@go-to-k/cdkd 0.305.0 → 0.307.0

package/dist/{deploy-engine-BdqMXegu.js → deploy-engine-BOgsnnk0.js}

@@ -1,8 +1,8 @@
-import { r as getAwsClients, s as __exportAll } from "./aws-clients-WQOzP1x4.js";
-import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-Durl920o.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, d as prepareRemovalForUpdate, dt as startInterruptWatch, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as ElapsedBudgetRegistry, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as monotonicNowMs, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, ut as isInterruptedWaitError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-OyoL9Woo.js";
+import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
+import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-Cp2r-ot9.js";
+import { t as getCdkdVersion } from "./version-Dhhyrf1v.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,7 +10,7 @@ import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetRe
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionConfigurationCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeNatGatewaysCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, ListTagsOfResourceCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
@@ -2360,7 +2360,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-WQOzP1x4.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-Bu9EMILF.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -9430,10 +9430,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
-			provenance: "value-scan",
-			secrets
-		});
+		for (const [k, v] of Object.entries(bag)) {
+			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
+				provenance: "value-scan",
+				secrets
+			});
+			if (secrets.size > 0 && RENDERED_DEFINITION_KEYS.has(k) && definitionSourceCarriesSecret(source)) out[k] = nameDefinitionSecrets(out[k], source, secrets);
+		}
 		return out;
 	}
 	return redactForState(bag, {
@@ -9462,8 +9465,211 @@ function pathCrossesDottedKey(bag, path) {
 	}
 	return false;
 }
+const DEFINITION_SOURCE_KEYS = [
+	"DefinitionSubstitutions",
+	"DefinitionString",
+	"Definition"
+];
+const RENDERED_DEFINITION_KEYS = /* @__PURE__ */ new Set(["Definition", "DefinitionString"]);
+function definitionSourceCarriesSecret(source) {
+	return DEFINITION_SOURCE_KEYS.some((k) => Object.hasOwn(source, k) && (subtreeHasDynamicReference(source[k]) || carriesSecretMask(source[k])));
+}
+function nameScalarSecrets(value, secrets) {
+	const byValue = /* @__PURE__ */ new Set();
+	for (const plaintext of secrets.keys()) try {
+		const parsed = JSON.parse(plaintext);
+		if (typeof parsed === "number" && Number.isFinite(parsed) || typeof parsed === "boolean") byValue.add(parsed);
+	} catch {}
+	if (byValue.size === 0) return value;
+	const walk = (node) => {
+		if (typeof node === "number" || typeof node === "boolean") {
+			if (typeof node === "number" && !Number.isFinite(node)) return node;
+			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
+		}
+		if (Array.isArray(node)) return node.map(walk);
+		if (isPlainObject$7(node) && hasPlainPrototype(node)) {
+			const out = Object.create(null);
+			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
+			return out;
+		}
+		return node;
+	};
+	return walk(value);
+}
+const SENTINEL_IN_STRING = "";
+const SENTINEL_OUT_OF_STRING = "";
+function substitutionIsSecret(value) {
+	return subtreeHasDynamicReference(value) || value.includes("***");
+}
+function sentinelDefinitionOf(source) {
+	const subs = source["DefinitionSubstitutions"];
+	const values = /* @__PURE__ */ new Map();
+	if (isPlainObject$7(subs)) {
+		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
+	}
+	for (const key of ["DefinitionString", "Definition"]) {
+		if (!Object.hasOwn(source, key)) continue;
+		const raw = source[key];
+		const body = typeof raw === "string" ? raw : isPlainObject$7(raw) ? JSON.stringify(raw) : void 0;
+		if (body === void 0) continue;
+		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
+		const names = [];
+		let text = "";
+		let inString = false;
+		let escaped = false;
+		const feed = (c) => {
+			text += c;
+			if (inString) {
+				if (escaped) escaped = false;
+				else if (c === "\\") escaped = true;
+				else if (c === "\"") inString = false;
+			} else if (c === "\"") inString = true;
+		};
+		for (let i = 0; i < body.length; i++) {
+			if (body.startsWith("${", i)) {
+				const end = body.indexOf("}", i + 2);
+				const name = end === -1 ? void 0 : body.slice(i + 2, end);
+				const value = name === void 0 ? void 0 : values.get(name);
+				if (name !== void 0 && value !== void 0) {
+					if (substitutionIsSecret(value)) {
+						const index = names.push(name) - 1;
+						text += inString ? `${SENTINEL_IN_STRING}${index}${SENTINEL_IN_STRING}` : `"${SENTINEL_OUT_OF_STRING}${index}${SENTINEL_OUT_OF_STRING}"`;
+					} else for (const c of value) feed(c);
+					i = end;
+					continue;
+				}
+			}
+			feed(body[i]);
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			continue;
+		}
+		const keys = /* @__PURE__ */ new Set();
+		const strings = /* @__PURE__ */ new Set();
+		const scalars = /* @__PURE__ */ new Set();
+		const secretLeaves = [];
+		const marked = (t) => t.includes(SENTINEL_IN_STRING) || t.includes(SENTINEL_OUT_OF_STRING);
+		const outOfString = new RegExp(`^${SENTINEL_OUT_OF_STRING}(\\d+)${SENTINEL_OUT_OF_STRING}$`);
+		const inStringMarkers = new RegExp(`${SENTINEL_IN_STRING}(\\d+)${SENTINEL_IN_STRING}`, "g");
+		const written = (t) => t.replace(inStringMarkers, (_m, i) => `\${${names[Number(i)]}}`);
+		const walk = (node, path, shapes) => {
+			if (typeof node === "string") {
+				const m = outOfString.exec(node);
+				if (m !== null) secretLeaves.push({
+					path,
+					shapes,
+					outOfStringName: names[Number(m[1])],
+					asWritten: void 0
+				});
+				else if (marked(node)) secretLeaves.push({
+					path,
+					shapes,
+					outOfStringName: void 0,
+					asWritten: written(node)
+				});
+				else strings.add(node);
+				return;
+			}
+			if (typeof node === "number" || typeof node === "boolean") {
+				scalars.add(node);
+				return;
+			}
+			if (Array.isArray(node)) {
+				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
+				return;
+			}
+			if (isPlainObject$7(node)) {
+				const own = new Set(Object.keys(node).map(written));
+				for (const [k, v] of Object.entries(node)) {
+					if (!marked(k)) keys.add(k);
+					walk(v, [...path, written(k)], [...shapes, own]);
+				}
+			}
+		};
+		walk(parsed, [], []);
+		try {
+			collectObjectKeys(JSON.parse(body), keys);
+		} catch {}
+		return {
+			keys,
+			strings,
+			scalars,
+			secretLeaves
+		};
+	}
+}
+function alignedSecretLeaf(root, leaf) {
+	let cursor = root;
+	for (const [depth, segment] of leaf.path.entries()) {
+		const shape = leaf.shapes[depth];
+		if (typeof shape === "number") {
+			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
+			cursor = cursor[segment];
+		} else {
+			if (!isPlainObject$7(cursor)) return void 0;
+			const own = Object.keys(cursor);
+			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
+			if (!Object.hasOwn(cursor, segment)) return void 0;
+			cursor = cursor[segment];
+		}
+	}
+	return { value: cursor };
+}
+function collectObjectKeys(value, into) {
+	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
+	else if (isPlainObject$7(value)) for (const [k, v] of Object.entries(value)) {
+		into.add(k);
+		collectObjectKeys(v, into);
+	}
+}
+function spelledKeysOf(properties) {
+	const keys = /* @__PURE__ */ new Set();
+	collectObjectKeys(properties, keys);
+	for (const key of sentinelDefinitionOf(properties)?.keys ?? []) keys.add(key);
+	return keys;
+}
+function someKeyIsUnspelled(value, spelled) {
+	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
+	if (isPlainObject$7(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	return false;
+}
+function nameDefinitionSecrets(value, source, secrets) {
+	if (value === null || typeof value !== "object") return value;
+	const sentinel = sentinelDefinitionOf(source);
+	if (sentinel === void 0) {
+		const plaintexts = [...secrets.keys()].filter((p) => p !== "");
+		const keyHoldsSecret = (key) => plaintexts.some((p) => key === p || p.length >= 4 && key.includes(p));
+		if (someKeyIsUnspelled(value, (key) => !keyHoldsSecret(key))) return "***";
+		return nameScalarSecrets(value, secrets);
+	}
+	if (someKeyIsUnspelled(value, (key) => sentinel.keys.has(key))) return "***";
+	let out = value;
+	for (const leaf of sentinel.secretLeaves) {
+		if (alignedSecretLeaf(out, leaf) === void 0) return "***";
+		if (leaf.outOfStringName !== void 0) out = replaceAtPath(out, leaf.path, "***");
+	}
+	return out;
+}
+function replaceAtPath(root, path, leaf) {
+	if (path.length === 0) return leaf;
+	const [head, ...rest] = path;
+	if (Array.isArray(root)) {
+		const copy = [...root];
+		copy[head] = replaceAtPath(root[head], rest, leaf);
+		return copy;
+	}
+	const copy = Object.create(null);
+	Object.assign(copy, root);
+	copy[head] = replaceAtPath(root[head], rest, leaf);
+	return copy;
+}
 function isUncertifiedBaselineMaskPosition(properties, path) {
 	if (pathCrossesDottedKey(properties, path)) return false;
+	const [head] = path.split(".");
+	if (head !== void 0 && RENDERED_DEFINITION_KEYS.has(head)) return definitionSourceCarriesSecret(properties);
 	let cursor = properties;
 	for (const segment of path.split(".")) {
 		if (typeof cursor === "string") break;
@@ -9534,7 +9740,79 @@ function deepEqualJsonValue(a, b) {
 
 //#endregion
 //#region src/deployment/secret-redaction/readback-certification.ts
-function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
+function renderedDefinitionLiterals(source) {
+	const keep = /* @__PURE__ */ new Set();
+	const scalarKeep = /* @__PURE__ */ new Set();
+	const keyKeep = /* @__PURE__ */ new Set();
+	const subs = source["DefinitionSubstitutions"];
+	const scalars = [];
+	if (isPlainObject$7(subs)) {
+		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+			scalars.push([name, String(value)]);
+			if (typeof value === "string") keep.add(value);
+			addScalarSpelling(scalarKeep, value);
+		}
+	}
+	const bodies = [];
+	for (const key of ["DefinitionString", "Definition"]) {
+		if (!Object.hasOwn(source, key)) continue;
+		const body = source[key];
+		if (typeof body === "string") bodies.push(body);
+		else if (isPlainObject$7(body)) bodies.push(JSON.stringify(body));
+	}
+	for (const body of bodies) {
+		let rendered = body;
+		for (const [name, value] of scalars) rendered = rendered.split(`\${${name}}`).join(value);
+		for (const text of rendered === body ? [body] : [body, rendered]) {
+			keep.add(text);
+			try {
+				const parsed = JSON.parse(text);
+				for (const leaf of wholeStringLeavesOf(parsed)) keep.add(leaf);
+				collectScalarLeaves(parsed, scalarKeep);
+				collectObjectKeys(parsed, keyKeep);
+			} catch {}
+		}
+	}
+	const sentinel = sentinelDefinitionOf(source);
+	if (sentinel !== void 0) {
+		for (const leaf of sentinel.strings) keep.add(leaf);
+		for (const leaf of sentinel.secretLeaves) if (leaf.asWritten !== void 0) keep.add(leaf.asWritten);
+		for (const leaf of sentinel.scalars) scalarKeep.add(leaf);
+		for (const key of sentinel.keys) keyKeep.add(key);
+	}
+	return {
+		strings: keep,
+		scalars: scalarKeep,
+		keys: keyKeep,
+		sentinel
+	};
+}
+function certifiedAtSecretPosition(value, rendered) {
+	if (typeof value === "symbol") return true;
