@go-to-k/cdkd 0.306.0 → 0.308.0

package/dist/{deploy-engine-Bjr-FAuZ.js → deploy-engine-DSpxEUjC.js}

@@ -1,8 +1,8 @@
-import { c as __exportAll, r as getAwsClients } from "./aws-clients-DhsLtXsN.js";
-import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-Durl920o.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, d as prepareRemovalForUpdate, dt as startInterruptWatch, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as ElapsedBudgetRegistry, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as monotonicNowMs, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, ut as isInterruptedWaitError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-BbtwI9vN.js";
+import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
+import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-CZkNvTWF.js";
+import { t as getCdkdVersion } from "./version-DzajQDkv.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,8 +10,8 @@ import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetRe
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionConfigurationCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, ListTagsOfResourceCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeNatGatewaysCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
 import { DescribeApiDestinationCommand, DescribeConnectionCommand } from "@aws-sdk/client-eventbridge";
@@ -2360,7 +2360,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-DhsLtXsN.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-Bu9EMILF.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -7845,7 +7845,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$7(value) {
+function isPlainObject$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -8101,7 +8101,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$7(args)) return void 0;
+		if (!isPlainObject$9(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -8147,7 +8147,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$7(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$9(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -8441,12 +8441,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
+	if (!isPlainObject$9(resolvedProperties) || !isPlainObject$9(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
+	if (!isPlainObject$9(resolvedParameters) || !isPlainObject$9(sourceParameters)) return;
 	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -8495,7 +8495,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$7(sourceLeaf)) return void 0;
+		if (!isPlainObject$9(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -8832,7 +8832,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 		}
 		return { value: out };
 	}
-	if (!isPlainObject$7(node)) return void 0;
+	if (!isPlainObject$9(node)) return void 0;
 	const keys = Object.keys(node);
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
@@ -8873,7 +8873,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 }
 function evaluatePureSub(args, bind, pseudo, evaluate) {
 	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
-	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$9(variables)) return;
 	const bound = /* @__PURE__ */ new Map();
 	for (const [name, variable] of Object.entries(variables)) {
 		const evaluated = evaluate(variable);
@@ -8906,7 +8906,7 @@ function bindReadName(name, bind, pseudo) {
 function collectRereadConditions(node, names, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
-	if (!isPlainObject$7(node)) return true;
+	if (!isPlainObject$9(node)) return true;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
@@ -8917,7 +8917,7 @@ function collectRereadConditions(node, names, depth = 0) {
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
-	if (!isPlainObject$7(node)) return false;
+	if (!isPlainObject$9(node)) return false;
 	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
 }
 function rendersReadTo(spelling, parentSecrets, value) {
@@ -8960,7 +8960,7 @@ function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return true;
 	if (typeof node === "string") return node.includes("{{resolve:");
 	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
-	if (!isPlainObject$7(node)) return false;
+	if (!isPlainObject$9(node)) return false;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (Object.keys(node).length !== 1) return true;
@@ -9073,7 +9073,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$7(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$9(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -9105,7 +9105,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$7(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$9(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -9268,7 +9268,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$7(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$9(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -9296,7 +9296,7 @@ const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 ]);
 function arrayElementDrop(element, depth = 0) {
 	if (depth > 16) return "unknown";
-	if (!isPlainObject$7(element)) return "never";
+	if (!isPlainObject$9(element)) return "never";
 	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
 	const keys = Object.keys(element);
 	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
@@ -9332,7 +9332,7 @@ function keptLiteralsCorroborate(kept, bag, secrets) {
 	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
 }
 function isIntrinsicNode(value) {
-	if (!isPlainObject$7(value)) return false;
+	if (!isPlainObject$9(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
 }
@@ -9345,7 +9345,7 @@ function keptElementCorroborates(source, bag, secrets, depth = 0) {
 	if (source === null || typeof source !== "object") return source === bag;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
-	if (!isPlainObject$7(source) || !isPlainObject$7(bag)) return false;
+	if (!isPlainObject$9(source) || !isPlainObject$9(bag)) return false;
 	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
 	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
 }
@@ -9355,12 +9355,12 @@ function corroboratesWhateverResolves(source, depth = 0) {
 	if (source === null || typeof source !== "object") return true;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
-	if (!isPlainObject$7(source)) return false;
+	if (!isPlainObject$9(source)) return false;
 	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
 	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
 }
 function arrayPairsWhateverDrops(source) {
-	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	if (!source.some((element) => isPlainObject$9(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
 	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -9377,13 +9377,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$7(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$9(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 		const reread = positionByParameterReread(bag, source, secrets);
 		if (reread !== void 0) return reread;
 	}
-	if (typeof bag === "string" && isPlainObject$7(source)) {
+	if (typeof bag === "string" && isPlainObject$9(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -9393,7 +9393,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$7(source)) {
+	if (Array.isArray(bag) && isPlainObject$9(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -9428,7 +9428,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) {
 			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
@@ -9450,7 +9450,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$7(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$9(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -9487,7 +9487,7 @@ function nameScalarSecrets(value, secrets) {
 			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
 		}
 		if (Array.isArray(node)) return node.map(walk);
-		if (isPlainObject$7(node) && hasPlainPrototype(node)) {
+		if (isPlainObject$9(node) && hasPlainPrototype(node)) {
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
 			return out;
@@ -9504,13 +9504,13 @@ function substitutionIsSecret(value) {
 function sentinelDefinitionOf(source) {
 	const subs = source["DefinitionSubstitutions"];
 	const values = /* @__PURE__ */ new Map();
-	if (isPlainObject$7(subs)) {
+	if (isPlainObject$9(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
 	}
 	for (const key of ["DefinitionString", "Definition"]) {
 		if (!Object.hasOwn(source, key)) continue;
 		const raw = source[key];
-		const body = typeof raw === "string" ? raw : isPlainObject$7(raw) ? JSON.stringify(raw) : void 0;
+		const body = typeof raw === "string" ? raw : isPlainObject$9(raw) ? JSON.stringify(raw) : void 0;
 		if (body === void 0) continue;
 		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
 		const names = [];
@@ -9581,7 +9581,7 @@ function sentinelDefinitionOf(source) {
 				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
 				return;
 			}
-			if (isPlainObject$7(node)) {
+			if (isPlainObject$9(node)) {
 				const own = new Set(Object.keys(node).map(written));
 				for (const [k, v] of Object.entries(node)) {
 					if (!marked(k)) keys.add(k);
@@ -9609,7 +9609,7 @@ function alignedSecretLeaf(root, leaf) {
 			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
 			cursor = cursor[segment];
 		} else {
-			if (!isPlainObject$7(cursor)) return void 0;
+			if (!isPlainObject$9(cursor)) return void 0;
 			const own = Object.keys(cursor);
 			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
 			if (!Object.hasOwn(cursor, segment)) return void 0;
@@ -9620,7 +9620,7 @@ function alignedSecretLeaf(root, leaf) {
 }
 function collectObjectKeys(value, into) {
 	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
-	else if (isPlainObject$7(value)) for (const [k, v] of Object.entries(value)) {
+	else if (isPlainObject$9(value)) for (const [k, v] of Object.entries(value)) {
 		into.add(k);
 		collectObjectKeys(v, into);
 	}
@@ -9633,7 +9633,7 @@ function spelledKeysOf(properties) {
 }
 function someKeyIsUnspelled(value, spelled) {
 	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
-	if (isPlainObject$7(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	if (isPlainObject$9(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
 	return false;
 }
 function nameDefinitionSecrets(value, source, secrets) {
@@ -9728,8 +9728,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$7(a)) {
-		if (!isPlainObject$7(b)) return false;
+	if (isPlainObject$9(a)) {
+		if (!isPlainObject$9(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -9746,7 +9746,7 @@ function renderedDefinitionLiterals(source) {
 	const keyKeep = /* @__PURE__ */ new Set();
 	const subs = source["DefinitionSubstitutions"];
 	const scalars = [];
-	if (isPlainObject$7(subs)) {
+	if (isPlainObject$9(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
 			scalars.push([name, String(value)]);
 			if (typeof value === "string") keep.add(value);
@@ -9758,7 +9758,7 @@ function renderedDefinitionLiterals(source) {
 		if (!Object.hasOwn(source, key)) continue;
 		const body = source[key];
 		if (typeof body === "string") bodies.push(body);
-		else if (isPlainObject$7(body)) bodies.push(JSON.stringify(body));
+		else if (isPlainObject$9(body)) bodies.push(JSON.stringify(body));
 	}
 	for (const body of bodies) {
 		let rendered = body;
@@ -9809,7 +9809,7 @@ function collectScalarLeaves(value, into) {
 		return;
 	}
 	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
-	else if (isPlainObject$7(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+	else if (isPlainObject$9(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
 }
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
 	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9827,7 +9827,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, s
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
-	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$9(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
@@ -9854,7 +9854,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
-	if (failClosed === true && isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+	if (failClosed === true && isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
 		const keep = renderedDefinitionLiterals(source);
 		const out = Object.create(null);
 		const rest = Object.create(null);
@@ -9888,7 +9888,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return out;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -9915,14 +9915,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$7(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$9(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$7(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$9(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -9932,8 +9932,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$7(source)) {
-		if (!isPlainObject$7(bag)) return false;
+	if (isPlainObject$9(source)) {
+		if (!isPlainObject$9(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -10024,13 +10024,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$7(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$9(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(refused) && isPlainObject$7(scanned)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(refused) && isPlainObject$9(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -11520,7 +11520,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$7(variables) ? variables : void 0;
+				const vars = isPlainObject$9(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -11554,7 +11554,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$7(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$9(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -11570,7 +11570,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$7(value)) {
+				if (!isPlainObject$9(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -11619,7 +11619,7 @@ function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, con
 	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
 		parameters: noEchoParameters,
 		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), {
+	}, (coordinate, node) => nodes.set(canonicalJson$4(coordinate), {
 		coordinate,
 		node
 	}));
@@ -11631,7 +11631,7 @@ function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames
 	if (properties === null || typeof properties !== "object") return bag;
 	const coordinates = /* @__PURE__ */ new Map();
 	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
-	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$3(coordinate), coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$4(coordinate), coordinate);
 	const recordLeaf = (leaf) => {
 		if (typeof leaf === "string") {
 			if (leaf === "***" || leaf.includes("{{resolve:")) return;
@@ -11655,7 +11655,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$7(value)) {
+	if (isPlainObject$9(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -11678,7 +11678,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$7(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$9(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -11694,7 +11694,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$7(node)) return { ...node };
+	if (isPlainObject$9(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -11761,20 +11761,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$7(element)) return path;
+			if (key === void 0 || !isPlainObject$9(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$7(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$9(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$7(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$9(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$7(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$9(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -11803,7 +11803,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$7(v) ? !isPlainObject$7(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$9(v) ? !isPlainObject$9(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -11832,8 +11832,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$7(v) && isPlainObject$7(s)) {
-			const tt = isPlainObject$7(t) ? t : {};
+		if (isPlainObject$9(v) && isPlainObject$9(s)) {
+			const tt = isPlainObject$9(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -11856,13 +11856,13 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$7(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$9(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
-	return canonicalJson$3(a) === canonicalJson$3(b);
+	return canonicalJson$4(a) === canonicalJson$4(b);
 }
-function canonicalJson$3(value) {
+function canonicalJson$4(value) {
 	return JSON.stringify(value, (_key, node) => {
 		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
 		const sorted = Object.create(null);
@@ -11900,7 +11900,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$7(node)) {
+				if (isPlainObject$9(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11943,8 +11943,8 @@ function noEchoOutputsComparison(templateValues, sources) {
 	return (current, desired) => {
 		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
 		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
-		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$3(desired[key])));
-		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$3(desired[key]))) maskedKeys.add(key);
+		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$4(desired[key])));
+		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$4(desired[key]))) maskedKeys.add(key);
 		if (maskedKeys.size === 0) return {
 			current,
 			desired,
@@ -11958,7 +11958,7 @@ function noEchoOutputsComparison(templateValues, sources) {
 			const stored = current[key];
 			if (containsMask(stored)) continue;
 			normalized = { ...normalized ?? {} };
-			normalized[key] = canonicalJson$3(stored) === canonicalJson$3(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+			normalized[key] = canonicalJson$4(stored) === canonicalJson$4(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
 		}
 		return {
 			current: normalized,
@@ -12614,6 +12614,39 @@ function glueTableNameChanged(oldValue, newValue) {
 	if (oldName === void 0 || newName === void 0) return false;
 	return oldName.toLowerCase() !== newName.toLowerCase();
 }
