@go-to-k/cdkd 0.296.31 → 0.297.0

package/dist/{provider-classes-B7Z4-Zsc.js → provider-classes-uUFRfL9s.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Cz2tPxXk.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as getPriorAttempts, $a as coerceCfnBoolean, $n as reserveStackCreateToken, Ar as markWaitAbandoned, B as beginDeleteWait, Ca as refuseMalformedResourcesForDestroy, Cr as unchangedBehindSecretReference, Do as passedNoEchoParametersOf, Dr as deleteSkipReason, Dt as withNestedStackContext, Et as getCurrentNestedStackContext, Fa as withheldAccountClause, Fr as reDisableInstanceApiTermination, G as DELETE_INDEX_WAIT_PROCEED_NOTE, Go as markSameGenerationBag, H as deleteBudgetKey, Ir as reEnableInstanceApiTermination, J as waitForIndexesSettled, Ja as WARM_THROUGHPUT_MEMBERS, K as INDEX_SETTLE_POLL_INTERVAL_MS, Kc as decodeListingKey, Ko as redactSecretsForState, Ks as rewriteTemplateAssetReferences, La as findSilentDropProperties, Lt as awaitInFlightSibling, Mr as ec2InstanceProtectionSite, Nr as isTerminationProtectionPropagationError, Oi as accountArgs, Or as withIndeterminateGuard, Po as hasMaskableValues, Pr as observeThenDisableInstanceApiTermination, Q as isTruthyCfnBoolean, Qa as toFiniteNumber, R as DynamoDBGlobalTableProvider, Si as passedParameterClassesOf, Sr as slowCcOperationTimeoutMs, St as revertNestedChildFromJournal, U as resolveDynamoDbDeleteBudgetClock, V as compensateRemovedDeletionProtection, Vs as stringifyValue, W as resolveDynamoDbDeleteBudgetMs, X as S3_AUTO_DELETE_OBJECTS_TAG, Xa as isWarmThroughputDecrease, Xc as derivePartitionAndUrlSuffix, Y as ECR_AUTO_DELETE_IMAGES_TAG, Ya as coerceWarmThroughput$1, Yc as canonicalizeRegion, Yo as dynamicReferenceTokens, Z as hasCdkAutoDeleteTag, Za as toCfnInteger, Zn as earliestDefined, a as findNestedTemplateTreeDefect, ai as s3BucketWebsiteUrl, an as redactedDeleteAddressFields, ao as replayWarn, ar as readTagList, b as lookupEachName, c as renderNestedTemplateTreeDefect, cl as renderAssemblyPathEscape, co as requireConfigString, cr as tagPlanWarning, ei as isSettledInstanceState, eo as coerceCfnInteger, et as markRefusedBeforeApplying, fo as withRetry, ho as sameLambdaFunctionAddress, ii as s3BucketRegionalDomainName, in as isRedactedRecordedValue, io as readConfigString, ir as planTagDiff, kr as isWaitAbandonedError, li as getAccountInfo, ll as resolveAssemblyPath, lr as definedAttributes, mo as lambdaFunctionNameForMask, ni as s3BucketDomainName, no as configIntegerRefusal, nr as DBPROXY_TAGS_WHAT, ns as carriesSecretMask, o as isAbsoluteAssetPath, ol as describeFileReadFailure, on as redactedDeleteAddressSkip, oo as requireConfigArray, or as refuseMalformedDesiredTags, po as canonicalLambdaFunctionName, q as deleteTableWithIndexBusyRetry, ra as refuseMalformedNestedChildOutputs, ri as s3BucketDualStackDomainName, rn as REDACTED_DELETE_ADDRESS_SKIP_REASON, ro as configStringRefusal, rr as DBPROXY_TAG_OPTIONS, s as listNestedTemplateRows, sl as displayAssemblyPath, so as requireConfigObject, sr as tagMapAsList, t as DeployEngine, ti as s3BucketArn, tn as getCurrentProducerRegions, to as configBooleanRefusal, tr as acquireIdempotencyToken, ts as recoverMaskedOutput, ur as stringifyIfAssigned, v as chunks, x as withApiLimit, y as isAccessDeniedError, yi as parseWebACLArn, yr as getCurrentResourceSecrets, yt as getNestedRevertRun, z as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, za as withoutSilentDropProperties, zt as getStackRecords } from "./deploy-engine-5FFXg6ih.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-syetbMnw.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-Db1eBDeq.js";
-import { RDSProvider } from "./rds-provider-B4sFJ8YW.js";
-import { NeptuneProvider } from "./neptune-provider-B1D2CFBs.js";
-import { ASGProvider } from "./asg-provider-Ca7cV9tM.js";