+	if (typeof value !== "string") return false;
+	if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return true;
+	return (value.includes("{{resolve:") || value.includes("***") || value.includes("${")) && rendered.has(value);
+}
+function addScalarSpelling(into, value) {
+	if (typeof value !== "string") {
+		into.add(value);
+		return;
+	}
+	try {
+		const parsed = JSON.parse(value);
+		if (typeof parsed === "number" || typeof parsed === "boolean") into.add(parsed);
+	} catch {}
+}
+function collectScalarLeaves(value, into) {
+	if (typeof value === "number" || typeof value === "boolean") {
+		into.add(value);
+		return;
+	}
+	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
+	else if (isPlainObject$7(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+}
+function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
+	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
 	if (typeof value === "string") {
 		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
 		if (value === "") return value;
@@ -9546,13 +9824,13 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 	if (Array.isArray(value)) {
 		const out = [];
 		seen.set(value, out);
-		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
+		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
 	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
-		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
+		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
 		return out;
 	}
 	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9576,6 +9854,39 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
+	if (failClosed === true && isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+		const keep = renderedDefinitionLiterals(source);
+		const out = Object.create(null);
+		const rest = Object.create(null);
+		for (const [k, v] of Object.entries(bag)) if (!RENDERED_DEFINITION_KEYS.has(k)) rest[k] = v;
+		const walkedRest = refuseUncertifiedReadbackPositions(rest, source, secrets, failClosed, learn, mark);
+		for (const [k, v] of Object.entries(bag)) {
+			if (!RENDERED_DEFINITION_KEYS.has(k)) {
+				out[k] = walkedRest[k];
+				continue;
+			}
+			if (someKeyIsUnspelled(v, (key) => keep.keys.has(key))) {
+				out[k] = mark ? POSITION_UNCERTIFIED : "***";
+				continue;
+			}
+			let positioned = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
+			let misaligned = false;
+			for (const leaf of keep.sentinel?.secretLeaves ?? []) {
+				const at = alignedSecretLeaf(positioned, leaf);
+				if (at === void 0) {
+					misaligned = true;
+					break;
+				}
+				if (!certifiedAtSecretPosition(at.value, keep.strings)) positioned = replaceAtPath(positioned, leaf.path, mark ? POSITION_UNCERTIFIED : "***");
+			}
+			if (misaligned) {
+				out[k] = mark ? POSITION_UNCERTIFIED : "***";
+				continue;
+			}
+			out[k] = refuseUncertifiedSubtree(positioned, keep.strings, mark, keep.scalars);
+		}
+		return out;
+	}
 	if (!subtreeHasDynamicReference(source)) return bag;
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
@@ -12303,6 +12614,9 @@ function glueTableNameChanged(oldValue, newValue) {
 	if (oldName === void 0 || newName === void 0) return false;
 	return oldName.toLowerCase() !== newName.toLowerCase();
 }
+function natZoneAddressesAddedToAutomaticGateway(oldValue, newValue) {
+	return oldValue == null && newValue != null;
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
@@ -12627,6 +12941,10 @@ var ReplacementRulesRegistry = class {
 			"KeyName",
 			"NetworkInterfaces"
 		]) });
+		this.rules.set("AWS::EC2::NatGateway", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", natZoneAddressesAddedToAutomaticGateway]])
+		});
 		this.rules.set("AWS::EC2::Volume", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"AvailabilityZone",
@@ -16023,6 +16341,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"LogsConfig",
 			"Name",
 			"QueuedTimeoutInMinutes",
+			"ResourceAccessRole",
 			"SecondaryArtifacts",
 			"SecondarySources",
 			"SecondarySourceVersions",
@@ -16031,13 +16350,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceVersion",
 			"Tags",
 			"TimeoutInMinutes",
+			"Visibility",
 			"VpcConfig"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["ResourceAccessRole", "not yet implemented by cdkd"],
-			["Triggers", "not yet implemented by cdkd"],
-			["Visibility", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map([["Triggers", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
 		ccRouteUnavailable: true
@@ -16371,21 +16687,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::EC2::NatGateway", {
 		handled: /* @__PURE__ */ new Set([
 			"AllocationId",
+			"AvailabilityMode",
+			"AvailabilityZoneAddresses",
 			"ConnectivityType",
 			"PrivateIpAddress",
 			"SecondaryAllocationIds",
 			"SecondaryPrivateIpAddressCount",
 			"SecondaryPrivateIpAddresses",
 			"SubnetId",
-			"Tags"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityMode", "not yet implemented by cdkd"],
-			["AvailabilityZoneAddresses", "not yet implemented by cdkd"],
-			["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and cdkd rejects NatGateway updates outright — routed via Cloud Control instead"],
-			["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]
+			"Tags",
+			"VpcId"
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["AvailabilityMode", "VpcId"]),
+		silentDrop: /* @__PURE__ */ new Map([["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and the cdkd NatGateway update releases only the AvailabilityZoneAddresses of a regional gateway, never the secondary addresses of a zonal one — routed via Cloud Control instead"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"AutoProvisionZones",
 			"AutoScalingIps",
@@ -16970,8 +17284,12 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		ccRouteUnavailable: true
 	}],
 	["AWS::Glue::Connection", {
-		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
-		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
+		handled: /* @__PURE__ */ new Set([
+			"CatalogId",
+			"ConnectionInput",
+			"Tags"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Name"]),
 		ccRouteUnavailable: false
@@ -17210,13 +17528,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DesiredShardLevelMetrics",
 			"MaxRecordSizeInKiB",
 			"Name",
+			"RecordDistributionStrategy",
 			"RetentionPeriodHours",
 			"ShardCount",
 			"StreamEncryption",
 			"StreamModeDetails",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["RecordDistributionStrategy", "not yet implemented by cdkd"], ["WarmThroughputMiBps", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map([["WarmThroughputMiBps", "AWS accepts it only on an account enrolled in the Kinesis minimum throughput billing commitment, so the SDK path is not wired (go-to-k/cdkd#1695); Cloud Control forwards it."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "WarmThroughputObject"]),
 		ccRouteUnavailable: false
@@ -20623,8 +20942,7 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AppConfig::HostedConfigurationVersion",
 	"AWS::AppConfig::Deployment",
-	"AWS::S3Tables::Namespace",
-	"AWS::S3Tables::Table"
+	"AWS::S3Tables::Namespace"
 ]);
 const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = /* @__PURE__ */ new Set([
 	"AWS::EC2::EIP",
@@ -20706,11 +21024,25 @@ function recordSetRefFromPhysicalId(physicalId, stateLookup) {
 	if (recordedName === void 0) return void 0;
 	return canonicalizeRoute53QueryName(name) === canonicalizeRoute53QueryName(recordedName) ? name : void 0;
 }
+function s3TablesTableRefFromPhysicalId(physicalId, stateLookup) {
+	if (!physicalId.includes("|") || !stateLookup) return physicalId;
+	const tableArn = stateLookup(["TableARN"]);
+	if (tableArn === void 0) return physicalId;
+	if (carriesSecretMask(tableArn)) return tableArn;
+	return tableArn.startsWith("arn:") && !tableArn.includes("|") ? tableArn : physicalId;
+}
+function lacksRecordedTableArn(resource) {
+	if (resource.resourceType !== "AWS::S3Tables::Table") return false;
+	if (!resource.physicalId.includes("|")) return false;
+	const recorded = (bag) => {
+		if (bag === void 0 || !Object.hasOwn(bag, "TableARN")) return false;
+		const value = bag["TableARN"];
+		return typeof value === "string" && (carriesSecretMask(value) || value.startsWith("arn:") && !value.includes("|"));
+	};
+	return !recorded(resource.properties) && !recorded(resource.attributes);
+}
 function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
-	if (resourceType === "AWS::S3Tables::Table" && !physicalId.includes("|") && stateLookup) {
-		const tableName = stateLookup(["TableName", "Name"]);
-		if (tableName) return tableName;
-	}
+	if (resourceType === "AWS::S3Tables::Table") return s3TablesTableRefFromPhysicalId(physicalId, stateLookup);
 	if (resourceType === "AWS::Glue::Table") {
 		const tableName = glueTableRefFromPhysicalId(physicalId, stateLookup);
 		if (tableName !== void 0) return tableName;
@@ -23725,6 +24057,68 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 		}
 		default: return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 	}
+	if (resourceType === "AWS::EC2::NatGateway") {
+		if (attributeName === "NatGatewayId") return physicalId;
+		if (attributeName === "RouteTableId" || attributeName === "EniId" || attributeName === "AutoProvisionZones" || attributeName === "AutoScalingIps") {
+			const read = async () => {
+				try {
+					const gateway = (await resolver.clients.clientsForRegion(resolver.explicitRegion).ec2.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.NatGatewayId === physicalId);
+					const addresses = gateway?.NatGatewayAddresses ?? [];
+					const primary = addresses.find((a) => a.IsPrimary === true) ?? addresses[0];
+					const value = attributeName === "RouteTableId" ? gateway?.RouteTableId : attributeName === "AutoProvisionZones" ? gateway?.AutoProvisionZones : attributeName === "AutoScalingIps" ? gateway?.AutoScalingIps : gateway?.AvailabilityMode === "regional" ? void 0 : primary?.NetworkInterfaceId;
+					return {
+						state: gateway?.State,
+						regional: gateway?.AvailabilityMode === "regional",
+						value: typeof value === "string" && value !== "" ? value : void 0
+					};
+				} catch (err) {
+					return refuseUnservedAttribute(resolver, {
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: describeFailureObserved(resolver, "DescribeNatGateways", err, context),
+						remedy: "Fix the read (the ec2:DescribeNatGateways permission, or the region) and deploy again."
+					});
+				}
+			};
+			let observedRead = await read();
+			if (observedRead.value === void 0 && observedRead.state === "pending") {
+				const watch = startInterruptWatch(`NAT gateway ${logicalId} attribute wait`);
+				try {
+					for (let poll = 0; poll < natGatewayAttributeWait.polls && observedRead.state === "pending"; poll++) {
+						if (watch.isInterrupted()) throw watch.onInterrupted();
+						await natGatewayAttributeWait.sleep(natGatewayAttributeWait.delayMs);
+						observedRead = await read();
+					}
+				} finally {
+					watch.dispose();
+				}
+			}
+			if (observedRead.value !== void 0) return observedRead.value;
+			if (observedRead.state === "pending") return refuseUnservedAttribute(resolver, {
+				logicalId,
+				attributeName,
+				resourceType,
+				physicalId,
+				context,
+				observed: "the NAT gateway was still pending when the attribute wait ran out",
+				remedy: "Check the gateway with `aws ec2 describe-nat-gateways`, then deploy again once it is available."
