@go-to-k/cdkd 0.306.0 → 0.307.0

package/dist/{deploy-engine-Bjr-FAuZ.js → deploy-engine-BOgsnnk0.js}

@@ -1,8 +1,8 @@
-import { c as __exportAll, r as getAwsClients } from "./aws-clients-DhsLtXsN.js";
-import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-Durl920o.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, d as prepareRemovalForUpdate, dt as startInterruptWatch, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as ElapsedBudgetRegistry, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as monotonicNowMs, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, ut as isInterruptedWaitError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-BbtwI9vN.js";
+import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
+import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-CZkNvTWF.js";
+import { t as getCdkdVersion } from "./version-Dhhyrf1v.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,7 +10,7 @@ import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetRe
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionConfigurationCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeNatGatewaysCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, ListTagsOfResourceCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
@@ -2360,7 +2360,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-DhsLtXsN.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-Bu9EMILF.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -12614,6 +12614,9 @@ function glueTableNameChanged(oldValue, newValue) {
 	if (oldName === void 0 || newName === void 0) return false;
 	return oldName.toLowerCase() !== newName.toLowerCase();
 }
+function natZoneAddressesAddedToAutomaticGateway(oldValue, newValue) {
+	return oldValue == null && newValue != null;
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
@@ -12938,6 +12941,10 @@ var ReplacementRulesRegistry = class {
 			"KeyName",
 			"NetworkInterfaces"
 		]) });
+		this.rules.set("AWS::EC2::NatGateway", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", natZoneAddressesAddedToAutomaticGateway]])
+		});
 		this.rules.set("AWS::EC2::Volume", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"AvailabilityZone",
@@ -16680,21 +16687,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::EC2::NatGateway", {
 		handled: /* @__PURE__ */ new Set([
 			"AllocationId",
+			"AvailabilityMode",
+			"AvailabilityZoneAddresses",
 			"ConnectivityType",
 			"PrivateIpAddress",
 			"SecondaryAllocationIds",
 			"SecondaryPrivateIpAddressCount",
 			"SecondaryPrivateIpAddresses",
 			"SubnetId",
-			"Tags"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityMode", "not yet implemented by cdkd"],
-			["AvailabilityZoneAddresses", "not yet implemented by cdkd"],
-			["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and cdkd rejects NatGateway updates outright — routed via Cloud Control instead"],
-			["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]
+			"Tags",
+			"VpcId"
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["AvailabilityMode", "VpcId"]),
+		silentDrop: /* @__PURE__ */ new Map([["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and the cdkd NatGateway update releases only the AvailabilityZoneAddresses of a regional gateway, never the secondary addresses of a zonal one — routed via Cloud Control instead"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"AutoProvisionZones",
 			"AutoScalingIps",
@@ -24052,6 +24057,68 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 		}
 		default: return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 	}
+	if (resourceType === "AWS::EC2::NatGateway") {
+		if (attributeName === "NatGatewayId") return physicalId;
+		if (attributeName === "RouteTableId" || attributeName === "EniId" || attributeName === "AutoProvisionZones" || attributeName === "AutoScalingIps") {
+			const read = async () => {
+				try {
+					const gateway = (await resolver.clients.clientsForRegion(resolver.explicitRegion).ec2.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.NatGatewayId === physicalId);
+					const addresses = gateway?.NatGatewayAddresses ?? [];
+					const primary = addresses.find((a) => a.IsPrimary === true) ?? addresses[0];
+					const value = attributeName === "RouteTableId" ? gateway?.RouteTableId : attributeName === "AutoProvisionZones" ? gateway?.AutoProvisionZones : attributeName === "AutoScalingIps" ? gateway?.AutoScalingIps : gateway?.AvailabilityMode === "regional" ? void 0 : primary?.NetworkInterfaceId;
+					return {
+						state: gateway?.State,
+						regional: gateway?.AvailabilityMode === "regional",
+						value: typeof value === "string" && value !== "" ? value : void 0
+					};
+				} catch (err) {
+					return refuseUnservedAttribute(resolver, {
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: describeFailureObserved(resolver, "DescribeNatGateways", err, context),
+						remedy: "Fix the read (the ec2:DescribeNatGateways permission, or the region) and deploy again."
+					});
+				}
+			};
+			let observedRead = await read();
+			if (observedRead.value === void 0 && observedRead.state === "pending") {
+				const watch = startInterruptWatch(`NAT gateway ${logicalId} attribute wait`);
+				try {
+					for (let poll = 0; poll < natGatewayAttributeWait.polls && observedRead.state === "pending"; poll++) {
+						if (watch.isInterrupted()) throw watch.onInterrupted();
+						await natGatewayAttributeWait.sleep(natGatewayAttributeWait.delayMs);
+						observedRead = await read();
+					}
+				} finally {
+					watch.dispose();
+				}
+			}
+			if (observedRead.value !== void 0) return observedRead.value;
+			if (observedRead.state === "pending") return refuseUnservedAttribute(resolver, {
+				logicalId,
+				attributeName,
+				resourceType,
+				physicalId,
+				context,
+				observed: "the NAT gateway was still pending when the attribute wait ran out",
+				remedy: "Check the gateway with `aws ec2 describe-nat-gateways`, then deploy again once it is available."
+			});
+			const remedy = observedRead.state === "available" ? attributeName === "EniId" && observedRead.regional ? "The gateway is available and has no such value: a regional NAT gateway reports no single EniId. Reference another attribute." : attributeName !== "EniId" && !observedRead.regional ? "The gateway is available, and AWS reports no such value for this zonal gateway; the attribute is set on regional NAT gateways. Reference another attribute." : "The gateway is available and AWS reports no such value for it; check it with `aws ec2 describe-nat-gateways`." : observedRead.state === "failed" ? "The gateway is failed and has no such attribute to serve; fix the gateway and deploy again." : observedRead.state === void 0 ? "DescribeNatGateways no longer returns the gateway; check it in the console." : "The gateway is deleted or being deleted and has no such attribute to serve.";
+			return refuseUnservedAttribute(resolver, {
+				logicalId,
+				attributeName,
+				resourceType,
+				physicalId,
+				context,
+				observed: `DescribeNatGateways reports no ${displayMasked(resolver, attributeName, context)}`,
+				remedy
+			});
+		}
+		return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
+	}
 	if (resourceType === "AWS::EC2::LaunchTemplate") {
 		if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
 			try {
@@ -24112,6 +24179,11 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 	}
 	return NOT_CONSTRUCTED;
 }
+const natGatewayAttributeWait = {
+	polls: 60,
+	delayMs: 1e4,
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/functions.ts
@@ -28394,7 +28466,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DrREeZeh.js");
+			const { ASGProvider } = await import("./asg-provider-oKlrkJeO.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28503,7 +28575,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Dps9UxBz.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D_3VAhFf.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DcBsBQLi.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DvuvSkfJ.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -46590,15 +46662,17 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
-		if (properties["SSESpecification"]) {
-			const sse = properties["SSESpecification"];
-			const sseInput = { Enabled: sse["SSEEnabled"] !== void 0 ? Boolean(sse["SSEEnabled"]) : true };
-			if (sse["SSEType"]) sseInput.SSEType = sse["SSEType"];
-			createParams.SSESpecification = sseInput;
+		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
+		if (sseEnabledRefusal !== void 0) {
+			const onReplay = replayWarn(log, context).onUnusable;
+			if (!onReplay) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${sseEnabledRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
+			onReplay(`${sseEnabledRefusal}. Encryption is enabled, the block's default.`);
 		}
+		if (properties["SSESpecification"]) createParams.SSESpecification = toSdkTableSseSpecification(properties["SSESpecification"], readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion)));
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
-		if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
+		const localTableClass = extractLocalTableClass(properties, currentRegion);
+		if (localTableClass !== void 0) createParams.TableClass = localTableClass;
 		const createCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 		const createOnDemand = {