+function natZoneAddressesAddedToAutomaticGateway(oldValue, newValue) {
+	return oldValue == null && newValue != null;
+}
+function ecsServiceLaunchTypeSetOrChanged(oldValue, newValue) {
+	return newValue != null && !isDeepStrictEqual(oldValue, newValue);
+}
+const EMR_INSTANCES_IN_PLACE_MEMBERS = ["TerminationProtected", "UnhealthyNodeReplacement"];
+const EMR_GROUP_IN_PLACE_MEMBERS = ["InstanceCount", "AutoScalingPolicy"];
+const EMR_FLEET_IN_PLACE_MEMBERS = ["TargetOnDemandCapacity", "TargetSpotCapacity"];
+function withoutKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+	const copy = { ...value };
+	for (const key of keys) delete copy[key];
+	return copy;
+}
+function emrInstancesReplacingPart(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+	const instances = withoutKeys(value, EMR_INSTANCES_IN_PLACE_MEMBERS);
+	const strip = (key, keys) => {
+		if (!(key in instances)) return;
+		const member = instances[key];
+		instances[key] = Array.isArray(member) ? member.map((entry) => withoutKeys(entry, keys)) : withoutKeys(member, keys);
+	};
+	strip("CoreInstanceGroup", EMR_GROUP_IN_PLACE_MEMBERS);
+	strip("TaskInstanceGroups", EMR_GROUP_IN_PLACE_MEMBERS);
+	strip("CoreInstanceFleet", EMR_FLEET_IN_PLACE_MEMBERS);
+	strip("TaskInstanceFleets", EMR_FLEET_IN_PLACE_MEMBERS);
+	return instances;
+}
+function emrClusterInstancesReplaced(oldValue, newValue) {
+	if (oldValue === void 0 && newValue === void 0) return true;
+	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
@@ -12938,6 +12971,10 @@ var ReplacementRulesRegistry = class {
 			"KeyName",
 			"NetworkInterfaces"
 		]) });
+		this.rules.set("AWS::EC2::NatGateway", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", natZoneAddressesAddedToAutomaticGateway]])
+		});
 		this.rules.set("AWS::EC2::Volume", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"AvailabilityZone",
@@ -12967,6 +13004,14 @@ var ReplacementRulesRegistry = class {
 			"TaskRoleArn",
 			"Volumes"
 		]) });
+		this.rules.set("AWS::ECS::Service", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["LaunchType", ecsServiceLaunchTypeSetOrChanged]])
+		});
+		this.rules.set("AWS::EMR::Cluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Instances", emrClusterInstancesReplaced]])
+		});
 		this.rules.set("AWS::ElasticLoadBalancingV2::ListenerRule", { replacementProperties: /* @__PURE__ */ new Set(["ListenerArn"]) });
 		this.logger.debug(`Initialized replacement rules for ${this.rules.size} resource types`);
 	}
@@ -14846,7 +14891,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -14886,7 +14931,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$6(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$8(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -14898,7 +14943,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -14911,7 +14956,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -14925,7 +14970,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -14939,10 +14984,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$6(value) {
+function isPlainObject$8(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -14969,7 +15014,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -15146,6 +15191,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AIOps::InvestigationGroup",
 	"AWS::IoTSiteWise::Workspace",
+	"AWS::CloudWatch::Space",
 	"AWS::Rbin::Rule",
 	"AWS::SMSVOICE::PhoneNumber",
 	"AWS::SMSVOICE::SenderId"
@@ -16680,21 +16726,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::EC2::NatGateway", {
 		handled: /* @__PURE__ */ new Set([
 			"AllocationId",
+			"AvailabilityMode",
+			"AvailabilityZoneAddresses",
 			"ConnectivityType",
 			"PrivateIpAddress",
 			"SecondaryAllocationIds",
 			"SecondaryPrivateIpAddressCount",
 			"SecondaryPrivateIpAddresses",
 			"SubnetId",
-			"Tags"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityMode", "not yet implemented by cdkd"],
-			["AvailabilityZoneAddresses", "not yet implemented by cdkd"],
-			["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and cdkd rejects NatGateway updates outright — routed via Cloud Control instead"],
-			["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]
+			"Tags",
+			"VpcId"
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["AvailabilityMode", "VpcId"]),
+		silentDrop: /* @__PURE__ */ new Map([["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and the cdkd NatGateway update releases only the AvailabilityZoneAddresses of a regional gateway, never the secondary addresses of a zonal one — routed via Cloud Control instead"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"AutoProvisionZones",
 			"AutoScalingIps",
@@ -17008,19 +17052,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::EFS::MountTarget", {
 		handled: /* @__PURE__ */ new Set([
 			"FileSystemId",
-			"SecurityGroups",
-			"SubnetId"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["IpAddress", "not yet implemented by cdkd"],
-			["IpAddressType", "not yet implemented by cdkd"],
-			["Ipv6Address", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
 			"IpAddress",
 			"IpAddressType",
-			"Ipv6Address"
+			"Ipv6Address",
+			"SecurityGroups",
+			"SubnetId"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Id"]),
 		ccRouteUnavailable: false
 	}],
@@ -18244,6 +18283,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Route53::HostedZone", {
 		handled: /* @__PURE__ */ new Set([
+			"DelegationSetId",
 			"HostedZoneConfig",
 			"HostedZoneFeatures",
 			"HostedZoneTags",
@@ -18251,8 +18291,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"QueryLoggingConfig",
 			"VPCs"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["DelegationSetId", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["DelegationSetId"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Id", "NameServers"]),
 		ccRouteUnavailable: false
 	}],
@@ -19976,12 +20016,12 @@ function declaresNoEcho(definition) {
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	if (value === void 0) return "null";
-	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$3).join(",")}]`;
 	if (value !== null && typeof value === "object") {
 		const record = value;
-		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$2(record[key])}`).join(",")}}`;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$3(record[key])}`).join(",")}}`;
 	}
 	return JSON.stringify(value) ?? "null";
 }
@@ -20002,7 +20042,7 @@ function splitInputFingerprint(entry) {
 	};
 }
 function templateCarriesNeedle(templateValue, secrets) {
-	const text = canonicalJson$2(templateValue);
+	const text = canonicalJson$3(templateValue);
 	for (const needle of printingCorpusOf(secrets).keys()) {
 		if (needle.length < 4) continue;
 		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
@@ -20010,14 +20050,14 @@ function templateCarriesNeedle(templateValue, secrets) {
 	return false;
 }
 function maskedPropertyFingerprint(templateValue) {
-	const digest = createHash("sha256").update(canonicalJson$2({
+	const digest = createHash("sha256").update(canonicalJson$3({
 		layout: FINGERPRINT_LAYOUT$1,
 		value: templateValue
 	})).digest("hex");
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -20025,7 +20065,7 @@ const NESTED_STACK_TYPE$4 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
-	const text = canonicalJson$2(value);
+	const text = canonicalJson$3(value);
 	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
 	for (const corpus of corpora) {
 		if (corpus === void 0) continue;
@@ -20037,7 +20077,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$5(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$7(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -20048,7 +20088,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$5(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$7(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -20099,7 +20139,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$5(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$7(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -20124,7 +20164,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$5(value)) return false;
+		if (!isPlainObject$7(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -20136,7 +20176,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -20150,7 +20190,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$5(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$7(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -20166,7 +20206,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$5(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$7(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -20181,7 +20221,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$5(value)) return;
+		if (!isPlainObject$7(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -20214,7 +20254,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -20243,8 +20283,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$5(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$5(map)) return "unknown";
+	const map = isPlainObject$7(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$7(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -20312,7 +20352,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$5(value)) return {
+	if (!isPlainObject$7(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -20375,7 +20415,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -20428,8 +20468,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$5(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$5(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$7(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$7(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -20453,34 +20493,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$5(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$7(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$5(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$7(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$5(properties)) return "unknown";
+	if (!isPlainObject$7(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$5(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$7(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$5(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$7(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$5(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$7(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$5(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$7(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -20497,7 +20537,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$5(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$7(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -20510,8 +20550,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$5(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$5(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$7(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$7(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -20583,7 +20623,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$5(value)) return "clean";
+	if (!isPlainObject$7(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -20598,7 +20638,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -20662,7 +20702,7 @@ async function maskedInputFingerprint(templateValue, sources) {
 		if (error instanceof UnknownInput) return void 0;
 		throw error;
 	}
-	const digest = createHash("sha256").update(canonicalJson$2({
+	const digest = createHash("sha256").update(canonicalJson$3({
 		layout: INPUT_FINGERPRINT_LAYOUT,
 		value: form
 	})).digest("hex");
@@ -20676,7 +20716,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$5(parameters)) return classes;
+	if (!isPlainObject$7(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -20717,13 +20757,13 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$5(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$7(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
 		const value = resolvedProps[key];
 		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
-		const text = canonicalJson$2(value);
+		const text = canonicalJson$3(value);
 		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
 	});
 }
@@ -20748,7 +20788,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$5(field)) return read;
+	if (!isPlainObject$7(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -20756,7 +20796,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$5(field)) return read;
+	if (!isPlainObject$7(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -20803,7 +20843,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$5(field) ? Object.entries(field) : [];
+	const next = isPlainObject$7(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -20836,10 +20876,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$5(previous)) return scrubbed;
+		if (!isPlainObject$7(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$5(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$7(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -22180,11 +22220,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$4(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$6(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -22202,11 +22242,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$4(field)) return void 0;
+	if (!isPlainObject$6(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -22215,9 +22255,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$4(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$6(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -22239,7 +22279,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$4(field)) return record;
+	if (!isPlainObject$6(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -22251,12 +22291,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$4(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$6(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$4(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$6(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$4(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$6(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -22274,7 +22314,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$4(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$6(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -22317,7 +22357,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$4(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$6(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -24052,6 +24092,68 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 		}
 		default: return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 	}
+	if (resourceType === "AWS::EC2::NatGateway") {
+		if (attributeName === "NatGatewayId") return physicalId;
+		if (attributeName === "RouteTableId" || attributeName === "EniId" || attributeName === "AutoProvisionZones" || attributeName === "AutoScalingIps") {
+			const read = async () => {
+				try {
+					const gateway = (await resolver.clients.clientsForRegion(resolver.explicitRegion).ec2.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.NatGatewayId === physicalId);
+					const addresses = gateway?.NatGatewayAddresses ?? [];
+					const primary = addresses.find((a) => a.IsPrimary === true) ?? addresses[0];
+					const value = attributeName === "RouteTableId" ? gateway?.RouteTableId : attributeName === "AutoProvisionZones" ? gateway?.AutoProvisionZones : attributeName === "AutoScalingIps" ? gateway?.AutoScalingIps : gateway?.AvailabilityMode === "regional" ? void 0 : primary?.NetworkInterfaceId;
+					return {
+						state: gateway?.State,
+						regional: gateway?.AvailabilityMode === "regional",
+						value: typeof value === "string" && value !== "" ? value : void 0
+					};
+				} catch (err) {
+					return refuseUnservedAttribute(resolver, {
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: describeFailureObserved(resolver, "DescribeNatGateways", err, context),
+						remedy: "Fix the read (the ec2:DescribeNatGateways permission, or the region) and deploy again."
+					});
+				}
+			};
+			let observedRead = await read();
+			if (observedRead.value === void 0 && observedRead.state === "pending") {
+				const watch = startInterruptWatch(`NAT gateway ${logicalId} attribute wait`);
+				try {
+					for (let poll = 0; poll < natGatewayAttributeWait.polls && observedRead.state === "pending"; poll++) {
+						if (watch.isInterrupted()) throw watch.onInterrupted();
+						await natGatewayAttributeWait.sleep(natGatewayAttributeWait.delayMs);
+						observedRead = await read();
+					}
+				} finally {
+					watch.dispose();
+				}
+			}
+			if (observedRead.value !== void 0) return observedRead.value;
+			if (observedRead.state === "pending") return refuseUnservedAttribute(resolver, {
+				logicalId,
+				attributeName,
+				resourceType,
+				physicalId,
+				context,
+				observed: "the NAT gateway was still pending when the attribute wait ran out",
+				remedy: "Check the gateway with `aws ec2 describe-nat-gateways`, then deploy again once it is available."
+			});
+			const remedy = observedRead.state === "available" ? attributeName === "EniId" && observedRead.regional ? "The gateway is available and has no such value: a regional NAT gateway reports no single EniId. Reference another attribute." : attributeName !== "EniId" && !observedRead.regional ? "The gateway is available, and AWS reports no such value for this zonal gateway; the attribute is set on regional NAT gateways. Reference another attribute." : "The gateway is available and AWS reports no such value for it; check it with `aws ec2 describe-nat-gateways`." : observedRead.state === "failed" ? "The gateway is failed and has no such attribute to serve; fix the gateway and deploy again." : observedRead.state === void 0 ? "DescribeNatGateways no longer returns the gateway; check it in the console." : "The gateway is deleted or being deleted and has no such attribute to serve.";
+			return refuseUnservedAttribute(resolver, {
+				logicalId,
+				attributeName,
+				resourceType,
+				physicalId,
+				context,
+				observed: `DescribeNatGateways reports no ${displayMasked(resolver, attributeName, context)}`,
+				remedy
+			});
+		}
+		return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
+	}
 	if (resourceType === "AWS::EC2::LaunchTemplate") {