+			});
+			const remedy = observedRead.state === "available" ? attributeName === "EniId" && observedRead.regional ? "The gateway is available and has no such value: a regional NAT gateway reports no single EniId. Reference another attribute." : attributeName !== "EniId" && !observedRead.regional ? "The gateway is available, and AWS reports no such value for this zonal gateway; the attribute is set on regional NAT gateways. Reference another attribute." : "The gateway is available and AWS reports no such value for it; check it with `aws ec2 describe-nat-gateways`." : observedRead.state === "failed" ? "The gateway is failed and has no such attribute to serve; fix the gateway and deploy again." : observedRead.state === void 0 ? "DescribeNatGateways no longer returns the gateway; check it in the console." : "The gateway is deleted or being deleted and has no such attribute to serve.";
+			return refuseUnservedAttribute(resolver, {
+				logicalId,
+				attributeName,
+				resourceType,
+				physicalId,
+				context,
+				observed: `DescribeNatGateways reports no ${displayMasked(resolver, attributeName, context)}`,
+				remedy
+			});
+		}
+		return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
+	}
 	if (resourceType === "AWS::EC2::LaunchTemplate") {
 		if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
 			try {
@@ -23785,6 +24179,11 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 	}
 	return NOT_CONSTRUCTED;
 }
+const natGatewayAttributeWait = {
+	polls: 60,
+	delayMs: 1e4,
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/functions.ts
@@ -24355,6 +24754,11 @@ function lookupResourceRecord(resolver, logicalId, via, context) {
 async function resolveRef(resolver, logicalId, context, onParameter) {
 	const resource = lookupResourceRecord(resolver, logicalId, "Ref", context);
 	if (resource) {
+		if (lacksRecordedTableArn(resource)) {
+			const tableArn = await resolveGetAtt(resolver, [logicalId, "TableARN"], context);
+			if (typeof tableArn === "string" && tableArn.startsWith("arn:") && !tableArn.includes("|")) return tableArn;
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Ref ${displayMasked(resolver, logicalId, context)}: the state records no usable TableARN for this S3 Tables table (a cdkd older than v0.201.0 recorded none), and CloudFormation's Ref of a table is its TableARN, which its physical id does not contain. No usable one could be read from AWS either. If the state records none, run 'cdkd deploy' with permission to call s3tables:GetTable so cdkd records it; if it records a value that is not the table's ARN, re-import the table with 'cdkd import'.`));
+		}
 		const refValue = resolveRefValue(resolver, logicalId, resource, context);
 		recordSecretNamedRead(logicalId, refValue, context);
 		resolver.logger.debug(`Resolved Ref to resource: ${logRender(resolver, logicalId, context)} resolved to ${logRender(resolver, String(refValue), context)}`);
@@ -28062,7 +28466,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C8HDzpYh.js");
+			const { ASGProvider } = await import("./asg-provider-oKlrkJeO.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28171,7 +28575,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CjasAFV5.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DvFVCaYo.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DcBsBQLi.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DvuvSkfJ.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -45305,11 +45709,12 @@ const priorAttemptStore = new AsyncLocalStorage();
 function withPriorAttempts(lookup, fn) {
 	return priorAttemptStore.run(lookup, fn);
 }
-function priorAttemptLookup(logicalId, attempts) {
+function priorAttemptLookup(logicalId, attempts, provenOrphanIds) {
 	let landed = false;
 	return {
 		logicalId,
 		attempts,
+		...provenOrphanIds !== void 0 && { provenOrphanIds },
 		notePossiblyLanded: () => {
 			landed = true;
 		},
@@ -45321,20 +45726,32 @@ function getPriorAttempts(logicalId) {
 	return bound?.logicalId === logicalId ? bound : void 0;
 }
 function priorAttemptsInJournal(journal, logicalId, resourceType) {
-	let bags = [];
-	for (const segment of journal?.segments ?? []) {
-		if (segment.operations.some((op) => op.logicalId === logicalId)) bags = [];
-		for (const op of segment.failedOperations ?? []) {
-			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
-			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
-			if (op.changeType === "UPDATE" && op.replacementOrphaned !== void 0) continue;
-			if (recordedAsNewResource(op)) continue;
-			bags.push(op.attemptedProperties);
-		}
-		if (segment.supersededLogicalIds?.includes(logicalId)) bags = [];
+	const bags = [];
+	for (const op of unsupersededFailedOps(journal, logicalId, resourceType)) {
+		if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
+		if (op.changeType === "UPDATE" && op.replacementOrphaned !== void 0) continue;
+		if (recordedAsNewResource(op)) continue;
+		bags.push(op.attemptedProperties);
 	}
 	return bags;
 }
+function provenOrphanIdsInJournal(journal, logicalId, resourceType) {
+	const ids = [];
+	for (const op of unsupersededFailedOps(journal, logicalId, resourceType)) {
+		if (op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true) continue;
+		if (typeof op.physicalId === "string" && op.physicalId !== "") ids.push(op.physicalId);
+	}
+	return ids;
+}
+function unsupersededFailedOps(journal, logicalId, resourceType) {
+	let ops = [];
+	for (const segment of journal?.segments ?? []) {
+		if (segment.operations.some((op) => op.logicalId === logicalId)) ops = [];
+		for (const op of segment.failedOperations ?? []) if (op.logicalId === logicalId && op.resourceType === resourceType) ops.push(op);
+		if (segment.supersededLogicalIds?.includes(logicalId)) ops = [];
+	}
+	return ops;
+}
 function recordedAsNewResource(op) {
 	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
 	if (op.physicalIdRecoveredFromError === true) return false;
@@ -46245,15 +46662,17 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
-		if (properties["SSESpecification"]) {
-			const sse = properties["SSESpecification"];
-			const sseInput = { Enabled: sse["SSEEnabled"] !== void 0 ? Boolean(sse["SSEEnabled"]) : true };
-			if (sse["SSEType"]) sseInput.SSEType = sse["SSEType"];
-			createParams.SSESpecification = sseInput;
+		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
+		if (sseEnabledRefusal !== void 0) {
+			const onReplay = replayWarn(log, context).onUnusable;
+			if (!onReplay) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${sseEnabledRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
+			onReplay(`${sseEnabledRefusal}. Encryption is enabled, the block's default.`);
 		}
+		if (properties["SSESpecification"]) createParams.SSESpecification = toSdkTableSseSpecification(properties["SSESpecification"], readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion)));
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
-		if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
+		const localTableClass = extractLocalTableClass(properties, currentRegion);
+		if (localTableClass !== void 0) createParams.TableClass = localTableClass;
 		const createCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 		const createOnDemand = {
 			...createCeilings.read.value !== void 0 && { MaxReadRequestUnits: createCeilings.read.value },
@@ -46333,12 +46752,20 @@ var DynamoDBGlobalTableProvider = class {
 					const region = replica.RegionName;
 					if (!region || region === currentRegion) continue;
 					try {
+						const declared = readReplicaDeletionProtection(localReplicaEntry(wiringProperties, region), region);
+						try {
+							if ((declared === true ? await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName })) : void 0)?.Table?.DeletionProtectionEnabled === true) await this.setReplicaDeletionProtection(tableName, region, false, logicalId, maskSecrets);
+						} catch (flipError) {
+							if (isInterruptedWaitError(flipError)) throw flipError;
+							log.debug(`Partial-create cleanup: could not turn off deletion protection on the ${region} replica of ${log.value(tableName)}: ` + log.mask(describeAwsFailure(flipError).detail));
+						}
 						await this.dynamoDBClient.send(new UpdateTableCommand({
 							TableName: tableName,
 							ReplicaUpdates: [{ Delete: { RegionName: region } }]
 						}));
 						await this.waitForReplicaGone(tableName, region, logicalId, void 0, void 0, maskSecrets);
 					} catch (replicaCleanupErr) {
+						if (isInterruptedWaitError(replicaCleanupErr)) throw replicaCleanupErr;
 						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup: failed to drop replica ${region} on ${tableName}: `, replicaCleanupErr)} Run: ${pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName='${region}'}' --region ${currentRegion}`.render()}`);
 					}
 				}
@@ -46374,13 +46801,15 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics, maskSecrets = (text) => text) {
 		const create = { RegionName: region };
-		if (replica["KMSMasterKeyId"]) create.KMSMasterKeyId = replica["KMSMasterKeyId"];
+		const kmsMasterKeyId = readReplicaKmsMasterKeyId(replica);
+		if (kmsMasterKeyId !== void 0) create.KMSMasterKeyId = kmsMasterKeyId;
 		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics, maskSecrets);
 		if (replicaIndexes) create.GlobalSecondaryIndexes = replicaIndexes;
 		const tableOverrides = toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		if (tableOverrides.ProvisionedThroughputOverride) create.ProvisionedThroughputOverride = tableOverrides.ProvisionedThroughputOverride;
 		if (tableOverrides.OnDemandThroughputOverride) create.OnDemandThroughputOverride = tableOverrides.OnDemandThroughputOverride;
-		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
+		const tableClass = readReplicaTableClass(replica);
+		if (tableClass !== void 0) create.TableClassOverride = tableClass;
 		const replicaUpdates = [{ Create: create }];
 		for (let attempt = 1;; attempt++) try {
 			await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -46394,6 +46823,259 @@ var DynamoDBGlobalTableProvider = class {
 			await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
 		}
 		await this.waitForReplicaActive(tableName, region, logicalId, void 0, maskSecrets);
+		if (readReplicaDeletionProtection(replica, region, (message) => this.logger.warn(maskSecrets(message))) === true) await this.setReplicaDeletionProtection(tableName, region, true, logicalId, maskSecrets);
+	}
+	async setReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, budget) {
+		await this.sendReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, { budget });
+		await this.waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget);
+	}
+	async sendReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, opts = {}) {
+		await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, {
+			...opts,
+			region
+		});
+		await this.writeReplicaDeletionProtection(tableName, region, enabled);
+	}
+	async writeReplicaDeletionProtection(tableName, region, enabled) {
+		await this.getRegionalClient(region).send(new UpdateTableCommand({
+			TableName: tableName,
+			DeletionProtectionEnabled: enabled
+		}));
+	}
+	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget) {
+		const wait = beginDeleteWait(60, budget);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} deletion-protection change on ${tableName}`));
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				const replica = await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }));
+				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table.DeletionProtectionEnabled === enabled) {
+					if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+				}
+				await new Promise((resolve) => setTimeout(resolve, REPLICA_PROTECTION_SETTLE_POLL_MS));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+	}
+	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === currentRegion || addedRegions.has(region)) continue;
+			const declared = readReplicaDeletionProtection(replica, region, warn);
+			if (declared === UNUSABLE) continue;
+			const previous = readReplicaDeletionProtection(localReplicaEntry(previousProperties, region), region);
+			const newDpe = declared ?? false;
+			const oldDpe = previous === UNUSABLE ? void 0 : previous ?? false;
