoint",
 			"EnableIAMDatabaseAuthentication",
 			"Engine",
+			"EngineLifecycleSupport",
 			"EngineVersion",
 			"KmsKeyId",
 			"ManageMasterUserPassword",
+			"MasterUserAuthenticationType",
 			"MasterUsername",
 			"MasterUserPassword",
 			"MasterUserSecret",
@@ -18069,7 +18093,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AvailabilityZones", "not yet implemented by cdkd"],
 			["BacktrackWindow", "not yet implemented by cdkd"],
 			["ClusterScalabilityType", "not yet implemented by cdkd"],
-			["DatabaseInsightsMode", "not yet implemented by cdkd"],
 			["DBClusterInstanceClass", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
@@ -18078,11 +18101,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["EnableGlobalWriteForwarding", "not yet implemented by cdkd"],
 			["EnableLocalWriteForwarding", "not yet implemented by cdkd"],
-			["EngineLifecycleSupport", "not yet implemented by cdkd"],
 			["EngineMode", "not yet implemented by cdkd"],
 			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
 			["Iops", "not yet implemented by cdkd"],
-			["MasterUserAuthenticationType", "not yet implemented by cdkd"],
 			["ReplicationSourceIdentifier", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
@@ -18140,11 +18161,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EnableIAMDatabaseAuthentication",
 			"EnablePerformanceInsights",
 			"Engine",
+			"EngineLifecycleSupport",
 			"EngineVersion",
 			"Iops",
 			"KmsKeyId",
 			"LicenseModel",
 			"ManageMasterUserPassword",
+			"MasterUserAuthenticationType",
 			"MasterUsername",
 			"MasterUserPassword",
 			"MasterUserSecret",
@@ -18188,8 +18211,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DomainFqdn", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["DomainOu", "not yet implemented by cdkd"],
-			["EngineLifecycleSupport", "not yet implemented by cdkd"],
-			["MasterUserAuthenticationType", "not yet implemented by cdkd"],
 			["NcharCharacterSetName", "not yet implemented by cdkd"],
 			["ProcessorFeatures", "not yet implemented by cdkd"],
 			["ReplicaMode", "not yet implemented by cdkd"],
@@ -22181,6 +22202,7 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 	const prefix = context.stateBackend?.prefix ?? "cdkd";
 	const s3 = new S3Client({
 		...awsClientDefaults(),
+		...s3ClientDefaults(),
 		region: bucketRegion,
 		credentials: {
 			accessKeyId: credentials.accessKeyId,
@@ -26084,7 +26106,11 @@ const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 ]);
 const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({
 	"AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]),
-	"AWS::EC2::Instance": /* @__PURE__ */ new Set(["PublicIp", "PublicDnsName"])
+	"AWS::EC2::Instance": /* @__PURE__ */ new Set([
+		"PublicIp",
+		"PublicDnsName",
+		"PrivateDnsName"
+	])
 });
 const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
 const REF_READ = "<Ref>";
@@ -28559,6 +28585,7 @@ var CloudControlProvider = class {
 				redirected = true;
 				const regional = new S3Client({
 					...awsClientDefaults(),
+					...s3ClientDefaults(),
 					region: redirectRegion,
 					credentials: first.config?.credentials,
 					logger: quietS3Logger()
@@ -28608,7 +28635,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-4rNFSmz9.js");
+			const { ASGProvider } = await import("./asg-provider-D1KLOLzB.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28717,7 +28744,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-C8enyD9d.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BqtKFZaE.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-C6299G23.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D4a9cJ2i.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29653,6 +29680,57 @@ function maskLeavesDeep(value) {
 	return "***";
 }
 
+// src/provisioning/providers/custom-resource-response-endpoint.ts
+const CR_S3_ENDPOINT_ENV = "CDKD_CR_S3_ENDPOINT_URL";
+function refuse(reason) {
+	throw new CdkdError(`${CR_S3_ENDPOINT_ENV} ${reason}. Set it to an http:// or https:// endpoint (e.g. http://s3:4566) that the custom resource's Lambda can reach, or unset it.`, "INVALID_CR_S3_ENDPOINT_URL");
+}
+function customResourceS3Endpoint(env = process.env) {
+	const raw = env[CR_S3_ENDPOINT_ENV];
+	if (raw === void 0 || raw === "") return void 0;
+	const value = raw.trim();
+	if (value === "") refuse("is set to whitespace only");
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		refuse("is not a URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") refuse("must use http:// or https://");