+import { $ as getPriorAttempts, $a as isWarmThroughputDecrease, $c as derivePartitionAndUrlSuffix, $n as reserveStackCreateToken, Ao as passedNoEchoParametersOf, Ar as deleteSkipReason, B as beginDeleteWait, Ba as findSilentDropProperties, Dt as withNestedStackContext, Ea as refuseMalformedResourcesForDestroy, Er as unchangedBehindSecretReference, Et as getCurrentNestedStackContext, Fr as ec2InstanceProtectionSite, G as DELETE_INDEX_WAIT_PROCEED_NOTE, H as deleteBudgetKey, Ha as withoutSilentDropProperties, Ir as isTerminationProtectionPropagationError, J as waitForIndexesSettled, Jo as markSameGenerationBag, K as INDEX_SETTLE_POLL_INTERVAL_MS, Lo as hasMaskableValues, Lr as observeThenDisableInstanceApiTermination, Lt as awaitInFlightSibling, Mr as isWaitAbandonedError, Nr as markWaitAbandoned, Q as isTruthyCfnBoolean, Qa as coerceWarmThroughput$1, Qc as canonicalizeRegion, Qo as dynamicReferenceTokens, R as DynamoDBGlobalTableProvider, Ra as withheldAccountClause, Rr as reDisableInstanceApiTermination, Si as parseWebACLArn, St as revertNestedChildFromJournal, Ti as passedParameterClassesOf, Tr as slowCcOperationTimeoutMs, U as resolveDynamoDbDeleteBudgetClock, V as compensateRemovedDeletionProtection, W as resolveDynamoDbDeleteBudgetMs, Ws as stringifyValue, X as S3_AUTO_DELETE_OBJECTS_TAG, Y as ECR_AUTO_DELETE_IMAGES_TAG, Yc as decodeListingKey, Yo as redactSecretsForState, Ys as rewriteTemplateAssetReferences, Z as hasCdkAutoDeleteTag, Za as WARM_THROUGHPUT_MEMBERS, Zn as earliestDefined, _o as lambdaFunctionNameForMask, a as findNestedTemplateTreeDefect, ai as s3BucketDomainName, an as redactedDeleteAddressFields, ao as configIntegerRefusal, ar as readTagList, as as carriesSecretMask, b as lookupEachName, c as renderNestedTemplateTreeDefect, ci as s3BucketWebsiteUrl, co as replayWarn, cr as tagPlanWarning, dl as renderAssemblyPathEscape, do as requireConfigString, eo as toCfnInteger, et as markRefusedBeforeApplying, fi as getAccountInfo, fl as resolveAssemblyPath, go as canonicalLambdaFunctionName, ho as withRetry, ii as s3BucketArn, in as isRedactedRecordedValue, io as configBooleanRefusal, ir as planTagDiff, is as recoverMaskedOutput, ji as accountArgs, jr as withIndeterminateGuard, ll as describeFileReadFailure, lo as requireConfigArray, lr as definedAttributes, no as coerceCfnBoolean, nr as DBPROXY_TAGS_WHAT, o as isAbsoluteAssetPath, oa as refuseMalformedNestedChildOutputs, oi as s3BucketDualStackDomainName, on as redactedDeleteAddressSkip, oo as configStringRefusal, or as refuseMalformedDesiredTags, q as deleteTableWithIndexBusyRetry, ri as isSettledInstanceState, rn as REDACTED_DELETE_ADDRESS_SKIP_REASON, ro as coerceCfnInteger, rr as DBPROXY_TAG_OPTIONS, s as listNestedTemplateRows, si as s3BucketRegionalDomainName, so as readConfigString, sr as tagMapAsList, t as DeployEngine, tn as getCurrentProducerRegions, to as toFiniteNumber, tr as acquireIdempotencyToken, ul as displayAssemblyPath, uo as requireConfigObject, ur as stringifyIfAssigned, v as chunks, vo as sameLambdaFunctionAddress, x as withApiLimit, y as isAccessDeniedError, yr as getCurrentResourceSecrets, yt as getNestedRevertRun, z as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, zr as reEnableInstanceApiTermination, zt as getStackRecords } from "./deploy-engine-dvf1UDuo.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider--5HuX51Z.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-NRnM6vPK.js";
+import { RDSProvider } from "./rds-provider-CU0LZr05.js";
+import { NeptuneProvider } from "./neptune-provider-xROL9y31.js";
+import { ASGProvider } from "./asg-provider-D9Po293s.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -8653,7 +8653,7 @@ function declaredConsumptionMode(properties) {
 	return config[KAFKA_CONSUMPTION_MODE_KEY];
 }
 function consumptionModeRefusalMessage(logicalId, mode) {
-	return `AWS::Lambda::EventSourceMapping ${logicalId}: SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript does not model the member, so it would be dropped from the ${mode === "create" ? "CreateEventSourceMapping" : "UpdateEventSourceMapping"} request without an error (issue #3848). Remove ${KAFKA_CONSUMPTION_MODE_KEY} from SelfManagedKafkaEventSourceConfig to deploy the mapping without it.`;
+	return `AWS::Lambda::EventSourceMapping ${logicalId}: SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript does not model the member, so it would be dropped from the ${mode === "create" ? "CreateEventSourceMapping" : "UpdateEventSourceMapping"} request without an error. Remove ${KAFKA_CONSUMPTION_MODE_KEY} from SelfManagedKafkaEventSourceConfig to deploy the mapping without it.`;
 }
 function kafkaConfigForUpdate(desired, previous, options) {
 	const asObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
@@ -10701,7 +10701,7 @@ var DynamoDBTableProvider = class {