 			...createCeilings.read.value !== void 0 && { MaxReadRequestUnits: createCeilings.read.value },
@@ -46678,12 +46752,20 @@ var DynamoDBGlobalTableProvider = class {
 					const region = replica.RegionName;
 					if (!region || region === currentRegion) continue;
 					try {
+						const declared = readReplicaDeletionProtection(localReplicaEntry(wiringProperties, region), region);
+						try {
+							if ((declared === true ? await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName })) : void 0)?.Table?.DeletionProtectionEnabled === true) await this.setReplicaDeletionProtection(tableName, region, false, logicalId, maskSecrets);
+						} catch (flipError) {
+							if (isInterruptedWaitError(flipError)) throw flipError;
+							log.debug(`Partial-create cleanup: could not turn off deletion protection on the ${region} replica of ${log.value(tableName)}: ` + log.mask(describeAwsFailure(flipError).detail));
+						}
 						await this.dynamoDBClient.send(new UpdateTableCommand({
 							TableName: tableName,
 							ReplicaUpdates: [{ Delete: { RegionName: region } }]
 						}));
 						await this.waitForReplicaGone(tableName, region, logicalId, void 0, void 0, maskSecrets);
 					} catch (replicaCleanupErr) {
+						if (isInterruptedWaitError(replicaCleanupErr)) throw replicaCleanupErr;
 						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup: failed to drop replica ${region} on ${tableName}: `, replicaCleanupErr)} Run: ${pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName='${region}'}' --region ${currentRegion}`.render()}`);
 					}
 				}
@@ -46719,13 +46801,15 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics, maskSecrets = (text) => text) {
 		const create = { RegionName: region };
-		if (replica["KMSMasterKeyId"]) create.KMSMasterKeyId = replica["KMSMasterKeyId"];
+		const kmsMasterKeyId = readReplicaKmsMasterKeyId(replica);
+		if (kmsMasterKeyId !== void 0) create.KMSMasterKeyId = kmsMasterKeyId;
 		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics, maskSecrets);
 		if (replicaIndexes) create.GlobalSecondaryIndexes = replicaIndexes;
 		const tableOverrides = toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		if (tableOverrides.ProvisionedThroughputOverride) create.ProvisionedThroughputOverride = tableOverrides.ProvisionedThroughputOverride;
 		if (tableOverrides.OnDemandThroughputOverride) create.OnDemandThroughputOverride = tableOverrides.OnDemandThroughputOverride;
-		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
+		const tableClass = readReplicaTableClass(replica);
+		if (tableClass !== void 0) create.TableClassOverride = tableClass;
 		const replicaUpdates = [{ Create: create }];
 		for (let attempt = 1;; attempt++) try {
 			await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -46739,6 +46823,259 @@ var DynamoDBGlobalTableProvider = class {
 			await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
 		}
 		await this.waitForReplicaActive(tableName, region, logicalId, void 0, maskSecrets);
+		if (readReplicaDeletionProtection(replica, region, (message) => this.logger.warn(maskSecrets(message))) === true) await this.setReplicaDeletionProtection(tableName, region, true, logicalId, maskSecrets);
+	}
+	async setReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, budget) {
+		await this.sendReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, { budget });
+		await this.waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget);
+	}
+	async sendReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, opts = {}) {
+		await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, {
+			...opts,
+			region
+		});
+		await this.writeReplicaDeletionProtection(tableName, region, enabled);
+	}
+	async writeReplicaDeletionProtection(tableName, region, enabled) {
+		await this.getRegionalClient(region).send(new UpdateTableCommand({
+			TableName: tableName,
+			DeletionProtectionEnabled: enabled
+		}));
+	}
+	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget) {
+		const wait = beginDeleteWait(60, budget);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} deletion-protection change on ${tableName}`));
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				const replica = await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }));
+				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table.DeletionProtectionEnabled === enabled) {
+					if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+				}
+				await new Promise((resolve) => setTimeout(resolve, REPLICA_PROTECTION_SETTLE_POLL_MS));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+	}
+	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === currentRegion || addedRegions.has(region)) continue;
+			const declared = readReplicaDeletionProtection(replica, region, warn);
+			if (declared === UNUSABLE) continue;
+			const previous = readReplicaDeletionProtection(localReplicaEntry(previousProperties, region), region);
+			const newDpe = declared ?? false;
+			const oldDpe = previous === UNUSABLE ? void 0 : previous ?? false;
+			if (oldDpe !== void 0 && newDpe !== oldDpe) {
+				if (oldDpe && declared === void 0) warn(`Auto-disabling DeletionProtectionEnabled on the ${region} replica of ${tableName}: the template no longer sets it for that replica. Set it to false explicitly to silence this warning.`);
+				await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
+				continue;
+			}
+			if (declared === void 0) continue;
+			let live;
+			try {
+				live = (await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.DeletionProtectionEnabled;
+			} catch (readError) {
+				this.logger.debug(maskSecrets(`Could not read DeletionProtectionEnabled on the ${region} replica of ${tableName}: ` + describeAwsFailure(readError).detail));
+			}
+			if (typeof live === "boolean" && live !== newDpe) await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
+		}
+	}
+	async convergeReplicaSettings(tableName, logicalId, currentRegion, properties, addedRegions, maskSecrets) {
+		const kept = (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map(asRecord).filter((r) => typeof r?.["Region"] === "string" && r["Region"] !== currentRegion && !addedRegions.has(r["Region"]));
+		if (kept.every((r) => readReplicaTableClass(r) === void 0)) return;
+		let liveReplicas;
+		let sourceClass;
+		try {
+			const described = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+			liveReplicas = described.Table?.Replicas;
+			sourceClass = described.Table?.TableClassSummary?.TableClass;
+		} catch (readError) {
+			this.logger.debug(maskSecrets(`Could not read the replicas of ${tableName} to converge their table class: ` + describeAwsFailure(readError).detail));
+			return;
+		}
+		for (const replica of kept) {
+			const region = replica["Region"];
+			const live = liveReplicas?.find((r) => r.RegionName === region);
+			if (!live) continue;
+			const tableClass = readReplicaTableClass(replica);
+			if (tableClass === void 0) continue;
+			if (tableClass === (live.ReplicaTableClassSummary?.TableClass ?? sourceClass ?? "STANDARD")) {
+				this.logger.debug(maskSecrets(`The ${region} replica of ${tableName} already holds its declared table class`));
+				continue;
+			}
+			this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared table class`));
+			try {
+				await this.dynamoDBClient.send(new UpdateTableCommand({
+					TableName: tableName,
+					ReplicaUpdates: [{ Update: {
+						RegionName: region,
+						TableClassOverride: tableClass
+					} }]
+				}));
+				await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+			} catch (convergeError) {
+				if (isInterruptedWaitError(convergeError)) throw convergeError;
+				this.logger.debug(maskSecrets(`Could not bring the ${region} replica of ${tableName} to its declared table class: ` + describeAwsFailure(convergeError).detail));
+				this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold its declared TableClass, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+			}
+		}
+	}
+	async applyReplicaKeys(tableName, logicalId, currentRegion, properties, previousProperties, addedRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets) {
+		if (!(properties["SSESpecification"] !== void 0 && configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification") === void 0 && toSdkTableSseSpecification(properties["SSESpecification"], void 0).Enabled)) return;
+		const declared = /* @__PURE__ */ new Map();
+		for (const entry of Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region === "string") declared.set(region, readReplicaKmsMasterKeyId(replica));
+		}
+		if ([...declared.values()].every((key) => key === void 0)) return;
+		const replicaKeyChanged = [...declared].some(([region, key]) => region !== currentRegion && key !== void 0 && !addedRegions.has(region) && key !== readReplicaKmsMasterKeyId(localReplicaEntry(previousProperties, region)));
+		let liveKeys;
+		try {
+			liveKeys = await this.readLiveKeys(tableName, currentRegion);
+		} catch (readError) {
+			if (replicaKeyChanged || deferredSseFromTemplate || keylessSseFromTemplate) throw readError;
+			this.logger.debug(maskSecrets(`Could not read the KMS keys of ${tableName} to converge them: ` + describeAwsFailure(readError).detail));
+			return;
+		}