 		if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
 			try {
@@ -24112,6 +24214,11 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 	}
 	return NOT_CONSTRUCTED;
 }
+const natGatewayAttributeWait = {
+	polls: 60,
+	delayMs: 1e4,
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/functions.ts
@@ -25772,17 +25879,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 
 //#endregion
 //#region src/analyzer/read-provenance-promotion.ts
-function isPlainObject$3(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readsAcrossStacks(value) {
 	if (Array.isArray(value)) return value.some(readsAcrossStacks);
-	if (!isPlainObject$3(value)) return false;
+	if (!isPlainObject$5(value)) return false;
 	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
 	return Object.values(value).some(readsAcrossStacks);
 }
 function recordedReadVersions(record) {
-	if (!isPlainObject$3(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$5(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = referenceProvenanceOf(record);
 	if (field === void 0) return void 0;
 	let out;
@@ -25793,7 +25900,7 @@ async function readProvenancePromotions(args) {
 	const { currentState, desiredTemplate, sources } = args;
 	const parser = args.parser ?? new TemplateParser();
 	const records = currentState.resources;
-	const parameters = isPlainObject$3(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const parameters = isPlainObject$5(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
 	const out = [];
 	for (const { logicalId, changeType } of args.rows) {
 		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
@@ -25801,7 +25908,7 @@ async function readProvenancePromotions(args) {
 		const readVersions = recordedReadVersions(record);
 		if (readVersions === void 0) continue;
 		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
-		const properties = isPlainObject$3(resource?.Properties) ? resource.Properties : {};
+		const properties = isPlainObject$5(resource?.Properties) ? resource.Properties : {};
 		const reads = [];
 		for (const [key, value] of Object.entries(properties)) {
 			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
@@ -25844,7 +25951,7 @@ async function readProvenancePromotions(args) {
 			if (recorded.some((version) => !domain.has(version))) moved.push(token);
 		}
 		if (moved.length === 0) continue;
-		const recordProperties = isPlainObject$3(record?.properties) ? record.properties : {};
+		const recordProperties = isPlainObject$5(record?.properties) ? record.properties : {};
 		const keys = [];
 		for (const r of reads) {
 			if (!Object.hasOwn(recordProperties, r.key)) continue;
@@ -27417,8 +27524,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$2(previous)) {
-		if (!isPlainObject$2(desired)) return "differs";
+	if (isPlainObject$4(previous)) {
+		if (!isPlainObject$4(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -27444,7 +27551,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$2(value) {
+function isPlainObject$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -27836,6 +27943,7 @@ const SLOW_CC_OPERATION_TIMEOUTS = {
 	},
 	"AWS::ElastiCache::CacheCluster": {
 		create: 60 * MINUTE_MS,
+		update: 60 * MINUTE_MS,
 		delete: 60 * MINUTE_MS
 	},
 	"AWS::RDS::DBInstance": {
@@ -28394,7 +28502,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DrREeZeh.js");
+			const { ASGProvider } = await import("./asg-provider-CsRMe_zh.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28503,7 +28611,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Dps9UxBz.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D_3VAhFf.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BPs9JSk_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-p59T8CFv.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29659,11 +29767,11 @@ function applyNoEchoDeleteValues(properties, recordedLeaves, values) {
 		payload: properties,
 		unresolved: []
 	};
-	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$3(leaf.coordinate), leaf]));
+	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$4(leaf.coordinate), leaf]));
 	const entries = [];
 	const unresolved = [];
 	for (const coordinate of masked) {
-		const leaf = byKey.get(canonicalJson$3(coordinate));
+		const leaf = byKey.get(canonicalJson$4(coordinate));
 		if (leaf === void 0) unresolved.push(coordinate);
 		else entries.push({
 			coordinate,
@@ -29714,7 +29822,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	const fingerprinter = options.inputSources === void 0 ? void 0 : inputFingerprinter(templateProps, options.inputSources);
 	const leaves = [];
 	for (const coordinate of masked) {
-		if (!nodes.has(canonicalJson$3(coordinate))) continue;
+		if (!nodes.has(canonicalJson$4(coordinate))) continue;
 		if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 		const value = valueAtCoordinate(resolvedProperties, coordinate);
 		if (value === void 0 || carriesSecretMask(value)) continue;
@@ -29893,7 +30001,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const bag = await this.noEchoNeedles();
 		const leaves = [];
 		for (const coordinate of masked) {
-			const key = canonicalJson$3(coordinate);
+			const key = canonicalJson$4(coordinate);
 			if (!nodes.has(key)) continue;
 			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
@@ -36984,7 +37092,7 @@ const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
-function canonicalJson$1(value) {
+function canonicalJson$2(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
 			const sorted = Object.create(null);
@@ -37014,7 +37122,7 @@ function skippedOutputDigest(template, outputKey) {
 		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
 	}
 	const entry = template.Outputs?.[outputKey];
-	return createHash("sha256").update(canonicalJson$1({
+	return createHash("sha256").update(canonicalJson$2({
 		output: entry,
 		template: sections
 	})).digest("hex");
@@ -38887,7 +38995,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	const marked = noEchoLeavesOf(baseline) ?? [];
 	const names = declaredNoEchoAttributeNames(baseline);
 	if (marked.length === 0 && names.length === 0 && substituted.length === 0) return record;
-	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$3(leaf.value) === canonicalJson$3(value));
+	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$4(leaf.value) === canonicalJson$4(value));
 	let attributes = record.attributes;
 	if (attributes !== void 0 && attributes !== null && typeof attributes === "object") for (const [name, value] of Object.entries(attributes)) {
 		if (!names.includes(name) && !echoes(name, value)) continue;
@@ -38898,7 +39006,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 		const list = coordinate.findIndex((segment) => typeof segment === "number");
 		if (list < 0) return false;
 		const path = coordinate.slice(0, list);
-		return canonicalJson$3(valueAtCoordinate(byIndex, path)) !== canonicalJson$3(valueAtCoordinate(baseline.properties, path));
+		return canonicalJson$4(valueAtCoordinate(byIndex, path)) !== canonicalJson$4(valueAtCoordinate(baseline.properties, path));
 	});
 	const properties = reshaped.length === 0 ? byIndex : maskReadbackAtCoordinates(byIndex, baseline.properties, reshaped);
 	const widened = reshaped.map((coordinate) => readbackPathFor(byIndex, baseline.properties, coordinate)).filter((path, i) => path !== void 0 && path.length < reshaped[i].length);
@@ -44747,18 +44855,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject$1(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function canonicalJson(value) {
-	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+function canonicalJson$1(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
+	if (isPlainObject$3(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject$1(value)) return false;
+	if (!isPlainObject$3(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44781,8 +44889,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject$1(definitions)) return void 0;
-	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$3(definitions)) return void 0;
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44804,7 +44912,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject$1(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -44822,7 +44930,7 @@ function conditionFingerprint(template, name, inputOf) {
 		}
 	}
 	return {
-		fingerprint: `sha256:${createHash("sha256").update(canonicalJson({
+		fingerprint: `sha256:${createHash("sha256").update(canonicalJson$1({
 			layout: FINGERPRINT_LAYOUT,
 			conditions: closure,
 			parameters: inputs
@@ -44835,7 +44943,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject$1(value)) return;
+	if (!isPlainObject$3(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -44849,9 +44957,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject$1(section)) continue;
+		if (!isPlainObject$3(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject$1(entry)) continue;
+			if (!isPlainObject$3(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -44883,10 +44991,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject$1(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject$1(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$3(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -44932,11 +45040,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject$1(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$3(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45271,7 +45379,7 @@ function deferredServiceTokenWarning(row) {
 
 //#endregion
 //#region src/deployment/read-provenance-sources.ts
-function isPlainObject(value) {
+function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function crossStackNodes(value, into = []) {
@@ -45279,7 +45387,7 @@ function crossStackNodes(value, into = []) {
 		for (const item of value) crossStackNodes(item, into);
 		return into;
 	}
-	if (!isPlainObject(value)) return into;
+	if (!isPlainObject$2(value)) return into;
 	const keys = Object.keys(value);
 	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
 	for (const item of Object.values(value)) crossStackNodes(item, into);
@@ -45303,11 +45411,11 @@ function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
 function inheritedProvenanceForChildDiff(args) {
 	const { row, rowRecord, parentRecords, parentTemplate } = args;
 	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
-	const recordedParameters = isPlainObject(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const recordedParameters = isPlainObject$2(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
 	const tokens = referenceTokensIn(recordedParameters);
 	if (tokens.size === 0) return void 0;
 	const own = referenceProvenanceOf(rowRecord);
-	const upstreams = [...new TemplateParser().extractReferences(isPlainObject(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$2(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
 	const out = /* @__PURE__ */ new Map();
 	for (const token of tokens) {
 		const versions = /* @__PURE__ */ new Set();
@@ -46138,6 +46246,41 @@ function isTruthyCfnBoolean(value) {
 	return value === true || value === "true";
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-ttl.ts
+function readTtlSpec(spec) {
+	if (spec === void 0 || spec === null) return {
+		enabled: false,
+		attributeName: void 0
+	};
+	const s = spec;
+	const rawName = s["AttributeName"];
+	const attributeName = typeof rawName === "string" && rawName !== "" ? rawName : void 0;
+	const rawEnabled = s["Enabled"];
+	return {
+		enabled: rawEnabled === void 0 ? true : typeof rawEnabled === "string" ? rawEnabled.toLowerCase() === "true" : Boolean(rawEnabled),
+		attributeName
+	};
+}
+function planTimeToLive(spec, previousSpec, mode) {
+	const desired = readTtlSpec(spec);
+	if (spec !== void 0 && spec !== null && desired.enabled) return desired.attributeName ? {
+		kind: "enable",
+		attributeName: desired.attributeName
+	} : { kind: "none" };
+	if (mode === "create") return { kind: "none" };
+	const previousPresent = previousSpec !== void 0 && previousSpec !== null;
+	const previous = readTtlSpec(previousSpec);
+	if (previousPresent && previous.enabled && previous.attributeName) return {
+		kind: "disable",
+		attributeName: previous.attributeName
+	};
+	return { kind: "disable-live" };
+}
+function isTtlAlreadyDisabled(awsDetail) {
+	return /TimeToLive is already disabled/i.test(awsDetail);
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
@@ -46356,6 +46499,718 @@ function isResourceNotFoundError(error) {
 	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-contributor-insights.ts
+const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
+function readContributorInsightsSpec(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "Enabled", path) ?? configStringRefusal(value, "Mode", "", path);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["Enabled"]) ?? false;
+	const mode = block["Mode"];
+	return typeof mode === "string" && mode.length > 0 ? {
+		kind: "usable",
+		enabled,
+		mode
+	} : {
+		kind: "usable",
+		enabled
+	};
+}
+function planContributorInsightsOp(desired, previous, onUnusable) {
+	if (desired.kind === "unusable") {
+		onUnusable(desired.reason);
+		return;
+	}
+	if (desired.kind === "absent") return previous.kind === "absent" ? void 0 : { action: "DISABLE" };
+	if (previous.kind === "usable" && previous.enabled === desired.enabled && (!desired.enabled || previous.mode === desired.mode)) return;
+	if (!desired.enabled) return { action: "DISABLE" };
+	return desired.mode === void 0 ? { action: "ENABLE" } : {
+		action: "ENABLE",
+		mode: desired.mode
+	};
+}
+const INDEX_CONTRIBUTOR_INSIGHTS_PATH = `GlobalSecondaryIndexes[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+function indexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
+}
+function planIndexContributorInsightsOps(desiredIndexes, previousIndexes, onUnusable) {
+	const previousByName = indexEntriesByName(previousIndexes);
+	const ops = [];
+	for (const [indexName, entry] of indexEntriesByName(desiredIndexes)) {
+		const path = INDEX_CONTRIBUTOR_INSIGHTS_PATH;
+		const op = planContributorInsightsOp(readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], path), readContributorInsightsSpec(previousByName.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], path), (reason) => onUnusable(indexName, reason));
+		if (op !== void 0) ops.push({
+			indexName,
+			...op
+		});
+	}
+	return ops;
+}
+function contributorInsightsRefusals(tableBlock, indexes) {
+	const refusals = [];
+	const table = readContributorInsightsSpec(tableBlock, CONTRIBUTOR_INSIGHTS_KEY);
+	if (table.kind === "unusable") refusals.push(table.reason);
+	if (!Array.isArray(indexes)) return refusals;
+	indexes.forEach((entry, position) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `GlobalSecondaryIndexes[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		if (read.kind === "unusable") refusals.push(read.reason);
+	});
+	return refusals;
+}
+function stripIndexContributorInsights(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+	if (!("ContributorInsightsSpecification" in entry)) return entry;
+	const { [CONTRIBUTOR_INSIGHTS_KEY]: _stripped, ...rest } = entry;
+	return rest;
+}
+function indexDeclaresContributorInsights(desiredEntry) {
+	return readContributorInsightsSpec(desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY], "").kind === "usable";
+}
+function enabledForStatus(status, transientAsTarget) {
+	if (status === "ENABLED" || transientAsTarget && status === "ENABLING") return true;
+	if (status === "DISABLED" || transientAsTarget && status === "DISABLING") return false;
+}
+function reverseMapTableContributorInsights(status, mode) {
+	const enabled = enabledForStatus(status, false);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	if (enabled && mode !== void 0) block["Mode"] = mode;
+	return block;
+}
+function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
+	const declared = readContributorInsightsSpec(declaredBlock, INDEX_CONTRIBUTOR_INSIGHTS_PATH);
+	if (declared.kind !== "usable") return void 0;
+	const enabled = enabledForStatus(status, true);
+	if (enabled === void 0) return void 0;
+	const declaredEnabled = declaredBlock["Enabled"];
+	const block = { Enabled: typeof declaredEnabled !== "string" ? enabled : declared.enabled === enabled ? declaredEnabled : String(enabled) };
+	if (enabled && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-replica-settings.ts
+const PITR_KEY = "PointInTimeRecoverySpecification";
+const KINESIS_KEY = "KinesisStreamSpecification";
+const TABLE_POLICY_KEY = "ResourcePolicy";
+const REPLICA_STREAM_KEY = "ReplicaStreamSpecification";
+const DEFAULT_RECOVERY_PERIOD_DAYS = 35;
+const DEFAULT_KINESIS_PRECISION = "MILLISECOND";
+const PITR_PATH = `Replicas[].${PITR_KEY}`;
+const CI_PATH = `Replicas[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+const KINESIS_PATH = `Replicas[].${KINESIS_KEY}`;
+const TABLE_POLICY_PATH = `Replicas[].${TABLE_POLICY_KEY}`;
+const STREAM_POLICY_PATH = `Replicas[].${REPLICA_STREAM_KEY}.ResourcePolicy`;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readPitrSpec(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "PointInTimeRecoveryEnabled", PITR_PATH) ?? configIntegerRefusal(value, "RecoveryPeriodInDays", PITR_PATH, 1, 35);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["PointInTimeRecoveryEnabled"]) ?? false;
+	const period = enabled ? coerceCfnInteger(block["RecoveryPeriodInDays"]) : void 0;
+	return period === void 0 ? {
+		kind: "usable",
+		enabled
+	} : {
+		kind: "usable",
+		enabled,
+		recoveryPeriodInDays: period
+	};
+}
+function readKinesisSpec(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configStringRefusal(value, "StreamArn", "required", KINESIS_PATH) ?? configStringRefusal(value, "ApproximateCreationDateTimePrecision", "", KINESIS_PATH);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const streamArn = block["StreamArn"];
+	if (typeof streamArn !== "string") return {
+		kind: "unusable",
+		reason: `${KINESIS_PATH}.StreamArn is required`
+	};
+	const precision = block["ApproximateCreationDateTimePrecision"];
+	return typeof precision === "string" && precision.length > 0 ? {
+		kind: "usable",
+		streamArn,
+		precision
+	} : {
+		kind: "usable",
+		streamArn
+	};
+}