 						gsiHandledByBillingFlip.add(indexName);
 					}
 					if (indexUpdates.length > 0) updateInput.GlobalSecondaryIndexUpdates = indexUpdates;
-					if (unspecified.length > 0) warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.map((n) => maskSecrets(n)).join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically (issue #1617), so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
+					if (unspecified.length > 0) warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.map((n) => maskSecrets(n)).join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically, so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
@@ -11381,7 +11381,7 @@ var DynamoDBTableProvider = class {
 	}
 	warnUnusableOnDemandCeiling(scope, member, raw, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		warn(`${scope}: OnDemandThroughput.${member} ${JSON.stringify(maskLeafValue(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO ceiling was substituted for it. Both OnDemandThroughput members are OPTIONAL to DynamoDB, so — unlike a ProvisionedThroughput member — AWS does not necessarily reject the request, and what happens next depends on the path: a CREATE gets no maximum for this half; an UPDATE KEEPS whatever maximum the table already carries, since only an explicit -1 removes one; and if NEITHER member was usable the block is sent EMPTY, which AWS ACCEPTS (measured us-east-1 2026-09-17) and stores as no maximum at all, so the deploy SUCCEEDS with no ceiling applied. cdkd's state keeps the value the template declared and \`cdkd drift\` reports the difference until the template is corrected; CloudFormation is expected to refuse the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer (\`-1\` removes an existing maximum).`);
+		warn(`${scope}: OnDemandThroughput.${member} ${JSON.stringify(maskLeafValue(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO ceiling was substituted for it. Both OnDemandThroughput members are OPTIONAL to DynamoDB, so — unlike a ProvisionedThroughput member — AWS does not necessarily reject the request, and what happens next depends on the path: a CREATE gets no maximum for this half; an UPDATE KEEPS whatever maximum the table already carries, since only an explicit -1 removes one; and if NEITHER member was usable the block is sent EMPTY, which AWS ACCEPTS and stores as no maximum at all, so the deploy SUCCEEDS with no ceiling applied. cdkd's state keeps the value the template declared and \`cdkd drift\` reports the difference until the template is corrected; CloudFormation is expected to refuse the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer (\`-1\` removes an existing maximum).`);
 	}
 	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -11395,7 +11395,7 @@ var DynamoDBTableProvider = class {
 	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets) {
 		if (!isZeroCapacityPlaceholder(requested)) return false;
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		warn(`${this.indexScopeAt(indexName, physicalId, maskSecrets)}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
+		warn(`${this.indexScopeAt(indexName, physicalId, maskSecrets)}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a state record an older cdkd release wrote — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
 	}
 	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets) {
@@ -14906,7 +14906,7 @@ var EC2Provider = class {
 			}
 			if (attempt < maxAttempts) await this.sleep(100 * 2 ** (attempt - 1));
 		}
-		this.logger.debug(`MapPublicIpOnLaunch=${expected} not yet visible on ${subnetId} after ${maxAttempts} reads — the observed-state capture may record the stale value (issue #1299)`);
+		this.logger.debug(`MapPublicIpOnLaunch=${expected} not yet visible on ${subnetId} after ${maxAttempts} reads — the observed-state capture may record the stale value`);
 	}
 	async deleteSubnet(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Subnet ${logicalId}: ${physicalId}`);
@@ -20208,7 +20208,7 @@ var ApiGatewayV2Provider = class {
 		return merged;
 	}
 	warnTlsConfigIgnoredIfPublic(logicalId, properties, log) {
-		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") log.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS (issue #1602).`);
+		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") log.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS.`);