+		const templateChanged = replicaKeyChanged || keylessSseFromTemplate && [...declared].some(([region, key]) => region !== currentRegion && key !== void 0) || deferredSseFromTemplate && declared.get(currentRegion) !== liveKeys.get(currentRegion);
+		let request;
+		if (liveKeys.size < 2) {
+			if (deferredSseUpdate === void 0) return;
+			request = {
+				TableName: tableName,
+				SSESpecification: deferredSseUpdate
+			};
+		} else {
+			const built = this.replicaKeysRequest(tableName, logicalId, liveKeys, declared, templateChanged, maskSecrets);
+			if (built === void 0) return;
+			request = built;
+		}
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand(request));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		} catch (keyError) {
+			if (templateChanged || isInterruptedWaitError(keyError)) throw keyError;
+			this.logger.debug(maskSecrets(`Could not bring the KMS keys of ${tableName} to the declared ones: ` + describeAwsFailure(keyError).detail));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared KMS keys, and setting them failed (${describeAwsFailure(keyError).summary}). The next deploy that updates this table tries again.`));
+		}
+	}
+	async readLiveKeys(tableName, currentRegion) {
+		const described = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+		const keys = /* @__PURE__ */ new Map([[currentRegion, described.Table?.SSEDescription?.KMSMasterKeyArn]]);
+		for (const r of described.Table?.Replicas ?? []) if (r.RegionName !== void 0 && r.RegionName !== currentRegion) keys.set(r.RegionName, r.KMSMasterKeyId);
+		return keys;
+	}
+	replicaKeysRequest(tableName, logicalId, liveKeys, declared, templateChanged, maskSecrets) {
+		const drifted = [...liveKeys].some(([region, live]) => {
+			const key = declared.get(region);
+			return isKmsKeyArn(key) && key !== live;
+		});
+		if (!templateChanged && !drifted) {
+			this.logger.debug(maskSecrets(`Every region of ${tableName} already holds its declared KMS key`));
+			return;
+		}
+		const entries = [...liveKeys].map(([region, live]) => ({ Update: {
+			RegionName: region,
+			KMSMasterKeyId: declared.get(region) ?? live
+		} }));
+		const keyless = entries.filter((e) => e.Update.KMSMasterKeyId === void 0);
+		if (keyless.length > 0) {
+			const text = `The KMS keys of ${tableName} were not changed: DynamoDB takes every region's key in one call, and no key is declared or reported for ${keyless.map((e) => e.Update.RegionName).join(", ")}`;
+			if (templateChanged) throw new ProvisioningError(maskSecrets(`${text}. Declare a key for every replica`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+			this.logger.warn(maskSecrets(`${text}.`));
+			return;
+		}
+		this.logger.debug(maskSecrets(`Setting the KMS key of every region of ${tableName} in one ReplicaUpdates call`));
+		return {
+			TableName: tableName,
+			ReplicaUpdates: entries
+		};
+	}
+	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		} catch (error) {
+			if (fromTemplate || isInterruptedWaitError(error)) throw error;
+			this.logger.debug(maskSecrets(`Could not bring the ${what} of ${tableName} to the declared one: ` + describeAwsFailure(error).detail));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}). The next deploy that updates this table tries again.`));
+		}
+	}
+	async waitForGlobalTableSettled(tableName, logicalId, maskSecrets, opts = {}) {
+		const wait = beginDeleteWait(opts.maxPolls ?? 600, opts.budget);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB global table ${tableName} settling after an update`));
+		try {
+			while (wait.nextPoll()) {
+				if (opts.interruptible !== false && watch.isInterrupted()) throw watch.onInterrupted();
+				const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
+				if (table?.TableStatus === "ACTIVE" && table.SSEDescription?.Status !== "UPDATING" && (table.Replicas ?? []).every((r) => r.ReplicaStatus === "ACTIVE")) {
+					if (opts.region === void 0) return;
+					if ((await this.getRegionalClient(opts.region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+				}
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new ProvisioningError(maskSecrets(`Table ${tableName} and its replicas did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+	}
+	async dropReplicaForDelete(tableName, region, removeProtection, logicalId, budget, maskSecrets) {
+		let flippedOff = false;
+		if (removeProtection) {
+			try {
+				if ((await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.DeletionProtectionEnabled === true) {
+					await this.sendReplicaDeletionProtection(tableName, region, false, logicalId, maskSecrets, { budget });
+					flippedOff = true;
+				}
+			} catch (flipError) {
+				if (isInterruptedWaitError(flipError)) throw flipError;
+				this.logger.debug(maskSecrets(`Could not disable DeletionProtectionEnabled on the ${region} replica of ${tableName}: ` + describeAwsFailure(flipError).detail));
+			}
+			if (flippedOff) try {
+				await this.waitForReplicaProtectionSettled(tableName, region, false, logicalId, maskSecrets, budget);
+			} catch (waitError) {
+				await this.restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, isInterruptedWaitError(waitError) ? "the destroy was interrupted" : "its deletion-protection change did not settle");
+				throw waitError;
+			}
+		}
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand({
+				TableName: tableName,
+				ReplicaUpdates: [{ Delete: { RegionName: region } }]
+			}));
+		} catch (dropError) {
+			if (flippedOff) await this.restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, "it could not be dropped");
+			throw dropError;
+		}
+	}
+	async restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, reason) {
+		for (let attempt = 1;; attempt++) try {
+			if (attempt === 1) await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, {
+				region,
+				maxPolls: 60,
+				interruptible: false
+			}).catch(() => void 0);
+			await this.writeReplicaDeletionProtection(tableName, region, true);
+			return;
+		} catch (restoreError) {
+			if (attempt === 1 && restoreError instanceof Error && restoreError.name === "ThrottlingException") {
+				await new Promise((resolve) => setTimeout(resolve, DELETION_PROTECTION_REFLIP_MS));
+				continue;
+			}
+			try {
+				this.logger.debug(maskSecrets(`Could not restore DeletionProtectionEnabled on the ${region} replica of ${tableName}: ${describeAwsFailure(restoreError).detail}`));
+				const head = maskSecrets(`The ${region} replica of ${tableName} was not deleted (${reason}), and its deletion protection, which this destroy turned off, could not be turned back on (${describeAwsFailure(restoreError).summary}). It is LEFT UNPROTECTED. To restore it, run: `);
+				const command = pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --deletion-protection-enabled --region ${region}`.render();
+				this.logger.warn(safeMsg`${head}${command}`);
+			} catch {}
+			return;
+		}
 	}
 	async waitForRegionalCopyReleased(tableName, region, maskSecrets) {
 		const client = this.getRegionalClient(region);
@@ -46782,6 +47119,18 @@ var DynamoDBGlobalTableProvider = class {
 			} catch {
 				guardRegion = "";
 			}
+			const protectedReplica = guardRegion === "" || extractLocalDeletionProtection(previousProperties, guardRegion) === true ? void 0 : (Array.isArray(previousProperties["Replicas"]) ? previousProperties["Replicas"] : []).map(asRecord).find((r) => typeof r?.["Region"] === "string" && r["Region"] !== guardRegion && coerceCfnBoolean(r["DeletionProtectionEnabled"]) === true)?.["Region"];
+			if (typeof protectedReplica === "string") return protectedReplacementAdvice({
+				evidence: `cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the ${protectedReplica} replica`,
+				replaceFlags,
+				disable: {
+					before: "aws dynamodb update-table --table-name",
+					identifier: physicalId,
+					after: "--no-deletion-protection-enabled",
+					caveat: "Run it with --region set to that replica's region.",
+					maskSecrets
+				}
+			});
 			return extractLocalDeletionProtection(previousProperties, guardRegion) === true ? protectedReplacementAdvice({
 				evidence: "cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the deploy region",
 				replaceFlags,
@@ -46819,8 +47168,12 @@ var DynamoDBGlobalTableProvider = class {
 				refuse(describeAwsFailure(error).detail, error);
 			}
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
+			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
 			if (refusal !== void 0) refuse(refusal);
+		} else {
+			const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
+			if (sseEnabledRefusal !== void 0) warn(`${sseEnabledRefusal}. Encryption is treated as enabled, the block's default.`);
 		}
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		let effectiveProperties;
@@ -46884,28 +47237,38 @@ var DynamoDBGlobalTableProvider = class {
 				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {}, maskSecrets);
 			}
 			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets);
+			let deferredSseUpdate;
+			let deferredSseFromTemplate = false;
+			let keylessSseFromTemplate = false;
 			const newDpe = extractLocalDeletionProtection(properties, currentRegion);
 			const oldDpe = extractLocalDeletionProtection(previousProperties, currentRegion);
 			const awsDpe = describeResp.Table?.DeletionProtectionEnabled;
 			const flatUpdate = { TableName: physicalId };
 			let flatChanged = false;
+			let tableClassUpdate;
+			let sseUpdate;
+			let sseFromTemplate = false;