+	if (parsed.username !== "" || parsed.password !== "") refuse("must not carry user info");
+	if (parsed.search !== "" || parsed.hash !== "") refuse("must not carry a query or fragment");
+	return {
+		url: value,
+		origin: parsed.origin
+	};
+}
+const presignClients = /* @__PURE__ */ new WeakMap();
+function responsePresignClient(base, endpoint) {
+	const cached = presignClients.get(base);
+	if (cached !== void 0 && cached.url === endpoint.url) return cached.client;
+	const client = buildPresignClient(base, endpoint);
+	presignClients.set(base, {
+		url: endpoint.url,
+		client
+	});
+	client.catch(() => {
+		if (presignClients.get(base)?.client === client) presignClients.delete(base);
+	});
+	return client;
+}
+async function buildPresignClient(base, endpoint) {
+	const config = base.config;
+	const region = typeof config?.region === "function" ? await config.region() : void 0;
+	const credentials = config?.credentials;
+	return new S3Client({
+		...ambientClientDefaults(),
+		...s3ClientDefaults({ explicitEndpoint: true }),
+		...typeof region === "string" && region !== "" && { region },
+		...credentials !== void 0 && { credentials },
+		endpoint: endpoint.url
+	});
+}
+
 // src/state/state-bucket-lifecycle.ts
 const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID = "cdkd-custom-resource-responses-expiration";
 const CUSTOM_RESOURCE_RESPONSE_EXPIRATION_DAYS = 1;
@@ -30504,6 +30582,15 @@ const CR_TRANSIENT_AUTHZ_LOG_SIGNALS = [
 	"access denied"
 ];
 const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
+const CR_RECYCLE_DESCRIPTION_PREFIX = "cdkd: recycled for IAM-propagation retry (";
+const CR_RECYCLE_RESTORE_CONFLICT_RETRIES = 2;
+const CR_RECYCLE_RESTORE_CONFLICT_WAIT_SECONDS = 60;
+const CR_RECYCLE_BUDGET_SECONDS = 240;
+const CR_RECYCLE_MIN_WAIT_SECONDS = 2;
+function recycleFunctionKey(serviceToken) {
+	if (!LAMBDA_FUNCTION_ARN.test(serviceToken)) return serviceToken;
+	return serviceToken.split(":").slice(0, 7).join(":");
+}
 const CR_AUTHZ_MAX_RETRIES_DEFAULT = 2;
 const CR_AUTHZ_MAX_RETRIES_CEILING = 10;
 const CR_ERROR_CAUSE_MAX_DEPTH = 5;
@@ -30573,6 +30660,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 	responseClientResolveInFlight = null;
 	responseClientGeneration = 0;
 	ownsS3Client = false;
+	recycleChains = /* @__PURE__ */ new Map();
+	originalDescriptions = /* @__PURE__ */ new Map();
 	disableOuterRetry = true;
 	SYNC_RESPONSE_TIMEOUT_MS = 3e4;
 	asyncResponseTimeoutMs;
@@ -30928,22 +31017,95 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 	async recycleBackingFunctionExecEnv(serviceToken, logicalId, mask) {
 		if (this.isSnsServiceToken(serviceToken)) return;
+		const key = recycleFunctionKey(serviceToken);
+		const run = (this.recycleChains.get(key) ?? Promise.resolve()).then(() => this.recycleAndRestore(serviceToken, key, logicalId, mask));
+		const tail = run.catch(() => void 0);
+		this.recycleChains.set(key, tail);
+		try {
+			await run;
+		} finally {
+			if (this.recycleChains.get(key) === tail) this.recycleChains.delete(key);
+		}
+	}
+	async recycleAndRestore(serviceToken, key, logicalId, mask) {
+		const deadline = Date.now() + CR_RECYCLE_BUDGET_SECONDS * 1e3;
+		const remaining = (cap) => Math.min(cap, Math.floor((deadline - Date.now()) / 1e3));
+		const original = await this.readOriginalDescription(serviceToken, key, logicalId, mask);
 		const rejections = new WaiterRejections();
 		try {
 			await this.lambdaClient.send(new UpdateFunctionConfigurationCommand({
 				FunctionName: serviceToken,
-				Description: `cdkd: recycled for IAM-propagation retry (${logicalId})`
+				Description: `${CR_RECYCLE_DESCRIPTION_PREFIX}${logicalId})`
 			}));
-			await waitUntilFunctionUpdatedV2({
-				client: observingLambdaClient(this.lambdaClient, rejections),
-				maxWaitTime: 120,
-				minDelay: 1,
-				maxDelay: 5
-			}, { FunctionName: serviceToken });
 		} catch (error) {
-			this.logger.debug(`Could not recycle backing function for ${logicalId} (${withholdWaiterPayload(error, rejections, (line) => this.logger.debug(maskerOrIdentity(mask)(line))) ?? (error instanceof Error && carriesResponseBody(error) ? `${error.name} (response body withheld)` : describeAwsFailure(error).detail)}); retrying invoke without a forced cold start`);
+			this.logger.debug(safeMsg`Could not recycle backing function for ${logicalId} (${this.describeRecycleFailure(error, rejections, mask)}); retrying invoke without a forced cold start`);
+			return;