+			if (oldDpe !== void 0 && newDpe !== oldDpe) {
+				if (oldDpe && declared === void 0) warn(`Auto-disabling DeletionProtectionEnabled on the ${region} replica of ${tableName}: the template no longer sets it for that replica. Set it to false explicitly to silence this warning.`);
+				await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
+				continue;
+			}
+			if (declared === void 0) continue;
+			let live;
+			try {
+				live = (await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.DeletionProtectionEnabled;
+			} catch (readError) {
+				this.logger.debug(maskSecrets(`Could not read DeletionProtectionEnabled on the ${region} replica of ${tableName}: ` + describeAwsFailure(readError).detail));
+			}
+			if (typeof live === "boolean" && live !== newDpe) await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
+		}
+	}
+	async convergeReplicaSettings(tableName, logicalId, currentRegion, properties, addedRegions, maskSecrets) {
+		const kept = (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map(asRecord).filter((r) => typeof r?.["Region"] === "string" && r["Region"] !== currentRegion && !addedRegions.has(r["Region"]));
+		if (kept.every((r) => readReplicaTableClass(r) === void 0)) return;
+		let liveReplicas;
+		let sourceClass;
+		try {
+			const described = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+			liveReplicas = described.Table?.Replicas;
+			sourceClass = described.Table?.TableClassSummary?.TableClass;
+		} catch (readError) {
+			this.logger.debug(maskSecrets(`Could not read the replicas of ${tableName} to converge their table class: ` + describeAwsFailure(readError).detail));
+			return;
+		}
+		for (const replica of kept) {
+			const region = replica["Region"];
+			const live = liveReplicas?.find((r) => r.RegionName === region);
+			if (!live) continue;
+			const tableClass = readReplicaTableClass(replica);
+			if (tableClass === void 0) continue;
+			if (tableClass === (live.ReplicaTableClassSummary?.TableClass ?? sourceClass ?? "STANDARD")) {
+				this.logger.debug(maskSecrets(`The ${region} replica of ${tableName} already holds its declared table class`));
+				continue;
+			}
+			this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared table class`));
+			try {
+				await this.dynamoDBClient.send(new UpdateTableCommand({
+					TableName: tableName,
+					ReplicaUpdates: [{ Update: {
+						RegionName: region,
+						TableClassOverride: tableClass
+					} }]
+				}));
+				await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+			} catch (convergeError) {
+				if (isInterruptedWaitError(convergeError)) throw convergeError;
+				this.logger.debug(maskSecrets(`Could not bring the ${region} replica of ${tableName} to its declared table class: ` + describeAwsFailure(convergeError).detail));
+				this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold its declared TableClass, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+			}
+		}
+	}
+	async applyReplicaKeys(tableName, logicalId, currentRegion, properties, previousProperties, addedRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets) {
+		if (!(properties["SSESpecification"] !== void 0 && configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification") === void 0 && toSdkTableSseSpecification(properties["SSESpecification"], void 0).Enabled)) return;
+		const declared = /* @__PURE__ */ new Map();
+		for (const entry of Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region === "string") declared.set(region, readReplicaKmsMasterKeyId(replica));
+		}
+		if ([...declared.values()].every((key) => key === void 0)) return;
+		const replicaKeyChanged = [...declared].some(([region, key]) => region !== currentRegion && key !== void 0 && !addedRegions.has(region) && key !== readReplicaKmsMasterKeyId(localReplicaEntry(previousProperties, region)));
+		let liveKeys;
+		try {
+			liveKeys = await this.readLiveKeys(tableName, currentRegion);
+		} catch (readError) {
+			if (replicaKeyChanged || deferredSseFromTemplate || keylessSseFromTemplate) throw readError;
+			this.logger.debug(maskSecrets(`Could not read the KMS keys of ${tableName} to converge them: ` + describeAwsFailure(readError).detail));
+			return;
+		}
+		const templateChanged = replicaKeyChanged || keylessSseFromTemplate && [...declared].some(([region, key]) => region !== currentRegion && key !== void 0) || deferredSseFromTemplate && declared.get(currentRegion) !== liveKeys.get(currentRegion);
+		let request;
+		if (liveKeys.size < 2) {
+			if (deferredSseUpdate === void 0) return;
+			request = {
+				TableName: tableName,
+				SSESpecification: deferredSseUpdate
+			};
+		} else {
+			const built = this.replicaKeysRequest(tableName, logicalId, liveKeys, declared, templateChanged, maskSecrets);
+			if (built === void 0) return;
+			request = built;
+		}
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand(request));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		} catch (keyError) {
+			if (templateChanged || isInterruptedWaitError(keyError)) throw keyError;
+			this.logger.debug(maskSecrets(`Could not bring the KMS keys of ${tableName} to the declared ones: ` + describeAwsFailure(keyError).detail));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared KMS keys, and setting them failed (${describeAwsFailure(keyError).summary}). The next deploy that updates this table tries again.`));
+		}
+	}
+	async readLiveKeys(tableName, currentRegion) {
+		const described = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+		const keys = /* @__PURE__ */ new Map([[currentRegion, described.Table?.SSEDescription?.KMSMasterKeyArn]]);
+		for (const r of described.Table?.Replicas ?? []) if (r.RegionName !== void 0 && r.RegionName !== currentRegion) keys.set(r.RegionName, r.KMSMasterKeyId);
+		return keys;
+	}
+	replicaKeysRequest(tableName, logicalId, liveKeys, declared, templateChanged, maskSecrets) {
+		const drifted = [...liveKeys].some(([region, live]) => {
+			const key = declared.get(region);
+			return isKmsKeyArn(key) && key !== live;
+		});
+		if (!templateChanged && !drifted) {
+			this.logger.debug(maskSecrets(`Every region of ${tableName} already holds its declared KMS key`));
+			return;
+		}
+		const entries = [...liveKeys].map(([region, live]) => ({ Update: {
+			RegionName: region,
+			KMSMasterKeyId: declared.get(region) ?? live
+		} }));
+		const keyless = entries.filter((e) => e.Update.KMSMasterKeyId === void 0);
+		if (keyless.length > 0) {
+			const text = `The KMS keys of ${tableName} were not changed: DynamoDB takes every region's key in one call, and no key is declared or reported for ${keyless.map((e) => e.Update.RegionName).join(", ")}`;
+			if (templateChanged) throw new ProvisioningError(maskSecrets(`${text}. Declare a key for every replica`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+			this.logger.warn(maskSecrets(`${text}.`));
+			return;
+		}
+		this.logger.debug(maskSecrets(`Setting the KMS key of every region of ${tableName} in one ReplicaUpdates call`));
+		return {
+			TableName: tableName,
+			ReplicaUpdates: entries
+		};
+	}
+	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		} catch (error) {
+			if (fromTemplate || isInterruptedWaitError(error)) throw error;
+			this.logger.debug(maskSecrets(`Could not bring the ${what} of ${tableName} to the declared one: ` + describeAwsFailure(error).detail));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}). The next deploy that updates this table tries again.`));
+		}
+	}
+	async waitForGlobalTableSettled(tableName, logicalId, maskSecrets, opts = {}) {
+		const wait = beginDeleteWait(opts.maxPolls ?? 600, opts.budget);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB global table ${tableName} settling after an update`));
+		try {
+			while (wait.nextPoll()) {
+				if (opts.interruptible !== false && watch.isInterrupted()) throw watch.onInterrupted();
+				const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
+				if (table?.TableStatus === "ACTIVE" && table.SSEDescription?.Status !== "UPDATING" && (table.Replicas ?? []).every((r) => r.ReplicaStatus === "ACTIVE")) {
+					if (opts.region === void 0) return;
+					if ((await this.getRegionalClient(opts.region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+				}
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new ProvisioningError(maskSecrets(`Table ${tableName} and its replicas did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+	}
+	async dropReplicaForDelete(tableName, region, removeProtection, logicalId, budget, maskSecrets) {
+		let flippedOff = false;
+		if (removeProtection) {
+			try {
+				if ((await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.DeletionProtectionEnabled === true) {
+					await this.sendReplicaDeletionProtection(tableName, region, false, logicalId, maskSecrets, { budget });
+					flippedOff = true;
+				}
+			} catch (flipError) {
+				if (isInterruptedWaitError(flipError)) throw flipError;
+				this.logger.debug(maskSecrets(`Could not disable DeletionProtectionEnabled on the ${region} replica of ${tableName}: ` + describeAwsFailure(flipError).detail));
+			}
+			if (flippedOff) try {
+				await this.waitForReplicaProtectionSettled(tableName, region, false, logicalId, maskSecrets, budget);
+			} catch (waitError) {
+				await this.restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, isInterruptedWaitError(waitError) ? "the destroy was interrupted" : "its deletion-protection change did not settle");
+				throw waitError;
+			}
+		}
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand({
+				TableName: tableName,
+				ReplicaUpdates: [{ Delete: { RegionName: region } }]
+			}));
+		} catch (dropError) {
+			if (flippedOff) await this.restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, "it could not be dropped");
+			throw dropError;
+		}
+	}
+	async restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, reason) {
+		for (let attempt = 1;; attempt++) try {
+			if (attempt === 1) await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, {
+				region,
+				maxPolls: 60,
+				interruptible: false
+			}).catch(() => void 0);
+			await this.writeReplicaDeletionProtection(tableName, region, true);
+			return;
+		} catch (restoreError) {
+			if (attempt === 1 && restoreError instanceof Error && restoreError.name === "ThrottlingException") {
+				await new Promise((resolve) => setTimeout(resolve, DELETION_PROTECTION_REFLIP_MS));
+				continue;
+			}
+			try {
+				this.logger.debug(maskSecrets(`Could not restore DeletionProtectionEnabled on the ${region} replica of ${tableName}: ${describeAwsFailure(restoreError).detail}`));
+				const head = maskSecrets(`The ${region} replica of ${tableName} was not deleted (${reason}), and its deletion protection, which this destroy turned off, could not be turned back on (${describeAwsFailure(restoreError).summary}). It is LEFT UNPROTECTED. To restore it, run: `);
+				const command = pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --deletion-protection-enabled --region ${region}`.render();
+				this.logger.warn(safeMsg`${head}${command}`);
+			} catch {}
+			return;
+		}
 	}
 	async waitForRegionalCopyReleased(tableName, region, maskSecrets) {
 		const client = this.getRegionalClient(region);
@@ -46437,6 +47119,18 @@ var DynamoDBGlobalTableProvider = class {
 			} catch {
 				guardRegion = "";
 			}
+			const protectedReplica = guardRegion === "" || extractLocalDeletionProtection(previousProperties, guardRegion) === true ? void 0 : (Array.isArray(previousProperties["Replicas"]) ? previousProperties["Replicas"] : []).map(asRecord).find((r) => typeof r?.["Region"] === "string" && r["Region"] !== guardRegion && coerceCfnBoolean(r["DeletionProtectionEnabled"]) === true)?.["Region"];
+			if (typeof protectedReplica === "string") return protectedReplacementAdvice({
+				evidence: `cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the ${protectedReplica} replica`,
+				replaceFlags,
+				disable: {
+					before: "aws dynamodb update-table --table-name",
+					identifier: physicalId,
+					after: "--no-deletion-protection-enabled",
+					caveat: "Run it with --region set to that replica's region.",
+					maskSecrets
+				}
+			});
 			return extractLocalDeletionProtection(previousProperties, guardRegion) === true ? protectedReplacementAdvice({