+			let tableClassFromTemplate = false;
 			if (newDpe !== oldDpe || newDpe !== void 0 && typeof awsDpe === "boolean" && Boolean(newDpe) !== awsDpe) {
 				if ((oldDpe === true || awsDpe === true) && Boolean(newDpe ?? false) === false && !(newDpe !== void 0)) warn(`Auto-disabling DeletionProtectionEnabled on ${physicalId}: the CDK code does not set 'deletionProtection: true' but AWS has it enabled. AWS will accept DeleteTable on this resource after this deploy. If you meant to keep protection on, set 'deletionProtection: true' in your CDK code; if you meant to disable it explicitly, set 'deletionProtection: false' to silence this warning.`);
 				flatUpdate.DeletionProtectionEnabled = Boolean(newDpe ?? false);
 				flatChanged = true;
 			}
-			if (properties["TableClass"] !== void 0 && properties["TableClass"] !== previousProperties["TableClass"]) {
-				flatUpdate.TableClass = properties["TableClass"];
-				flatChanged = true;
-			}
-			if (properties["SSESpecification"] !== void 0 && !deepEqual(properties["SSESpecification"], previousProperties["SSESpecification"])) {
-				const sse = properties["SSESpecification"];
-				flatUpdate.SSESpecification = {
-					Enabled: sse["SSEEnabled"] !== void 0 ? Boolean(sse["SSEEnabled"]) : true,
-					...sse["SSEType"] !== void 0 && { SSEType: sse["SSEType"] }
-				};
-				flatChanged = true;
-			}
+			const tableClassChange = tableClassToSend(extractLocalTableClass(previousProperties, currentRegion), extractLocalTableClass(properties, currentRegion));
+			const declaredTableClass = extractLocalTableClass(properties, currentRegion);
+			const liveTableClass = describeResp.Table?.TableClassSummary?.TableClass ?? "STANDARD";
+			if (tableClassChange !== void 0) {
+				tableClassUpdate = tableClassChange;
+				tableClassFromTemplate = true;
+			} else if (declaredTableClass !== void 0 && declaredTableClass !== liveTableClass) tableClassUpdate = declaredTableClass;
+			const newLocalKmsKey = readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion));
+			if (properties["SSESpecification"] !== void 0 && (!deepEqual(properties["SSESpecification"], previousProperties["SSESpecification"]) || newLocalKmsKey !== readReplicaKmsMasterKeyId(localReplicaEntry(previousProperties, currentRegion)))) {
+				sseUpdate = toSdkTableSseSpecification(properties["SSESpecification"], newLocalKmsKey);
+				sseFromTemplate = true;
+			} else if (properties["SSESpecification"] === void 0 && previousProperties["SSESpecification"] !== void 0 && toSdkTableSseSpecification(previousProperties["SSESpecification"], void 0).Enabled) {
+				sseUpdate = { Enabled: false };
+				sseFromTemplate = true;
+			} else if (isKmsKeyArn(newLocalKmsKey) && properties["SSESpecification"] !== void 0 && configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification") === void 0 && toSdkTableSseSpecification(properties["SSESpecification"], void 0).Enabled && describeResp.Table?.SSEDescription?.KMSMasterKeyArn !== newLocalKmsKey) sseUpdate = toSdkTableSseSpecification(properties["SSESpecification"], newLocalKmsKey);
 			if (properties["StreamSpecification"] !== void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) {
 				let streamSpecUnusable = false;
 				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
@@ -46969,6 +47332,21 @@ var DynamoDBGlobalTableProvider = class {
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			if (tableClassUpdate !== void 0) await this.sendLocalSettingUpdate({
+				TableName: physicalId,
+				TableClass: tableClassUpdate
+			}, tableClassFromTemplate, "TableClass", physicalId, logicalId, maskSecrets);
+			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
+			if (sseUpdate?.KMSMasterKeyId !== void 0 && liveHasCrossRegionReplica) {
+				deferredSseUpdate = sseUpdate;
+				deferredSseFromTemplate = sseFromTemplate;
+			} else if (sseUpdate !== void 0) {
+				await this.sendLocalSettingUpdate({
+					TableName: physicalId,
+					SSESpecification: sseUpdate
+				}, sseFromTemplate, "encryption", physicalId, logicalId, maskSecrets);
+				keylessSseFromTemplate = sseFromTemplate && sseUpdate.KMSMasterKeyId === void 0 && liveHasCrossRegionReplica;
+			}
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (oldBilling !== newBilling) {
 				const billingUpdate = {
@@ -47081,7 +47459,6 @@ var DynamoDBGlobalTableProvider = class {
 					}));
 				}
 				const updateAction = { RegionName: region };
-				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
 				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, void 0, maskSecrets);
 				if (replicaIndexes) updateAction.GlobalSecondaryIndexes = replicaIndexes;
 				const replicaOverrides = toSdkReplicaThroughputOverrides(replica, newBilling, void 0, {}, maskSecrets);
@@ -47094,8 +47471,9 @@ var DynamoDBGlobalTableProvider = class {
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
 					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING. The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
-				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
-				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
+				const replicaTableClassChange = tableClassToSend(readReplicaTableClass(oldReplica), readReplicaTableClass(replica));
+				if (replicaTableClassChange !== void 0) updateAction.TableClassOverride = replicaTableClassChange;
+				if (!(updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
 					debug(`Cross-region replica ${region} of ${maskSecrets(physicalId)}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
@@ -47105,6 +47483,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
+			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
+			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, warn, maskSecrets);
+			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
+			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -47579,10 +47961,7 @@ var DynamoDBGlobalTableProvider = class {
 				try {
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget, void 0, progress);
 					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget, void 0, progress);
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						ReplicaUpdates: [{ Delete: { RegionName: region } }]
-					}));
+					await this.dropReplicaForDelete(physicalId, region, context?.removeProtection === true, logicalId, budget, deleteMask);
 					progress.stripped = true;
 					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
 				} catch (replicaErr) {
@@ -48100,11 +48479,57 @@ function localReplicaEntry(props, region) {
 	return raw.find((r) => r?.["Region"] === region);
 }
 function extractLocalDeletionProtection(props, region) {
-	const perReplica = localReplicaEntry(props, region)?.["DeletionProtectionEnabled"];
-	if (typeof perReplica === "boolean") return perReplica;
+	const local = localReplicaEntry(props, region);
+	const perReplica = coerceCfnBoolean(local?.["DeletionProtectionEnabled"]);
+	if (perReplica !== void 0) return perReplica;
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
 }
+function extractAnyDeletionProtection(props, region) {
+	if ((Array.isArray(props["Replicas"]) ? props["Replicas"] : []).some((r) => coerceCfnBoolean(asRecord(r)?.["DeletionProtectionEnabled"]) === true)) return true;
+	return extractLocalDeletionProtection(props, region);
+}
+function readReplicaKmsMasterKeyId(replica) {
+	const key = asRecord(asRecord(replica)?.["SSESpecification"])?.["KMSMasterKeyId"];
+	return typeof key === "string" && key !== "" ? key : void 0;
+}
+function readReplicaTableClass(replica) {
+	const tableClass = asRecord(replica)?.["TableClass"];
+	return typeof tableClass === "string" && tableClass !== "" ? tableClass : void 0;
+}
+const UNUSABLE = Symbol("unusable");
+function readReplicaDeletionProtection(replica, region, warn) {
+	const refusal = configBooleanRefusal(replica, "DeletionProtectionEnabled", `AWS::DynamoDB::GlobalTable Replicas[${region}]`);
+	if (refusal !== void 0) {
+		warn?.(`${refusal}. The ${region} replica's deletion protection is left as it is.`);
+		return UNUSABLE;
+	}
+	return coerceCfnBoolean(replica?.["DeletionProtectionEnabled"]);
+}
+function replicaKeyBlocks(props) {
+	return (Array.isArray(props["Replicas"]) ? props["Replicas"] : []).map((r) => [asRecord(r)?.["Region"], asRecord(r)?.["SSESpecification"]]);
+}
+function isKmsKeyArn(key) {
+	return key !== void 0 && /^arn:aws[a-z-]*:kms:[^:]+:\d+:key\//.test(key);
+}
+function tableClassToSend(previous, desired) {
+	if (desired !== void 0) return desired !== previous ? desired : void 0;
+	return previous !== void 0 && previous !== "STANDARD" ? "STANDARD" : void 0;
+}
+function toSdkTableSseSpecification(block, kmsMasterKeyId) {
+	const sse = asRecord(block) ?? {};
+	return {
+		Enabled: coerceCfnBoolean(sse["SSEEnabled"]) ?? true,
+		...sse["SSEType"] !== void 0 && sse["SSEType"] !== "" && { SSEType: sse["SSEType"] },
+		...kmsMasterKeyId !== void 0 && { KMSMasterKeyId: kmsMasterKeyId }
+	};
+}
+function extractLocalTableClass(props, region) {
+	const perReplica = readReplicaTableClass(localReplicaEntry(props, region));
+	if (perReplica !== void 0) return perReplica;
+	const topLevel = props["TableClass"];
+	return typeof topLevel === "string" && topLevel !== "" ? topLevel : void 0;
+}
 function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics, maskSecrets = (text) => text) {
 	const rawReplicas = properties["Replicas"];