+		}
+		try {
+			await this.waitForBackingFunctionUpdated(serviceToken, rejections, remaining(120));
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not recycle backing function for ${logicalId} (${this.describeRecycleFailure(error, rejections, mask)}); retrying invoke without a forced cold start`);
 			this.debugWaiterRejections(logicalId, rejections);
 		}
+		if (original === void 0) {
+			this.logger.debug(safeMsg`Not restoring the backing function's Description for ${logicalId}: its prior value could not be read`);
+			return;
+		}
+		const restoreRejections = new WaiterRejections();
+		for (let attempt = 0;; attempt++) try {
+			await this.lambdaClient.send(new UpdateFunctionConfigurationCommand({
+				FunctionName: serviceToken,
+				Description: original
+			}));
+			break;
+		} catch (error) {
+			const conflictWait = remaining(CR_RECYCLE_RESTORE_CONFLICT_WAIT_SECONDS);
+			if (error instanceof Error && error.name === "ResourceConflictException" && attempt < CR_RECYCLE_RESTORE_CONFLICT_RETRIES && conflictWait >= CR_RECYCLE_MIN_WAIT_SECONDS) {
+				const conflictRejections = new WaiterRejections();
+				try {
+					await this.waitForBackingFunctionUpdated(serviceToken, conflictRejections, conflictWait);
+				} catch {}
+				continue;
+			}
+			this.logger.debug(safeMsg`Could not restore the backing function's Description after the recycle for ${logicalId} (${this.describeRecycleFailure(error, restoreRejections, mask)}); \`cdkd drift\` will report it until the function is next updated`);
+			return;
+		}
+		const settleWait = remaining(120);
+		if (settleWait < CR_RECYCLE_MIN_WAIT_SECONDS) {
+			this.logger.debug(safeMsg`Restored the backing function's Description after the recycle for ${logicalId}, but the recycle's time budget ran out before the update settled`);
+			return;
+		}
+		try {
+			await this.waitForBackingFunctionUpdated(serviceToken, restoreRejections, settleWait);
+		} catch (error) {
+			this.logger.debug(safeMsg`Restored the backing function's Description after the recycle for ${logicalId}, but the update did not settle (${this.describeRecycleFailure(error, restoreRejections, mask)})`);
+			this.debugWaiterRejections(logicalId, restoreRejections);
+		}
+	}
+	async readOriginalDescription(serviceToken, key, logicalId, mask) {
+		let current;
+		try {
+			const config = await this.lambdaClient.send(new GetFunctionConfigurationCommand({ FunctionName: serviceToken }));
+			if (config.FunctionName !== void 0) current = config.Description ?? "";
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not read the backing function's Description for ${logicalId} before recycling it (${this.describeRecycleFailure(error, new WaiterRejections(), mask)})`);
+		}
+		if (current !== void 0 && !current.startsWith(CR_RECYCLE_DESCRIPTION_PREFIX)) {
+			this.originalDescriptions.set(key, current);
+			return current;
+		}
+		return this.originalDescriptions.get(key);
+	}
+	async waitForBackingFunctionUpdated(serviceToken, rejections, maxWaitTime = 120) {
+		await waitUntilFunctionUpdatedV2({
+			client: observingLambdaClient(this.lambdaClient, rejections),
+			maxWaitTime,
+			minDelay: 1,
+			maxDelay: 5
+		}, { FunctionName: serviceToken });
+	}
+	describeRecycleFailure(error, rejections, mask) {
+		return withholdWaiterPayload(error, rejections, (line) => this.logger.debug(maskerOrIdentity(mask)(line))) ?? (error instanceof Error && carriesResponseBody(error) ? `${error.name} (response body withheld)` : describeAwsFailure(error).detail);
 	}
 	debugWaiterRejections(logicalId, rejections) {
 		for (const line of waiterRejectionDebugLines(rejections)) this.logger.debug(safeMsg`Readiness waiter for ${logicalId} observed ${line}`);
@@ -31091,6 +31253,12 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 	async generateResponseURL(responseKey, logicalId, watch, mask) {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
+		let signingEndpoint;
+		try {
+			signingEndpoint = customResourceS3Endpoint();
+		} catch (error) {
+			throw markNonRetryable(error);
+		}
 		await this.ensureResponseClient();
 		const bucket = this.responseBucket;
 		if (this.responsePrefix === "custom-resource-responses") ensureCustomResourceResponseExpirationOnce(this.s3Client, bucket, this.logger);
@@ -31117,7 +31285,12 @@ var CustomResourceProvider = class CustomResourceProvider {
 			Bucket: this.responseBucket,
 			Key: responseKey
 		});
-		const presignedUrl = await getSignedUrl(this.s3Client, command, { expiresIn: 7200 });