 	}
 	toSdkResponseParameters(value, log) {
 		const maskSecrets = log.mask;
@@ -28726,7 +28726,7 @@ var CognitoUserPoolProvider = class {
 			if (!sendsPoliciesSubKey(previousProperties, subKey)) continue;
 			if (sendsPoliciesSubKey(properties, subKey)) continue;
 			const { label, reset } = POLICIES_SUB_KEY_ANNOUNCEMENT[subKey];
-			this.logger.warn(`UserPool ${physicalId}: the desired configuration no longer declares Policies.${subKey}, and no UpdateUserPool input can express that removal — omitting the sub-key PRESERVES the live value (measured us-east-1 2026-08-19, issue #1968), so the pool keeps its current ${label}. CloudFormation is the same no-op on the identical template edit (measured us-east-1 2026-09-02, issue #1979), so cdkd deliberately sends no reset. To change the live value, declare Policies.${subKey} explicitly with the intended configuration (${reset}).`);
+			this.logger.warn(`UserPool ${physicalId}: the desired configuration no longer declares Policies.${subKey}, and no UpdateUserPool input can express that removal — omitting the sub-key PRESERVES the live value, so the pool keeps its current ${label}. CloudFormation is the same no-op on the identical template edit, so cdkd deliberately sends no reset. To change the live value, declare Policies.${subKey} explicitly with the intended configuration (${reset}).`);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -32169,7 +32169,7 @@ function refuseNestedRename(args) {
 	const remedyFlags = args.stateful ? "--replace --force-stateful-recreation" : "--replace";
 	const shownRecorded = mask(recordedName);
 	const shownDesired = mask(desiredName);
-	throw new ResourceUpdateNotSupportedError(args.resourceType, args.logicalId, `${args.field} changed from '${shownRecorded}' to '${shownDesired}', and cdkd cannot rename a Glue ${args.noun} in place — ${args.consequence(shownDesired)}. To rename it, re-deploy with ${remedyFlags}, which DELETEs the ${args.noun} '${shownRecorded}' and then CREATEs '${shownDesired}' (under UpdateReplacePolicy: Retain the old one is kept instead); the CREATE fails if a ${args.noun} named '${shownDesired}' already exists, after the DELETE. If the template did not change this name, the state record was left by an earlier deploy that wrote to '${shownDesired}' (issue #3724): check that ${args.noun} before re-deploying. Otherwise keep the name '${shownRecorded}'`);
+	throw new ResourceUpdateNotSupportedError(args.resourceType, args.logicalId, `${args.field} changed from '${shownRecorded}' to '${shownDesired}', and cdkd cannot rename a Glue ${args.noun} in place — ${args.consequence(shownDesired)}. To rename it, re-deploy with ${remedyFlags}, which DELETEs the ${args.noun} '${shownRecorded}' and then CREATEs '${shownDesired}' (under UpdateReplacePolicy: Retain the old one is kept instead); the CREATE fails if a ${args.noun} named '${shownDesired}' already exists, after the DELETE. If the template did not change this name, the state record was left by an earlier deploy that wrote to '${shownDesired}': check that ${args.noun} before re-deploying. Otherwise keep the name '${shownRecorded}'`);
 }
 function secretNamePairs(values) {
 	return values.map((value) => [value, typeof value === "string" ? value : void 0]);
@@ -33200,7 +33200,7 @@ function enforceIcebergTableInputAbsent(logicalId, resourceType, properties, opt
 	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId);
 }
 function icebergTableInputRefusalMessage(logicalId, key, mode) {
-	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : mode === "create-replay" ? "cannot be deployed by AWS in any shape, so cdkd normally refuses it before calling Glue (issue #1454) — but this create is REPLAYING a historical cdkd STATE record (a rollback reverse-replacement re-creating the OLD table), not your template, and refusing would leave that table unrestorable with no template-side remedy, only a hand-edit of state.json. cdkd therefore warns and proceeds (issue #1463). The re-created table is DEGRADED exactly as the original was: under the CFn spelling IcebergTableInput the AWS SDK serializer drops the unknown member (issue #1390), so the table comes back without its Iceberg metadata; under the SDK spelling CreateIcebergTableInput the value IS sent and Glue rejects the call, failing this one rollback operation. Either way, fix it forward with 'cdkd deploy' using the working shape below." : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