 				evidence: "cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the deploy region",
 				replaceFlags,
@@ -46474,8 +47168,12 @@ var DynamoDBGlobalTableProvider = class {
 				refuse(describeAwsFailure(error).detail, error);
 			}
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
+			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
 			if (refusal !== void 0) refuse(refusal);
+		} else {
+			const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
+			if (sseEnabledRefusal !== void 0) warn(`${sseEnabledRefusal}. Encryption is treated as enabled, the block's default.`);
 		}
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		let effectiveProperties;
@@ -46539,28 +47237,38 @@ var DynamoDBGlobalTableProvider = class {
 				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {}, maskSecrets);
 			}
 			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets);
+			let deferredSseUpdate;
+			let deferredSseFromTemplate = false;
+			let keylessSseFromTemplate = false;
 			const newDpe = extractLocalDeletionProtection(properties, currentRegion);
 			const oldDpe = extractLocalDeletionProtection(previousProperties, currentRegion);
 			const awsDpe = describeResp.Table?.DeletionProtectionEnabled;
 			const flatUpdate = { TableName: physicalId };
 			let flatChanged = false;
+			let tableClassUpdate;
+			let sseUpdate;
+			let sseFromTemplate = false;
+			let tableClassFromTemplate = false;
 			if (newDpe !== oldDpe || newDpe !== void 0 && typeof awsDpe === "boolean" && Boolean(newDpe) !== awsDpe) {
 				if ((oldDpe === true || awsDpe === true) && Boolean(newDpe ?? false) === false && !(newDpe !== void 0)) warn(`Auto-disabling DeletionProtectionEnabled on ${physicalId}: the CDK code does not set 'deletionProtection: true' but AWS has it enabled. AWS will accept DeleteTable on this resource after this deploy. If you meant to keep protection on, set 'deletionProtection: true' in your CDK code; if you meant to disable it explicitly, set 'deletionProtection: false' to silence this warning.`);
 				flatUpdate.DeletionProtectionEnabled = Boolean(newDpe ?? false);
 				flatChanged = true;
 			}
-			if (properties["TableClass"] !== void 0 && properties["TableClass"] !== previousProperties["TableClass"]) {
-				flatUpdate.TableClass = properties["TableClass"];
-				flatChanged = true;
-			}
-			if (properties["SSESpecification"] !== void 0 && !deepEqual(properties["SSESpecification"], previousProperties["SSESpecification"])) {
-				const sse = properties["SSESpecification"];
-				flatUpdate.SSESpecification = {
-					Enabled: sse["SSEEnabled"] !== void 0 ? Boolean(sse["SSEEnabled"]) : true,
-					...sse["SSEType"] !== void 0 && { SSEType: sse["SSEType"] }
-				};
-				flatChanged = true;
-			}
+			const tableClassChange = tableClassToSend(extractLocalTableClass(previousProperties, currentRegion), extractLocalTableClass(properties, currentRegion));
+			const declaredTableClass = extractLocalTableClass(properties, currentRegion);
+			const liveTableClass = describeResp.Table?.TableClassSummary?.TableClass ?? "STANDARD";
+			if (tableClassChange !== void 0) {
+				tableClassUpdate = tableClassChange;
+				tableClassFromTemplate = true;
+			} else if (declaredTableClass !== void 0 && declaredTableClass !== liveTableClass) tableClassUpdate = declaredTableClass;
+			const newLocalKmsKey = readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion));
+			if (properties["SSESpecification"] !== void 0 && (!deepEqual(properties["SSESpecification"], previousProperties["SSESpecification"]) || newLocalKmsKey !== readReplicaKmsMasterKeyId(localReplicaEntry(previousProperties, currentRegion)))) {
+				sseUpdate = toSdkTableSseSpecification(properties["SSESpecification"], newLocalKmsKey);
+				sseFromTemplate = true;
+			} else if (properties["SSESpecification"] === void 0 && previousProperties["SSESpecification"] !== void 0 && toSdkTableSseSpecification(previousProperties["SSESpecification"], void 0).Enabled) {
+				sseUpdate = { Enabled: false };
+				sseFromTemplate = true;
+			} else if (isKmsKeyArn(newLocalKmsKey) && properties["SSESpecification"] !== void 0 && configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification") === void 0 && toSdkTableSseSpecification(properties["SSESpecification"], void 0).Enabled && describeResp.Table?.SSEDescription?.KMSMasterKeyArn !== newLocalKmsKey) sseUpdate = toSdkTableSseSpecification(properties["SSESpecification"], newLocalKmsKey);
 			if (properties["StreamSpecification"] !== void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) {
 				let streamSpecUnusable = false;
 				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
@@ -46624,6 +47332,21 @@ var DynamoDBGlobalTableProvider = class {
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			if (tableClassUpdate !== void 0) await this.sendLocalSettingUpdate({
+				TableName: physicalId,
+				TableClass: tableClassUpdate
+			}, tableClassFromTemplate, "TableClass", physicalId, logicalId, maskSecrets);
+			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
+			if (sseUpdate?.KMSMasterKeyId !== void 0 && liveHasCrossRegionReplica) {
+				deferredSseUpdate = sseUpdate;
+				deferredSseFromTemplate = sseFromTemplate;
+			} else if (sseUpdate !== void 0) {
+				await this.sendLocalSettingUpdate({
+					TableName: physicalId,
+					SSESpecification: sseUpdate
+				}, sseFromTemplate, "encryption", physicalId, logicalId, maskSecrets);
+				keylessSseFromTemplate = sseFromTemplate && sseUpdate.KMSMasterKeyId === void 0 && liveHasCrossRegionReplica;
+			}
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (oldBilling !== newBilling) {
 				const billingUpdate = {
@@ -46736,7 +47459,6 @@ var DynamoDBGlobalTableProvider = class {
 					}));
 				}
 				const updateAction = { RegionName: region };
-				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
 				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, void 0, maskSecrets);
 				if (replicaIndexes) updateAction.GlobalSecondaryIndexes = replicaIndexes;
 				const replicaOverrides = toSdkReplicaThroughputOverrides(replica, newBilling, void 0, {}, maskSecrets);
@@ -46749,8 +47471,9 @@ var DynamoDBGlobalTableProvider = class {
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
 					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING. The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
-				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
-				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
+				const replicaTableClassChange = tableClassToSend(readReplicaTableClass(oldReplica), readReplicaTableClass(replica));
+				if (replicaTableClassChange !== void 0) updateAction.TableClassOverride = replicaTableClassChange;
+				if (!(updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
 					debug(`Cross-region replica ${region} of ${maskSecrets(physicalId)}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
@@ -46760,6 +47483,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
+			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
+			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, warn, maskSecrets);
+			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
+			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -47234,10 +47961,7 @@ var DynamoDBGlobalTableProvider = class {
 				try {
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget, void 0, progress);
 					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget, void 0, progress);
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						ReplicaUpdates: [{ Delete: { RegionName: region } }]
-					}));
+					await this.dropReplicaForDelete(physicalId, region, context?.removeProtection === true, logicalId, budget, deleteMask);
 					progress.stripped = true;
 					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
 				} catch (replicaErr) {
@@ -47755,11 +48479,57 @@ function localReplicaEntry(props, region) {
 	return raw.find((r) => r?.["Region"] === region);
 }
 function extractLocalDeletionProtection(props, region) {
-	const perReplica = localReplicaEntry(props, region)?.["DeletionProtectionEnabled"];
-	if (typeof perReplica === "boolean") return perReplica;
+	const local = localReplicaEntry(props, region);
+	const perReplica = coerceCfnBoolean(local?.["DeletionProtectionEnabled"]);
+	if (perReplica !== void 0) return perReplica;
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
 }
+function extractAnyDeletionProtection(props, region) {
+	if ((Array.isArray(props["Replicas"]) ? props["Replicas"] : []).some((r) => coerceCfnBoolean(asRecord(r)?.["DeletionProtectionEnabled"]) === true)) return true;
+	return extractLocalDeletionProtection(props, region);
+}
+function readReplicaKmsMasterKeyId(replica) {
+	const key = asRecord(asRecord(replica)?.["SSESpecification"])?.["KMSMasterKeyId"];
+	return typeof key === "string" && key !== "" ? key : void 0;
+}
+function readReplicaTableClass(replica) {
+	const tableClass = asRecord(replica)?.["TableClass"];
+	return typeof tableClass === "string" && tableClass !== "" ? tableClass : void 0;
+}
+const UNUSABLE = Symbol("unusable");
+function readReplicaDeletionProtection(replica, region, warn) {
+	const refusal = configBooleanRefusal(replica, "DeletionProtectionEnabled", `AWS::DynamoDB::GlobalTable Replicas[${region}]`);
+	if (refusal !== void 0) {
+		warn?.(`${refusal}. The ${region} replica's deletion protection is left as it is.`);
+		return UNUSABLE;
+	}
+	return coerceCfnBoolean(replica?.["DeletionProtectionEnabled"]);
+}
+function replicaKeyBlocks(props) {
+	return (Array.isArray(props["Replicas"]) ? props["Replicas"] : []).map((r) => [asRecord(r)?.["Region"], asRecord(r)?.["SSESpecification"]]);
+}
+function isKmsKeyArn(key) {
+	return key !== void 0 && /^arn:aws[a-z-]*:kms:[^:]+:\d+:key\//.test(key);
+}
+function tableClassToSend(previous, desired) {
+	if (desired !== void 0) return desired !== previous ? desired : void 0;
+	return previous !== void 0 && previous !== "STANDARD" ? "STANDARD" : void 0;
+}
+function toSdkTableSseSpecification(block, kmsMasterKeyId) {
+	const sse = asRecord(block) ?? {};
+	return {
+		Enabled: coerceCfnBoolean(sse["SSEEnabled"]) ?? true,
+		...sse["SSEType"] !== void 0 && sse["SSEType"] !== "" && { SSEType: sse["SSEType"] },
+		...kmsMasterKeyId !== void 0 && { KMSMasterKeyId: kmsMasterKeyId }
+	};
+}
+function extractLocalTableClass(props, region) {
+	const perReplica = readReplicaTableClass(localReplicaEntry(props, region));
+	if (perReplica !== void 0) return perReplica;
+	const topLevel = props["TableClass"];
+	return typeof topLevel === "string" && topLevel !== "" ? topLevel : void 0;
+}
 function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics, maskSecrets = (text) => text) {
 	const rawReplicas = properties["Replicas"];
 	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
@@ -47837,6 +48607,9 @@ function collectAutoScalingTargets(properties, localRegion) {
 }
 const REPLICA_COPY_RELEASE_POLLS = 180;
 const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
+const DELETION_PROTECTION_REFLIP_MS = 16e3;
+const REPLICA_PROTECTION_SETTLE_POLLS = 60;
+const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
 const REPLICA_COPY_RELEASE_ATTEMPTS = 3;
 function isReplicaCopyExistsRefusal(error) {
 	return error instanceof Error && /one or more replicas already existed as tables/i.test(error.message);
@@ -48492,7 +49265,7 @@ const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Neptune::DBCluster": "DeletionProtection",
 	"AWS::Neptune::DBInstance": "DeletionProtection",
 	"AWS::DynamoDB::Table": "DeletionProtectionEnabled",
-	"AWS::DynamoDB::GlobalTable": (bag, region) => extractLocalDeletionProtection(bag, region ?? ""),
+	"AWS::DynamoDB::GlobalTable": (bag, region) => extractAnyDeletionProtection(bag, region ?? ""),
 	"AWS::EC2::Instance": "DisableApiTermination",
 	"AWS::Cognito::UserPool": "DeletionProtection",
 	"AWS::AutoScaling::AutoScalingGroup": "DeletionProtection",
@@ -48541,7 +49314,7 @@ function isProtectionValueActive(resourceType, value) {
 //#endregion
 //#region src/provisioning/recorded-protection.ts
 const READER_LABELS = {
-	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled for the deploy region",
+	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled on the table or a replica",