 	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
@@ -48182,6 +48607,9 @@ function collectAutoScalingTargets(properties, localRegion) {
 }
 const REPLICA_COPY_RELEASE_POLLS = 180;
 const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
+const DELETION_PROTECTION_REFLIP_MS = 16e3;
+const REPLICA_PROTECTION_SETTLE_POLLS = 60;
+const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
 const REPLICA_COPY_RELEASE_ATTEMPTS = 3;
 function isReplicaCopyExistsRefusal(error) {
 	return error instanceof Error && /one or more replicas already existed as tables/i.test(error.message);
@@ -48837,7 +49265,7 @@ const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Neptune::DBCluster": "DeletionProtection",
 	"AWS::Neptune::DBInstance": "DeletionProtection",
 	"AWS::DynamoDB::Table": "DeletionProtectionEnabled",
-	"AWS::DynamoDB::GlobalTable": (bag, region) => extractLocalDeletionProtection(bag, region ?? ""),
+	"AWS::DynamoDB::GlobalTable": (bag, region) => extractAnyDeletionProtection(bag, region ?? ""),
 	"AWS::EC2::Instance": "DisableApiTermination",
 	"AWS::Cognito::UserPool": "DeletionProtection",
 	"AWS::AutoScaling::AutoScalingGroup": "DeletionProtection",
@@ -48886,7 +49314,7 @@ function isProtectionValueActive(resourceType, value) {
 //#endregion
 //#region src/provisioning/recorded-protection.ts
 const READER_LABELS = {
-	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled for the deploy region",
+	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled on the table or a replica",
 	"AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancerAttributes deletion_protection.enabled"
 };
 const REPLACEMENT_BLOCKING_VALUES = { "AWS::AutoScaling::AutoScalingGroup": /* @__PURE__ */ new Set(["prevent-all-deletion"]) };
@@ -52089,5 +52517,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { pendingRequestCount as $, malformedLocalResourceEntriesWarning as $a, hasReasonlessBaselineRefusal as $c, keepHeldTokenProvenance as $i, getLegacyStateBucketName as $l, destroyStackRecordsView as $n, NO_CC_HANDLERS_REASON as $o, markDeleteStarted as $r, literalSplitDelimitersOf as $s, seedsDeleteFirstGuard as $t, inheritedProvenanceForChildDiff as A, refStateLookupFromResource as Aa, recordNoEchoAttributeValues as Ac, deleteSkipReason as Ai, buildDockerImage as Al, isWholeDynamicReferenceValue as An, refuseMalformedResourceEntriesForOrphan as Ao, secretNamePrintingBags as Ar, TemplateParser as As, readRefactorMarkerOnce as At, hasPlainPrototype$1 as Au, conditionFingerprint as B, UNREADABLE_RESOURCES_MAP_ROW as Ba, CrossPrefixReadError as Bc, DiffCalculator as Bi, isMalformedEnvKey as Bl, findDestructiveChanges as Bn, repairMalformedOrphansForReadOnly as Bo, effectiveDeletionPolicy as Br, passedNoEchoParametersOf as Bs, replayFailedOperations as Bt, clearBucketRegionCache as Bu, hasCdkAutoDeleteTag as C, carriesFetchableDynamicReference as Ca, recordAttributeIdCopy as Cc, CloudControlProvider as Ci, getBootstrapMarkerKey as Cl, exportAliasCollisionScrubWarning as Cn, refuseMalformedOutputsForDestroy as Co, createReadOnlyAttributeHealerFactory as Cr, templateResourceTypes as Cs, sameJournaledOrphans as Ct, StageLoadError as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, cfnRefValueFromPhysicalId as Da, provenPublicValue as Dc, UNSPECIFIED_SKIP_REASON as Di, validateAssetBucketName as Dl, carriedExportAliasExposure as Dn, refuseMalformedResourceEntriesForDestroy as Do, namingSecretsWithRecordedNoEcho as Dr, lambdaFunctionNameForMask as Ds, lookupEachName as Dt, utf8ByteLength as Du, markRefusedBeforeApplying as E, AWS_NO_VALUE as Ea, carriesSecretMask as Ec, RollbackInlinePolicyWriters as Ei, readBootstrapMarkerBody as El, secretSafeKeyDisplay as En, refuseMalformedResourceEntriesForDeploy as Eo, maskEventTextWithBoundBags as Er, canonicalLambdaFunctionName as Es, isAccessDeniedError as Et, parseFailureDebugDetail as Eu, findNestedTemplateTreeDefect as F, declaresNoEcho as Fa, isSingleDynamicReferenceToken as Fc, ec2InstanceProtectionSite as Fi, dockerSpawnEnvWithSensitive as Fl, bindingSkippedOutputs as Fn, refuseMalformedResourcesForDeploy as Fo, ATOMIC_FINAL_SNAPSHOT_TYPES as Fr, maskWholeValue as Fs, updateRefactorMarker as Ft, displayAssemblyPath as Fu, withResourceDeadline as G, hasReadableOutputs as Ga, isNotImplemented as Gc, s3BucketArn as Gi, runDockerForeground as Gl, rollbackOrphanIds as Gn, unpreviewableOrphanRecords as Go, ledgerForStack as Gr, liveMatchesUnresolvedTokenFrame as Gs, isJournaledOrphan as Gt, parentSuppliedValues as H, deployRefusesOrphanRowsReason as Ha, applyCrossPrefixScan as Hc, IntrinsicFunctionResolver as Hi, redactDockerArgvValues as Hl, findRefactorHints as Hn, repairMalformedResourceEntriesForReadOnly as Ho, refusesFinalSnapshot as Hr, readsNoEchoSource as Hs, removeProtectionTypeList as Ht, isAbsoluteAssetPath as I, JSON_LISTING_HOLE_VALUE as Ia, LockManager as Ic, isTerminationProtectionPropagationError as Ii, finchSecretArgvRefusal as Il, DEFAULT_RESOURCE_TIMEOUT_MS as In, refuseMalformedResourcesForDestroy as Io, PRE_DELETE_SNAPSHOT_TYPES as Ir, maskedLeafCoordinatesOf as Is, hasPendingMovesOut as It, renderAssemblyPathEscape as Iu, keptWholeReasonText as J, isReadableResourceEntry as Ja, splitImportedOps as Jc, s3BucketRegionalDomainName as Ji, AssetManifestLoader as Jl, looselyEqual as Jn, withheldAccountClause as Jo, acquireIdempotencyToken as Jr, recordReferenceProvenanceEntry as Js, planRollback as Jt, diffSecurity as K, hasReadableResources as Ka, stackInstanceIdOf as Kc, s3BucketDomainName as Ki, runDockerStreaming as Kl, withMovedTo as Kn, unreadableOrphanRecords as Ko, reserveStackCreateToken as Kr, markSameGenerationBag as Ks, isReplacementOrphan as Kt, listNestedTemplateRows as L, STATE_REGION_DIVERGED as La, isLockInfoExpired as Lc, observeThenDisableInstanceApiTermination as Li, formatDockerLoginError as Ll, DEFAULT_RESOURCE_WARN_AFTER_MS as Ln, refuseMalformedResourcesForExport as Lo, buildFinalSnapshotIdentifier as Lr, noEchoCoordinatesOf as Ls, pendingMovesOutOf as Lt, resolveAssemblyPath as Lu, findServiceTokenRefusals as M, withSharedDrainBudget as Ma, recordProvenPublicExpression as Mc, isWaitAbandonedError as Mi, describeDockerCapturedOutput as Ml, collectDeclaredOutputNames as Mn, refuseMalformedResourcePropertiesForDrift as Mo, secretNamedRecordNeedles as Mr, isMarkedCoordinate as Ms, refactorMarkerRefusalMessage as Mt, ownValue as Mu, serviceTokenBlockingReason as N, parameterInputsFor as Na, wholeStringLeavesOf as Nc, markWaitAbandoned as Ni, describeDockerExecFailure as Nl, collectPublishedOutputNames as Nn, refuseMalformedResourcePropertiesForExport as No, stateSecretNameNeedles as Nr, maskAtCoordinates as Ns, refuseRefactorMarker as Nt, absoluteAssemblyPathEscape as Nu, computeImplicitDeleteEdges as O, isStalePlaceholderArnAttribute as Oa, recordMaskOnlyValue as Oc, deleteIndeterminateGuards as Oi, validateContainerRepoName as Ol, exportNameNoEchoParameters as On, refuseMalformedResourceEntriesForImport as Oo, orphanRecordsPrintingBag as Or, sameLambdaFunctionAddress as Os, withApiLimit as Ot, defineOwnKey as Ou, childTemplateLoader as P, passedParameterClassesOf as Pa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Pc, disableInstanceApiTermination as Pi, describeDockerFailure as Pl, isExportAliasCollision as Pn, refuseMalformedResourcePropertiesForOrphan as Po, storedSecretNameNeedles as Pr, maskReadbackAtCoordinates as Ps, sameMove as Pt, describeFileReadFailure as Pu, planOrphanAdoption as Q, malformedLocalOutputsWarning as Qa, hasReadableExportSet as Qc, refuseUnreadableCdkCrossAccountRefs as Qi, getDefaultStateBucketName as Ql, awaitInFlightSibling as Qn, withoutSilentDropProperties as Qo, isRefusedByName as Qr, hasMaskableValues as Qs, resolveReplacementOldType as Qt, renderNestedTemplateTreeDefect as R, STATE_RESOURCES_MALFORMED as Ra, S3StateBackend as Rc, reDisableInstanceApiTermination as Ri, getDockerCmd as Rl, maskingRetryLogger as Rn, refuseMalformedState as Ro, ccRoutedFinalSnapshotError as Rr, noEchoLeavesOf as Rs, pendingMovesRefusalMessage as Rt, injectAwsRegion as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, carriesDynamicReference as Sa, physicalNameCopiesOf as Sc, customResourceResponseExpirationWarning as Si, ensureAssetStorage as Sl, displayTextOrWithheld as Sn, refuseMalformedOutputs as So, noEchoParameterNamesOf as Sr, prefetchCreateOnlyPropertyPaths as Ss, makeForeignHolderScan as St, AssemblyReader as Su, getPriorAttempts as T, keepsSecretReferenceToken as Ta, splitGetAttStringForm as Tc, unchangedBehindSecretReference as Ti, parseBootstrapMarker as Tl, secretBearingStateKeyWarning as Tn, refuseMalformedResourceEntries as To, journaledOrphanPrintingBag as Tr, withRetry as Ts, chunks as Tt, describeJsonParseFailure as Tu, readRecordedConditionVerdicts as U, displayLogicalId as Ua, crossPrefixDeniedWarning as Uc, poisonRenderedSpellingsCollidingIn as Ui, redactedCause as Ul, hintSidesOf as Un, repairMalformedResourcePropertiesForReadOnly as Uo, unsupportedFinalSnapshotError as Ur, recordedNoEchoValuesOf as Us, recordAfterRollbackUpdate as Ut, conditionInputsFrom as V, accountArgs as Va, CrossPrefixScanCache as Vc, INTRINSIC_KEYS as Vi, partitionSensitiveEnv as Vl, formatDestructiveChange as Vn, repairMalformedOutputsForReadOnly as Vo, isFinalSnapshotError as Vr, readbackPathFor as Vs, replayRollback as