+	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue.` : mode === "create-replay" ? "cannot be deployed by AWS in any shape, so cdkd normally refuses it before calling Glue — but this create is REPLAYING a historical cdkd STATE record (a rollback reverse-replacement re-creating the OLD table), not your template, and refusing would leave that table unrestorable with no template-side remedy, only a hand-edit of state.json. cdkd therefore warns and proceeds. The re-created table is DEGRADED exactly as the original was: under the CFn spelling IcebergTableInput the AWS SDK serializer drops the unknown member, so the table comes back without its Iceberg metadata; under the SDK spelling CreateIcebergTableInput the value IS sent and Glue rejects the call, failing this one rollback operation. Either way, fix it forward with 'cdkd deploy' using the working shape below." : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns. A CREATE of this table would be refused outright."}\n  Measured against AWS: glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 function buildEncryptionConfiguration(input) {
 	const result = {};
@@ -37024,7 +37024,7 @@ var EFSProvider = class {
 			"AccessPointTags"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint, so a template-supplied value would be overwritten. The SDK does not own this field either: an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
 		if (!this.client) {
 			this.client = new EFSClient({
@@ -40355,7 +40355,7 @@ var FirehoseProvider = class {
 		if (activeDest && !SUPPORTED_UPDATE_DESTINATIONS.has(activeDest)) {
 			const nextDest = properties[activeDest] ?? {};
 			const prevDest = previousProperties[activeDest] ?? {};
-			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `In-place update for '${activeDest}' on AWS::KinesisFirehose::DeliveryStream is not yet implemented in cdkd (AWS exposes UpdateDestination for it; the per-shape reverse-mapper is a follow-up to #549). Re-deploy with cdkd deploy --replace.`);
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `In-place update for '${activeDest}' on AWS::KinesisFirehose::DeliveryStream is not yet implemented in cdkd (AWS exposes UpdateDestination for it). Re-deploy with cdkd deploy --replace.`);
 		}
 		const nextTagsOk = isReadableTagList(properties["Tags"]);
 		const prevTagsOk = isReadableTagList(previousProperties["Tags"]);
@@ -44069,14 +44069,14 @@ var NestedStackProvider = class {
 		["Description", "CFn-only informational — no semantic effect on the recursive deploy"],
 		["DisableRollback", "CFn-only — cdkd controls rollback via the top-level deploy-engine --no-rollback flag, not per nested stack"],
 		["EnableTerminationProtection", "CFn-only per-nested-stack flag — cdkd records stack-level terminationProtection at CDK synth time (parent only) and `cdkd destroy` consults that for refusal"],
-		["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent (issue #459 design §9)"],
+		["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent"],
 		["RoleARN", "CFn-only role-assumption — cdkd uses the caller credentials directly, no per-resource role assumption"],
 		["StackName", "cdkd derives the child stack name as `<parent>~<logicalId>` per design §3 (state-key uniqueness); a user-provided StackName has no effect"],
 		["StackPolicyBody", "CFn-only stack-update policy — cdkd has no equivalent (per-resource diff replaces stack-level policy)"],
 		["StackPolicyURL", "CFn-only stack-update policy URL — cdkd has no equivalent"],
 		["StackStatusReason", "CFn-only read-only output — never a real input property"],
 		["Tags", "CFn-only — cdkd does not tag the synthesized \"stack\" (the parent's synthesized ARN is a cdkd-local placeholder, not a real AWS resource)"],
-		["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead (issue #459 design §9)"]
+		["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead"]
 	])]]);
 	async create(logicalId, resourceType, properties, context) {
 		const ctx = this.requireContext();
@@ -44764,4 +44764,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-B7Z4-Zsc.js.map
+//# sourceMappingURL=provider-classes-uUFRfL9s.js.map