 	"AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancerAttributes deletion_protection.enabled"
 };
 const REPLACEMENT_BLOCKING_VALUES = { "AWS::AutoScaling::AutoScalingGroup": /* @__PURE__ */ new Set(["prevent-all-deletion"]) };
@@ -50137,7 +50910,8 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 	}
 }
 async function provisionResourceBody(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
-	const priorAttempts = priorAttemptLookup(logicalId, async () => priorAttemptsInJournal(await engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion), logicalId, change.resourceType));
+	const loadJournal = () => engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion);
+	const priorAttempts = priorAttemptLookup(logicalId, async () => priorAttemptsInJournal(await loadJournal(), logicalId, change.resourceType), async () => provenOrphanIdsInJournal(await loadJournal(), logicalId, change.resourceType));
 	return withStackRecords(engine.stackRecordsView, () => {
 		switch (change.changeType) {
 			case "CREATE": return withPriorAttempts(priorAttempts, () => provisionCreate(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress));
@@ -51743,5 +52517,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { pendingRequestCount as $, malformedLocalResourcesWarning as $a, importableOutputKeys as $c, keepHeldTokenProvenance as $i, resolveApp as $l, destroyStackRecordsView as $n, hasNoCloudControlHandlers as $o, markDeleteStarted as $r, logOnlyValueCount as $s, seedsDeleteFirstGuard as $t, inheritedProvenanceForChildDiff as A, parseWebACLArn as Aa, recordProvenPublicExpression as Ac, deleteSkipReason as Ai, describeDockerCapturedOutput as Al, isWholeDynamicReferenceValue as An, refuseMalformedResourcePropertiesForDestroy as Ao, secretNamePrintingBags as Ar, canonicalCoordinates as As, readRefactorMarkerOnce as At, ownValue as Au, conditionFingerprint as B, accountArgs as Ba, applyCrossPrefixScan as Bc, DiffCalculator as Bi, redactDockerArgvValues as Bl, findDestructiveChanges as Bn, repairMalformedOutputsForReadOnly as Bo, effectiveDeletionPolicy as Br, readbackPathFor as Bs, replayFailedOperations as Bt, hasCdkAutoDeleteTag as C, carriesFetchableDynamicReference as Ca, splitGetAttStringForm as Cc, CloudControlProvider as Ci, parseBootstrapMarker as Cl, exportAliasCollisionScrubWarning as Cn, refuseMalformedResourceAttributesForOrphan as Co, createReadOnlyAttributeHealerFactory as Cr, describeTypeWithThrottleRetry as Cs, sameJournaledOrphans as Ct, describeJsonParseFailure as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, cfnRefValueFromPhysicalId as Da, recordMaskOnlyValuesIn as Dc, UNSPECIFIED_SKIP_REASON as Di, buildDenyExternalAccessPolicy as Dl, carriedExportAliasExposure as Dn, refuseMalformedResourceEntriesForImport as Do, namingSecretsWithRecordedNoEcho as Dr, sameLambdaFunctionAddress as Ds, lookupEachName as Dt, hasOwnKey as Du, markRefusedBeforeApplying as E, AWS_NO_VALUE as Ea, recordMaskOnlyValue as Ec, RollbackInlinePolicyWriters as Ei, validateContainerRepoName as El, secretSafeKeyDisplay as En, refuseMalformedResourceEntriesForDestroy as Eo, maskEventTextWithBoundBags as Er, lambdaFunctionNameForMask as Es, isAccessDeniedError as Et, defineOwnKey as Eu, findNestedTemplateTreeDefect as F, JSON_LISTING_HOLE_VALUE as Fa, isLockInfoExpired as Fc, ec2InstanceProtectionSite as Fi, formatDockerLoginError as Fl, bindingSkippedOutputs as Fn, refuseMalformedResourcesForDestroy as Fo, ATOMIC_FINAL_SNAPSHOT_TYPES as Fr, maskedLeafCoordinatesOf as Fs, updateRefactorMarker as Ft, resolveAssemblyPath as Fu, withResourceDeadline as G, hasReadableResources as Ga, withStackInstanceIdWithheld as Gc, s3BucketArn as Gi, warnFinchArgvExposure as Gl, rollbackOrphanIds as Gn, unreadableOrphanRecords as Go, ledgerForStack as Gr, markSameGenerationBag as Gs, isJournaledOrphan as Gt, parentSuppliedValues as H, displayLogicalId as Ha, isAccessDenied$1 as Hc, IntrinsicFunctionResolver as Hi, redactedDockerCause as Hl, findRefactorHints as Hn, repairMalformedResourcePropertiesForReadOnly as Ho, refusesFinalSnapshot as Hr, recordedNoEchoValuesOf as Hs, removeProtectionTypeList as Ht, isAbsoluteAssetPath as I, STATE_REGION_DIVERGED as Ia, S3StateBackend as Ic, isTerminationProtectionPropagationError as Ii, getDockerCmd as Il, DEFAULT_RESOURCE_TIMEOUT_MS as In, refuseMalformedResourcesForExport as Io, PRE_DELETE_SNAPSHOT_TYPES as Ir, noEchoCoordinatesOf as Is, hasPendingMovesOut as It, injectAwsRegion as Iu, keptWholeReasonText as J, malformedDriftResourcePropertiesWarning as Ja, describeRegionValueKind as Jc, s3BucketRegionalDomainName as Ji, Synthesizer as Jl, looselyEqual as Jn, findActionableSilentDrops as Jo, acquireIdempotencyToken as Jr, snapshotPassProvenance as Js, planRollback as Jt, diffSecurity as K, isReadableOrphanRecord as Ka, splitImportedOps as Kc, s3BucketDomainName as Ki, AssetManifestLoader as Kl, withMovedTo as Kn, unreadableResourceEntries as Ko, reserveStackCreateToken as Kr, redactForState as Ks, isReplacementOrphan as Kt, listNestedTemplateRows as L, STATE_RESOURCES_MALFORMED as La, rebuildClientForBucketRegion as Lc, observeThenDisableInstanceApiTermination as Li, isDockerClientEnvKey as Ll, DEFAULT_RESOURCE_WARN_AFTER_MS as Ln, refuseMalformedState as Lo, buildFinalSnapshotIdentifier as Lr, noEchoLeavesOf as Ls, pendingMovesOutOf as Lt, injectedAwsRegionValue as Lu, findServiceTokenRefusals as M, parameterInputsFor as Ma, WHOLE_DYNAMIC_REFERENCE_PATTERN as Mc, isWaitAbandonedError as Mi, describeDockerFailure as Ml, collectDeclaredOutputNames as Mn, refuseMalformedResourcePropertiesForExport as Mo, secretNamedRecordNeedles as Mr, maskAtCoordinates as Ms, refactorMarkerRefusalMessage as Mt, describeFileReadFailure as Mu, serviceTokenBlockingReason as N, passedParameterClassesOf as Na, isSingleDynamicReferenceToken as Nc, markWaitAbandoned as Ni, dockerSpawnEnvWithSensitive as Nl, collectPublishedOutputNames as Nn, refuseMalformedResourcePropertiesForOrphan as No, stateSecretNameNeedles as Nr, maskReadbackAtCoordinates as Ns, refuseRefactorMarker as Nt, displayAssemblyPath as Nu, computeImplicitDeleteEdges as O, isStalePlaceholderArnAttribute as Oa, recordNoEchoAttributeValues as Oc, deleteIndeterminateGuards as Oi, buildDockerImage as Ol, exportNameNoEchoParameters as On, refuseMalformedResourceEntriesForImportSave as Oo, orphanRecordsPrintingBag as Or, DagBuilder as Os, withApiLimit as Ot, hasPlainPrototype$1 as Ou, childTemplateLoader as P, declaresNoEcho as Pa, LockManager as Pc, disableInstanceApiTermination as Pi, finchSecretArgvRefusal as Pl, isExportAliasCollision as Pn, refuseMalformedResourcesForDeploy as Po, storedSecretNameNeedles as Pr, maskWholeValue as Ps, sameMove as Pt, renderAssemblyPathEscape as Pu, planOrphanAdoption as Q, malformedLocalResourceEntriesWarning as Qa, hasUnverifiableParameterRefusal as Qc, refuseUnreadableCdkCrossAccountRefs as Qi, loadCdkJson as Ql, awaitInFlightSibling as Qn, NO_CC_HANDLERS_REASON as Qo, isRefusedByName as Qr, literalSplitDelimitersOf as Qs, resolveReplacementOldType as Qt, renderNestedTemplateTreeDefect as R, UNREADABLE_ORPHANS_CONTAINER_ROW as Ra, CrossPrefixReadError as Rc, reDisableInstanceApiTermination as Ri, isMalformedEnvKey as Rl, maskingRetryLogger as Rn, repairMalformedOrphanRecordsForReadOnly as Ro, ccRoutedFinalSnapshotError as Rr, noEchoOutputsComparison as Rs, pendingMovesRefusalMessage as Rt, clearBucketRegionCache as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, carriesDynamicReference as Sa, recordPhysicalNameCopy as Sc, customResourceResponseExpirationWarning as Si, isCrossRegionRedirect as Sl, displayTextOrWithheld as Sn, refuseMalformedOutputsForDestroy as So, noEchoParameterNamesOf as Sr, templateResourceTypes as Ss, makeForeignHolderScan as St, processStackMessages as Su, getPriorAttempts as T, keepsSecretReferenceToken as Ta, provenPublicValue as Tc, unchangedBehindSecretReference as Ti, validateAssetBucketName as Tl, secretBearingStateKeyWarning as Tn, refuseMalformedResourceEntriesForDeploy as To, journaledOrphanPrintingBag as Tr, canonicalLambdaFunctionName as Ts, chunks as Tt, utf8ByteLength as Tu, readRecordedConditionVerdicts as U, hasReadableOrphans as Ua, isNotImplemented as Uc, poisonRenderedSpellingsCollidingIn as Ui, runDockerForeground as Ul, hintSidesOf as Un, repairMalformedResourcesForReadOnly as Uo, unsupportedFinalSnapshotError as Ur, valueAtCoordinate as Us, recordAfterRollbackUpdate as Ut, conditionInputsFrom as V, deployRefusesOrphanRowsReason as Va, crossPrefixDeniedWarning as Vc, INTRINSIC_KEYS as Vi, redactedCause as Vl, formatDestructiveChange as Vn, repairMalformedResourceEntriesForReadOnly as Vo, isFinalSnapshotError as Vr, readsNoEchoSource as Vs, replayRollback as Vt, enclosingDeadlineRemainingMs as W, hasReadableOutputs as Wa, stackInstanceIdOf as Wc, isSettledInstanceState as Wi, runDockerStreaming as Wl, movedToHint as Wn, unpreviewableOrphanRecords as Wo, earliestDefined as Wr, liveMatchesUnresolvedTokenFrame as Ws, demoteSupersededOrphans as Wt, makeCanonicalizePropertiesFn as X, malformedExportSourceWarning as Xa, hasReadableExportSet as Xc, resolveDynamicReferences as Xi, getDefaultStateBucketName as Xl, parseMappingFile as Xn, unwrittenCreateOnlyReplacement as Xo, DeploymentEventsStore as Xr, createUnionSecretMasker as Xs, recordUnderIdIsNotOwn as Xt, mergeNoChangeOutputs as Y, malformedExportNamesWarning as Ya, exportNamesCarriedFrom as Yc, s3BucketWebsiteUrl as Yi, synthesisStatusMessage as Yl, mappingPairs as Yn, findSilentDropProperties as Yo, DeploymentEventsReader as Yr, carryLogOnlyValues as Ys, recheckFailedPlan as Yt, makeSiblingClaimReader as Z, malformedLocalOutputsWarning as Za, hasReasonlessBaselineRefusal as Zc, producerLookupOver as Zi, getLegacyStateBucketName as Zl, proposeRenames as Zn, withoutSilentDropProperties as Zo, extractDeploymentEventError as Zr, hasMaskableValues as Zs, replacementNeverSwapped as Zt, deleteTableWithIndexBusyRetry as _, coerceParameterTypedValue as _a, inheritNestedStackParameterAssociations as _c, isCustomResourceType as _i, AssetModeResolver as _l, computeParameterTaint as _n, refuseMalformedOrphanRecordsForDestroy as _o, supersededResourcesOf as _r, replayWarn as _s, dropFailedCommands as _t, PARTITION_TABLE as _u, isProtectionValueActive as a, assertSendableRoleArn as aa, createSecretMasker as ac, tagMapAsList as ai, stackInstanceIdCarriedFrom as al, isRedactedRecordedValue as an, malformedOutputsRefusalMessage as ao, gray as ar, renderStatefulReason as as, displacedPhysicalIdShown as at, resolveUseCdkBootstrapAssets as au, waitForIndexesSettled as b, getAccountInfo as ba, physicalNameCopiesOf as bc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as bi, ensureAssetStorage as bl, resourcesNamingDeclaredParameter as bn, refuseMalformedOrphansForOrphan as bo, noEchoComparisonForTemplate as br, requireConfigString as bs, journaledOrphanLines as bt, AssemblyReader as bu, DynamoDBGlobalTableProvider as c, sendableAssumeRoleCommand as ca, maskSecretsInText as cc, stringifyIfAssigned as ci, timePhase as cl, updatePartialMessage as cn, malformedResourceEntriesWarning as co, yellow as cr, isWarmThroughputDecrease as cs, nestedChildStackName as ct, ssmResolvedValueType as cu, compensateRemovedDeletionProtection as d, callerEnvCredentials as da, withoutPhysicalNameCopies as dc, ccBrokenReason as di, stringifyValue as dl, nameGenerationHighWaterOf as dn, malformedScrubResourceEntriesRefusalMessage as do, holdsSupersededResources as dr, coerceCfnBoolean as ds, revertedNestedRowIds as dt, MIGRATE_TMP_PREFIX as du, outputReferenceProvenanceOf as ea, printingCorpusOf as ec, DBPROXY_TAGS_WHAT as ei, importableOutputs as el, orphanNeedsIdentity as en, malformedOrphanRecordsRefusalMessage as eo, getStackRecords as er, findReplacedReadersOfRecreateTargets as es, resolvePendingCloudControlRequests as et, resolveAutoAssetStorage as eu, deleteBudgetKey as f, envCredentialsAreAssumedRole as fa, DYNAMIC_REFERENCE_TOKEN_SCAN as fc, isCustomResource as fi, WorkGraph as fl, nameScopeOf as fn, malformedStateRefusalMessage as fo, isSupersededResourceRecord as fr, coerceCfnInteger as fs, withNestedRevertRun as ft, findLargeInlineResources as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, regionLessSecretName as ga, identityKeyFor