Vt, resolveBucketRegion as Vu, enclosingDeadlineRemainingMs as W, hasReadableOrphans as Wa, isAccessDenied$1 as Wc, isSettledInstanceState as Wi, redactedDockerCause as Wl, movedToHint as Wn, repairMalformedResourcesForReadOnly as Wo, earliestDefined as Wr, valueAtCoordinate as Ws, demoteSupersededOrphans as Wt, makeCanonicalizePropertiesFn as X, malformedExportNamesWarning as Xa, describeRegionValueKind as Xc, resolveDynamicReferences as Xi, Synthesizer as Xl, parseMappingFile as Xn, findSilentDropProperties as Xo, DeploymentEventsStore as Xr, carryLogOnlyValues as Xs, recordUnderIdIsNotOwn as Xt, mergeNoChangeOutputs as Y, malformedDriftResourcePropertiesWarning as Ya, acceptedCreateOnlyDropsOf as Yc, s3BucketWebsiteUrl as Yi, getDockerImageBySourceHash as Yl, mappingPairs as Yn, findActionableSilentDrops as Yo, DeploymentEventsReader as Yr, snapshotPassProvenance as Ys, recheckFailedPlan as Yt, makeSiblingClaimReader as Z, malformedExportSourceWarning as Za, exportNamesCarriedFrom as Zc, producerLookupOver as Zi, synthesisStatusMessage as Zl, proposeRenames as Zn, unwrittenCreateOnlyReplacement as Zo, extractDeploymentEventError as Zr, createUnionSecretMasker as Zs, replacementNeverSwapped as Zt, deleteTableWithIndexBusyRetry as _, coerceParameterTypedValue as _a, spelledKeysOf as _c, isCustomResourceType as _i, loadPublishableAssetManifest as _l, computeParameterTaint as _n, refuseMalformedOrphanRecords as _o, supersededResourcesOf as _r, readConfigString as _s, dropFailedCommands as _t, decodeListingKey as _u, isProtectionValueActive as a, assertSendableRoleArn as aa, unionOfSecretBags as ac, tagMapAsList as ai, orphansCarriedFrom as al, isRedactedRecordedValue as an, malformedOrphansWarning as ao, gray as ar, isStatefulRecreateTargetSync as as, displacedPhysicalIdShown as at, resolveStateBucketWithDefault as au, waitForIndexesSettled as b, getAccountInfo as ba, recordNestedStackParameterExpressions as bc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as bi, BOOTSTRAP_MARKER_PREFIX as bl, resourcesNamingDeclaredParameter as bn, refuseMalformedOrphansForDestroy as bo, noEchoComparisonForTemplate as br, requireConfigObject as bs, journaledOrphanLines as bt, canonicalizeRegion as bu, DynamoDBGlobalTableProvider as c, sendableAssumeRoleCommand as ca, maskSecretsInError as cc, stringifyIfAssigned as ci, PhaseClock as cl, updatePartialMessage as cn, malformedRenderedContainersWarning as co, yellow as cr, coerceWarmThroughput as cs, nestedChildStackName as ct, stateBucketExistenceConfirmed as cu, compensateRemovedDeletionProtection as d, callerEnvCredentials as da, withPhysicalNameCopies as dc, ccBrokenReason as di, AssetPublisher as dl, nameGenerationHighWaterOf as dn, malformedResourcesWarning as do, holdsSupersededResources as dr, toFiniteNumber as ds, revertedNestedRowIds as dt, CFN_TEMPLATE_BODY_LIMIT as du, outputReferenceProvenanceOf as ea, logOnlyValueCount as ec, DBPROXY_TAGS_WHAT as ei, hasUnverifiableParameterRefusal as el, orphanNeedsIdentity as en, malformedLocalResourcesWarning as eo, getStackRecords as er, hasNoCloudControlHandlers as es, resolvePendingCloudControlRequests as et, loadCdkJson as eu, deleteBudgetKey as f, envCredentialsAreAssumedRole as fa, withoutPhysicalNameCopies as fc, isCustomResource as fi, isSensitiveAttributeName as fl, nameScopeOf as fn, malformedScrubResourceEntriesRefusalMessage as fo, isSupersededResourceRecord as fr, coerceCfnBoolean as fs, withNestedRevertRun as ft, CFN_TEMPLATE_URL_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, regionLessSecretName as ga, pathCrossesDottedKey as gc, readsNoEchoDeleteValues as gi, createAssetRedirectResolver as gl, withNameGenerationReached as gn, refuseMalformedNestedChildOutputs as go, supersededHolderOf as gr, configStringRefusal as gs, deleteJournaledOrphans as gt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, producerRegionsFromState as ha, isUncertifiedBaselineMaskPosition as hc, TemplateNoEchoReresolver as hi, buildAssetRedirectMap as hl, retiredNameGenerationsLeaving as hn, refuseDivergentRecordRegionForDestroy as ho, supersededHeldByOtherTypeWarning as hr, configIntegerRefusal as hs, withNestedStackContext as ht, uploadCfnTemplate as hu, PROTECTION_PROPERTY_BY_TYPE as i, assertFlagRoleArn as ia, shareLogOnlyValues as ic, refuseMalformedDesiredTags as ii, orphansAfterRollback as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, malformedOrphansRefusalMessage as io, cyan as ir, isStatefulRecreateTargetForReplace as is, displacedOpClause as it, resolveSkipPrefix as iu, deferredServiceTokenWarning as j, parseWebACLArn as ja, recordNoEchoParameterFreshValue as jc, withIndeterminateGuard as ji, resolveDockerContextDirectory as jl, noEchoParameterValueSeed as jn, refuseMalformedResourcePropertiesForDestroy as jo, secretNamedAttributeNamesOf as jr, canonicalCoordinates as js, refactorMarkerMovesOf as jt, nullPrototypeRecord as ju, crossStackOutputProvenanceSource as k, lacksRecordedTableArn as ka, recordMaskOnlyValuesIn as kc, deleteLeftInPlace as ki, buildDenyExternalAccessPolicy as kl, exportNameSecretExposure as kn, refuseMalformedResourceEntriesForImportSave as ko, secretNamePrintingBag as kr, DagBuilder as ks, readRefactorMarker as kt, hasOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, AWS_CREDENTIAL_ENV_KEYS as la, maskSecretsInText as lc, CC_BROKEN_REASON as li, renderPhaseTimings as ll, updatePartialReason as ln, malformedResourceEntriesWarning as lo, addSuperseded as lr, isWarmThroughputDecrease as ls, recordDisplacedSkips as lt, warnDeprecatedNoPrefixCliFlag as lu, resolveDynamoDbDeleteBudgetMs as m, classifyReplaySecretRegion as ma, dynamicReferenceTokens as mc, waitForLambdaFunctionActive as mi, WorkGraph as ml, retiredNameGenerationsAfter as mn, previewableOrphanRecords as mo, supersededAfterRollback as mr, configBooleanRefusal as ms, getCurrentNestedStackContext as mt, findLargeInlineResources as mu, recordedProtectionEvidence as n, recordedReferenceRegions as na, recordLogOnlyParameterValue as nc, planTagDiff as ni, importableOutputs as nl, getCurrentProducerRegions as nn, malformedOrphanRecordsWarning as no, replacedDeleteFailureVerdict as nr, shownType as ns, recordRetainedForReadoption as nt, resolveAutoAssetStorage as nu, perType as o, explicitRoleArnOrThrow as oa, createSecretMasker as oc, tagPlanWarning as oi, shouldRetainResource as ol, redactedDeleteAddressFields as on, malformedOutputsRefusalMessage as oo, green as or, renderStatefulReason as os, dropSettledNestedJournals as ot, resolveStateBucketWithDefaultAndSource as ou, resolveDynamoDbDeleteBudgetClock as p, classifyRecordedSecretRegion as pa, DYNAMIC_REFERENCE_TOKEN_SCAN as pc, wouldReturnToSdkProvider as pi, stringifyValue as pl, retiredAfterRollback as pn, malformedStateRefusalMessage as po, removeSuperseded as pr, coerceCfnInteger as ps, collectNestedChildUnaddressed as pt, MIGRATE_TMP_PREFIX as pu, isSecretBearingReferenceString as q, isReadableOrphanRecord as qa, withStackInstanceIdWithheld as qc, s3BucketDualStackDomainName as qi, warnFinchArgvExposure as ql, isPairableType as qn, unreadableResourceEntries as qo, withCreateTokenLedger as qr, redactForState as qs, planFailedOps as qt, recordedProtectionNote as r, applyRoleArnIfSet as ra, recordLogOnlyValue as rc, readTagList as ri, isReadableBag as rl, inheritProducerRegions as rn, malformedOrphanRowsKeptWarning as ro, bold as rr, MULTI_REGION_RECREATE_BLOCKED_TYPES as rs, NESTED_PENDING_PARENT_REASON as rt, resolveCaptureObservedState as ru, readProtection as s, isIamRoleArn as sa, errorCauseChain as sc, definedAttributes as si, stackInstanceIdCarriedFrom as sl, redactedDeleteAddressSkip as sn, malformedOutputsWarning as so, red as sr, WARM_THROUGHPUT_MEMBERS as ss, getNestedRevertRun as st, resolveUseCdkBootstrapAssets as su, DeployEngine as t, recordedOutputReferenceRegions as ta, printingCorpusOf as tc, DBPROXY_TAG_OPTIONS as ti, importableOutputKeys as tl, findNestedStackTypeChanges as tn, malformedOrphanRecordsRefusalMessage as to, withStackRecords as tr, findReplacedReadersOfRecreateTargets as ts, keptForRetainedRecord as tt, resolveApp as tu, beginDeleteWait as u, applyCallerIdentityCredentials as ua, scrubResourceRecord as uc, ProviderRegistry as ui, timePhase as ul, nameGenerationCarriedFrom as un, malformedResourcePropertiesWarning as uo, deleteSupersededEntry as ur, toCfnInteger as us, revertNestedChildFromJournal as ut, ssmResolvedValueType as uu, maskedLogger as v, isUnboundTemplateParameter as va, identityKeyFor as vc, getCurrentResourceSecrets as vi, rewriteTemplateAssetReferences as vl, namesAnyDeclaredParameter as vn, refuseMalformedOrphanRecordsForDestroy as vo, withoutSuperseded as vr, replayWarn as vs, dropFailedHint as vt, expectedOwnerParam as vu, isTruthyCfnBoolean as w, isNamelessDynamicReferenceError as wa, recordPhysicalNameCopy as wc, slowCcOperationTimeoutMs as wi, isCrossRegionRedirect as wl, secretBearing as wn, refuseMalformedResourceAttributesForOrphan as wo, completedReplayEntries as wr, describeTypeWithThrottleRetry as ws, formatResourceLine as wt, processStackMessages as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, isImpossibleEmptyStoredAttribute as xa, recoverMaskedOutput as xc, applyCustomResourceResponseExpiration as xi, assertAssetBucketRegion as xl, WITHHELD_NAME_DISPLAY as xn, refuseMalformedOrphansForOrphan as xo, noEchoExactEchoLeavesOf as xr, requireConfigString as xs, loadJournaledOrphans as xt, derivePartitionAndUrlSuffix as xu, relayedIndexBusyDelete as y, parameterTypeMayLoseSecretIdentity as ya, inheritNestedStackParameterAssociations as yc, withPrintingSecrets as yi, AssetModeResolver as yl, reachableDivergentParameters as yn, refuseMalformedOrphans as yo, noEchoAttributeNamesOf as yr, requireConfigArray as ys, isHandledOrphan as yt, PARTITION_TABLE as yu, templateIdentity as z, UNREADABLE_ORPHANS_CONTAINER_ROW as za, rebuildClientForBucketRegion as zc, reEnableInstanceApiTermination as zi, isDockerClientEnvKey as zl, constructPathOf as zn, repairMalformedOrphanRecordsForReadOnly as zo, createPreDeleteFinalSnapshot as zr, noEchoOutputsComparison as zs, refusePendingMovesOut as zt, injectedAwsRegionValue as zu };