+		let signer = this.s3Client;
+		if (signingEndpoint !== void 0) {
+			signer = await responsePresignClient(this.s3Client, signingEndpoint);
+			this.logger.debug(safeMsg`Signing the custom resource ResponseURL for ${CR_S3_ENDPOINT_ENV} (${signingEndpoint.origin})`);
+		}
+		const presignedUrl = await getSignedUrl(signer, command, { expiresIn: 7200 });
 		this.logger.debug(`Generated pre-signed URL for response: s3://${displaySafe(this.responseBucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}`);
 		return presignedUrl;
 	}
@@ -39490,9 +39663,8 @@ function deepEqual$1(a, b) {
 	}
 	const aObj = a;
 	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	const bKeys = Object.keys(bObj);
-	if (aKeys.length !== bKeys.length) return false;
+	const aKeys = definedKeys(aObj);
+	if (aKeys.length !== definedKeys(bObj).length) return false;
 	for (const key of aKeys) {
 		if (!Object.prototype.hasOwnProperty.call(bObj, key)) return false;
 		if (!deepEqual$1(aObj[key], bObj[key])) return false;
@@ -39512,8 +39684,8 @@ function equalModuloMask(state, aws, mask) {
 	}
 	const aObj = a;
 	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	if (aKeys.length !== Object.keys(bObj).length) return false;
+	const aKeys = definedKeys(aObj);
+	if (aKeys.length !== definedKeys(bObj).length) return false;
 	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
 }
 function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinMarked = isMarked) {
@@ -39533,14 +39705,14 @@ function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinM
 	}
 	const aObj = a;
 	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	if (aKeys.length !== Object.keys(bObj).length) return false;
+	const aKeys = definedKeys(aObj);
+	if (aKeys.length !== definedKeys(bObj).length) return false;
 	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked, isWithinMarked));
 }
 function wholeMaskOf(value, mask) {
 	if (value === null || value === void 0) return value;
 	if (Array.isArray(value)) return value.map((v) => wholeMaskOf(v, mask));
-	if (isPlainObject$5(value)) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
+	if (isPlainObject$5(value)) return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
 	return mask;
 }
 function isWhollyMask$1(value, mask) {
@@ -39567,8 +39739,11 @@ function sameJson(a, b) {
 	}
 	const aObj = a;
 	const bObj = b;
-	const keys = Object.keys(aObj);
-	return keys.length === Object.keys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
+	const keys = definedKeys(aObj);
+	return keys.length === definedKeys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
+}
+function definedKeys(obj) {
+	return Object.keys(obj).filter((k) => obj[k] !== void 0);
 }
 function isPlainObject$5(value) {
 	return typeof value === "object" && value !== null;
@@ -55860,4 +56035,4 @@ function sameGenerationClaimsOf(record) {
 }
 
 export { isTtlRateLimited as $, recordedReferenceRegions as $a, createUnionSecretMasker as $c, stringifyIfAssigned as $i, exportNamesCarriedFrom as $l, nameGenerationCarriedFrom as $n, malformedOrphanRecordsWarning as $o, addSuperseded as $r, findReplacedReadersOfRecreateTargets as $s, deleteJournaledOrphans as $t, synthesisStatusMessage as $u, resolvedResourceTimeoutMs as A, reEnableInstanceApiTermination as Aa, sameLambdaFunctionAddress as Ac, defineOwnKey as Ad, createPreDeleteFinalSnapshot as Ai, recordMaskOnlyValue as Al, equalModuloMarkedMask as An, parameterInputsFor as Ao, formatDestructiveChange as Ar, refuseMalformedResourcePropertiesForExport as As, isSecretBearingReferenceString as At, validateContainerRepoName as Au, DELETE_INDEX_WAIT_PROCEED_NOTE as B, poisonRenderedSpellingsCollidingIn as Ba, noEchoLeavesOf as Bc, injectAwsRegion as Bd, DeploymentEventsReader as Bi, S3StateBackend as Bl, replacementNeverSwapped as Bn, displayLogicalId as Bo, proposeRenames as Br, repairMalformedResourcePropertiesForReadOnly as Bs, NESTED_PENDING_PARENT_REASON as Bt, getDockerCmd as Bu, planContributorInsightsOp as C, withIndeterminateGuard as Ca, withRetry as Cc, derivePartitionAndUrlSuffix as Cd, secretNamedRecordNeedles as Ci, recoverMaskedOutput as Cl, replayFailedOperations as Cn, AWS_NO_VALUE as Co, isExportAliasCollision as Cr, refuseMalformedResourceEntriesForDeploy as Cs, conditionInputsFrom as Ct, assertAssetBucketRegion as Cu, reverseMapTableContributorInsights as D, isTerminationProtectionPropagationError as Da, emrClusterInstancesReplaced as Dc, describeJsonParseFailure as Dd, PRE_DELETE_SNAPSHOT_TYPES as