+function readPolicyBlock(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!isPlainObject$1(value)) return {
+		kind: "unusable",
+		reason: `${path} must be an object with a PolicyDocument`
+	};
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (!isPlainObject$1(document)) return {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument must be a policy object or a JSON string`
+	};
+	const keys = Object.keys(document);
+	if (keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"))) return {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument is an unresolved intrinsic`
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+function readTablePolicy(replica) {
+	return readPolicyBlock(replica?.[TABLE_POLICY_KEY], TABLE_POLICY_PATH);
+}
+function readStreamPolicy$1(replica) {
+	const stream = replica?.[REPLICA_STREAM_KEY];
+	if (stream === void 0 || stream === null) return { kind: "absent" };
+	if (!isPlainObject$1(stream)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
+	};
+	return readPolicyBlock(stream["ResourcePolicy"], STREAM_POLICY_PATH);
+}
+function replicaSettingRefusals(replica) {
+	return [
+		readPitrSpec(replica?.[PITR_KEY]),
+		readContributorInsightsSpec(replica?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH),
+		readKinesisSpec(replica?.[KINESIS_KEY]),
+		readTablePolicy(replica),
+		readStreamPolicy$1(replica)
+	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []);
+}
+function settingOf(op) {
+	switch (op.kind) {
+		case "pitr": return "pitr";
+		case "contributorInsights": return "contributorInsights";
+		case "kinesisDisable":
+		case "kinesisEnable":
+		case "kinesisPrecision": return "kinesis";
+		case "deleteTablePolicy":
+		case "putTablePolicy": return "tablePolicy";
+		case "deleteStreamPolicy":
+		case "putStreamPolicy": return "streamPolicy";
+	}
+}
+const SETTING_MEMBER = {
+	pitr: PITR_KEY,
+	contributorInsights: CONTRIBUTOR_INSIGHTS_KEY,
+	kinesis: KINESIS_KEY,
+	tablePolicy: TABLE_POLICY_KEY,
+	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`
+};
+function samePolicyDocument$1(left, right) {
+	if (left === right) return true;
+	try {
+		return JSON.stringify(JSON.parse(left)) === JSON.stringify(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+function planReplicaSettingOps(desired, previous, options, onUnusable) {
+	const prev = options.fresh ? void 0 : previous;
+	const ops = [];
+	const removes = (setting) => options.keepOnRemoval?.has(setting) !== true;
+	const pitr = readPitrSpec(desired?.[PITR_KEY]);
+	const prevPitr = readPitrSpec(prev?.[PITR_KEY]);
+	if (pitr.kind === "unusable") onUnusable(pitr.reason);
+	else if (pitr.kind === "absent") {
+		if (prevPitr.kind !== "absent" && removes("pitr")) ops.push({
+			kind: "pitr",
+			enabled: false
+		});
+	} else {
+		const unchanged = prevPitr.kind === "usable" && prevPitr.enabled === pitr.enabled && prevPitr.recoveryPeriodInDays === pitr.recoveryPeriodInDays;
+		const noop = options.fresh && !pitr.enabled;
+		if (!unchanged && !noop) ops.push(pitr.recoveryPeriodInDays === void 0 ? {
+			kind: "pitr",
+			enabled: pitr.enabled
+		} : {
+			kind: "pitr",
+			enabled: pitr.enabled,
+			recoveryPeriodInDays: pitr.recoveryPeriodInDays
+		});
+	}
+	const desiredCi = readContributorInsightsSpec(desired?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH);
+	const ci = planContributorInsightsOp(desiredCi, readContributorInsightsSpec(prev?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH), onUnusable);
+	if (ci !== void 0 && !(options.fresh && ci.action === "DISABLE") && !(desiredCi.kind === "absent" && !removes("contributorInsights"))) ops.push(ci.mode === void 0 ? {
+		kind: "contributorInsights",
+		action: ci.action
+	} : {
+		kind: "contributorInsights",
+		action: ci.action,
+		mode: ci.mode
+	});
+	const kinesis = readKinesisSpec(desired?.[KINESIS_KEY]);
+	const prevKinesis = readKinesisSpec(prev?.[KINESIS_KEY]);
+	if (kinesis.kind === "unusable") onUnusable(kinesis.reason);
+	else if (kinesis.kind === "absent") {
+		if (prevKinesis.kind === "usable" && removes("kinesis")) ops.push({
+			kind: "kinesisDisable",
+			streamArn: prevKinesis.streamArn
+		});
+	} else if (prevKinesis.kind === "usable" && prevKinesis.streamArn === kinesis.streamArn) {
+		if (kinesis.precision !== void 0 && kinesis.precision !== prevKinesis.precision) ops.push({
+			kind: "kinesisPrecision",
+			streamArn: kinesis.streamArn,
+			precision: kinesis.precision
+		});
+		else if (kinesis.precision === void 0 && prevKinesis.precision !== void 0 && prevKinesis.precision !== DEFAULT_KINESIS_PRECISION && removes("kinesis")) ops.push({
+			kind: "kinesisPrecision",
+			streamArn: kinesis.streamArn,
+			precision: DEFAULT_KINESIS_PRECISION
+		});
+	} else {
+		if (prevKinesis.kind === "usable") ops.push({
+			kind: "kinesisDisable",
+			streamArn: prevKinesis.streamArn
+		});
+		ops.push(kinesis.precision === void 0 ? {
+			kind: "kinesisEnable",
+			streamArn: kinesis.streamArn
+		} : {
+			kind: "kinesisEnable",
+			streamArn: kinesis.streamArn,
+			precision: kinesis.precision
+		});
+	}
+	const policyOps = (want, had, replaced, put, del, setting) => {
+		if (want.kind === "unusable") {
+			onUnusable(want.reason);
+			return;
+		}
+		if (want.kind === "absent") {
+			if (had.kind !== "absent" && removes(setting)) ops.push(del);
+			return;
+		}
+		if (!replaced && had.kind === "usable" && samePolicyDocument$1(had.document, want.document)) return;
+		ops.push(put(want.document));
+	};
+	policyOps(readTablePolicy(desired), readTablePolicy(prev), false, (document) => ({
+		kind: "putTablePolicy",
+		document
+	}), { kind: "deleteTablePolicy" }, "tablePolicy");
+	policyOps(readStreamPolicy$1(desired), readStreamPolicy$1(prev), options.streamReplaced === true, (document) => ({
+		kind: "putStreamPolicy",
+		document
+	}), { kind: "deleteStreamPolicy" }, "streamPolicy");
+	return ops;
+}
+function planReplicaSettingCorrections(desired, live, only) {
+	const ops = [];
+	const pitr = readPitrSpec(desired?.[PITR_KEY]);
+	if (only.has("pitr") && pitr.kind === "usable" && live.pitr !== void 0) {
+		if (pitr.enabled && !live.pitr.enabled) ops.push(pitr.recoveryPeriodInDays === void 0 ? {
+			kind: "pitr",
+			enabled: pitr.enabled
+		} : {
+			kind: "pitr",
+			enabled: pitr.enabled,
+			recoveryPeriodInDays: pitr.recoveryPeriodInDays
+		});
+	}
+	const ci = readContributorInsightsSpec(desired?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH);
+	if (only.has("contributorInsights") && ci.kind === "usable" && live.contributorInsightsEnabled !== void 0 && live.contributorInsightsEnabled !== ci.enabled) ops.push(!ci.enabled ? {
+		kind: "contributorInsights",
+		action: "DISABLE"
+	} : ci.mode === void 0 ? {
+		kind: "contributorInsights",
+		action: "ENABLE"
+	} : {
+		kind: "contributorInsights",
+		action: "ENABLE",
+		mode: ci.mode
+	});
+	const kinesis = readKinesisSpec(desired?.[KINESIS_KEY]);
+	if (only.has("kinesis") && kinesis.kind === "usable" && live.kinesisStreamArns !== void 0 && !live.kinesisStreamArns.has(kinesis.streamArn)) ops.push(kinesis.precision === void 0 ? {
+		kind: "kinesisEnable",
+		streamArn: kinesis.streamArn
+	} : {
+		kind: "kinesisEnable",
+		streamArn: kinesis.streamArn,
+		precision: kinesis.precision
+	});
+	const tablePolicy = readTablePolicy(desired);
+	if (only.has("tablePolicy") && tablePolicy.kind === "usable" && live.hasTablePolicy === false) ops.push({
+		kind: "putTablePolicy",
+		document: tablePolicy.document
+	});
+	const streamPolicy = readStreamPolicy$1(desired);
+	if (only.has("streamPolicy") && streamPolicy.kind === "usable" && live.hasStreamPolicy === false) ops.push({
+		kind: "putStreamPolicy",
+		document: streamPolicy.document
+	});
+	return ops;
+}
+function declaredReplicaSettings(desired) {
+	const declared = /* @__PURE__ */ new Set();
+	if (readPitrSpec(desired?.["PointInTimeRecoverySpecification"]).kind === "usable") declared.add("pitr");
+	if (readContributorInsightsSpec(desired?.["ContributorInsightsSpecification"], CI_PATH).kind === "usable") declared.add("contributorInsights");
+	if (readKinesisSpec(desired?.["KinesisStreamSpecification"]).kind === "usable") declared.add("kinesis");
+	if (readTablePolicy(desired).kind === "usable") declared.add("tablePolicy");
+	if (readStreamPolicy$1(desired).kind === "usable") declared.add("streamPolicy");
+	return declared;
+}
+function enabledForReadStatus(status) {
+	if (status === "ENABLED" || status === "ENABLING") return true;
+	if (status === "DISABLED" || status === "DISABLING") return false;
+}
+function reverseMapReplicaPitr(status, recoveryPeriodInDays, declaredBlock) {
+	const enabled = enabledForReadStatus(status);
+	if (enabled === void 0) return void 0;
+	const block = { PointInTimeRecoveryEnabled: enabled };
+	if (!enabled) return block;
+	const declared = readPitrSpec(declaredBlock);
+	const period = recoveryPeriodInDays ?? (status === "ENABLING" ? (declared.kind === "usable" ? declared.recoveryPeriodInDays : void 0) ?? DEFAULT_RECOVERY_PERIOD_DAYS : void 0);
+	if (period !== void 0) block["RecoveryPeriodInDays"] = period;
+	return block;
+}
+function reverseMapReplicaContributorInsights(status, mode, declaredBlock) {
+	const enabled = enabledForReadStatus(status);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	const declared = readContributorInsightsSpec(declaredBlock, CI_PATH);
+	if (enabled && declared.kind === "usable" && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+const READBACK_5381_MEMBERS = [
+	"SSESpecification",
+	"TableClass",
+	"DeletionProtectionEnabled",
+	TABLE_POLICY_KEY,
+	REPLICA_STREAM_KEY
+];
+const READBACK_5381_NESTED = [[
+	PITR_KEY,
+	"RecoveryPeriodInDays",
+	"PointInTimeRecoveryEnabled"
+], [
+	CONTRIBUTOR_INSIGHTS_KEY,
+	"Mode",
+	"Enabled"
+]];
+function isPre5381ReplicaBaseline(baseline) {
+	if ("TableClass" in baseline || "DeletionProtectionEnabled" in baseline) return true;
+	const replicas = baseline["Replicas"];
+	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$1(r) && "KMSMasterKeyId" in r);
+}
+function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFromReadback = false) {
+	if (!isPre5381ReplicaBaseline(baseline)) return baseline;
+	const result = { ...baseline };
+	const topLevel = {};
+	for (const key of ["TableClass", "DeletionProtectionEnabled"]) if (key in result) {
+		topLevel[key] = result[key];
+		delete result[key];
+	}
+	const replicas = result["Replicas"];
+	if (!Array.isArray(replicas)) return result;
+	const awsReplicas = Array.isArray(aws["Replicas"]) ? aws["Replicas"] : [];
+	result["Replicas"] = replicas.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const region = element["Region"];
+		const entry = { ...element };
+		if (region === localRegion && localRegion !== "") {
+			for (const [key, value] of Object.entries(topLevel)) if (localFromReadback || !(key in entry)) entry[key] = value;
+		}
+		if ("KMSMasterKeyId" in entry) {
+			const key = entry["KMSMasterKeyId"];
+			delete entry["KMSMasterKeyId"];
+			if (!("SSESpecification" in entry)) entry["SSESpecification"] = { KMSMasterKeyId: key };
+		}
+		const live = awsReplicas.find((r) => isPlainObject$1(r) && r["Region"] === region);
+		if (live !== void 0) {
+			for (const member of READBACK_5381_MEMBERS) if (!(member in entry) && member in live) entry[member] = structuredClone(live[member]);
+			for (const [block, member, flag] of READBACK_5381_NESTED) {
+				const mine = entry[block];
+				const theirs = live[block];
+				if (isPlainObject$1(mine) && isPlainObject$1(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
+					...mine,
+					[member]: theirs[member]
+				};
+			}
+		}
+		return entry;
+	});
+	return result;
+}
+const UNREAD_REPLICA_MEMBERS = [
+	"TableClass",
+	"DeletionProtectionEnabled",
+	"SSESpecification"
+];
+function keepUnreadReplicaMembers(desired, previous) {
+	const replicas = desired["Replicas"];
+	const prevReplicas = previous["Replicas"];
+	if (!Array.isArray(replicas) || !Array.isArray(prevReplicas)) return desired;
+	const sse = desired["SSESpecification"];
+	const sseOn = isPlainObject$1(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
+	let changed = false;
+	const completed = replicas.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const live = prevReplicas.find((r) => isPlainObject$1(r) && r["Region"] === element["Region"]);
+		if (live === void 0) return element;
+		const entry = { ...element };
+		let touched = false;
+		for (const member of UNREAD_REPLICA_MEMBERS) {
+			if (member === "SSESpecification" && !sseOn) continue;
+			if (!(member in entry) && member in live) {
+				entry[member] = structuredClone(live[member]);
+				touched = true;
+			}
+		}
+		const pitr = entry[PITR_KEY];
+		const wantPitr = readPitrSpec(pitr);
+		const livePitr = readPitrSpec(live[PITR_KEY]);
+		if (isPlainObject$1(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
+			entry[PITR_KEY] = {
+				...pitr,
+				RecoveryPeriodInDays: livePitr.recoveryPeriodInDays
+			};
+			touched = true;
+		}
+		if (!touched) return element;
+		changed = true;
+		return entry;
+	});
+	return changed ? {
+		...desired,
+		Replicas: completed
+	} : desired;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-stream-members.ts
+const STREAM_SPECIFICATION_KEY$1 = "StreamSpecification";
+const STREAM_POLICY_KEY = "ResourcePolicy";
+const STREAM_TAGS_KEY = "Tags";
+const POLICY_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_POLICY_KEY}`;
+const TAGS_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_TAGS_KEY}`;
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function refusalOf(guard) {
+	try {
+		guard();
+		return;
+	} catch (error) {
+		return describeAwsFailure(error).detail;
+	}
+}
+function blockMembers(block) {
+	return isPlainObject(block) ? block : {};
+}
+function readStreamPolicy(block) {
+	const value = blockMembers(block)[STREAM_POLICY_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const containerRefusal = refusalOf(() => requireConfigObject(value, POLICY_PATH));
+	if (containerRefusal !== void 0) return {
+		kind: "unusable",
+		reason: containerRefusal
+	};
+	const documentPath = `${POLICY_PATH}.PolicyDocument`;
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${documentPath} must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (document === void 0 || document === null) return {
+		kind: "unusable",
+		reason: `${documentPath} is required when ${POLICY_PATH} is declared`
+	};
+	const documentRefusal = refusalOf(() => requireConfigObject(document, documentPath));
+	if (documentRefusal !== void 0) return {
+		kind: "unusable",
+		reason: documentRefusal
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+function readStreamTags(block) {
+	const value = blockMembers(block)[STREAM_TAGS_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!Array.isArray(value)) return {
+		kind: "unusable",
+		reason: `${TAGS_PATH} must be an array of {Key, Value} entries`
+	};
+	const tags = /* @__PURE__ */ new Map();
+	for (const [position, entry] of value.entries()) {
+		const entryPath = `${TAGS_PATH}[${position}]`;
+		const refusal = refusalOf(() => requireConfigObject(entry, entryPath)) ?? configStringRefusal(entry, "Key", "required", entryPath) ?? configStringRefusal(entry, "Value", "", entryPath);
+		if (refusal !== void 0) return {
+			kind: "unusable",
+			reason: refusal
+		};
+		const { Key: key, Value: tagValue } = entry;
+		if (typeof key !== "string") return {
+			kind: "unusable",
+			reason: `${entryPath}.Key is required`
+		};
+		tags.set(key, typeof tagValue === "string" ? tagValue : "");
+	}
+	return {
+		kind: "usable",
+		tags
+	};
+}
+function streamMemberRefusals(block) {
+	const refusals = [];
+	const policy = readStreamPolicy(block);
+	if (policy.kind === "unusable") refusals.push(policy.reason);
+	const tags = readStreamTags(block);
+	if (tags.kind === "unusable") refusals.push(tags.reason);
+	return refusals;
+}
+function planStreamMemberOps(desiredBlock, previousBlock, options, onUnusable) {
+	let desiredPolicy = readStreamPolicy(desiredBlock);
+	let desiredTags = readStreamTags(desiredBlock);
+	if (desiredPolicy.kind === "unusable") onUnusable(desiredPolicy.reason);
+	if (desiredTags.kind === "unusable") onUnusable(desiredTags.reason);
+	let previousPolicy = readStreamPolicy(previousBlock);
+	let previousTags = readStreamTags(previousBlock);
+	if (options.freshStream) {
+		if (desiredPolicy.kind === "unusable" && previousPolicy.kind === "usable") desiredPolicy = previousPolicy;
+		if (desiredTags.kind === "unusable" && previousTags.kind === "usable") desiredTags = previousTags;
+		previousPolicy = { kind: "absent" };
+		previousTags = { kind: "absent" };
+	} else if (options.contentsUnknown === true) {
+		previousPolicy = {
+			kind: "unusable",
+			reason: ""
+		};
+		previousTags = { kind: "absent" };
+	}
+	const tagOps = [];
+	if (desiredTags.kind !== "unusable") {
+		const desired = desiredTags.kind === "usable" ? desiredTags.tags : /* @__PURE__ */ new Map();
+		const previous = previousTags.kind === "usable" ? previousTags.tags : /* @__PURE__ */ new Map();
+		const keysToRemove = [...previous.keys()].filter((key) => !desired.has(key));
+		if (keysToRemove.length > 0) tagOps.push({
+			kind: "untag",
+			keys: keysToRemove
+		});
+		const tagsToSet = [...desired].filter(([key, value]) => previous.get(key) !== value).map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		if (tagsToSet.length > 0) tagOps.push({
+			kind: "tag",
+			tags: tagsToSet
+		});
+	}
+	const policyPut = desiredPolicy.kind === "usable" && !(previousPolicy.kind === "usable" && samePolicyDocument(previousPolicy.document, desiredPolicy.document));
+	const policyDelete = previousPolicy.kind !== "absent" && (desiredPolicy.kind === "absent" || policyPut && tagOps.length > 0);
+	const ops = [];
+	if (policyDelete) ops.push({ kind: "deletePolicy" });
+	ops.push(...tagOps);
+	if (policyPut && desiredPolicy.kind === "usable") ops.push({
+		kind: "putPolicy",
+		document: desiredPolicy.document
+	});
+	return ops;
+}
+function samePolicyDocument(left, right) {
+	if (left === right) return true;
+	try {
+		return canonicalJson(JSON.parse(left)) === canonicalJson(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+function streamDeclaresPolicy(desiredBlock) {
+	return readStreamPolicy(desiredBlock).kind === "usable";