-//# sourceMappingURL=deploy-engine-Bjr-FAuZ.js.map
+export { planOrphanAdoption as $, malformedLocalOutputsWarning as $a, hasReadableExportSet as $c, refuseUnreadableCdkCrossAccountRefs as $i, getDefaultStateBucketName as $l, awaitInFlightSibling as $n, withoutSilentDropProperties as $o, isRefusedByName as $r, hasMaskableValues as $s, resolveReplacementOldType as $t, inheritedProvenanceForChildDiff as A, lacksRecordedTableArn as Aa, recordMaskOnlyValuesIn as Ac, deleteLeftInPlace as Ai, buildDenyExternalAccessPolicy as Al, exportNameSecretExposure as An, refuseMalformedResourceEntriesForImportSave as Ao, secretNamePrintingBag as Ar, DagBuilder as As, readRefactorMarker as At, hasOwnKey as Au, conditionFingerprint as B, UNREADABLE_ORPHANS_CONTAINER_ROW as Ba, rebuildClientForBucketRegion as Bc, reEnableInstanceApiTermination as Bi, isDockerClientEnvKey as Bl, constructPathOf as Bn, repairMalformedOrphanRecordsForReadOnly as Bo, createPreDeleteFinalSnapshot as Br, noEchoOutputsComparison as Bs, refusePendingMovesOut as Bt, injectedAwsRegionValue as Bu, hasCdkAutoDeleteTag as C, carriesDynamicReference as Ca, physicalNameCopiesOf as Cc, customResourceResponseExpirationWarning as Ci, ensureAssetStorage as Cl, displayTextOrWithheld as Cn, refuseMalformedOutputs as Co, noEchoParameterNamesOf as Cr, prefetchCreateOnlyPropertyPaths as Cs, makeForeignHolderScan as Ct, AssemblyReader as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, AWS_NO_VALUE as Da, carriesSecretMask as Dc, RollbackInlinePolicyWriters as Di, readBootstrapMarkerBody as Dl, secretSafeKeyDisplay as Dn, refuseMalformedResourceEntriesForDeploy as Do, maskEventTextWithBoundBags as Dr, canonicalLambdaFunctionName as Ds, isAccessDeniedError as Dt, parseFailureDebugDetail as Du, markRefusedBeforeApplying as E, keepsSecretReferenceToken as Ea, splitGetAttStringForm as Ec, unchangedBehindSecretReference as Ei, parseBootstrapMarker as El, secretBearingStateKeyWarning as En, refuseMalformedResourceEntries as Eo, journaledOrphanPrintingBag as Er, withRetry as Es, chunks as Et, describeJsonParseFailure as Eu, findNestedTemplateTreeDefect as F, passedParameterClassesOf as Fa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fc, disableInstanceApiTermination as Fi, describeDockerFailure as Fl, isExportAliasCollision as Fn, refuseMalformedResourcePropertiesForOrphan as Fo, storedSecretNameNeedles as Fr, maskReadbackAtCoordinates as Fs, sameMove as Ft, describeFileReadFailure as Fu, enclosingDeadlineRemainingMs as G, hasReadableOrphans as Ga, isAccessDenied$1 as Gc, isSettledInstanceState as Gi, redactedDockerCause as Gl, movedToHint as Gn, repairMalformedResourcesForReadOnly as Go, earliestDefined as Gr, valueAtCoordinate as Gs, demoteSupersededOrphans as Gt, parentSuppliedValues as H, accountArgs as Ha, CrossPrefixScanCache as Hc, INTRINSIC_KEYS as Hi, partitionSensitiveEnv as Hl, formatDestructiveChange as Hn, repairMalformedOutputsForReadOnly as Ho, isFinalSnapshotError as Hr, readbackPathFor as Hs, replayRollback as Ht, resolveBucketRegion as Hu, isAbsoluteAssetPath as I, declaresNoEcho as Ia, isSingleDynamicReferenceToken as Ic, ec2InstanceProtectionSite as Ii, dockerSpawnEnvWithSensitive as Il, bindingSkippedOutputs as In, refuseMalformedResourcesForDeploy as Io, ATOMIC_FINAL_SNAPSHOT_TYPES as Ir, maskWholeValue as Is, updateRefactorMarker as It, displayAssemblyPath as Iu, isSecretBearingReferenceString as J, isReadableOrphanRecord as Ja, withStackInstanceIdWithheld as Jc, s3BucketDualStackDomainName as Ji, warnFinchArgvExposure as Jl, isPairableType as Jn, unreadableResourceEntries as Jo, withCreateTokenLedger as Jr, redactForState as Js, planFailedOps as Jt, withResourceDeadline as K, hasReadableOutputs as Ka, isNotImplemented as Kc, s3BucketArn as Ki, runDockerForeground as Kl, rollbackOrphanIds as Kn, unpreviewableOrphanRecords as Ko, ledgerForStack as Kr, liveMatchesUnresolvedTokenFrame as Ks, isJournaledOrphan as Kt, listNestedTemplateRows as L, JSON_LISTING_HOLE_VALUE as La, LockManager as Lc, isTerminationProtectionPropagationError as Li, finchSecretArgvRefusal as Ll, DEFAULT_RESOURCE_TIMEOUT_MS as Ln, refuseMalformedResourcesForDestroy as Lo, PRE_DELETE_SNAPSHOT_TYPES as Lr, maskedLeafCoordinatesOf as Ls, hasPendingMovesOut as Lt, renderAssemblyPathEscape as Lu, findServiceTokenRefusals as M, parseWebACLArn as Ma, recordNoEchoParameterFreshValue as Mc, withIndeterminateGuard as Mi, resolveDockerContextDirectory as Ml, noEchoParameterValueSeed as Mn, refuseMalformedResourcePropertiesForDestroy as Mo, secretNamedAttributeNamesOf as Mr, canonicalCoordinates as Ms, refactorMarkerMovesOf as Mt, nullPrototypeRecord as Mu, serviceTokenBlockingReason as N, withSharedDrainBudget as Na, recordProvenPublicExpression as Nc, isWaitAbandonedError as Ni, describeDockerCapturedOutput as Nl, collectDeclaredOutputNames as Nn, refuseMalformedResourcePropertiesForDrift as No, secretNamedRecordNeedles as Nr, isMarkedCoordinate as Ns, refactorMarkerRefusalMessage as Nt, ownValue as Nu, computeImplicitDeleteEdges as O, cfnRefValueFromPhysicalId as Oa, provenPublicValue as Oc, UNSPECIFIED_SKIP_REASON as Oi, validateAssetBucketName as Ol, carriedExportAliasExposure as On, refuseMalformedResourceEntriesForDestroy as Oo, namingSecretsWithRecordedNoEcho as Or, lambdaFunctionNameForMask as Os, lookupEachName as Ot, utf8ByteLength as Ou, childTemplateLoader as P, parameterInputsFor as Pa, wholeStringLeavesOf as Pc, markWaitAbandoned as Pi, describeDockerExecFailure as Pl, collectPublishedOutputNames as Pn, refuseMalformedResourcePropertiesForExport as Po, stateSecretNameNeedles as Pr, maskAtCoordinates as Ps, refuseRefactorMarker as Pt, absoluteAssemblyPathEscape as Pu, makeSiblingClaimReader as Q, malformedExportSourceWarning as Qa, exportNamesCarriedFrom as Qc, producerLookupOver as Qi, synthesisStatusMessage as Ql, proposeRenames as Qn, unwrittenCreateOnlyReplacement as Qo, extractDeploymentEventError as Qr, createUnionSecretMasker as Qs, replacementNeverSwapped as Qt, renderNestedTemplateTreeDefect as R, STATE_REGION_DIVERGED as Ra, isLockInfoExpired as Rc, observeThenDisableInstanceApiTermination as Ri, formatDockerLoginError as Rl, DEFAULT_RESOURCE_WARN_AFTER_MS as Rn, refuseMalformedResourcesForExport as Ro, buildFinalSnapshotIdentifier as Rr, noEchoCoordinatesOf as Rs, pendingMovesOutOf as Rt, resolveAssemblyPath as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, isImpossibleEmptyStoredAttribute as Sa, recoverMaskedOutput as Sc, applyCustomResourceResponseExpiration as Si, assertAssetBucketRegion as Sl, WITHHELD_NAME_DISPLAY as Sn, refuseMalformedOrphansForOrphan as So, noEchoExactEchoLeavesOf as Sr, requireConfigString as Ss, loadJournaledOrphans as St, derivePartitionAndUrlSuffix as Su, getPriorAttempts as T, isNamelessDynamicReferenceError as Ta, recordPhysicalNameCopy as Tc, slowCcOperationTimeoutMs as Ti, isCrossRegionRedirect as Tl, secretBearing as Tn, refuseMalformedResourceAttributesForOrphan as To, completedReplayEntries as Tr, describeTypeWithThrottleRetry as Ts, formatResourceLine as Tt, processStackMessages as Tu, readRecordedConditionVerdicts as U, deployRefusesOrphanRowsReason as Ua, applyCrossPrefixScan as Uc, IntrinsicFunctionResolver as Ui, redactDockerArgvValues as Ul, findRefactorHints as Un, repairMalformedResourceEntriesForReadOnly as Uo, refusesFinalSnapshot as Ur, readsNoEchoSource as Us, removeProtectionTypeList as Ut, conditionInputsFrom as V, UNREADABLE_RESOURCES_MAP_ROW as Va, CrossPrefixReadError as Vc, DiffCalculator as Vi, isMalformedEnvKey as Vl, findDestructiveChanges as Vn, repairMalformedOrphansForReadOnly as Vo, effectiveDeletionPolicy as Vr, passedNoEchoParametersOf as Vs, replayFailedOperations as Vt, clearBucketRegionCache as Vu, enclosingDeadlineExpired as W, displayLogicalId as Wa, crossPrefixDeniedWarning as Wc, poisonRenderedSpellingsCollidingIn as Wi, redactedCause as Wl, hintSidesOf as Wn, repairMalformedResourcePropertiesForReadOnly as Wo, unsupportedFinalSnapshotError as Wr, recordedNoEchoValuesOf as Ws, recordAfterRollbackUpdate as Wt, mergeNoChangeOutputs as X, malformedDriftResourcePropertiesWarning as Xa, acceptedCreateOnlyDropsOf as Xc, s3BucketWebsiteUrl as Xi, getDockerImageBySourceHash as Xl, mappingPairs as Xn, findActionableSilentDrops as Xo, DeploymentEventsReader as Xr, snapshotPassProvenance as Xs, recheckFailedPlan as Xt, keptWholeReasonText as Y, isReadableResourceEntry as Ya, splitImportedOps as Yc, s3BucketRegionalDomainName as Yi, AssetManifestLoader as Yl, looselyEqual as Yn, withheldAccountClause