as gc, readsNoEchoDeleteValues as gi, rewriteTemplateAssetReferences as gl, withNameGenerationReached as gn, refuseMalformedOrphanRecords as go, supersededHolderOf as gr, readConfigString as gs, deleteJournaledOrphans as gt, expectedOwnerParam as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, producerRegionsFromState as ha, pathCrossesDottedKey as hc, TemplateNoEchoReresolver as hi, loadPublishableAssetManifest as hl, retiredNameGenerationsLeaving as hn, refuseMalformedNestedChildOutputs as ho, supersededHeldByOtherTypeWarning as hr, configStringRefusal as hs, withNestedStackContext as ht, decodeListingKey as hu, PROTECTION_PROPERTY_BY_TYPE as i, assertFlagRoleArn as ia, unionOfSecretBags as ic, refuseMalformedDesiredTags as ii, shouldRetainResource as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, malformedOrphansWarning as io, cyan as ir, isStatefulRecreateTargetSync as is, displacedOpClause as it, resolveStateBucketWithDefaultAndSource as iu, deferredServiceTokenWarning as j, withSharedDrainBudget as ja, wholeStringLeavesOf as jc, withIndeterminateGuard as ji, describeDockerExecFailure as jl, noEchoParameterValueSeed as jn, refuseMalformedResourcePropertiesForDrift as jo, secretNamedAttributeNamesOf as jr, isMarkedCoordinate as js, refactorMarkerMovesOf as jt, absoluteAssemblyPathEscape as ju, crossStackOutputProvenanceSource as k, refStateLookupFromResource as ka, recordNoEchoParameterFreshValue as kc, deleteLeftInPlace as ki, resolveDockerContextDirectory as kl, exportNameSecretExposure as kn, refuseMalformedResourceEntriesForOrphan as ko, secretNamePrintingBag as kr, TemplateParser as ks, readRefactorMarker as kt, nullPrototypeRecord as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, AWS_CREDENTIAL_ENV_KEYS as la, scrubResourceRecord as lc, CC_BROKEN_REASON as li, AssetPublisher as ll, updatePartialReason as ln, malformedResourcePropertiesWarning as lo, addSuperseded as lr, toCfnInteger as ls, recordDisplacedSkips as lt, CFN_TEMPLATE_BODY_LIMIT as lu, resolveDynamoDbDeleteBudgetMs as m, classifyReplaySecretRegion as ma, isUncertifiedBaselineMaskPosition as mc, waitForLambdaFunctionActive as mi, createAssetRedirectResolver as ml, retiredNameGenerationsAfter as mn, refuseDivergentRecordRegionForDestroy as mo, supersededAfterRollback as mr, configIntegerRefusal as ms, getCurrentNestedStackContext as mt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mu, recordedProtectionEvidence as n, recordedReferenceRegions as na, recordLogOnlyValue as nc, planTagDiff as ni, orphansAfterRollback as nl, getCurrentProducerRegions as nn, malformedOrphanRowsKeptWarning as no, replacedDeleteFailureVerdict as nr, MULTI_REGION_RECREATE_BLOCKED_TYPES as ns, recordRetainedForReadoption as nt, resolveSkipPrefix as nu, perType as o, explicitRoleArnOrThrow as oa, errorCauseChain as oc, tagPlanWarning as oi, PhaseClock as ol, redactedDeleteAddressFields as on, malformedOutputsWarning as oo, green as or, WARM_THROUGHPUT_MEMBERS as os, dropSettledNestedJournals as ot, stateBucketExistenceConfirmed as ou, resolveDynamoDbDeleteBudgetClock as p, classifyRecordedSecretRegion as pa, dynamicReferenceTokens as pc, wouldReturnToSdkProvider as pi, buildAssetRedirectMap as pl, retiredAfterRollback as pn, previewableOrphanRecords as po, removeSuperseded as pr, configBooleanRefusal as ps, collectNestedChildUnaddressed as pt, uploadCfnTemplate as pu, isSecretBearingReferenceString as q, isReadableResourceEntry as qa, acceptedCreateOnlyDropsOf as qc, s3BucketDualStackDomainName as qi, getDockerImageBySourceHash as ql, isPairableType as qn, withheldAccountClause as qo, withCreateTokenLedger as qr, recordReferenceProvenanceEntry as qs, planFailedOps as qt, recordedProtectionNote as r, applyRoleArnIfSet as ra, shareLogOnlyValues as rc, readTagList as ri, orphansCarriedFrom as rl, inheritProducerRegions as rn, malformedOrphansRefusalMessage as ro, bold as rr, isStatefulRecreateTargetForReplace as rs, NESTED_PENDING_PARENT_REASON as rt, resolveStateBucketWithDefault as ru, readProtection as s, isIamRoleArn as sa, maskSecretsInError as sc, definedAttributes as si, renderPhaseTimings as sl, redactedDeleteAddressSkip as sn, malformedRenderedContainersWarning as so, red as sr, coerceWarmThroughput as ss, getNestedRevertRun as st, warnDeprecatedNoPrefixCliFlag as su, DeployEngine as t, recordedOutputReferenceRegions as ta, recordLogOnlyParameterValue as tc, DBPROXY_TAG_OPTIONS as ti, isReadableBag as tl, findNestedStackTypeChanges as tn, malformedOrphanRecordsWarning as to, withStackRecords as tr, shownType as ts, keptForRetainedRecord as tt, resolveCaptureObservedState as tu, beginDeleteWait as u, applyCallerIdentityCredentials as ua, withPhysicalNameCopies as uc, ProviderRegistry as ui, isSensitiveAttributeName as ul, nameGenerationCarriedFrom as un, malformedResourcesWarning as uo, deleteSupersededEntry as ur, toFiniteNumber as us, revertNestedChildFromJournal as ut, CFN_TEMPLATE_URL_LIMIT as uu, maskedLogger as v, isUnboundTemplateParameter as va, recordNestedStackParameterExpressions as vc, getCurrentResourceSecrets as vi, BOOTSTRAP_MARKER_PREFIX as vl, namesAnyDeclaredParameter as vn, refuseMalformedOrphans as vo, withoutSuperseded as vr, requireConfigArray as vs, dropFailedHint as vt, canonicalizeRegion as vu, isTruthyCfnBoolean as w, isNamelessDynamicReferenceError as wa, carriesSecretMask as wc, slowCcOperationTimeoutMs as wi, readBootstrapMarkerBody as wl, secretBearing as wn, refuseMalformedResourceEntries as wo, completedReplayEntries as wr, withRetry as ws, formatResourceLine as wt, parseFailureDebugDetail as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, isImpossibleEmptyStoredAttribute as xa, recordAttributeIdCopy as xc, applyCustomResourceResponseExpiration as xi, getBootstrapMarkerKey as xl, WITHHELD_NAME_DISPLAY as xn, refuseMalformedOutputs as xo, noEchoExactEchoLeavesOf as xr, prefetchCreateOnlyPropertyPaths as xs, loadJournaledOrphans as xt, StageLoadError as xu, relayedIndexBusyDelete as y, parameterTypeMayLoseSecretIdentity as ya, recoverMaskedOutput as yc, withPrintingSecrets as yi, assertAssetBucketRegion as yl, reachableDivergentParameters as yn, refuseMalformedOrphansForDestroy as yo, noEchoAttributeNamesOf as yr, requireConfigObject as ys, isHandledOrphan as yt, derivePartitionAndUrlSuffix as yu, templateIdentity as z, UNREADABLE_RESOURCES_MAP_ROW as za, CrossPrefixScanCache as zc, reEnableInstanceApiTermination as zi, partitionSensitiveEnv as zl, constructPathOf as zn, repairMalformedOrphansForReadOnly as zo, createPreDeleteFinalSnapshot as zr, passedNoEchoParametersOf as zs, refusePendingMovesOut as zt, resolveBucketRegion as zu };
-//# sourceMappingURL=deploy-engine-BdqMXegu.js.map
+export { planOrphanAdoption as $, malformedLocalOutputsWarning as $a, hasReadableExportSet as $c, refuseUnreadableCdkCrossAccountRefs as $i, getDefaultStateBucketName as $l, awaitInFlightSibling as $n, withoutSilentDropProperties as $o, isRefusedByName as $r, hasMaskableValues as $s, resolveReplacementOldType as $t, inheritedProvenanceForChildDiff as A, lacksRecordedTableArn as Aa, recordMaskOnlyValuesIn as Ac, deleteLeftInPlace as Ai, buildDenyExternalAccessPolicy as Al, exportNameSecretExposure as An, refuseMalformedResourceEntriesForImportSave as Ao, secretNamePrintingBag as Ar, DagBuilder as As, readRefactorMarker as At, hasOwnKey as Au, conditionFingerprint as B, UNREADABLE_ORPHANS_CONTAINER_ROW as Ba, rebuildClientForBucketRegion as Bc, reEnableInstanceApiTermination as Bi, isDockerClientEnvKey as Bl, constructPathOf as Bn, repairMalformedOrphanRecordsForReadOnly as Bo, createPreDeleteFinalSnapshot as Br, noEchoOutputsComparison as Bs, refusePendingMovesOut as Bt, injectedAwsRegionValue as Bu, hasCdkAutoDeleteTag as C, carriesDynamicReference as Ca, physicalNameCopiesOf as Cc, customResourceResponseExpirationWarning as Ci, ensureAssetStorage as Cl, displayTextOrWithheld as Cn, refuseMalformedOutputs as Co, noEchoParameterNamesOf as Cr, prefetchCreateOnlyPropertyPaths as Cs, makeForeignHolderScan as Ct, AssemblyReader as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, AWS_NO_VALUE as Da, carriesSecretMask as Dc, RollbackInlinePolicyWriters as Di, readBootstrapMarkerBody as Dl, secretSafeKeyDisplay as Dn, refuseMalformedResourceEntriesForDeploy as Do, maskEventTextWithBoundBags as Dr, canonicalLambdaFunctionName as Ds, isAccessDeniedError as Dt, parseFailureDebugDetail as Du, markRefusedBeforeApplying as E, keepsSecretReferenceToken as Ea, splitGetAttStringForm as Ec, unchangedBehindSecretReference as Ei, parseBootstrapMarker as El, secretBearingStateKeyWarning as En, refuseMalformedResourceEntries as Eo, journaledOrphanPrintingBag as Er, withRetry as Es, chunks as Et, describeJsonParseFailure as Eu, findNestedTemplateTreeDefect as F, passedParameterClassesOf as Fa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fc, disableInstanceApiTermination as Fi, describeDockerFailure as Fl, isExportAliasCollision as Fn, refuseMalformedResourcePropertiesForOrphan as Fo, storedSecretNameNeedles as Fr, maskReadbackAtCoordinates as Fs, sameMove as Ft, describeFileReadFailure as Fu, enclosingDeadlineRemainingMs as G, hasReadableOrphans as Ga, isAccessDenied$1 as Gc, isSettledInstanceState as Gi, redactedDockerCause as Gl, movedToHint as Gn, repairMalformedResourcesForReadOnly as Go, earliestDefined as Gr, valueAtCoordinate as Gs, demoteSupersededOrphans as Gt, parentSuppliedValues as H, accountArgs as Ha, CrossPrefixScanCache as Hc, INTRINSIC_KEYS as Hi, partitionSensitiveEnv as Hl, formatDestructiveChange as Hn, repairMalformedOutputsForReadOnly as Ho, isFinalSnapshotError as Hr, readbackPathFor as Hs, replayRollback as Ht, resolveBucketRegion as Hu, isAbsoluteAssetPath as I, declaresNoEcho as Ia, isSingleDynamicReferenceToken as Ic, ec2InstanceProtectionSite as Ii, dockerSpawnEnvWithSensitive as Il, bindingSkippedOutputs as In, refuseMalformedResourcesForDeploy as Io, ATOMIC_FINAL_SNAPSHOT_TYPES as Ir, maskWholeValue as Is, updateRefactorMarker as It, displayAssemblyPath as Iu, isSecretBearingReferenceString as J, isReadableOrphanRecord as Ja, withStackInstanceIdWithheld as Jc, s3BucketDualStackDomainName as Ji, warnFinchArgvExposure as Jl, isPairableType as Jn, unreadableResourceEntries as Jo, withCreateTokenLedger as Jr, redactForState as Js, planFailedOps as Jt, withResourceDeadline as K, hasReadableOutputs as Ka, isNotImplemented as Kc, s3BucketArn as Ki, runDockerForeground as Kl, rollbackOrphanIds as Kn, unpreviewableOrphanRecords as Ko, ledgerForStack as Kr, liveMatchesUnresolvedTokenFrame as Ks, isJournaledOrphan as Kt, listNestedTemplateRows as L, JSON_LISTING_HOLE_VALUE as La, LockManager as Lc, isTerminationProtectionPropagationError as Li, finchSecretArgvRefusal as Ll, DEFAULT_RESOURCE_TIMEOUT_MS as Ln, refuseMalformedResourcesForDestroy as Lo, PRE_DELETE_SNAPSHOT_TYPES as Lr, maskedLeafCoordinatesOf as Ls, hasPendingMovesOut as Lt, renderAssemblyPathEscape as Lu, findServiceTokenRefusals as M, parseWebACLArn as Ma, recordNoEchoParameterFreshValue as Mc, withIndeterminateGuard as Mi, resolveDockerContextDirectory as Ml, noEchoParameterValueSeed as Mn, refuseMalformedResourcePropertiesForDestroy as Mo, secretNamedAttributeNamesOf as Mr, canonicalCoordinates as Ms, refactorMarkerMovesOf as Mt, nullPrototypeRecord as Mu, serviceTokenBlockingReason as N, withSharedDrainBudget as Na, recordProvenPublicExpression as Nc, isWaitAbandonedError as Ni, describeDockerCapturedOutput as Nl, collectDeclaredOutputNames as Nn, refuseMalformedResourcePropertiesForDrift as No, secretNamedRecordNeedles as Nr, isMarkedCoordinate as Ns, refactorMarkerRefusalMessage as Nt, ownValue as Nu, computeImplicitDeleteEdges as O, cfnRefValueFromPhysicalId as Oa, provenPublicValue as Oc, UNSPECIFIED_SKIP_REASON as Oi, validateAssetBucketName as Ol, carriedExportAliasExposure as On, refuseMalformedResourceEntriesForDestroy as Oo, namingSecretsWithRecordedNoEcho as Or, lambdaFunctionNameForMask as Os, lookupEachName as Ot, utf8ByteLength as Ou, childTemplateLoader as P, parameterInputsFor as Pa, wholeStringLeavesOf as Pc, markWaitAbandoned as Pi, describeDockerExecFailure as Pl, collectPublishedOutputNames as Pn, refuseMalformedResourcePropertiesForExport as Po, stateSecretNameNeedles as Pr, maskAtCoordinates