+}
+function streamDeclaresTags(desiredBlock) {
+	return readStreamTags(desiredBlock).kind === "usable";
+}
+function reverseMapStreamPolicy(livePolicy, desiredBlock) {
+	if (livePolicy === void 0 || livePolicy === "") return void 0;
+	const declared = blockMembers(blockMembers(desiredBlock)[STREAM_POLICY_KEY])["PolicyDocument"];
+	let parsed;
+	try {
+		parsed = JSON.parse(livePolicy);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	if (typeof declared !== "string") return { PolicyDocument: parsed };
+	let declaredParsed;
+	try {
+		declaredParsed = JSON.parse(declared);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	return { PolicyDocument: canonicalJson(declaredParsed) === canonicalJson(parsed) ? declared : livePolicy };
+}
+function streamPolicyMatchesDeclared(livePolicy, desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	if (declared.kind !== "usable" || livePolicy === void 0) return false;
+	try {
+		return canonicalJson(JSON.parse(livePolicy)) === canonicalJson(JSON.parse(declared.document));
+	} catch {
+		return false;
+	}
+}
+function declaredStreamPolicyMember(desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	return declared.kind === "usable" ? reverseMapStreamPolicy(declared.document, desiredBlock) : void 0;
+}
+function declaredStreamTagsMember(desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	return declared.kind === "usable" ? [...declared.tags].map(([Key, Value]) => ({
+		Key,
+		Value
+	})) : void 0;
+}
+function streamTagsMatchDeclared(liveTags, desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	if (declared.kind !== "usable" || liveTags.length !== declared.tags.size) return false;
+	return liveTags.every((tag) => declared.tags.get(tag.Key) === tag.Value);
+}
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
 function isTableName(id) {
@@ -46590,15 +47445,19 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
-		if (properties["SSESpecification"]) {
-			const sse = properties["SSESpecification"];
-			const sseInput = { Enabled: sse["SSEEnabled"] !== void 0 ? Boolean(sse["SSEEnabled"]) : true };
-			if (sse["SSEType"]) sseInput.SSEType = sse["SSEType"];
-			createParams.SSESpecification = sseInput;
-		}
+		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
+		if (sseEnabledRefusal !== void 0) {
+			const onReplay = replayWarn(log, context).onUnusable;
+			if (!onReplay) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${sseEnabledRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
+			onReplay(`${sseEnabledRefusal}. Encryption is enabled, the block's default.`);
+		}
+		const replicaSettingRefusal = replicaSettingsRefusal(properties, void 0, currentRegion);
+		if (replicaSettingRefusal !== void 0 && !replayWarn(log, context).onUnusable) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${replicaSettingRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
+		if (properties["SSESpecification"]) createParams.SSESpecification = toSdkTableSseSpecification(properties["SSESpecification"], readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion)));
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
-		if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
+		const localTableClass = extractLocalTableClass(properties, currentRegion);
+		if (localTableClass !== void 0) createParams.TableClass = localTableClass;
 		const createCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 		const createOnDemand = {
 			...createCeilings.read.value !== void 0 && { MaxReadRequestUnits: createCeilings.read.value },
@@ -46641,18 +47500,15 @@ var DynamoDBGlobalTableProvider = class {
 				if (!replicaTags || replicaTags.length === 0) continue;
 				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, resourceType, logicalId, tableName, maskSecrets);
 			}
-			if (properties["TimeToLiveSpecification"]) {
-				const ttl = properties["TimeToLiveSpecification"];
-				const attributeName = ttl["AttributeName"];
-				const enabled = ttl["Enabled"] !== void 0 ? Boolean(ttl["Enabled"]) : true;
-				if (attributeName) await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
-					TableName: tableName,
-					TimeToLiveSpecification: {
-						Enabled: enabled,
-						AttributeName: attributeName
-					}
-				}));
-			}
+			await this.applyReplicaSettings(tableName, logicalId, currentRegion, wiringProperties, void 0, /* @__PURE__ */ new Set(), false, replayWarn(log, context).onUnusable !== void 0, /* @__PURE__ */ new Set(), void 0, warn, maskSecrets);
+			const createTtl = planTimeToLive(properties["TimeToLiveSpecification"], void 0, "create");
+			if (createTtl.kind === "enable") await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
+				TableName: tableName,
+				TimeToLiveSpecification: {
+					Enabled: true,
+					AttributeName: createTtl.attributeName
+				}
+			}));
 			if (billingMode === "PROVISIONED") try {
 				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(wiringProperties, currentRegion), currentRegion, void 0, maskSecrets);
 			} catch (autoScalingErr) {
@@ -46678,12 +47534,20 @@ var DynamoDBGlobalTableProvider = class {
 					const region = replica.RegionName;
 					if (!region || region === currentRegion) continue;
 					try {
+						const declared = readReplicaDeletionProtection(localReplicaEntry(wiringProperties, region), region);
+						try {
+							if ((declared === true ? await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName })) : void 0)?.Table?.DeletionProtectionEnabled === true) await this.setReplicaDeletionProtection(tableName, region, false, logicalId, maskSecrets);
+						} catch (flipError) {
+							if (isInterruptedWaitError(flipError)) throw flipError;
+							log.debug(`Partial-create cleanup: could not turn off deletion protection on the ${region} replica of ${log.value(tableName)}: ` + log.mask(describeAwsFailure(flipError).detail));
+						}
 						await this.dynamoDBClient.send(new UpdateTableCommand({
 							TableName: tableName,
 							ReplicaUpdates: [{ Delete: { RegionName: region } }]
 						}));
 						await this.waitForReplicaGone(tableName, region, logicalId, void 0, void 0, maskSecrets);
 					} catch (replicaCleanupErr) {
+						if (isInterruptedWaitError(replicaCleanupErr)) throw replicaCleanupErr;
 						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup: failed to drop replica ${region} on ${tableName}: `, replicaCleanupErr)} Run: ${pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName='${region}'}' --region ${currentRegion}`.render()}`);
 					}
 				}
@@ -46719,13 +47583,15 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics, maskSecrets = (text) => text) {
 		const create = { RegionName: region };
-		if (replica["KMSMasterKeyId"]) create.KMSMasterKeyId = replica["KMSMasterKeyId"];
+		const kmsMasterKeyId = readReplicaKmsMasterKeyId(replica);
+		if (kmsMasterKeyId !== void 0) create.KMSMasterKeyId = kmsMasterKeyId;
 		const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics, maskSecrets);
 		if (replicaIndexes) create.GlobalSecondaryIndexes = replicaIndexes;
 		const tableOverrides = toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		if (tableOverrides.ProvisionedThroughputOverride) create.ProvisionedThroughputOverride = tableOverrides.ProvisionedThroughputOverride;
 		if (tableOverrides.OnDemandThroughputOverride) create.OnDemandThroughputOverride = tableOverrides.OnDemandThroughputOverride;
-		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
+		const tableClass = readReplicaTableClass(replica);
+		if (tableClass !== void 0) create.TableClassOverride = tableClass;
 		const replicaUpdates = [{ Create: create }];
 		for (let attempt = 1;; attempt++) try {
 			await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -46739,6 +47605,481 @@ var DynamoDBGlobalTableProvider = class {
 			await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
 		}
 		await this.waitForReplicaActive(tableName, region, logicalId, void 0, maskSecrets);
+		if (readReplicaDeletionProtection(replica, region, (message) => this.logger.warn(maskSecrets(message))) === true) await this.setReplicaDeletionProtection(tableName, region, true, logicalId, maskSecrets);
+	}
+	async setReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, budget) {
+		await this.sendReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, { budget });
+		await this.waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget);
+	}
+	async sendReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, opts = {}) {
+		await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, {
+			...opts,
+			region
+		});
+		await this.writeReplicaDeletionProtection(tableName, region, enabled);
+	}
+	async writeReplicaDeletionProtection(tableName, region, enabled) {
+		await this.getRegionalClient(region).send(new UpdateTableCommand({
+			TableName: tableName,
+			DeletionProtectionEnabled: enabled
+		}));
+	}
+	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget) {
+		const wait = beginDeleteWait(60, budget);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} deletion-protection change on ${tableName}`));
+		try {
+			while (wait.nextPoll()) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				const replica = await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }));
+				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table.DeletionProtectionEnabled === enabled) {
+					if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+				}
+				await new Promise((resolve) => setTimeout(resolve, REPLICA_PROTECTION_SETTLE_POLL_MS));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+	}
+	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, desiredFromReadback, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === currentRegion || addedRegions.has(region)) continue;
+			const declared = readReplicaDeletionProtection(replica, region, warn);
+			if (declared === UNUSABLE) continue;
+			if (declared === void 0 && desiredFromReadback) continue;
+			const previous = readReplicaDeletionProtection(localReplicaEntry(previousProperties, region), region);
+			const newDpe = declared ?? false;
+			const oldDpe = previous === UNUSABLE ? void 0 : previous ?? false;
+			if (oldDpe !== void 0 && newDpe !== oldDpe) {
+				if (oldDpe && declared === void 0) warn(`Auto-disabling DeletionProtectionEnabled on the ${region} replica of ${tableName}: the template no longer sets it for that replica. Set it to false explicitly to silence this warning.`);
+				await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
+				continue;
+			}
+			if (declared === void 0) continue;
+			let live;
+			try {
+				live = (await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.DeletionProtectionEnabled;
+			} catch (readError) {
+				this.logger.debug(maskSecrets(`Could not read DeletionProtectionEnabled on the ${region} replica of ${tableName}: ` + describeAwsFailure(readError).detail));
+			}
+			if (typeof live === "boolean" && live !== newDpe) await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
+		}
+	}
+	async convergeReplicaSettings(tableName, logicalId, currentRegion, properties, addedRegions, maskSecrets) {
+		const kept = (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map(asRecord).filter((r) => typeof r?.["Region"] === "string" && r["Region"] !== currentRegion && !addedRegions.has(r["Region"]));
+		if (kept.every((r) => readReplicaTableClass(r) === void 0)) return;
+		let liveReplicas;
+		let sourceClass;
+		try {
+			const described = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+			liveReplicas = described.Table?.Replicas;
+			sourceClass = described.Table?.TableClassSummary?.TableClass;
+		} catch (readError) {
+			this.logger.debug(maskSecrets(`Could not read the replicas of ${tableName} to converge their table class: ` + describeAwsFailure(readError).detail));
+			return;
+		}
+		for (const replica of kept) {
+			const region = replica["Region"];
+			const live = liveReplicas?.find((r) => r.RegionName === region);
+			if (!live) continue;
+			const tableClass = readReplicaTableClass(replica);
+			if (tableClass === void 0) continue;
+			if (tableClass === (live.ReplicaTableClassSummary?.TableClass ?? sourceClass ?? "STANDARD")) {
+				this.logger.debug(maskSecrets(`The ${region} replica of ${tableName} already holds its declared table class`));
+				continue;
+			}
+			this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared table class`));
+			try {
+				await this.dynamoDBClient.send(new UpdateTableCommand({
+					TableName: tableName,
+					ReplicaUpdates: [{ Update: {
+						RegionName: region,
+						TableClassOverride: tableClass
+					} }]
+				}));
+				await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+			} catch (convergeError) {
+				if (isInterruptedWaitError(convergeError)) throw convergeError;
+				this.logger.debug(maskSecrets(`Could not bring the ${region} replica of ${tableName} to its declared table class: ` + describeAwsFailure(convergeError).detail));
+				this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold its declared TableClass, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+			}
+		}
+	}
+	async applyReplicaKeys(tableName, logicalId, currentRegion, properties, previousProperties, addedRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets) {
+		if (!(properties["SSESpecification"] !== void 0 && configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification") === void 0 && toSdkTableSseSpecification(properties["SSESpecification"], void 0).Enabled)) return;
+		const declared = /* @__PURE__ */ new Map();
+		for (const entry of Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region === "string") declared.set(region, readReplicaKmsMasterKeyId(replica));
+		}
+		if ([...declared.values()].every((key) => key === void 0)) return;
+		const replicaKeyChanged = [...declared].some(([region, key]) => region !== currentRegion && key !== void 0 && !addedRegions.has(region) && key !== readReplicaKmsMasterKeyId(localReplicaEntry(previousProperties, region)));
+		let liveKeys;
+		try {
+			liveKeys = await this.readLiveKeys(tableName, currentRegion);
+		} catch (readError) {
+			if (replicaKeyChanged || deferredSseFromTemplate || keylessSseFromTemplate) throw readError;
+			this.logger.debug(maskSecrets(`Could not read the KMS keys of ${tableName} to converge them: ` + describeAwsFailure(readError).detail));
+			return;
+		}
+		const templateChanged = replicaKeyChanged || keylessSseFromTemplate && [...declared].some(([region, key]) => region !== currentRegion && key !== void 0) || deferredSseFromTemplate && declared.get(currentRegion) !== liveKeys.get(currentRegion);
+		let request;
+		if (liveKeys.size < 2) {
+			if (deferredSseUpdate === void 0) return;
+			request = {
+				TableName: tableName,
+				SSESpecification: deferredSseUpdate
+			};
+		} else {
+			const built = this.replicaKeysRequest(tableName, logicalId, liveKeys, declared, templateChanged, maskSecrets);
+			if (built === void 0) return;
+			request = built;
+		}
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand(request));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		} catch (keyError) {
+			if (templateChanged || isInterruptedWaitError(keyError)) throw keyError;
+			this.logger.debug(maskSecrets(`Could not bring the KMS keys of ${tableName} to the declared ones: ` + describeAwsFailure(keyError).detail));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared KMS keys, and setting them failed (${describeAwsFailure(keyError).summary}). The next deploy that updates this table tries again.`));
+		}
+	}
+	async readLiveKeys(tableName, currentRegion) {
+		const described = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+		const keys = /* @__PURE__ */ new Map([[currentRegion, described.Table?.SSEDescription?.KMSMasterKeyArn]]);
+		for (const r of described.Table?.Replicas ?? []) if (r.RegionName !== void 0 && r.RegionName !== currentRegion) keys.set(r.RegionName, r.KMSMasterKeyId);
+		return keys;
+	}
+	replicaKeysRequest(tableName, logicalId, liveKeys, declared, templateChanged, maskSecrets) {
+		const drifted = [...liveKeys].some(([region, live]) => {
+			const key = declared.get(region);
+			return isKmsKeyArn(key) && key !== live;
+		});
+		if (!templateChanged && !drifted) {
+			this.logger.debug(maskSecrets(`Every region of ${tableName} already holds its declared KMS key`));
+			return;
+		}
+		const entries = [...liveKeys].map(([region, live]) => ({ Update: {
+			RegionName: region,
+			KMSMasterKeyId: declared.get(region) ?? live
+		} }));
+		const keyless = entries.filter((e) => e.Update.KMSMasterKeyId === void 0);
+		if (keyless.length > 0) {
+			const text = `The KMS keys of ${tableName} were not changed: DynamoDB takes every region's key in one call, and no key is declared or reported for ${keyless.map((e) => e.Update.RegionName).join(", ")}`;
+			if (templateChanged) throw new ProvisioningError(maskSecrets(`${text}. Declare a key for every replica`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+			this.logger.warn(maskSecrets(`${text}.`));
+			return;
+		}
+		this.logger.debug(maskSecrets(`Setting the KMS key of every region of ${tableName} in one ReplicaUpdates call`));
+		return {
+			TableName: tableName,
+			ReplicaUpdates: entries
+		};
+	}
+	async applyReplicaSettings(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, streamReplaced, replaying, keepOnRemoval, previousLocalStreamArn, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const fresh = previousProperties === void 0 || freshRegions.has(region);
+			const previous = previousProperties === void 0 ? void 0 : localReplicaEntry(previousProperties, region);
+			const ops = planReplicaSettingOps(replica, previous, {
+				fresh,
+				streamReplaced,
+				keepOnRemoval
+			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
+			if (!fresh && keepOnRemoval.has("pitr") && replica?.["PointInTimeRecoverySpecification"] == null && (() => {
+				const prior = readPitrSpec(previous?.["PointInTimeRecoverySpecification"]);
+				return prior.kind === "usable" && prior.enabled;
+			})()) warn(`The ${region} replica of ${tableName}: point-in-time recovery was not turned off, although the properties being applied (a rollback's recorded state, or a drift --revert read-back) declare none — turning it off would delete every recovery point. Turn it off by hand if that is intended.`);