as Yo, acquireIdempotencyToken as Yr, recordReferenceProvenanceEntry as Ys, planRollback as Yt, makeCanonicalizePropertiesFn as Z, malformedExportNamesWarning as Za, describeRegionValueKind as Zc, resolveDynamicReferences as Zi, Synthesizer as Zl, parseMappingFile as Zn, findSilentDropProperties as Zo, DeploymentEventsStore as Zr, carryLogOnlyValues as Zs, recordUnderIdIsNotOwn as Zt, deleteTableWithIndexBusyRetry as _, regionLessSecretName as _a, pathCrossesDottedKey as _c, readsNoEchoDeleteValues as _i, createAssetRedirectResolver as _l, withNameGenerationReached as _n, refuseMalformedNestedChildOutputs as _o, supersededHolderOf as _r, configStringRefusal as _s, deleteJournaledOrphans as _t, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _u, isProtectionValueActive as a, assertFlagRoleArn as aa, shareLogOnlyValues as ac, refuseMalformedDesiredTags as ai, orphansAfterRollback as al, REDACTED_DELETE_ADDRESS_SKIP_REASON as an, malformedOrphansRefusalMessage as ao, cyan as ar, isStatefulRecreateTargetForReplace as as, displacedOpClause as at, resolveSkipPrefix as au, waitForIndexesSettled as b, parameterTypeMayLoseSecretIdentity as ba, inheritNestedStackParameterAssociations as bc, withPrintingSecrets as bi, AssetModeResolver as bl, reachableDivergentParameters as bn, refuseMalformedOrphans as bo, noEchoAttributeNamesOf as br, requireConfigArray as bs, isHandledOrphan as bt, PARTITION_TABLE as bu, DynamoDBGlobalTableProvider as c, isIamRoleArn as ca, errorCauseChain as cc, definedAttributes as ci, stackInstanceIdCarriedFrom as cl, redactedDeleteAddressSkip as cn, malformedOutputsWarning as co, red as cr, WARM_THROUGHPUT_MEMBERS as cs, getNestedRevertRun as ct, resolveUseCdkBootstrapAssets as cu, compensateRemovedDeletionProtection as d, applyCallerIdentityCredentials as da, scrubResourceRecord as dc, ProviderRegistry as di, timePhase as dl, nameGenerationCarriedFrom as dn, malformedResourcePropertiesWarning as do, deleteSupersededEntry as dr, toCfnInteger as ds, revertNestedChildFromJournal as dt, ssmResolvedValueType as du, keepHeldTokenProvenance as ea, literalSplitDelimitersOf as ec, markDeleteStarted as ei, hasReasonlessBaselineRefusal as el, seedsDeleteFirstGuard as en, malformedLocalResourceEntriesWarning as eo, destroyStackRecordsView as er, NO_CC_HANDLERS_REASON as es, pendingRequestCount as et, getLegacyStateBucketName as eu, deleteBudgetKey as f, callerEnvCredentials as fa, withPhysicalNameCopies as fc, ccBrokenReason as fi, AssetPublisher as fl, nameGenerationHighWaterOf as fn, malformedResourcesWarning as fo, holdsSupersededResources as fr, toFiniteNumber as fs, revertedNestedRowIds as ft, CFN_TEMPLATE_BODY_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, producerRegionsFromState as ga, isUncertifiedBaselineMaskPosition as gc, TemplateNoEchoReresolver as gi, buildAssetRedirectMap as gl, retiredNameGenerationsLeaving as gn, refuseDivergentRecordRegionForDestroy as go, supersededHeldByOtherTypeWarning as gr, configIntegerRefusal as gs, withNestedStackContext as gt, uploadCfnTemplate as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, classifyReplaySecretRegion as ha, dynamicReferenceTokens as hc, waitForLambdaFunctionActive as hi, WorkGraph as hl, retiredNameGenerationsAfter as hn, previewableOrphanRecords as ho, supersededAfterRollback as hr, configBooleanRefusal as hs, getCurrentNestedStackContext as ht, findLargeInlineResources as hu, PROTECTION_PROPERTY_BY_TYPE as i, applyRoleArnIfSet as ia, recordLogOnlyValue as ic, readTagList as ii, isReadableBag as il, inheritProducerRegions as in, malformedOrphanRowsKeptWarning as io, bold as ir, MULTI_REGION_RECREATE_BLOCKED_TYPES as is, NESTED_PENDING_PARENT_REASON as it, resolveCaptureObservedState as iu, deferredServiceTokenWarning as j, refStateLookupFromResource as ja, recordNoEchoAttributeValues as jc, deleteSkipReason as ji, buildDockerImage as jl, isWholeDynamicReferenceValue as jn, refuseMalformedResourceEntriesForOrphan as jo, secretNamePrintingBags as jr, TemplateParser as js, readRefactorMarkerOnce as jt, hasPlainPrototype$1 as ju, crossStackOutputProvenanceSource as k, isStalePlaceholderArnAttribute as ka, recordMaskOnlyValue as kc, deleteIndeterminateGuards as ki, validateContainerRepoName as kl, exportNameNoEchoParameters as kn, refuseMalformedResourceEntriesForImport as ko, orphanRecordsPrintingBag as kr, sameLambdaFunctionAddress as ks, withApiLimit as kt, defineOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, sendableAssumeRoleCommand as la, maskSecretsInError as lc, stringifyIfAssigned as li, PhaseClock as ll, updatePartialMessage as ln, malformedRenderedContainersWarning as lo, yellow as lr, coerceWarmThroughput as ls, nestedChildStackName as lt, stateBucketExistenceConfirmed as lu, resolveDynamoDbDeleteBudgetMs as m, classifyRecordedSecretRegion as ma, DYNAMIC_REFERENCE_TOKEN_SCAN as mc, wouldReturnToSdkProvider as mi, stringifyValue as ml, retiredAfterRollback as mn, malformedStateRefusalMessage as mo, removeSuperseded as mr, coerceCfnInteger as ms, collectNestedChildUnaddressed as mt, MIGRATE_TMP_PREFIX as mu, recordedProtectionEvidence as n, recordedOutputReferenceRegions as na, printingCorpusOf as nc, DBPROXY_TAG_OPTIONS as ni, importableOutputKeys as nl, findNestedStackTypeChanges as nn, malformedOrphanRecordsRefusalMessage as no, withStackRecords as nr, findReplacedReadersOfRecreateTargets as ns, keptForRetainedRecord as nt, resolveApp as nu, perType as o, assertSendableRoleArn as oa, unionOfSecretBags as oc, tagMapAsList as oi, orphansCarriedFrom as ol, isRedactedRecordedValue as on, malformedOrphansWarning as oo, gray as or, isStatefulRecreateTargetSync as os, displacedPhysicalIdShown as ot, resolveStateBucketWithDefault as ou, resolveDynamoDbDeleteBudgetClock as p, envCredentialsAreAssumedRole as pa, withoutPhysicalNameCopies as pc, isCustomResource as pi, isSensitiveAttributeName as pl, nameScopeOf as pn, malformedScrubResourceEntriesRefusalMessage as po, isSupersededResourceRecord as pr, coerceCfnBoolean as ps, withNestedRevertRun as pt, CFN_TEMPLATE_URL_LIMIT as pu, diffSecurity as q, hasReadableResources as qa, stackInstanceIdOf as qc, s3BucketDomainName as qi, runDockerStreaming as ql, withMovedTo as qn, unreadableOrphanRecords as qo, reserveStackCreateToken as qr, markSameGenerationBag as qs, isReplacementOrphan as qt, recordedProtectionNote as r, recordedReferenceRegions as ra, recordLogOnlyParameterValue as rc, planTagDiff as ri, importableOutputs as rl, getCurrentProducerRegions as rn, malformedOrphanRecordsWarning as ro, replacedDeleteFailureVerdict as rr, shownType as rs, recordRetainedForReadoption as rt, resolveAutoAssetStorage as ru, readProtection as s, explicitRoleArnOrThrow as sa, createSecretMasker as sc, tagPlanWarning as si, shouldRetainResource as sl, redactedDeleteAddressFields as sn, malformedOutputsRefusalMessage as so, green as sr, renderStatefulReason as ss, dropSettledNestedJournals as st, resolveStateBucketWithDefaultAndSource as su, DeployEngine as t, outputReferenceProvenanceOf as ta, logOnlyValueCount as tc, DBPROXY_TAGS_WHAT as ti, hasUnverifiableParameterRefusal as tl, orphanNeedsIdentity as tn, malformedLocalResourcesWarning as to, getStackRecords as tr, hasNoCloudControlHandlers as ts, resolvePendingCloudControlRequests as tt, loadCdkJson as tu, beginDeleteWait as u, AWS_CREDENTIAL_ENV_KEYS as ua, maskSecretsInText as uc, CC_BROKEN_REASON as ui, renderPhaseTimings as ul, updatePartialReason as un, malformedResourceEntriesWarning as uo, addSuperseded as ur, isWarmThroughputDecrease as us, recordDisplacedSkips as ut, warnDeprecatedNoPrefixCliFlag as uu, maskedLogger as v, coerceParameterTypedValue as va, spelledKeysOf as vc, isCustomResourceType as vi, loadPublishableAssetManifest as vl, computeParameterTaint as vn, refuseMalformedOrphanRecords as vo, supersededResourcesOf as vr, readConfigString as vs, dropFailedCommands as vt, decodeListingKey as vu, isTruthyCfnBoolean as w, carriesFetchableDynamicReference as wa, recordAttributeIdCopy as wc, CloudControlProvider as wi, getBootstrapMarkerKey as wl, exportAliasCollisionScrubWarning as wn, refuseMalformedOutputsForDestroy as wo, createReadOnlyAttributeHealerFactory as wr, templateResourceTypes as ws, sameJournaledOrphans as wt, StageLoadError as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, getAccountInfo as xa, recordNestedStackParameterExpressions as xc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xi, BOOTSTRAP_MARKER_PREFIX as xl, resourcesNamingDeclaredParameter as xn, refuseMalformedOrphansForDestroy as xo, noEchoComparisonForTemplate as xr, requireConfigObject as xs, journaledOrphanLines as xt, canonicalizeRegion as xu, relayedIndexBusyDelete as y, isUnboundTemplateParameter as ya, identityKeyFor as yc, getCurrentResourceSecrets as yi, rewriteTemplateAssetReferences as yl, namesAnyDeclaredParameter as yn, refuseMalformedOrphanRecordsForDestroy as yo, withoutSuperseded as yr, replayWarn as ys, dropFailedHint as yt, expectedOwnerParam as yu, templateIdentity as z, STATE_RESOURCES_MALFORMED as za, S3StateBackend as zc, reDisableInstanceApiTermination as zi, getDockerCmd as zl, maskingRetryLogger as zn, refuseMalformedState as zo, ccRoutedFinalSnapshotError as zr, noEchoLeavesOf as zs, pendingMovesRefusalMessage as zt, injectAwsRegion as zu };
+//# sourceMappingURL=deploy-engine-BOgsnnk0.js.map