as Ps, refuseRefactorMarker as Pt, absoluteAssemblyPathEscape as Pu, makeSiblingClaimReader as Q, malformedExportSourceWarning as Qa, exportNamesCarriedFrom as Qc, producerLookupOver as Qi, synthesisStatusMessage as Ql, proposeRenames as Qn, unwrittenCreateOnlyReplacement as Qo, extractDeploymentEventError as Qr, createUnionSecretMasker as Qs, replacementNeverSwapped as Qt, renderNestedTemplateTreeDefect as R, STATE_REGION_DIVERGED as Ra, isLockInfoExpired as Rc, observeThenDisableInstanceApiTermination as Ri, formatDockerLoginError as Rl, DEFAULT_RESOURCE_WARN_AFTER_MS as Rn, refuseMalformedResourcesForExport as Ro, buildFinalSnapshotIdentifier as Rr, noEchoCoordinatesOf as Rs, pendingMovesOutOf as Rt, resolveAssemblyPath as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, isImpossibleEmptyStoredAttribute as Sa, recoverMaskedOutput as Sc, applyCustomResourceResponseExpiration as Si, assertAssetBucketRegion as Sl, WITHHELD_NAME_DISPLAY as Sn, refuseMalformedOrphansForOrphan as So, noEchoExactEchoLeavesOf as Sr, requireConfigString as Ss, loadJournaledOrphans as St, derivePartitionAndUrlSuffix as Su, getPriorAttempts as T, isNamelessDynamicReferenceError as Ta, recordPhysicalNameCopy as Tc, slowCcOperationTimeoutMs as Ti, isCrossRegionRedirect as Tl, secretBearing as Tn, refuseMalformedResourceAttributesForOrphan as To, completedReplayEntries as Tr, describeTypeWithThrottleRetry as Ts, formatResourceLine as Tt, processStackMessages as Tu, readRecordedConditionVerdicts as U, deployRefusesOrphanRowsReason as Ua, applyCrossPrefixScan as Uc, IntrinsicFunctionResolver as Ui, redactDockerArgvValues as Ul, findRefactorHints as Un, repairMalformedResourceEntriesForReadOnly as Uo, refusesFinalSnapshot as Ur, readsNoEchoSource as Us, removeProtectionTypeList as Ut, conditionInputsFrom as V, UNREADABLE_RESOURCES_MAP_ROW as Va, CrossPrefixReadError as Vc, DiffCalculator as Vi, isMalformedEnvKey as Vl, findDestructiveChanges as Vn, repairMalformedOrphansForReadOnly as Vo, effectiveDeletionPolicy as Vr, passedNoEchoParametersOf as Vs, replayFailedOperations as Vt, clearBucketRegionCache as Vu, enclosingDeadlineExpired as W, displayLogicalId as Wa, crossPrefixDeniedWarning as Wc, poisonRenderedSpellingsCollidingIn as Wi, redactedCause as Wl, hintSidesOf as Wn, repairMalformedResourcePropertiesForReadOnly as Wo, unsupportedFinalSnapshotError as Wr, recordedNoEchoValuesOf as Ws, recordAfterRollbackUpdate as Wt, mergeNoChangeOutputs as X, malformedDriftResourcePropertiesWarning as Xa, acceptedCreateOnlyDropsOf as Xc, s3BucketWebsiteUrl as Xi, getDockerImageBySourceHash as Xl, mappingPairs as Xn, findActionableSilentDrops as Xo, DeploymentEventsReader as Xr, snapshotPassProvenance as Xs, recheckFailedPlan as Xt, keptWholeReasonText as Y, isReadableResourceEntry as Ya, splitImportedOps as Yc, s3BucketRegionalDomainName as Yi, AssetManifestLoader as Yl, looselyEqual as Yn, withheldAccountClause as Yo, acquireIdempotencyToken as Yr, recordReferenceProvenanceEntry as Ys, planRollback as Yt, makeCanonicalizePropertiesFn as Z, malformedExportNamesWarning as Za, describeRegionValueKind as Zc, resolveDynamicReferences as Zi, Synthesizer as Zl, parseMappingFile as Zn, findSilentDropProperties as Zo, DeploymentEventsStore as Zr, carryLogOnlyValues as Zs, recordUnderIdIsNotOwn as Zt, deleteTableWithIndexBusyRetry as _, regionLessSecretName as _a, pathCrossesDottedKey as _c, readsNoEchoDeleteValues as _i, createAssetRedirectResolver as _l, withNameGenerationReached as _n, refuseMalformedNestedChildOutputs as _o, supersededHolderOf as _r, configStringRefusal as _s, deleteJournaledOrphans as _t, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _u, isProtectionValueActive as a, assertFlagRoleArn as aa, shareLogOnlyValues as ac, refuseMalformedDesiredTags as ai, orphansAfterRollback as al, REDACTED_DELETE_ADDRESS_SKIP_REASON as an, malformedOrphansRefusalMessage as ao, cyan as ar, isStatefulRecreateTargetForReplace as as, displacedOpClause as at, resolveSkipPrefix as au, waitForIndexesSettled as b, parameterTypeMayLoseSecretIdentity as ba, inheritNestedStackParameterAssociations as bc, withPrintingSecrets as bi, AssetModeResolver as bl, reachableDivergentParameters as bn, refuseMalformedOrphans as bo, noEchoAttributeNamesOf as br, requireConfigArray as bs, isHandledOrphan as bt, PARTITION_TABLE as bu, DynamoDBGlobalTableProvider as c, isIamRoleArn as ca, errorCauseChain as cc, definedAttributes as ci, stackInstanceIdCarriedFrom as cl, redactedDeleteAddressSkip as cn, malformedOutputsWarning as co, red as cr, WARM_THROUGHPUT_MEMBERS as cs, getNestedRevertRun as ct, resolveUseCdkBootstrapAssets as cu, compensateRemovedDeletionProtection as d, applyCallerIdentityCredentials as da, scrubResourceRecord as dc, ProviderRegistry as di, timePhase as dl, nameGenerationCarriedFrom as dn, malformedResourcePropertiesWarning as do, deleteSupersededEntry as dr, toCfnInteger as ds, revertNestedChildFromJournal as dt, ssmResolvedValueType as du, keepHeldTokenProvenance as ea, literalSplitDelimitersOf as ec, markDeleteStarted as ei, hasReasonlessBaselineRefusal as el, seedsDeleteFirstGuard as en, malformedLocalResourceEntriesWarning as eo, destroyStackRecordsView as er, NO_CC_HANDLERS_REASON as es, pendingRequestCount as et, getLegacyStateBucketName as eu, deleteBudgetKey as f, callerEnvCredentials as fa, withPhysicalNameCopies as fc, ccBrokenReason as fi, AssetPublisher as fl, nameGenerationHighWaterOf as fn, malformedResourcesWarning as fo, holdsSupersededResources as fr, toFiniteNumber as fs, revertedNestedRowIds as ft, CFN_TEMPLATE_BODY_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, producerRegionsFromState as ga, isUncertifiedBaselineMaskPosition as gc, TemplateNoEchoReresolver as gi, buildAssetRedirectMap as gl, retiredNameGenerationsLeaving as gn, refuseDivergentRecordRegionForDestroy as go, supersededHeldByOtherTypeWarning as gr, configIntegerRefusal as gs, withNestedStackContext as gt, uploadCfnTemplate as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, classifyReplaySecretRegion as ha, dynamicReferenceTokens as hc, waitForLambdaFunctionActive as hi, WorkGraph as hl, retiredNameGenerationsAfter as hn, previewableOrphanRecords as ho, supersededAfterRollback as hr, configBooleanRefusal as hs, getCurrentNestedStackContext as ht, findLargeInlineResources as hu, PROTECTION_PROPERTY_BY_TYPE as i, applyRoleArnIfSet as ia, recordLogOnlyValue as ic, readTagList as ii, isReadableBag as il, inheritProducerRegions as in, malformedOrphanRowsKeptWarning as io, bold as ir, MULTI_REGION_RECREATE_BLOCKED_TYPES as is, NESTED_PENDING_PARENT_REASON as it, resolveCaptureObservedState as iu, deferredServiceTokenWarning as j, refStateLookupFromResource as ja, recordNoEchoAttributeValues as jc, deleteSkipReason as ji, buildDockerImage as jl, isWholeDynamicReferenceValue as jn, refuseMalformedResourceEntriesForOrphan as jo, secretNamePrintingBags as jr, TemplateParser as js, readRefactorMarkerOnce as jt, hasPlainPrototype$1 as ju, crossStackOutputProvenanceSource as k, isStalePlaceholderArnAttribute as ka, recordMaskOnlyValue as kc, deleteIndeterminateGuards as ki, validateContainerRepoName as kl, exportNameNoEchoParameters as kn, refuseMalformedResourceEntriesForImport as ko, orphanRecordsPrintingBag as kr, sameLambdaFunctionAddress as ks, withApiLimit as kt, defineOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, sendableAssumeRoleCommand as la, maskSecretsInError as lc, stringifyIfAssigned as li, PhaseClock as ll, updatePartialMessage as ln, malformedRenderedContainersWarning as lo, yellow as lr, coerceWarmThroughput as ls, nestedChildStackName as lt, stateBucketExistenceConfirmed as lu, resolveDynamoDbDeleteBudgetMs as m, classifyRecordedSecretRegion as ma, DYNAMIC_REFERENCE_TOKEN_SCAN as mc, wouldReturnToSdkProvider as mi, stringifyValue as ml, retiredAfterRollback as mn, malformedStateRefusalMessage as mo, removeSuperseded as mr, coerceCfnInteger as ms, collectNestedChildUnaddressed as mt, MIGRATE_TMP_PREFIX as mu, recordedProtectionEvidence as n, recordedOutputReferenceRegions as na, printingCorpusOf as nc, DBPROXY_TAG_OPTIONS as ni, importableOutputKeys as nl, findNestedStackTypeChanges as nn, malformedOrphanRecordsRefusalMessage as no, withStackRecords as nr, findReplacedReadersOfRecreateTargets as ns, keptForRetainedRecord as nt, resolveApp as nu, perType as o, assertSendableRoleArn as oa, unionOfSecretBags as oc, tagMapAsList as oi, orphansCarriedFrom as ol, isRedactedRecordedValue as on, malformedOrphansWarning as oo, gray as or, isStatefulRecreateTargetSync as os, displacedPhysicalIdShown as ot, resolveStateBucketWithDefault as ou, resolveDynamoDbDeleteBudgetClock as p, envCredentialsAreAssumedRole as pa, withoutPhysicalNameCopies as pc, isCustomResource as pi, isSensitiveAttributeName as pl, nameScopeOf as pn, malformedScrubResourceEntriesRefusalMessage as po, isSupersededResourceRecord as pr, coerceCfnBoolean as ps, withNestedRevertRun as pt, CFN_TEMPLATE_URL_LIMIT as pu, diffSecurity as q, hasReadableResources as qa, stackInstanceIdOf as qc, s3BucketDomainName as qi, runDockerStreaming as ql, withMovedTo as qn, unreadableOrphanRecords as qo, reserveStackCreateToken as qr, markSameGenerationBag as qs, isReplacementOrphan as qt, recordedProtectionNote as r, recordedReferenceRegions as ra, recordLogOnlyParameterValue as rc, planTagDiff as ri, importableOutputs as rl, getCurrentProducerRegions as rn, malformedOrphanRecordsWarning as ro, replacedDeleteFailureVerdict as rr, shownType as rs, recordRetainedForReadoption as rt, resolveAutoAssetStorage as ru, readProtection as s, explicitRoleArnOrThrow as sa, createSecretMasker as sc, tagPlanWarning as si, shouldRetainResource as sl, redactedDeleteAddressFields as sn, malformedOutputsRefusalMessage as so, green as sr, renderStatefulReason as ss, dropSettledNestedJournals as st, resolveStateBucketWithDefaultAndSource as su, DeployEngine as t, outputReferenceProvenanceOf as ta, logOnlyValueCount as tc, DBPROXY_TAGS_WHAT as ti, hasUnverifiableParameterRefusal as tl, orphanNeedsIdentity as tn, malformedLocalResourcesWarning as to, getStackRecords as tr, hasNoCloudControlHandlers as ts, resolvePendingCloudControlRequests as tt, loadCdkJson as tu, beginDeleteWait as u, AWS_CREDENTIAL_ENV_KEYS as ua, maskSecretsInText as uc, CC_BROKEN_REASON as ui, renderPhaseTimings as ul, updatePartialReason as un, malformedResourceEntriesWarning as uo, addSuperseded as ur, isWarmThroughputDecrease as us, recordDisplacedSkips as ut, warnDeprecatedNoPrefixCliFlag as uu, maskedLogger as v, coerceParameterTypedValue as va, spelledKeysOf as vc, isCustomResourceType as vi, loadPublishableAssetManifest as vl, computeParameterTaint as vn, refuseMalformedOrphanRecords as vo, supersededResourcesOf as vr, readConfigString as vs, dropFailedCommands as vt, decodeListingKey as vu, isTruthyCfnBoolean as w, carriesFetchableDynamicReference as wa, recordAttributeIdCopy as wc, CloudControlProvider as wi, getBootstrapMarkerKey as wl, exportAliasCollisionScrubWarning as wn, refuseMalformedOutputsForDestroy as wo, createReadOnlyAttributeHealerFactory as wr, templateResourceTypes as ws, sameJournaledOrphans as wt, StageLoadError as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, getAccountInfo as xa, recordNestedStackParameterExpressions as xc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xi, BOOTSTRAP_MARKER_PREFIX as xl, resourcesNamingDeclaredParameter as xn, refuseMalformedOrphansForDestroy as xo, noEchoComparisonForTemplate as xr, requireConfigObject as xs, journaledOrphanLines as xt, canonicalizeRegion as xu, relayedIndexBusyDelete as y, isUnboundTemplateParameter as ya, identityKeyFor as yc, getCurrentResourceSecrets as yi, rewriteTemplateAssetReferences as yl, namesAnyDeclaredParameter as yn, refuseMalformedOrphanRecordsForDestroy as yo, withoutSuperseded as yr, replayWarn as ys, dropFailedHint as yt, expectedOwnerParam as yu, templateIdentity as z, STATE_RESOURCES_MALFORMED as za, S3StateBackend as zc, reDisableInstanceApiTermination as zi, getDockerCmd as zl, maskingRetryLogger as zn, refuseMalformedState as zo, ccRoutedFinalSnapshotError as zr, noEchoLeavesOf as zs, pendingMovesRefusalMessage as zt, injectAwsRegion as zu };
+//# sourceMappingURL=deploy-engine-BOgsnnk0.js.map