+			const unchanged = fresh ? /* @__PURE__ */ new Set() : declaredReplicaSettings(replica);
+			for (const op of ops) unchanged.delete(settingOf(op));
+			if (ops.length === 0 && unchanged.size === 0) continue;
+			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, { ...region !== currentRegion && { region } });
+			let arns;
+			const describe = async () => {
+				if (arns === void 0) {
+					const described = await client.send(new DescribeTableCommand({ TableName: tableName }));
+					arns = {
+						...described.Table?.TableArn !== void 0 && { tableArn: described.Table.TableArn },
+						...described.Table?.LatestStreamArn !== void 0 && { streamArn: described.Table.LatestStreamArn }
+					};
+				}
+				return arns;
+			};
+			for (const op of ops) try {
+				await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			} catch (error) {
+				if (!replaying || !fresh || op.kind !== "putTablePolicy" || isInterruptedWaitError(error)) throw error;
+				warn(`The ${region} replica of ${tableName} was created without its ResourcePolicy: ${describeAwsFailure(error).summary}. The next deploy that updates this table puts it.`);
+			}
+			const priorStreamPolicy = readStreamPolicy$1(previous);
+			const desiredStreamPolicy = readStreamPolicy$1(replica);
+			const streamPolicyChanged = priorStreamPolicy.kind !== "absent" && desiredStreamPolicy.kind !== "unusable" && !(desiredStreamPolicy.kind === "absent" && keepOnRemoval.has("streamPolicy")) && !(priorStreamPolicy.kind === "usable" && desiredStreamPolicy.kind === "usable" && samePolicyDocument$1(priorStreamPolicy.document, desiredStreamPolicy.document));
+			if (region === currentRegion && streamReplaced && previousLocalStreamArn !== void 0 && streamPolicyChanged && (await describe()).streamArn !== previousLocalStreamArn) await this.deleteOldStreamPolicy(client, previousLocalStreamArn, tableName, warn, maskSecrets);
+			if (unchanged.size === 0) continue;
+			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets);
+			for (const op of planReplicaSettingCorrections(replica, live, unchanged)) {
+				const member = SETTING_MEMBER[settingOf(op)];
+				this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared ${member}`));
+				try {
+					await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+				} catch (convergeError) {
+					if (isInterruptedWaitError(convergeError)) throw convergeError;
+					this.logger.debug(maskSecrets(`Could not bring the ${region} replica of ${tableName} to its declared ${member}: ` + describeAwsFailure(convergeError).detail));
+					this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold its declared ${member}, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+				}
+			}
+		}
+	}
+	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets) {
+		const live = {};
+		const attempt = async (what, read) => {
+			try {
+				await read();
+			} catch (readError) {
+				this.logger.debug(maskSecrets(`Could not read ${what} of the ${region} replica of ${tableName}: ` + describeAwsFailure(readError).detail));
+			}
+		};
+		if (wanted.has("pitr")) await attempt("point-in-time recovery", async () => {
+			const pitr = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const status = pitr?.PointInTimeRecoveryStatus;
+			if (status === "ENABLED" || status === "DISABLED") live.pitr = {
+				enabled: status === "ENABLED",
+				...pitr?.RecoveryPeriodInDays !== void 0 && { recoveryPeriodInDays: pitr.RecoveryPeriodInDays }
+			};
+		});
+		if (wanted.has("contributorInsights")) await attempt("Contributor Insights", async () => {
+			const status = (await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }))).ContributorInsightsStatus;
+			if (status === "ENABLED" || status === "ENABLING") live.contributorInsightsEnabled = true;
+			else if (status === "DISABLED" || status === "DISABLING") live.contributorInsightsEnabled = false;
+		});
+		if (wanted.has("kinesis")) await attempt("the Kinesis streaming destination", async () => {
+			live.kinesisStreamArns = await this.activeKinesisStreamArns(client, tableName);
+		});
+		const hasPolicy = async (arn) => {
+			if (arn === void 0) return void 0;
+			try {
+				await client.send(new GetResourcePolicyCommand({ ResourceArn: arn }));
+				return true;
+			} catch (error) {
+				if (error instanceof PolicyNotFoundException) return false;
+				throw error;
+			}
+		};
+		if (wanted.has("tablePolicy")) await attempt("the resource policy", async () => {
+			const answer = await hasPolicy((await describe()).tableArn);
+			if (answer !== void 0) live.hasTablePolicy = answer;
+		});
+		if (wanted.has("streamPolicy")) await attempt("the stream resource policy", async () => {
+			const answer = await hasPolicy((await describe()).streamArn);
+			if (answer !== void 0) live.hasStreamPolicy = answer;
+		});
+		return live;
+	}
+	async deleteOldStreamPolicy(client, streamArn, tableName, warn, maskSecrets) {
+		try {
+			await this.retrySettlingRefusal(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the policy of the retired stream of ${tableName}`, maskSecrets);
+		} catch (error) {
+			if (isInterruptedWaitError(error)) throw error;
+			if (error instanceof PolicyNotFoundException || error instanceof ResourceNotFoundException$1) return;
+			warn(`The previous stream of ${tableName} (retired by the StreamViewType change) keeps its old resource policy until it expires: deleting it failed (${describeAwsFailure(error).summary}).`);
+		}
+	}
+	async kinesisStreaming(client, tableName, streamArn, refusal) {
+		if (isInterruptedWaitError(refusal)) throw refusal;
+		try {
+			return (await this.activeKinesisStreamArns(client, tableName)).has(streamArn);
+		} catch {
+			throw refusal;
+		}
+	}
+	async activeKinesisStreamArns(client, tableName) {
+		const out = await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }));
+		return new Set((out.KinesisDataStreamDestinations ?? []).filter((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING").flatMap((d) => d.StreamArn !== void 0 ? [d.StreamArn] : []));
+	}
+	async sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets) {
+		const scope = `the ${region} replica of ${tableName}`;
+		const arnFor = async (which) => {
+			const arn = (await describe())[which];
+			if (arn === void 0 || arn === "") throw new ProvisioningError(maskSecrets(`Cannot apply ${SETTING_MEMBER[settingOf(op)]} to ${scope}: DescribeTable returned no ${which === "tableArn" ? "TableArn" : "LatestStreamArn (the table has no stream)"}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+			return arn;
+		};
+		const send = (call) => this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		switch (op.kind) {
+			case "pitr":
+				await send(() => client.send(new UpdateContinuousBackupsCommand({
+					TableName: tableName,
+					PointInTimeRecoverySpecification: {
+						PointInTimeRecoveryEnabled: op.enabled,
+						...op.recoveryPeriodInDays !== void 0 && { RecoveryPeriodInDays: op.recoveryPeriodInDays }
+					}
+				})));
+				break;
+			case "contributorInsights":
+				await send(() => client.send(new UpdateContributorInsightsCommand({
+					TableName: tableName,
+					ContributorInsightsAction: op.action,
+					...op.mode !== void 0 && { ContributorInsightsMode: op.mode }
+				})));
+				break;
+			case "kinesisEnable":
+				if (await this.activeKinesisStreamArns(client, tableName).then((arns) => arns.has(op.streamArn), () => false)) break;
+				try {
+					await send(() => client.send(new EnableKinesisStreamingDestinationCommand({
+						TableName: tableName,
+						StreamArn: op.streamArn,
+						...op.precision !== void 0 && { EnableKinesisStreamingConfiguration: { ApproximateCreationDateTimePrecision: op.precision } }
+					})));
+				} catch (error) {
+					if (!await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
+				}
+				break;
+			case "kinesisDisable":
+				try {
+					await send(() => client.send(new DisableKinesisStreamingDestinationCommand({
+						TableName: tableName,
+						StreamArn: op.streamArn
+					})));
+				} catch (error) {
+					if (await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
+				}
+				break;
+			case "kinesisPrecision":
+				await send(() => client.send(new UpdateKinesisStreamingDestinationCommand({
+					TableName: tableName,
+					StreamArn: op.streamArn,
+					UpdateKinesisStreamingConfiguration: { ApproximateCreationDateTimePrecision: op.precision }
+				})));
+				break;
+			case "putTablePolicy":
+			case "putStreamPolicy": {
+				const arn = await arnFor(op.kind === "putTablePolicy" ? "tableArn" : "streamArn");
+				await send(() => client.send(new PutResourcePolicyCommand({
+					ResourceArn: arn,
+					Policy: op.document
+				})));
+				break;
+			}
+			case "deleteTablePolicy":
+			case "deleteStreamPolicy": {
+				if (op.kind === "deleteStreamPolicy" && (await describe()).streamArn === void 0) break;
+				const arn = await arnFor(op.kind === "deleteTablePolicy" ? "tableArn" : "streamArn");
+				try {
+					await send(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: arn })));
+				} catch (error) {
+					if (!(error instanceof PolicyNotFoundException)) throw error;
+				}
+				break;
+			}
+		}
+		this.logger.debug(maskSecrets(`Applied ${op.kind} to ${scope}`));
+	}
+	async retrySettlingRefusal(call, label, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB ${label}`));
+		try {
+			let delayMs = SETTLING_RETRY_INITIAL_MS;
+			for (let attempt = 1;; attempt++) try {
+				await call();
+				return;
+			} catch (error) {
+				const detail = describeAwsFailure(error).detail;
+				const name = error instanceof Error ? error.name : "";
+				if (!(/being enabled|being updated|please retry later|backups are being/i.test(detail) || name === "ResourceInUseException" || name === "LimitExceededException") || attempt >= 8) throw error;
+				this.logger.debug(maskSecrets(`Transient refusal of ${label} (attempt ${attempt}/${8}): ${detail} - retrying in ${delayMs}ms`));
+				await new Promise((resolve) => setTimeout(resolve, delayMs));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				delayMs = Math.min(delayMs * 2, 3e4);
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
+	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		} catch (error) {
+			if (fromTemplate || isInterruptedWaitError(error)) throw error;
+			this.logger.debug(maskSecrets(`Could not bring the ${what} of ${tableName} to the declared one: ` + describeAwsFailure(error).detail));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}). The next deploy that updates this table tries again.`));
+		}
+	}
+	async waitForGlobalTableSettled(tableName, logicalId, maskSecrets, opts = {}) {
+		const wait = beginDeleteWait(opts.maxPolls ?? 600, opts.budget);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB global table ${tableName} settling after an update`));
+		try {
+			while (wait.nextPoll()) {
+				if (opts.interruptible !== false && watch.isInterrupted()) throw watch.onInterrupted();
+				const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
+				if (table?.TableStatus === "ACTIVE" && table.SSEDescription?.Status !== "UPDATING" && (table.Replicas ?? []).every((r) => r.ReplicaStatus === "ACTIVE")) {
+					if (opts.region === void 0) return;
+					if ((await this.getRegionalClient(opts.region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
+				}
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new ProvisioningError(maskSecrets(`Table ${tableName} and its replicas did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+	}
+	async dropReplicaForDelete(tableName, region, removeProtection, logicalId, budget, maskSecrets) {
+		let flippedOff = false;
+		if (removeProtection) {
+			try {
+				if ((await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }))).Table?.DeletionProtectionEnabled === true) {
+					await this.sendReplicaDeletionProtection(tableName, region, false, logicalId, maskSecrets, { budget });
+					flippedOff = true;
+				}
+			} catch (flipError) {
+				if (isInterruptedWaitError(flipError)) throw flipError;
+				this.logger.debug(maskSecrets(`Could not disable DeletionProtectionEnabled on the ${region} replica of ${tableName}: ` + describeAwsFailure(flipError).detail));
+			}
+			if (flippedOff) try {
+				await this.waitForReplicaProtectionSettled(tableName, region, false, logicalId, maskSecrets, budget);
+			} catch (waitError) {
+				await this.restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, isInterruptedWaitError(waitError) ? "the destroy was interrupted" : "its deletion-protection change did not settle");
+				throw waitError;
+			}
+		}
+		try {
+			await this.dynamoDBClient.send(new UpdateTableCommand({
+				TableName: tableName,
+				ReplicaUpdates: [{ Delete: { RegionName: region } }]
+			}));
+		} catch (dropError) {
+			if (flippedOff) await this.restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, "it could not be dropped");
+			throw dropError;
+		}
+	}
+	async restoreReplicaDeletionProtection(tableName, region, logicalId, maskSecrets, reason) {
+		for (let attempt = 1;; attempt++) try {
+			if (attempt === 1) await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, {
+				region,
+				maxPolls: 60,
+				interruptible: false
+			}).catch(() => void 0);
+			await this.writeReplicaDeletionProtection(tableName, region, true);
+			return;
+		} catch (restoreError) {
+			if (attempt === 1 && restoreError instanceof Error && restoreError.name === "ThrottlingException") {
+				await new Promise((resolve) => setTimeout(resolve, DELETION_PROTECTION_REFLIP_MS));
+				continue;
+			}
+			try {
+				this.logger.debug(maskSecrets(`Could not restore DeletionProtectionEnabled on the ${region} replica of ${tableName}: ${describeAwsFailure(restoreError).detail}`));
+				const head = maskSecrets(`The ${region} replica of ${tableName} was not deleted (${reason}), and its deletion protection, which this destroy turned off, could not be turned back on (${describeAwsFailure(restoreError).summary}). It is LEFT UNPROTECTED. To restore it, run: `);
+				const command = pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --deletion-protection-enabled --region ${region}`.render();
+				this.logger.warn(safeMsg`${head}${command}`);
+			} catch {}
+			return;
+		}
 	}
 	async waitForRegionalCopyReleased(tableName, region, maskSecrets) {
 		const client = this.getRegionalClient(region);
@@ -46768,6 +48109,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback === true) properties = keepUnreadReplicaMembers(properties, previousProperties);
 		const log = this.operationSinks(context, [[properties["TableName"], physicalId], [previousProperties["TableName"], physicalId]]);
 		const maskSecrets = log.mask;
 		const warn = log.warn;
@@ -46782,6 +48124,18 @@ var DynamoDBGlobalTableProvider = class {
 			} catch {
 				guardRegion = "";
 			}
+			const protectedReplica = guardRegion === "" || extractLocalDeletionProtection(previousProperties, guardRegion) === true ? void 0 : (Array.isArray(previousProperties["Replicas"]) ? previousProperties["Replicas"] : []).map(asRecord).find((r) => typeof r?.["Region"] === "string" && r["Region"] !== guardRegion && coerceCfnBoolean(r["DeletionProtectionEnabled"]) === true)?.["Region"];
+			if (typeof protectedReplica === "string") return protectedReplacementAdvice({
+				evidence: `cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the ${protectedReplica} replica`,
+				replaceFlags,
+				disable: {
+					before: "aws dynamodb update-table --table-name",
+					identifier: physicalId,
+					after: "--no-deletion-protection-enabled",
+					caveat: "Run it with --region set to that replica's region.",
+					maskSecrets
+				}
+			});
 			return extractLocalDeletionProtection(previousProperties, guardRegion) === true ? protectedReplacementAdvice({
 				evidence: "cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the deploy region",
 				replaceFlags,
@@ -46819,8 +48173,13 @@ var DynamoDBGlobalTableProvider = class {
 				refuse(describeAwsFailure(error).detail, error);
 			}
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
+			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
+			if (refusal === void 0) refusal = replicaSettingsRefusal(properties, previousProperties);
 			if (refusal !== void 0) refuse(refusal);
+		} else {
+			const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
+			if (sseEnabledRefusal !== void 0) warn(`${sseEnabledRefusal}. Encryption is treated as enabled, the block's default.`);
 		}
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		let effectiveProperties;
@@ -46884,28 +48243,38 @@ var DynamoDBGlobalTableProvider = class {
 				toSdkReplicaThroughputOverrides(replica, newBilling, diagnostics, {}, maskSecrets);
 			}
 			this.reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets);
+			let deferredSseUpdate;
+			let deferredSseFromTemplate = false;
+			let keylessSseFromTemplate = false;
 			const newDpe = extractLocalDeletionProtection(properties, currentRegion);
 			const oldDpe = extractLocalDeletionProtection(previousProperties, currentRegion);
 			const awsDpe = describeResp.Table?.DeletionProtectionEnabled;
 			const flatUpdate = { TableName: physicalId };
 			let flatChanged = false;
+			let tableClassUpdate;
+			let sseUpdate;
+			let sseFromTemplate = false;
+			let tableClassFromTemplate = false;
 			if (newDpe !== oldDpe || newDpe !== void 0 && typeof awsDpe === "boolean" && Boolean(newDpe) !== awsDpe) {
 				if ((oldDpe === true || awsDpe === true) && Boolean(newDpe ?? false) === false && !(newDpe !== void 0)) warn(`Auto-disabling DeletionProtectionEnabled on ${physicalId}: the CDK code does not set 'deletionProtection: true' but AWS has it enabled. AWS will accept DeleteTable on this resource after this deploy. If you meant to keep protection on, set 'deletionProtection: true' in your CDK code; if you meant to disable it explicitly, set 'deletionProtection: false' to silence this warning.`);
 				flatUpdate.DeletionProtectionEnabled = Boolean(newDpe ?? false);
 				flatChanged = true;
 			}
-			if (properties["TableClass"] !== void 0 && properties["TableClass"] !== previousProperties["TableClass"]) {
-				flatUpdate.TableClass = properties["TableClass"];
-				flatChanged = true;
-			}
-			if (properties["SSESpecification"] !== void 0 && !deepEqual(properties["SSESpecification"], previousProperties["SSESpecification"])) {
