@go-to-k/cdkd 0.297.0 → 0.298.1

package/dist/{provider-classes-uUFRfL9s.js → provider-classes-CuZ-P4gB.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
-import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Cz2tPxXk.js";
+import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as getPriorAttempts, $a as isWarmThroughputDecrease, $c as derivePartitionAndUrlSuffix, $n as reserveStackCreateToken, Ao as passedNoEchoParametersOf, Ar as deleteSkipReason, B as beginDeleteWait, Ba as findSilentDropProperties, Dt as withNestedStackContext, Ea as refuseMalformedResourcesForDestroy, Er as unchangedBehindSecretReference, Et as getCurrentNestedStackContext, Fr as ec2InstanceProtectionSite, G as DELETE_INDEX_WAIT_PROCEED_NOTE, H as deleteBudgetKey, Ha as withoutSilentDropProperties, Ir as isTerminationProtectionPropagationError, J as waitForIndexesSettled, Jo as markSameGenerationBag, K as INDEX_SETTLE_POLL_INTERVAL_MS, Lo as hasMaskableValues, Lr as observeThenDisableInstanceApiTermination, Lt as awaitInFlightSibling, Mr as isWaitAbandonedError, Nr as markWaitAbandoned, Q as isTruthyCfnBoolean, Qa as coerceWarmThroughput$1, Qc as canonicalizeRegion, Qo as dynamicReferenceTokens, R as DynamoDBGlobalTableProvider, Ra as withheldAccountClause, Rr as reDisableInstanceApiTermination, Si as parseWebACLArn, St as revertNestedChildFromJournal, Ti as passedParameterClassesOf, Tr as slowCcOperationTimeoutMs, U as resolveDynamoDbDeleteBudgetClock, V as compensateRemovedDeletionProtection, W as resolveDynamoDbDeleteBudgetMs, Ws as stringifyValue, X as S3_AUTO_DELETE_OBJECTS_TAG, Y as ECR_AUTO_DELETE_IMAGES_TAG, Yc as decodeListingKey, Yo as redactSecretsForState, Ys as rewriteTemplateAssetReferences, Z as hasCdkAutoDeleteTag, Za as WARM_THROUGHPUT_MEMBERS, Zn as earliestDefined, _o as lambdaFunctionNameForMask, a as findNestedTemplateTreeDefect, ai as s3BucketDomainName, an as redactedDeleteAddressFields, ao as configIntegerRefusal, ar as readTagList, as as carriesSecretMask, b as lookupEachName, c as renderNestedTemplateTreeDefect, ci as s3BucketWebsiteUrl, co as replayWarn, cr as tagPlanWarning, dl as renderAssemblyPathEscape, do as requireConfigString, eo as toCfnInteger, et as markRefusedBeforeApplying, fi as getAccountInfo, fl as resolveAssemblyPath, go as canonicalLambdaFunctionName, ho as withRetry, ii as s3BucketArn, in as isRedactedRecordedValue, io as configBooleanRefusal, ir as planTagDiff, is as recoverMaskedOutput, ji as accountArgs, jr as withIndeterminateGuard, ll as describeFileReadFailure, lo as requireConfigArray, lr as definedAttributes, no as coerceCfnBoolean, nr as DBPROXY_TAGS_WHAT, o as isAbsoluteAssetPath, oa as refuseMalformedNestedChildOutputs, oi as s3BucketDualStackDomainName, on as redactedDeleteAddressSkip, oo as configStringRefusal, or as refuseMalformedDesiredTags, q as deleteTableWithIndexBusyRetry, ri as isSettledInstanceState, rn as REDACTED_DELETE_ADDRESS_SKIP_REASON, ro as coerceCfnInteger, rr as DBPROXY_TAG_OPTIONS, s as listNestedTemplateRows, si as s3BucketRegionalDomainName, so as readConfigString, sr as tagMapAsList, t as DeployEngine, tn as getCurrentProducerRegions, to as toFiniteNumber, tr as acquireIdempotencyToken, ul as displayAssemblyPath, uo as requireConfigObject, ur as stringifyIfAssigned, v as chunks, vo as sameLambdaFunctionAddress, x as withApiLimit, y as isAccessDeniedError, yr as getCurrentResourceSecrets, yt as getNestedRevertRun, z as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, zr as reEnableInstanceApiTermination, zt as getStackRecords } from "./deploy-engine-dvf1UDuo.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider--5HuX51Z.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-NRnM6vPK.js";
-import { RDSProvider } from "./rds-provider-CU0LZr05.js";
-import { NeptuneProvider } from "./neptune-provider-xROL9y31.js";
-import { ASGProvider } from "./asg-provider-D9Po293s.js";