Di, splitGetAttStringForm as Dl, settleUnsettledPrevious as Dn, refStateLookupFromResource as Do, maskingRetryLogger as Dr, refuseMalformedResourceEntriesForOrphan as Ds, enclosingDeadlineRemainingMs as Dt, parseBootstrapMarker as Du, reverseMapIndexContributorInsights as E, ec2InstanceProtectionSite as Ea, ecsServiceLaunchTypeSetOrChanged as Ec, processStackMessages as Ed, ATOMIC_FINAL_SNAPSHOT_TYPES as Ei, recordPhysicalNameCopy as El, recordAfterRollbackUpdate as En, lacksRecordedTableArn as Eo, DEFAULT_RESOURCE_WARN_AFTER_MS as Er, refuseMalformedResourceEntriesForImportSave as Es, enclosingDeadlineExpired as Et, isCrossRegionRedirect as Eu, beginDeleteWait as F, unsettledItemsOf as Fa, maskAtCoordinates as Fc, absoluteAssemblyPathEscape as Fd, earliestDefined as Fi, wholeStringLeavesOf as Fl, isReplacementOrphan as Fn, STATE_RESOURCES_MALFORMED as Fo, withMovedTo as Fr, refuseMalformedState as Fs, planOrphanAdoption as Ft, describeDockerExecFailure as Fu, relayedIndexBusyDelete as G, s3BucketRegionalDomainName as Ga, recordedNoEchoValuesOf as Gc, DBPROXY_TAGS_WHAT as Gi, crossPrefixDeniedWarning as Gl, getCurrentProducerRegions as Gn, isReadableResourceEntry as Go, withStackRecords as Gr, withheldAccountClause as Gs, nestedChildStackName as Gt, redactedCause as Gu, TABLE_INDEX_NOUN as H, s3BucketArn as Ha, passedNoEchoParametersOf as Hc, clearBucketRegionCache as Hd, extractDeploymentEventError as Hi, CrossPrefixReadError as Hl, seedsDeleteFirstGuard as Hn, hasReadableOutputs as Ho, awaitInFlightSibling as Hr, unpreviewableOrphanRecords as Hs, displacedPhysicalIdShown as Ht, isMalformedEnvKey as Hu, compensateRemovedDeletionProtection as I, unsettledPropertiesOf as Ia, maskReadbackAtCoordinates as Ic, describeFileReadFailure as Id, ledgerForStack as Ii, WHOLE_DYNAMIC_REFERENCE_PATTERN as Il, planFailedOps as In, UNREADABLE_ORPHANS_CONTAINER_ROW as Io, isPairableType as Ir, repairMalformedOrphanRecordsForReadOnly as Is, pendingRequestCount as It, describeDockerFailure as Iu, readbackVectorIndexes as J, producerLookupOver as Ja, markSameGenerationBag as Jc, readTagList as Ji, stackInstanceIdOf as Jl, isRedactedRecordedValue as Jn, malformedExportSourceWarning as Jo, cyan as Jr, findSdkUnwiredProperties as Js, revertedNestedRowIds as Jt, runDockerStreaming as Ju, waitForIndexesSettled as K, s3BucketWebsiteUrl as Ka, valueAtCoordinate as Kc, DBPROXY_TAG_OPTIONS as Ki, isAccessDenied$1 as Kl, inheritProducerRegions as Kn, malformedDriftResourcePropertiesWarning as Ko, replacedDeleteFailureVerdict as Kr, findActionableSdkUnwired as Ks, recordDisplacedSkips as Kt, redactedDockerCause as Ku, deleteBudgetKey as L, withUnsettledProperties as La, maskWholeValue as Lc, displayAssemblyPath as Ld, reserveStackCreateToken as Li, isSingleDynamicReferenceToken as Ll, planRollback as Ln, UNREADABLE_RESOURCES_MAP_ROW as Lo, looselyEqual as Lr, repairMalformedOrphansForReadOnly as Ls, resolvePendingCloudControlRequests as Lt, dockerSpawnEnvWithSensitive as Lu, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as M, INTRINSIC_KEYS as Ma, TemplateParser as Mc, hasPlainPrototype$1 as Md, isFinalSnapshotError as Mi, recordNoEchoAttributeValues as Ml, undeclaredEmptyObservedKeys as Mn, declaresNoEcho as Mo, hintSidesOf as Mr, refuseMalformedResourcesForDeploy as Ms, mergeNoChangeOutputs as Mt, buildDockerImage as Mu, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as N, isUsableAttemptedName as Na, canonicalCoordinates as Nc, nullPrototypeRecord as Nd, refusesFinalSnapshot as Ni, recordNoEchoParameterFreshValue as Nl, demoteSupersededOrphans as Nn, JSON_LISTING_HOLE_VALUE as No, movedToHint as Nr, refuseMalformedResourcesForDestroy as Ns, makeCanonicalizePropertiesFn as Nt, resolveDockerContextDirectory as Nu, stripIndexContributorInsights as O, observeThenDisableInstanceApiTermination as Oa, canonicalLambdaFunctionName as Oc, parseFailureDebugDetail as Od, buildFinalSnapshotIdentifier as Oi, carriesSecretMask as Ol, withUnprovenUnsettled as On, parseWebACLArn as Oo, constructPathOf as Or, refuseMalformedResourcePropertiesForDestroy as Os, withResourceDeadline as Ot, readBootstrapMarkerBody as Ou, DYNAMODB_DELETE_POLL_COST_MS as P, unsettledItemsField as Pa, isMarkedCoordinate as Pc, ownValue as Pd, unsupportedFinalSnapshotError as Pi, recordProvenPublicExpression as Pl, isJournaledOrphan as Pn, STATE_REGION_DIVERGED as Po, rollbackOrphanIds as Pr, refuseMalformedResourcesForExport as Ps, makeSiblingClaimReader as Pt, describeDockerCapturedOutput