-				const sse = properties["SSESpecification"];
-				flatUpdate.SSESpecification = {
-					Enabled: sse["SSEEnabled"] !== void 0 ? Boolean(sse["SSEEnabled"]) : true,
-					...sse["SSEType"] !== void 0 && { SSEType: sse["SSEType"] }
-				};
-				flatChanged = true;
-			}
+			const tableClassChange = tableClassToSend(extractLocalTableClass(previousProperties, currentRegion), extractLocalTableClass(properties, currentRegion));
+			const declaredTableClass = extractLocalTableClass(properties, currentRegion);
+			const liveTableClass = describeResp.Table?.TableClassSummary?.TableClass ?? "STANDARD";
+			if (tableClassChange !== void 0) {
+				tableClassUpdate = tableClassChange;
+				tableClassFromTemplate = true;
+			} else if (declaredTableClass !== void 0 && declaredTableClass !== liveTableClass) tableClassUpdate = declaredTableClass;
+			const newLocalKmsKey = readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion));
+			if (properties["SSESpecification"] !== void 0 && (!deepEqual(properties["SSESpecification"], previousProperties["SSESpecification"]) || newLocalKmsKey !== readReplicaKmsMasterKeyId(localReplicaEntry(previousProperties, currentRegion)))) {
+				sseUpdate = toSdkTableSseSpecification(properties["SSESpecification"], newLocalKmsKey);
+				sseFromTemplate = true;
+			} else if (properties["SSESpecification"] === void 0 && previousProperties["SSESpecification"] !== void 0 && toSdkTableSseSpecification(previousProperties["SSESpecification"], void 0).Enabled) {
+				sseUpdate = { Enabled: false };
+				sseFromTemplate = true;
+			} else if (isKmsKeyArn(newLocalKmsKey) && properties["SSESpecification"] !== void 0 && configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification") === void 0 && toSdkTableSseSpecification(properties["SSESpecification"], void 0).Enabled && describeResp.Table?.SSEDescription?.KMSMasterKeyArn !== newLocalKmsKey) sseUpdate = toSdkTableSseSpecification(properties["SSESpecification"], newLocalKmsKey);
 			if (properties["StreamSpecification"] !== void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) {
 				let streamSpecUnusable = false;
 				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
@@ -46969,6 +48338,21 @@ var DynamoDBGlobalTableProvider = class {
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			if (tableClassUpdate !== void 0) await this.sendLocalSettingUpdate({
+				TableName: physicalId,
+				TableClass: tableClassUpdate
+			}, tableClassFromTemplate, "TableClass", physicalId, logicalId, maskSecrets);
+			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
+			if (sseUpdate?.KMSMasterKeyId !== void 0 && liveHasCrossRegionReplica) {
+				deferredSseUpdate = sseUpdate;
+				deferredSseFromTemplate = sseFromTemplate;
+			} else if (sseUpdate !== void 0) {
+				await this.sendLocalSettingUpdate({
+					TableName: physicalId,
+					SSESpecification: sseUpdate
+				}, sseFromTemplate, "encryption", physicalId, logicalId, maskSecrets);
+				keylessSseFromTemplate = sseFromTemplate && sseUpdate.KMSMasterKeyId === void 0 && liveHasCrossRegionReplica;
+			}
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (oldBilling !== newBilling) {
 				const billingUpdate = {
@@ -47081,7 +48465,6 @@ var DynamoDBGlobalTableProvider = class {
 					}));
 				}
 				const updateAction = { RegionName: region };
-				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
 				const replicaIndexes = toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], newBilling, void 0, maskSecrets);
 				if (replicaIndexes) updateAction.GlobalSecondaryIndexes = replicaIndexes;
 				const replicaOverrides = toSdkReplicaThroughputOverrides(replica, newBilling, void 0, {}, maskSecrets);
@@ -47094,8 +48477,9 @@ var DynamoDBGlobalTableProvider = class {
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
 					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING. The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
-				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
-				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
+				const replicaTableClassChange = tableClassToSend(readReplicaTableClass(oldReplica), readReplicaTableClass(replica));
+				if (replicaTableClassChange !== void 0) updateAction.TableClassOverride = replicaTableClassChange;
+				if (!(updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
 					debug(`Cross-region replica ${region} of ${maskSecrets(physicalId)}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
@@ -47105,6 +48489,17 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
+			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
+			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, context?.desiredFromAwsReadback === true, warn, maskSecrets);
+			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
+			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
+			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, new Set(context?.desiredFromAwsReadback === true ? [
+				"pitr",
+				"contributorInsights",
+				"kinesis",
+				"tablePolicy",
+				"streamPolicy"
+			] : context?.replayingState === true ? ["pitr"] : []), describeResp.Table?.LatestStreamArn, warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -47202,28 +48597,39 @@ var DynamoDBGlobalTableProvider = class {
 					try {
 						await this.dynamoDBClient.send(cmd);
 					} catch (ttlErr) {
-						if (describeAwsFailure(ttlErr).detail.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						const msg = describeAwsFailure(ttlErr).detail;
+						if (cmd.input.TimeToLiveSpecification?.Enabled === false && isTtlAlreadyDisabled(msg)) {
+							this.logger.debug(maskSecrets(`TimeToLive already disabled on ${physicalId}`));
+							return;
+						}
+						if (msg.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table (the interval can last up to about an hour); wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
-				const ttl = properties["TimeToLiveSpecification"];
-				if (ttl?.["AttributeName"]) await sendTtl(new UpdateTimeToLiveCommand({
+				const ttlPlan = planTimeToLive(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"], "update");
+				let ttlTarget;
+				if (ttlPlan.kind === "enable" || ttlPlan.kind === "disable") ttlTarget = {
+					enabled: ttlPlan.kind === "enable",
+					attributeName: ttlPlan.attributeName
+				};
+				else if (ttlPlan.kind === "disable-live") {
+					let live;
+					await this.retrySettlingRefusal(async () => {
+						live = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
+					}, `TimeToLive read on ${physicalId}`, maskSecrets);
+					const status = live?.TimeToLiveStatus;
+					if ((status === "ENABLED" || status === "ENABLING") && live?.AttributeName) ttlTarget = {
+						enabled: false,
+						attributeName: live.AttributeName
+					};
+				}
+				if (ttlTarget) await sendTtl(new UpdateTimeToLiveCommand({
 					TableName: physicalId,
 					TimeToLiveSpecification: {
-						Enabled: ttl["Enabled"] !== void 0 ? Boolean(ttl["Enabled"]) : true,
-						AttributeName: ttl["AttributeName"]
+						Enabled: ttlTarget.enabled,
+						AttributeName: ttlTarget.attributeName
 					}
 				}));
-				else if (previousProperties["TimeToLiveSpecification"]) {
-					const prevTtl = previousProperties["TimeToLiveSpecification"];
-					if (prevTtl["AttributeName"]) await sendTtl(new UpdateTimeToLiveCommand({
-						TableName: physicalId,
-						TimeToLiveSpecification: {
-							Enabled: false,
-							AttributeName: prevTtl["AttributeName"]
-						}
-					}));
-				}
 			}
 			const finalDescribe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const impliedStream = replicationImpliedStreamSpecification(properties);
@@ -47579,10 +48985,7 @@ var DynamoDBGlobalTableProvider = class {
 				try {
 					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget, void 0, progress);
 					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget, void 0, progress);
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						ReplicaUpdates: [{ Delete: { RegionName: region } }]
-					}));
+					await this.dropReplicaForDelete(physicalId, region, context?.removeProtection === true, logicalId, budget, deleteMask);
 					progress.stripped = true;
 					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
 				} catch (replicaErr) {
@@ -47709,7 +49112,8 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
+		const afterOwnWrite = context?.afterOwnWrite === true;
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			if (!table) return void 0;
@@ -47729,21 +49133,37 @@ var DynamoDBGlobalTableProvider = class {
 				if (table.SSEDescription.SSEType !== void 0) sse["SSEType"] = table.SSEDescription.SSEType;
 				result["SSESpecification"] = sse;
 			}
-			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
-			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 			const tableNameForSubs = table.TableName ?? physicalId;
 			const sdkReplicas = table.Replicas && table.Replicas.length > 0 ? currentRegion && !table.Replicas.some((r) => r.RegionName === currentRegion) ? [...table.Replicas, { RegionName: currentRegion }] : table.Replicas : [{ RegionName: currentRegion }];
 			const replicas = await Promise.all(sdkReplicas.map(async (r) => {
 				const entry = { Region: r.RegionName };
-				if (r.KMSMasterKeyId !== void 0) entry["KMSMasterKeyId"] = r.KMSMasterKeyId;
 				if (!r.RegionName) return entry;
 				const isLocal = r.RegionName === currentRegion;
+				const kmsKey = isLocal ? table.SSEDescription?.Status === "ENABLED" ? table.SSEDescription.KMSMasterKeyArn : void 0 : r.KMSMasterKeyId;
+				if (kmsKey !== void 0 && kmsKey !== "") entry["SSESpecification"] = { KMSMasterKeyId: kmsKey };
+				entry["TableClass"] = (isLocal ? void 0 : r.ReplicaTableClassSummary?.TableClass) ?? table.TableClassSummary?.TableClass ?? "STANDARD";
+				const declaredReplica = properties ? localReplicaEntry(properties, r.RegionName) : void 0;
 				const client = isLocal ? this.dynamoDBClient : this.getRegionalClient(r.RegionName);
 				const regionLabel = r.RegionName;
 				const replicaArn = isLocal ? table.TableArn : table.TableArn ? this.replicaArnForRegion(table.TableArn, r.RegionName) : void 0;
-				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel);
+				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel, declaredReplica);
 				Object.assign(entry, subs);
+				let protection;
+				let streamArn;
+				if (isLocal) {
+					protection = table.DeletionProtectionEnabled;
+					streamArn = table.LatestStreamArn;
+				} else try {
+					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
+					protection = regional.Table?.DeletionProtectionEnabled;
+					streamArn = regional.Table?.LatestStreamArn;
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) this.logger.debug(safeMsg`Cross-region replica ${regionLabel} returned RNF on DescribeTable; omitting its protection and stream policy`);
+					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
+				}
+				if (typeof protection === "boolean") entry["DeletionProtectionEnabled"] = protection;
+				await this.readReplicaPolicies(client, tableNameForSubs, regionLabel, replicaArn, streamArn, declaredReplica, afterOwnWrite, entry);
 				if (replicaArn) try {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
 					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
@@ -47828,17 +49248,19 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readReplicaSubSpecs(client, tableName, regionLabel) {
+	async readReplicaSubSpecs(client, tableName, regionLabel, declaredReplica) {
 		const out = {};
 		try {
 			const ci = await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }));
-			if (ci.ContributorInsightsStatus) out["ContributorInsightsSpecification"] = { Enabled: ci.ContributorInsightsStatus === "ENABLED" };
+			const block = reverseMapReplicaContributorInsights(ci.ContributorInsightsStatus, ci.ContributorInsightsMode, declaredReplica?.["ContributorInsightsSpecification"]);
+			if (block !== void 0) out["ContributorInsightsSpecification"] = block;
 		} catch (err) {
 			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
-			const pitrStatus = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus;
-			if (pitrStatus) out["PointInTimeRecoverySpecification"] = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
+			const description = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const block = reverseMapReplicaPitr(description?.PointInTimeRecoveryStatus, description?.RecoveryPeriodInDays, declaredReplica?.["PointInTimeRecoverySpecification"]);
+			if (block !== void 0) out["PointInTimeRecoverySpecification"] = block;
 		} catch (err) {
 			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
@@ -47854,6 +49276,54 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		return out;
 	}
+	policyRereadDelaysMs = [
+		500,
+		1e3,
+		2e3
+	];
+	async readReplicaPolicies(client, tableName, regionLabel, tableArn, streamArn, declaredReplica, afterOwnWrite, entry) {
+		if (declaredReplica === void 0) return;
+		const readOne = async (what, arn, container) => {
+			if (arn === void 0 || arn === "") return void 0;
+			const declaredMember = () => declaredStreamPolicyMember(container);
+			let last;
+			const read = async () => {
+				try {
+					last = (await client.send(new GetResourcePolicyCommand({ ResourceArn: arn }))).Policy;
+				} catch (err) {
+					if (!(err instanceof PolicyNotFoundException)) throw err;
+					last = void 0;
+				}
+				return last;
+			};
+			try {
+				let live = await read();
+				for (const delayMs of afterOwnWrite ? this.policyRereadDelaysMs : []) {
+					if (streamPolicyMatchesDeclared(live, container)) break;
+					await new Promise((resolve) => setTimeout(resolve, delayMs));
+					live = await read();
+				}
+				if (afterOwnWrite && (live === void 0 || live === "")) {
+					this.logger.debug(safeMsg`Kept the declared ${what} of the ${regionLabel} replica of ${tableName} in the baseline captured after its write: the read still found no policy`);
+					return declaredMember();
+				}
+				return reverseMapStreamPolicy(live, container);
+			} catch (err) {
+				this.logger.debug(safeMsg`Could not read the ${what} of the ${regionLabel} replica of ${tableName}: ${describeAwsFailure(err).detail}`);
+				if (afterOwnWrite && last !== void 0 && last !== "") return reverseMapStreamPolicy(last, container);
+				if (afterOwnWrite && (isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1)) return declaredMember();
+				return;
+			}
+		};
+		if (readTablePolicy(declaredReplica).kind === "usable") {
+			const member = await readOne("ResourcePolicy", tableArn, declaredReplica);
+			if (member !== void 0) entry["ResourcePolicy"] = member;
+		}
+		if (readStreamPolicy$1(declaredReplica).kind === "usable") {
+			const member = await readOne("stream ResourcePolicy", streamArn, declaredReplica["ReplicaStreamSpecification"]);
+			if (member !== void 0) entry["ReplicaStreamSpecification"] = { ResourcePolicy: member };
+		}
+	}
 	async readAutoScalingSettings(tableName, scalableDimension, client, indexName) {
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
@@ -47933,33 +49403,14 @@ var DynamoDBGlobalTableProvider = class {
 			baseline,
 			aws
 		};
-		const key = "Replicas";
-		const baselineReplicas = baseline[key];
-		const awsReplicas = aws[key];
-		if (!Array.isArray(baselineReplicas) || !Array.isArray(awsReplicas)) return {
-			baseline,
-			aws
-		};
 		const localRegion = await this.dynamoDBClient.config.region() ?? "";
-		if (!localRegion) return {
+		const completed = completeLegacyLocalReplica(baseline, aws, localRegion);
+		const converted = canonicalizePre5381ReplicaBaseline(completed, aws, localRegion, completed !== baseline);
+		return converted === baseline ? {
 			baseline,
 			aws
-		};
-		const isLocal = (element) => asRecord(element)?.["Region"] === localRegion;
-		if (baselineReplicas.some(isLocal)) return {
-			baseline,
-			aws
-		};
-		const liveLocal = awsReplicas.find(isLocal);
-		if (liveLocal === void 0) return {
-			baseline,
-			aws
-		};
-		return {
-			baseline: {
-				...baseline,
-				[key]: [...baselineReplicas, structuredClone(liveLocal)]
-			},
+		} : {
+			baseline: converted,
 			aws
 		};
 	}
@@ -48094,17 +49545,102 @@ function refuseMalformedReplicaTags(properties, resourceType, logicalId, physica
 	});
 	return tagsByReplica;
 }
+function completeLegacyLocalReplica(baseline, aws, localRegion) {
+	const key = "Replicas";
+	const baselineReplicas = baseline[key];
+	const awsReplicas = aws[key];
+	if (!Array.isArray(baselineReplicas) || !Array.isArray(awsReplicas)) return baseline;
+	if (!localRegion) return baseline;
+	const isLocal = (element) => asRecord(element)?.["Region"] === localRegion;
+	if (baselineReplicas.some(isLocal)) return baseline;
+	const liveLocal = awsReplicas.find(isLocal);
+	if (liveLocal === void 0) return baseline;
+	return {
+		...baseline,
+		[key]: [...baselineReplicas, structuredClone(liveLocal)]
+	};
+}
 function localReplicaEntry(props, region) {
 	const raw = props["Replicas"];
 	if (!Array.isArray(raw)) return void 0;
 	return raw.find((r) => r?.["Region"] === region);
 }
+const REPLICA_SETTING_MEMBERS = [
+	"PointInTimeRecoverySpecification",
+	"ContributorInsightsSpecification",
+	"KinesisStreamSpecification",
+	"ResourcePolicy",
+	"ReplicaStreamSpecification"
+];
+function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
+	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
+		const region = asRecord(entry)?.["Region"];
+		return typeof region === "string" && region !== currentRegion;
+	});
+	for (const entry of desired) {
+		const replica = asRecord(entry);
+		const region = replica?.["Region"];
+		if (typeof region !== "string") continue;
+		const previous = previousProperties === void 0 ? void 0 : localReplicaEntry(previousProperties, region);
+		if (!(previous === void 0 || REPLICA_SETTING_MEMBERS.some((member) => !deepEqual(replica?.[member], previous[member])))) continue;
+		const [refusal] = replicaSettingRefusals(replica);
+		if (refusal !== void 0) return `The ${region} replica: ${refusal}`;