+import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as resolveAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ac as rewriteTemplateAssetReferences, ai as s3BucketArn, al as decodeListingKey, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bl as displayAssemblyPath, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, cl as canonicalizeRegion, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, ec as stringifyValue, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, ho as requireConfigObject, hs as carriesSecretMask, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, ll as derivePartitionAndUrlSuffix, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tt as markRefusedBeforeApplying, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, x as withApiLimit, xl as renderAssemblyPathEscape, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, yl as describeFileReadFailure, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-A-Ys_mhE.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CpqTal4K.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-D5gcmWad.js";
+import { RDSProvider } from "./rds-provider-X4mc-nGw.js";
+import { NeptuneProvider } from "./neptune-provider-C4A86Y7P.js";
+import { ASGProvider } from "./asg-provider-semUK44T.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -10179,6 +10179,50 @@ function narrowOnDemandCeilings(declared) {
 		dropped
 	};
 }
+function refusedOnDemandCeilingShape(value) {
+	if (value === void 0 || coerceCfnInteger(value) !== void 0) return void 0;
+	if (typeof value === "string") {
+		if (value.trim() === "" || /^[+-]?\d+$/.test(value)) return void 0;
+		return "a string";
+	}
+	if (typeof value === "number") return Number.isInteger(value) ? void 0 : "a number that is not an integer";
+	if (value === null) return "null";
+	if (typeof value === "boolean") return "a boolean";
+	if (Array.isArray(value)) return "an array";
+	return "an object";
+}
+function onDemandCeilingRefusal(properties, previousProperties, logicalId) {
+	const blockRefusal = (block, path) => {
+		if (!isPlainCapacityBlock(block)) return void 0;
+		for (const member of ON_DEMAND_CEILING_MEMBERS) {
+			if (!Object.hasOwn(block, member)) continue;
+			const shape = refusedOnDemandCeilingShape(block[member]);
+			if (shape === void 0) continue;
+			return `AWS::DynamoDB::Table ${logicalId}: ${path}.${member} must be an Integer CloudFormation accepts — an optional sign and decimal digits, with no surrounding whitespace, hex, exponent or decimal point; -1 removes an existing maximum (got ${shape}). CloudFormation refuses the same template`;
+		}
+	};
+	const changed = (desired, recorded) => JSON.stringify(desired) !== JSON.stringify(recorded);
+	if (previousProperties === void 0 || changed(properties["OnDemandThroughput"], previousProperties["OnDemandThroughput"])) {
+		const refusal = blockRefusal(properties["OnDemandThroughput"], "OnDemandThroughput");
+		if (refusal !== void 0) return refusal;
+	}
+	const desiredIndexes = properties["GlobalSecondaryIndexes"];
+	if (!Array.isArray(desiredIndexes)) return void 0;
+	const previousByName = /* @__PURE__ */ new Map();
+	const previousIndexes = previousProperties?.["GlobalSecondaryIndexes"];
+	if (Array.isArray(previousIndexes)) {
+		for (const entry of previousIndexes) if (isPlainCapacityBlock(entry) && entry["IndexName"]) previousByName.set(entry["IndexName"], entry);
+	}
+	for (const [position, entry] of desiredIndexes.entries()) {
+		if (!isPlainCapacityBlock(entry)) continue;
+		if (previousProperties !== void 0) {
+			const previous = previousByName.get(entry["IndexName"]);
+			if (previous !== void 0 && !changed(entry["OnDemandThroughput"], previous["OnDemandThroughput"])) continue;
+		}
+		const refusal = blockRefusal(entry["OnDemandThroughput"], `GlobalSecondaryIndexes[${position}].OnDemandThroughput`);
+		if (refusal !== void 0) return refusal;
+	}
+}
 function liveCeilingAlreadyMatches(live, requested) {
 	if (live === void 0) return false;
 	const liveBag = live;
@@ -10496,6 +10540,8 @@ var DynamoDBTableProvider = class {
 				if (streamRefusal !== void 0) throw new Error(`${streamRefusal}. Fix the template value`);