as Pu, isTtlAlreadyDisabled as Q, recordedOutputReferenceRegions as Qa, carryLogOnlyValues as Qc, definedAttributes as Qi, describeRegionValueKind as Ql, updatePartialReason as Qn, malformedOrphanRecordsRefusalMessage as Qo, yellow as Qr, hasNoCloudControlHandlers as Qs, withNestedStackContext as Qt, Synthesizer as Qu, resolveDynamoDbDeleteBudgetClock as R, withoutUnsettledProperties as Ra, maskedLeafCoordinatesOf as Rc, renderAssemblyPathEscape as Rd, withCreateTokenLedger as Ri, LockManager as Rl, recheckFailedPlan as Rn, accountArgs as Ro, mappingPairs as Rr, repairMalformedOutputsForReadOnly as Rs, keptForRetainedRecord as Rt, finchSecretArgvRefusal as Ru, indexDeclaresContributorInsights as S, deleteSkipReason as Sa, describeTypeWithThrottleRetry as Sc, canonicalizeRegion as Sd, secretNamedAttributeNamesOf as Si, recordNestedStackParameterExpressions as Sl, refusePendingMovesOut as Sn, keepsSecretReferenceToken as So, collectPublishedOutputNames as Sr, refuseMalformedResourceEntries as Ss, conditionFingerprint as St, BOOTSTRAP_MARKER_PREFIX as Su, readContributorInsightsSpec as T, disableInstanceApiTermination as Ta, dbInstanceEngineChangeIsInPlace as Tc, StageLoadError as Td, storedSecretNameNeedles as Ti, recordAttributeIdCopy as Tl, removeProtectionTypeList as Tn, isStalePlaceholderArnAttribute as To, DEFAULT_RESOURCE_TIMEOUT_MS as Tr, refuseMalformedResourceEntriesForImport as Ts, readRecordedConditionVerdicts as Tt, getBootstrapMarkerKey as Tu, deleteTableWithIndexBusyRetry as U, s3BucketDomainName as Ua, readbackPathFor as Uc, resolveBucketRegion as Ud, isRefusedByName as Ui, CrossPrefixScanCache as Ul, orphanNeedsIdentity as Un, hasReadableResources as Uo, destroyStackRecordsView as Ur, unreadableOrphanRecords as Us, dropSettledNestedJournals as Ut, partitionSensitiveEnv as Uu, INDEX_SETTLE_POLL_INTERVAL_MS as V, isSettledInstanceState as Va, noEchoOutputsComparison as Vc, injectedAwsRegionValue as Vd, DeploymentEventsStore as Vi, rebuildClientForBucketRegion as Vl, resolveReplacementOldType as Vn, hasReadableOrphans as Vo, refuseRestoreFromItself as Vr, repairMalformedResourcesForReadOnly as Vs, displacedOpClause as Vt, isDockerClientEnvKey as Vu, maskedLogger as W, s3BucketDualStackDomainName as Wa, readsNoEchoSource as Wc, markDeleteStarted as Wi, applyCrossPrefixScan as Wl, findNestedStackTypeChanges as Wn, isReadableOrphanRecord as Wo, getStackRecords as Wr, unreadableResourceEntries as Ws, getNestedRevertRun as Wt, redactDockerArgvValues as Wu, vectorIndexesSettled as X, keepHeldTokenProvenance as Xa, recordReferenceProvenanceEntry as Xc, tagMapAsList as Xi, splitImportedOps as Xl, redactedDeleteAddressSkip as Xn, malformedLocalResourceEntriesWarning as Xo, green as Xr, withoutSdkUnwiredProperties as Xs, collectNestedChildUnaddressed as Xt, AssetManifestLoader as Xu, vectorIndexesForCreate as Y, refuseUnreadableCdkCrossAccountRefs as Ya, redactForState as Yc, refuseMalformedDesiredTags as Yi, withStackInstanceIdWithheld as Yl, redactedDeleteAddressFields as Yn, malformedLocalOutputsWarning as Yo, gray as Yr, unwrittenCreateOnlyReplacement as Ys, withNestedRevertRun as Yt, warnFinchArgvExposure as Yu, vectorIndexesShapeDetail as Z, outputReferenceProvenanceOf as Za, snapshotPassProvenance as Zc, tagPlanWarning as Zi, acceptedCreateOnlyDropsOf as Zl, updatePartialMessage as Zn, malformedLocalResourcesWarning as Zo, red as Zr, NO_CC_HANDLERS_REASON as Zs, getCurrentNestedStackContext as Zt, getDockerImageBySourceHash as Zu, streamMemberRefusals as _, unchangedBehindSecretReference as _a, requireConfigArray as _c, uploadCfnTemplate as _d, maskEventTextWithBoundBags as _i, isUncertifiedBaselineMaskPosition as _l, sameMove as _n, getAccountInfo as _o, exportNameNoEchoParameters as _r, refuseMalformedOrphansForDestroy as _s, findNestedTemplateTreeDefect as _t, buildAssetRedirectMap as _u, isProtectionValueActive as a, waitForLambdaFunctionActive as aa, WARM_THROUGHPUT_MEMBERS as ac, resolveCaptureObservedState as ad, supersededHeldByOtherTypeWarning as ai, recordLogOnlyValue as al, makeForeignHolderScan as an, sendableAssumeRoleCommand as ao, withNameGenerationReached as ar, malformedRenderedContainersWarning as as, hasCdkAutoDeleteTag as at, isReadableBag as au, CONTRIBUTOR_INSIGHTS_KEY as b, deleteIndeterminateGuards as ba, prefetchCreateOnlyPropertyPaths as bc, expectedOwnerParam as bd, secretNamePrintingBag as bi, identityKeyFor as bl, pendingMovesOutOf as bn, carriesFetchableDynamicReference as