 				const pitrRefusal = pointInTimeRecoveryRefusal(properties["PointInTimeRecoverySpecification"]);
 				if (pitrRefusal !== void 0) throw new Error(`${pitrRefusal}. Fix the template value`);
+				const ceilingRefusal = onDemandCeilingRefusal(properties, void 0, logicalId);
+				if (ceilingRefusal !== void 0) throw new Error(`${ceilingRefusal}. Nothing was applied; fix the template value`);
 			}
 			const createParams = {
 				TableName: tableName,
@@ -10596,6 +10642,10 @@ var DynamoDBTableProvider = class {
 				const pitrRefusal = pointInTimeRecoveryRefusal(properties["PointInTimeRecoverySpecification"]);
 				if (pitrRefusal !== void 0) throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: ${pitrRefusal}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
 			}
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) {
+				const ceilingRefusal = onDemandCeilingRefusal(properties, previousProperties, logicalId);
+				if (ceilingRefusal !== void 0) throw new ProvisioningError(`${ceilingRefusal}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
+			}
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
@@ -28214,15 +28264,27 @@ const USER_POOL_ECHO_MEMBERS = [
 	"DeviceConfiguration",
 	"SmsVerificationMessage",
 	"EmailVerificationMessage",
-	"EmailVerificationSubject"
+	"EmailVerificationSubject",
+	"AcrConfiguration"
 ];
 function userPoolDeletionProtectionUpdate(physicalId, pool, value, opts = {}) {
 	const input = { UserPoolId: physicalId };
 	for (const member of USER_POOL_ECHO_MEMBERS) if (pool[member] !== void 0) Object.assign(input, { [member]: pool[member] });
+	const acr = customAcrLevels(pool.AcrConfiguration);
+	if (acr === void 0) delete input.AcrConfiguration;
+	else input.AcrConfiguration = acr;
 	if (echoesDeveloperEmail(pool) && opts.withoutDeveloperEmail !== true) input.EmailConfiguration = pool.EmailConfiguration;
 	input.DeletionProtection = value;
 	return input;
 }
+function customAcrLevels(acr) {
+	if (acr === void 0) return void 0;
+	const custom = Object.fromEntries(Object.entries(acr).filter(([level, cfg]) => {
+		const n = /^Level([1-4])$/.exec(level)?.[1];
+		return n === void 0 || cfg?.AcrValue !== `urn:cognito:loa:${n}`;
+	}));
+	return Object.keys(custom).length > 0 ? custom : void 0;
+}
 const sentWithoutEmail = /* @__PURE__ */ new WeakSet();
 const createUserPoolLatch = new AmbiguousCreateLatch("CreateUserPool");
 const userPoolsCreatedByThisProcess = new RecentIdSet();
@@ -36204,7 +36266,7 @@ var SchedulerScheduleProvider = class {
 		const bag = getCurrentResourceSecrets();
 		if (bag === void 0 || typeof desiredGroup !== "string") return false;
 		if (typeof recordedGroup !== "string" || !recordedGroup.includes("{{resolve:")) return false;
-		return redactSecretsForState(desiredGroup, bag) !== recordedGroup;
+		return withoutPhysicalNameCopies(bag, () => redactSecretsForState(desiredGroup, bag)) !== recordedGroup;
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const groupName = this.groupNameOf(properties);
@@ -44256,6 +44318,7 @@ var NestedStackProvider = class {
 			parameters: childParameters,
 			onDestructivePlan: void 0,
 			...inheritedSecrets && hasMaskableValues(inheritedSecrets) && { inheritedSecrets },
+			inheritedPhysicalNameCopies: inheritedPhysicalNameCopiesOf(inheritedSecrets),
 			...passedClasses && { passedParameterClasses: passedClasses },
 			passedNoEchoParameters: passedNoEchoParametersOf(inheritedSecrets),
 			inheritedProducerRegions: getCurrentProducerRegions(),
@@ -44385,6 +44448,10 @@ function runAccountOf(ctx) {
 		statePrefix: ctx.destroyOptions?.statePrefix
 	};
 }
+function inheritedPhysicalNameCopiesOf(bag) {
+	const copies = bag === void 0 ? void 0 : physicalNameCopiesOf.get(bag);
+	return copies === void 0 || copies.size === 0 ? void 0 : new Set(copies);
+}
 
 //#endregion
 //#region src/provisioning/providers/wait-condition-handle-provider.ts
@@ -44764,4 +44831,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-uUFRfL9s.js.map
+//# sourceMappingURL=provider-classes-CuZ-P4gB.js.map