bo, noEchoParameterValueSeed as br, refuseMalformedOutputsForDestroy as bs, renderNestedTemplateTreeDefect as bt, rewriteTemplateAssetReferences as bu, DynamoDBGlobalTableProvider as c, isCustomResourceType as ca, toCfnInteger as cc, resolveStateBucketWithDefaultAndSource as cd, withoutSuperseded as ci, createSecretMasker as cl, chunks as cn, callerEnvCredentials as co, reachableDivergentParameters as cr, malformedResourcesWarning as cs, markRefusedBeforeApplying as ct, shouldRetainResource as cu, declaredStreamPolicyMember as d, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as da, coerceCfnInteger as dc, warnDeprecatedNoPrefixCliFlag as dd, noEchoExactEchoLeavesOf as di, maskSecretsInText as dl, withApiLimit as dn, classifyReplaySecretRegion as do, displayTextOrWithheld as dr, previewableOrphanRecords as ds, crossStackOutputProvenanceSource as dt, renderPhaseTimings as du, CC_BROKEN_REASON as ea, shownType as ec, getDefaultStateBucketName as ed, deleteSupersededEntry as ei, hasMaskableValues as el, dropFailedCommands as en, applyRoleArnIfSet as eo, nameGenerationHighWaterOf as er, malformedOrphanRowsKeptWarning as es, planTimeToLive as et, hasReadableExportSet as eu, declaredStreamTagsMember as f, applyCustomResourceResponseExpiration as fa, configBooleanRefusal as fc, ssmResolvedValueType as fd, noEchoParameterNamesOf as fi, scrubResourceRecord as fl, readRefactorMarker as fn, producerRegionsFromState as fo, exportAliasCollisionScrubWarning as fr, refuseDivergentRecordRegionForDestroy as fs, inheritedProvenanceForChildDiff as ft, timePhase as fu, streamDeclaresTags as g, onlySecretReferencesDiffer as ga, replayWarn as gc, findLargeInlineResources as gd, journaledOrphanPrintingBag as gi, dynamicReferenceTokens as gl, refuseRefactorMarker as gn, parameterTypeMayLoseSecretIdentity as go, carriedExportAliasExposure as gr, refuseMalformedOrphans as gs, childTemplateLoader as gt, WorkGraph as gu, streamDeclaresPolicy as h, slowCcOperationTimeoutMs as ha, readConfigString as hc, MIGRATE_TMP_PREFIX as hd, completedReplayEntries as hi, DYNAMIC_REFERENCE_TOKEN_SCAN as hl, refactorMarkerRefusalMessage as hn, isUnboundTemplateParameter as ho, secretSafeKeyDisplay as hr, refuseMalformedOrphanRecordsForDestroy as hs, serviceTokenBlockingReason as ht, stringifyValue as hu, PROTECTION_PROPERTY_BY_TYPE as i, wouldReturnToSdkProvider as ia, renderStatefulReason as ic, resolveAutoAssetStorage as id, supersededAfterRollback as ii, recordLogOnlyParameterValue as il, loadJournaledOrphans as in, isIamRoleArn as io, retiredNameGenerationsLeaving as ir, malformedOutputsWarning as is, S3_AUTO_DELETE_OBJECTS_TAG as it, importableOutputs as iu, setResolvedResourceTimeouts as j, DiffCalculator as ja, DagBuilder as jc, hasOwnKey as jd, effectiveDeletionPolicy as ji, recordMaskOnlyValuesIn as jl, equalModuloMask as jn, passedParameterClassesOf as jo, findRefactorHints as jr, refuseMalformedResourcePropertiesForOrphan as js, keptWholeReasonText as jt, buildDenyExternalAccessPolicy as ju, waitForGoneAfterDelete as k, reDisableInstanceApiTermination as ka, lambdaFunctionNameForMask as kc, utf8ByteLength as kd, ccRoutedFinalSnapshotError as ki, provenPublicValue as kl, calculateResourceDrift as kn, withSharedDrainBudget as ko, findDestructiveChanges as kr, refuseMalformedResourcePropertiesForDrift as ks, diffSecurity as kt, validateAssetBucketName as ku, STREAM_POLICY_KEY as l, getCurrentResourceSecrets as la, toFiniteNumber as lc, resolveUseCdkBootstrapAssets as ld, noEchoAttributeNamesOf as li, errorCauseChain as ll, isAccessDeniedError as ln, envCredentialsAreAssumedRole as lo, resourcesNamingDeclaredParameter as lr, malformedScrubResourceEntriesRefusalMessage as ls, IMPLICIT_DELETE_DEPENDENCIES as lt, stackInstanceIdCarriedFrom as lu, reverseMapStreamPolicy as m, CloudControlProvider as ma, configStringRefusal as mc, CFN_TEMPLATE_URL_LIMIT as md, createReadOnlyAttributeHealerFactory as mi, withoutPhysicalNameCopies as ml, refactorMarkerMovesOf as mn, coerceParameterTypedValue as mo, secretBearingStateKeyWarning as mr, refuseMalformedOrphanRecords as ms, findServiceTokenRefusals as mt, isSensitiveAttributeName as mu, recordedProtectionEvidence as n, ccBrokenReason as na, isStatefulRecreateTargetForReplace as nc, loadCdkJson as nd, isSupersededResourceRecord as ni, logOnlyValueCount as nl, isHandledOrphan as nn, assertSendableRoleArn as no, retiredAfterRollback as nr, malformedOrphansWarning as ns, sendTtlWaitingOutRateLimit as nt, hasUnverifiableParameterRefusal as nu, perType as o, TemplateNoEchoReresolver as oa, coerceWarmThroughput as oc, resolveSkipPrefix as od, supersededHolderOf as oi, shareLogOnlyValues as ol, sameJournaledOrphans as on, AWS_CREDENTIAL_ENV_KEYS as oo, computeParameterTaint as or, malformedResourceEntriesWarning as os, isTruthyCfnBoolean as ot, orphansAfterRollback as ou, planStreamMemberOps as p, customResourceResponseExpirationWarning as pa, configIntegerRefusal as pc, CFN_TEMPLATE_BODY_LIMIT as pd, withAttemptedItemsMasked as pi, withPhysicalNameCopies as pl, readRefactorMarkerOnce as pn, regionLessSecretName as po, secretBearing as pr, refuseMalformedNestedChildOutputs as ps, deferredServiceTokenWarning as pt, AssetPublisher as pu, planVectorIndexUpdates as q, resolveDynamicReferences as qa, liveMatchesUnresolvedTokenFrame as qc, planTagDiff as qi, isNotImplemented as ql, REDACTED_DELETE_ADDRESS_SKIP_REASON as qn, malformedExportNamesWarning as qo, bold as qr, findHandledUnwrittenCreateOnly as qs, revertNestedChildFromJournal as qt, runDockerForeground as qu, recordedProtectionNote as r, isCustomResource as ra, isStatefulRecreateTargetSync as rc, resolveApp as rd, removeSuperseded as ri, printingCorpusOf as rl, journaledOrphanLines as rn, explicitRoleArnOrThrow as ro, retiredNameGenerationsAfter as rr, malformedOutputsRefusalMessage as rs, ECR_AUTO_DELETE_IMAGES_TAG as rt, importableOutputKeys as ru, readProtection as s, readsNoEchoDeleteValues as sa, isWarmThroughputDecrease as sc, resolveStateBucketWithDefault as sd, supersededResourcesOf as si, unionOfSecretBags as sl, formatResourceLine as sn, applyCallerIdentityCredentials as so, namesAnyDeclaredParameter as sr, malformedResourcePropertiesWarning as ss, getPriorAttempts as st, orphansCarriedFrom as su, DeployEngine as t, ProviderRegistry as ta, MULTI_REGION_RECREATE_BLOCKED_TYPES as tc, getLegacyStateBucketName as td, holdsSupersededResources as ti, literalSplitDelimitersOf as tl, dropFailedHint as tn, assertFlagRoleArn as to, nameScopeOf as tr, malformedOrphansRefusalMessage as ts, readTtlSpec as tt, hasReasonlessBaselineRefusal as tu, STREAM_TAGS_KEY as u, withPrintingSecrets as ua, coerceCfnBoolean as uc, stateBucketExistenceConfirmed as ud, noEchoComparisonForTemplate as ui, maskSecretsInError as ul, lookupEachName as un, classifyRecordedSecretRegion as uo, WITHHELD_NAME_DISPLAY as ur, malformedStateRefusalMessage as us, computeImplicitDeleteEdges as ut, PhaseClock as uu, streamPolicyMatchesDeclared as v, RollbackInlinePolicyWriters as va, requireConfigObject as vc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vd, namingSecretsWithRecordedNoEcho as vi, pathCrossesDottedKey as vl, updateRefactorMarker as vn, isImpossibleEmptyStoredAttribute as vo, exportNameSecretExposure as vr, refuseMalformedOrphansForOrphan as vs, isAbsoluteAssetPath as vt, createAssetRedirectResolver as vu, planIndexContributorInsightsOps as w, isWaitAbandonedError as wa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as wc, AssemblyReader as wd, stateSecretNameNeedles as wi, physicalNameCopiesOf as wl, replayRollback as wn, cfnRefValueFromPhysicalId as wo, bindingSkippedOutputs as wr, refuseMalformedResourceEntriesForDestroy as ws, parentSuppliedValues as wt, ensureAssetStorage as wu, contributorInsightsRefusals as x, deleteLeftInPlace as xa, templateResourceTypes as xc, PARTITION_TABLE as xd, secretNamePrintingBags as xi, inheritNestedStackParameterAssociations as xl, pendingMovesRefusalMessage as xn, isNamelessDynamicReferenceError as xo, collectDeclaredOutputNames as xr, refuseMalformedResourceAttributesForOrphan as xs, templateIdentity as xt, AssetModeResolver as xu, streamTagsMatchDeclared as y, UNSPECIFIED_SKIP_REASON as ya, requireConfigString as yc, decodeListingKey as yd, orphanRecordsPrintingBag as yi, spelledKeysOf as yl, hasPendingMovesOut as yn, carriesDynamicReference as yo, isWholeDynamicReferenceValue as yr, refuseMalformedOutputs as ys, listNestedTemplateRows as yt, loadPublishableAssetManifest as yu, resolveDynamoDbDeleteBudgetMs as z, IntrinsicFunctionResolver as za, noEchoCoordinatesOf as zc, resolveAssemblyPath as zd, acquireIdempotencyToken as zi, isLockInfoExpired as zl, recordUnderIdIsNotOwn as zn, deployRefusesOrphanRowsReason as zo, parseMappingFile as zr, repairMalformedResourceEntriesForReadOnly as zs, recordRetainedForReadoption as zt, formatDockerLoginError as zu };
-//# sourceMappingURL=deploy-engine-dYZ0v6Kz.js.map
+//# sourceMappingURL=deploy-engine-l-wZygYT.js.map