+		if ((previousProperties === void 0 ? crossRegionCreate : previous === void 0) && replica?.["ResourcePolicy"] !== void 0 && replica["ResourcePolicy"] !== null) return `The ${region} replica: Replicas[].ResourcePolicy cannot be set in the deploy that creates the replica — CloudFormation refuses it ("A replica cannot be created in the same stack update as putting a resource-based policy on that new replica"). ` + (previousProperties === void 0 ? `Deploy the table and its replicas without it` : `Deploy the replica without it`) + `, then add the policy in a later deploy`;
+	}
+}
 function extractLocalDeletionProtection(props, region) {
-	const perReplica = localReplicaEntry(props, region)?.["DeletionProtectionEnabled"];
-	if (typeof perReplica === "boolean") return perReplica;
+	const local = localReplicaEntry(props, region);
+	const perReplica = coerceCfnBoolean(local?.["DeletionProtectionEnabled"]);
+	if (perReplica !== void 0) return perReplica;
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
 }
+function extractAnyDeletionProtection(props, region) {
+	if ((Array.isArray(props["Replicas"]) ? props["Replicas"] : []).some((r) => coerceCfnBoolean(asRecord(r)?.["DeletionProtectionEnabled"]) === true)) return true;
+	return extractLocalDeletionProtection(props, region);
+}
+function readReplicaKmsMasterKeyId(replica) {
+	const key = asRecord(asRecord(replica)?.["SSESpecification"])?.["KMSMasterKeyId"];
+	return typeof key === "string" && key !== "" ? key : void 0;
+}
+function readReplicaTableClass(replica) {
+	const tableClass = asRecord(replica)?.["TableClass"];
+	return typeof tableClass === "string" && tableClass !== "" ? tableClass : void 0;
+}
+const UNUSABLE = Symbol("unusable");
+function readReplicaDeletionProtection(replica, region, warn) {
+	const refusal = configBooleanRefusal(replica, "DeletionProtectionEnabled", `AWS::DynamoDB::GlobalTable Replicas[${region}]`);
+	if (refusal !== void 0) {
+		warn?.(`${refusal}. The ${region} replica's deletion protection is left as it is.`);
+		return UNUSABLE;
+	}
+	return coerceCfnBoolean(replica?.["DeletionProtectionEnabled"]);
+}
+function replicaKeyBlocks(props) {
+	return (Array.isArray(props["Replicas"]) ? props["Replicas"] : []).map((r) => [asRecord(r)?.["Region"], asRecord(r)?.["SSESpecification"]]);
+}
+function isKmsKeyArn(key) {
+	return key !== void 0 && /^arn:aws[a-z-]*:kms:[^:]+:\d+:key\//.test(key);
+}
+function tableClassToSend(previous, desired) {
+	if (desired !== void 0) return desired !== previous ? desired : void 0;
+	return previous !== void 0 && previous !== "STANDARD" ? "STANDARD" : void 0;
+}
+function toSdkTableSseSpecification(block, kmsMasterKeyId) {
+	const sse = asRecord(block) ?? {};
+	return {
+		Enabled: coerceCfnBoolean(sse["SSEEnabled"]) ?? true,
+		...sse["SSEType"] !== void 0 && sse["SSEType"] !== "" && { SSEType: sse["SSEType"] },
+		...kmsMasterKeyId !== void 0 && { KMSMasterKeyId: kmsMasterKeyId }
+	};
+}
+function extractLocalTableClass(props, region) {
+	const perReplica = readReplicaTableClass(localReplicaEntry(props, region));
+	if (perReplica !== void 0) return perReplica;
+	const topLevel = props["TableClass"];
+	return typeof topLevel === "string" && topLevel !== "" ? topLevel : void 0;
+}
 function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics, maskSecrets = (text) => text) {
 	const rawReplicas = properties["Replicas"];
 	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
@@ -48182,6 +49718,11 @@ function collectAutoScalingTargets(properties, localRegion) {
 }
 const REPLICA_COPY_RELEASE_POLLS = 180;
 const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
+const DELETION_PROTECTION_REFLIP_MS = 16e3;
+const REPLICA_PROTECTION_SETTLE_POLLS = 60;
+const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
+const SETTLING_RETRY_ATTEMPTS = 8;
+const SETTLING_RETRY_INITIAL_MS = 2e3;
 const REPLICA_COPY_RELEASE_ATTEMPTS = 3;
 function isReplicaCopyExistsRefusal(error) {
 	return error instanceof Error && /one or more replicas already existed as tables/i.test(error.message);
@@ -48837,7 +50378,7 @@ const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Neptune::DBCluster": "DeletionProtection",
 	"AWS::Neptune::DBInstance": "DeletionProtection",
 	"AWS::DynamoDB::Table": "DeletionProtectionEnabled",
-	"AWS::DynamoDB::GlobalTable": (bag, region) => extractLocalDeletionProtection(bag, region ?? ""),
+	"AWS::DynamoDB::GlobalTable": (bag, region) => extractAnyDeletionProtection(bag, region ?? ""),
 	"AWS::EC2::Instance": "DisableApiTermination",
 	"AWS::Cognito::UserPool": "DeletionProtection",
 	"AWS::AutoScaling::AutoScalingGroup": "DeletionProtection",
@@ -48886,7 +50427,7 @@ function isProtectionValueActive(resourceType, value) {
 //#endregion
 //#region src/provisioning/recorded-protection.ts
 const READER_LABELS = {
-	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled for the deploy region",
+	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled on the table or a replica",
 	"AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancerAttributes deletion_protection.enabled"
 };
 const REPLACEMENT_BLOCKING_VALUES = { "AWS::AutoScaling::AutoScalingGroup": /* @__PURE__ */ new Set(["prevent-all-deletion"]) };
@@ -52089,5 +53630,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { pendingRequestCount as $, malformedLocalResourceEntriesWarning as $a, hasReasonlessBaselineRefusal as $c, keepHeldTokenProvenance as $i, getLegacyStateBucketName as $l, destroyStackRecordsView as $n, NO_CC_HANDLERS_REASON as $o, markDeleteStarted as $r, literalSplitDelimitersOf as $s, seedsDeleteFirstGuard as $t, inheritedProvenanceForChildDiff as A, refStateLookupFromResource as Aa, recordNoEchoAttributeValues as Ac, deleteSkipReason as Ai, buildDockerImage as Al, isWholeDynamicReferenceValue as An, refuseMalformedResourceEntriesForOrphan as Ao, secretNamePrintingBags as Ar, TemplateParser as As, readRefactorMarkerOnce as At, hasPlainPrototype$1 as Au, conditionFingerprint as B, UNREADABLE_RESOURCES_MAP_ROW as Ba, CrossPrefixReadError as Bc, DiffCalculator as Bi, isMalformedEnvKey as Bl, findDestructiveChanges as Bn, repairMalformedOrphansForReadOnly as Bo, effectiveDeletionPolicy as Br, passedNoEchoParametersOf as Bs, replayFailedOperations as Bt, clearBucketRegionCache as Bu, hasCdkAutoDeleteTag as C, carriesFetchableDynamicReference as Ca, recordAttributeIdCopy as Cc, CloudControlProvider as Ci, getBootstrapMarkerKey as Cl, exportAliasCollisionScrubWarning as Cn, refuseMalformedOutputsForDestroy as Co, createReadOnlyAttributeHealerFactory as Cr, templateResourceTypes as Cs, sameJournaledOrphans as Ct, StageLoadError as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, cfnRefValueFromPhysicalId as Da, provenPublicValue as Dc, UNSPECIFIED_SKIP_REASON as Di, validateAssetBucketName as Dl, carriedExportAliasExposure as Dn, refuseMalformedResourceEntriesForDestroy as Do, namingSecretsWithRecordedNoEcho as Dr, lambdaFunctionNameForMask as Ds, lookupEachName as Dt, utf8ByteLength as Du, markRefusedBeforeApplying as E, AWS_NO_VALUE as Ea, carriesSecretMask as Ec, RollbackInlinePolicyWriters as Ei, readBootstrapMarkerBody as El, secretSafeKeyDisplay as En, refuseMalformedResourceEntriesForDeploy as Eo, maskEventTextWithBoundBags as Er, canonicalLambdaFunctionName as Es, isAccessDeniedError as Et, parseFailureDebugDetail as Eu, findNestedTemplateTreeDefect as F, declaresNoEcho as Fa, isSingleDynamicReferenceToken as Fc, ec2InstanceProtectionSite as Fi, dockerSpawnEnvWithSensitive as Fl, bindingSkippedOutputs as Fn, refuseMalformedResourcesForDeploy as Fo, ATOMIC_FINAL_SNAPSHOT_TYPES as Fr, maskWholeValue as Fs, updateRefactorMarker as Ft, displayAssemblyPath as Fu, withResourceDeadline as G, hasReadableOutputs as Ga, isNotImplemented as Gc, s3BucketArn as Gi, runDockerForeground as Gl, rollbackOrphanIds as Gn, unpreviewableOrphanRecords as Go, ledgerForStack as Gr, liveMatchesUnresolvedTokenFrame as Gs, isJournaledOrphan as Gt, parentSuppliedValues as H, deployRefusesOrphanRowsReason as Ha, applyCrossPrefixScan as Hc, IntrinsicFunctionResolver as Hi, redactDockerArgvValues as Hl, findRefactorHints as Hn, repairMalformedResourceEntriesForReadOnly as Ho, refusesFinalSnapshot as Hr, readsNoEchoSource as Hs, removeProtectionTypeList as Ht, isAbsoluteAssetPath as I, JSON_LISTING_HOLE_VALUE as Ia, LockManager as Ic, isTerminationProtectionPropagationError as Ii, finchSecretArgvRefusal as Il, DEFAULT_RESOURCE_TIMEOUT_MS as In, refuseMalformedResourcesForDestroy as Io, PRE_DELETE_SNAPSHOT_TYPES as Ir, maskedLeafCoordinatesOf as Is, hasPendingMovesOut as It, renderAssemblyPathEscape as Iu, keptWholeReasonText as J, isReadableResourceEntry as Ja, splitImportedOps as Jc, s3BucketRegionalDomainName as Ji, AssetManifestLoader as Jl, looselyEqual as Jn, withheldAccountClause as Jo, acquireIdempotencyToken as Jr, recordReferenceProvenanceEntry as Js, planRollback as Jt, diffSecurity as K, hasReadableResources as Ka, stackInstanceIdOf as Kc, s3BucketDomainName as Ki, runDockerStreaming as Kl, withMovedTo as Kn, unreadableOrphanRecords as Ko, reserveStackCreateToken as Kr, markSameGenerationBag as Ks, isReplacementOrphan as Kt, listNestedTemplateRows as L, STATE_REGION_DIVERGED as La, isLockInfoExpired as Lc, observeThenDisableInstanceApiTermination as Li, formatDockerLoginError as Ll, DEFAULT_RESOURCE_WARN_AFTER_MS as Ln, refuseMalformedResourcesForExport as Lo, buildFinalSnapshotIdentifier as Lr, noEchoCoordinatesOf as Ls, pendingMovesOutOf as Lt, resolveAssemblyPath as Lu, findServiceTokenRefusals as M, withSharedDrainBudget as Ma, recordProvenPublicExpression as Mc, isWaitAbandonedError as Mi, describeDockerCapturedOutput as Ml, collectDeclaredOutputNames as Mn, refuseMalformedResourcePropertiesForDrift as Mo, secretNamedRecordNeedles as Mr, isMarkedCoordinate as Ms, refactorMarkerRefusalMessage as Mt, ownValue as Mu, serviceTokenBlockingReason as N, parameterInputsFor as Na, wholeStringLeavesOf as Nc, markWaitAbandoned as Ni, describeDockerExecFailure as Nl, collectPublishedOutputNames as Nn, refuseMalformedResourcePropertiesForExport as No, stateSecretNameNeedles as Nr, maskAtCoordinates as Ns, refuseRefactorMarker as Nt, absoluteAssemblyPathEscape as Nu, computeImplicitDeleteEdges as O, isStalePlaceholderArnAttribute as Oa, recordMaskOnlyValue as Oc, deleteIndeterminateGuards as Oi, validateContainerRepoName as Ol, exportNameNoEchoParameters as On, refuseMalformedResourceEntriesForImport as Oo, orphanRecordsPrintingBag as Or, sameLambdaFunctionAddress as Os, withApiLimit as Ot, defineOwnKey as Ou, childTemplateLoader as P, passedParameterClassesOf as Pa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Pc, disableInstanceApiTermination as Pi, describeDockerFailure as Pl, isExportAliasCollision as Pn, refuseMalformedResourcePropertiesForOrphan as Po, storedSecretNameNeedles as Pr, maskReadbackAtCoordinates as Ps, sameMove as Pt, describeFileReadFailure as Pu, planOrphanAdoption as Q, malformedLocalOutputsWarning as Qa, hasReadableExportSet as Qc, refuseUnreadableCdkCrossAccountRefs as Qi, getDefaultStateBucketName as Ql, awaitInFlightSibling as Qn, withoutSilentDropProperties as Qo, isRefusedByName as Qr, hasMaskableValues as Qs, resolveReplacementOldType as Qt, renderNestedTemplateTreeDefect as R, STATE_RESOURCES_MALFORMED as Ra, S3StateBackend as Rc, reDisableInstanceApiTermination as Ri, getDockerCmd as Rl, maskingRetryLogger as Rn, refuseMalformedState as Ro, ccRoutedFinalSnapshotError as Rr, noEchoLeavesOf as Rs, pendingMovesRefusalMessage as Rt, injectAwsRegion as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, carriesDynamicReference as Sa, physicalNameCopiesOf as Sc, customResourceResponseExpirationWarning as Si, ensureAssetStorage as Sl, displayTextOrWithheld as Sn, refuseMalformedOutputs as So, noEchoParameterNamesOf as Sr, prefetchCreateOnlyPropertyPaths as Ss, makeForeignHolderScan as St, AssemblyReader as Su, getPriorAttempts as T, keepsSecretReferenceToken as Ta, splitGetAttStringForm as Tc, unchangedBehindSecretReference as Ti, parseBootstrapMarker as Tl, secretBearingStateKeyWarning as Tn, refuseMalformedResourceEntries as To, journaledOrphanPrintingBag as Tr, withRetry as Ts, chunks as Tt, describeJsonParseFailure as Tu, readRecordedConditionVerdicts as U, displayLogicalId as Ua, crossPrefixDeniedWarning as Uc, poisonRenderedSpellingsCollidingIn as Ui, redactedCause as Ul, hintSidesOf as Un, repairMalformedResourcePropertiesForReadOnly as Uo, unsupportedFinalSnapshotError as Ur, recordedNoEchoValuesOf as Us, recordAfterRollbackUpdate as Ut, conditionInputsFrom as V, accountArgs as Va, CrossPrefixScanCache as Vc, INTRINSIC_KEYS as Vi, partitionSensitiveEnv as Vl, formatDestructiveChange as Vn, repairMalformedOutputsForReadOnly as Vo, isFinalSnapshotError as Vr, readbackPathFor as Vs, replayRollback as Vt, resolveBucketRegion as Vu, enclosingDeadlineRemainingMs as W, hasReadableOrphans as Wa, isAccessDenied$1 as Wc, isSettledInstanceState as Wi, redactedDockerCause as Wl, movedToHint as Wn, repairMalformedResourcesForReadOnly as Wo, earliestDefined as Wr, valueAtCoordinate as Ws, demoteSupersededOrphans as Wt, makeCanonicalizePropertiesFn as X, malformedExportNamesWarning as Xa, describeRegionValueKind as Xc, resolveDynamicReferences as Xi, Synthesizer as Xl, parseMappingFile as Xn, findSilentDropProperties as Xo, DeploymentEventsStore as Xr, carryLogOnlyValues as Xs, recordUnderIdIsNotOwn as Xt, mergeNoChangeOutputs as Y, malformedDriftResourcePropertiesWarning as Ya, acceptedCreateOnlyDropsOf as Yc, s3BucketWebsiteUrl as Yi, getDockerImageBySourceHash as Yl, mappingPairs as Yn, findActionableSilentDrops as Yo, DeploymentEventsReader as Yr, snapshotPassProvenance as Ys, recheckFailedPlan as Yt, makeSiblingClaimReader as Z, malformedExportSourceWarning as Za, exportNamesCarriedFrom as Zc, producerLookupOver as Zi, synthesisStatusMessage as Zl, proposeRenames as Zn, unwrittenCreateOnlyReplacement as Zo, extractDeploymentEventError as Zr, createUnionSecretMasker as Zs, replacementNeverSwapped as Zt, deleteTableWithIndexBusyRetry as _, coerceParameterTypedValue as _a, spelledKeysOf as _c, isCustomResourceType as _i, loadPublishableAssetManifest as _l, computeParameterTaint as _n, refuseMalformedOrphanRecords as _o, supersededResourcesOf as _r, readConfigString as _s, dropFailedCommands as _t, decodeListingKey as _u, isProtectionValueActive as a, assertSendableRoleArn as aa, unionOfSecretBags as ac, tagMapAsList as ai, orphansCarriedFrom as al, isRedactedRecordedValue as an, malformedOrphansWarning as ao, gray as ar, isStatefulRecreateTargetSync as as, displacedPhysicalIdShown as at, resolveStateBucketWithDefault as au, waitForIndexesSettled as b, getAccountInfo as ba, recordNestedStackParameterExpressions as bc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as bi, BOOTSTRAP_MARKER_PREFIX as bl, resourcesNamingDeclaredParameter as bn, refuseMalformedOrphansForDestroy as bo, noEchoComparisonForTemplate as br, requireConfigObject as bs, journaledOrphanLines as bt, canonicalizeRegion as bu, DynamoDBGlobalTableProvider as c, sendableAssumeRoleCommand as ca, maskSecretsInError as cc, stringifyIfAssigned as ci, PhaseClock as cl, updatePartialMessage as cn, malformedRenderedContainersWarning as co, yellow as cr, coerceWarmThroughput as cs, nestedChildStackName as ct, stateBucketExistenceConfirmed as cu, compensateRemovedDeletionProtection as d, callerEnvCredentials as da, withPhysicalNameCopies as dc, ccBrokenReason as di, AssetPublisher as dl, nameGenerationHighWaterOf as dn, malformedResourcesWarning as do, holdsSupersededResources as dr, toFiniteNumber as ds, revertedNestedRowIds as dt, CFN_TEMPLATE_BODY_LIMIT as du, outputReferenceProvenanceOf as ea, logOnlyValueCount as ec, DBPROXY_TAGS_WHAT as ei, hasUnverifiableParameterRefusal as el, orphanNeedsIdentity as en, malformedLocalResourcesWarning as eo, getStackRecords as er, hasNoCloudControlHandlers as es, resolvePendingCloudControlRequests as et, loadCdkJson as eu, deleteBudgetKey as f, envCredentialsAreAssumedRole as fa, withoutPhysicalNameCopies as fc, isCustomResource as fi, isSensitiveAttributeName as fl, nameScopeOf as fn, malformedScrubResourceEntriesRefusalMessage as fo, isSupersededResourceRecord as fr, coerceCfnBoolean as fs, withNestedRevertRun as ft, CFN_TEMPLATE_URL_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, regionLessSecretName as ga, pathCrossesDottedKey as gc, readsNoEchoDeleteValues as gi, createAssetRedirectResolver as gl, withNameGenerationReached as gn, refuseMalformedNestedChildOutputs as go, supersededHolderOf as gr, configStringRefusal as gs, deleteJournaledOrphans as gt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, producerRegionsFromState as ha, isUncertifiedBaselineMaskPosition as hc, TemplateNoEchoReresolver as hi, buildAssetRedirectMap as hl, retiredNameGenerationsLeaving as hn, refuseDivergentRecordRegionForDestroy as ho, supersededHeldByOtherTypeWarning as hr, configIntegerRefusal as hs, withNestedStackContext as ht, uploadCfnTemplate as hu, PROTECTION_PROPERTY_BY_TYPE as i, assertFlagRoleArn as ia, shareLogOnlyValues as ic, refuseMalformedDesiredTags as ii, orphansAfterRollback as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, malformedOrphansRefusalMessage as io, cyan as ir, isStatefulRecreateTargetForReplace as is, displacedOpClause as it, resolveSkipPrefix as iu, deferredServiceTokenWarning as j, parseWebACLArn as ja, recordNoEchoParameterFreshValue as jc, withIndeterminateGuard as ji, resolveDockerContextDirectory as jl, noEchoParameterValueSeed as jn, refuseMalformedResourcePropertiesForDestroy as jo, secretNamedAttributeNamesOf as jr, canonicalCoordinates as js, refactorMarkerMovesOf as jt, nullPrototypeRecord as ju, crossStackOutputProvenanceSource as k, lacksRecordedTableArn as ka, recordMaskOnlyValuesIn as kc, deleteLeftInPlace as ki, buildDenyExternalAccessPolicy as kl, exportNameSecretExposure as kn, refuseMalformedResourceEntriesForImportSave as ko, secretNamePrintingBag as kr, DagBuilder as ks, readRefactorMarker as kt, hasOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, AWS_CREDENTIAL_ENV_KEYS as la, maskSecretsInText as lc, CC_BROKEN_REASON as li, renderPhaseTimings as ll, updatePartialReason as ln, malformedResourceEntriesWarning as lo, addSuperseded as lr, isWarmThroughputDecrease as ls, recordDisplacedSkips as lt, warnDeprecatedNoPrefixCliFlag as lu, resolveDynamoDbDeleteBudgetMs as m, classifyReplaySecretRegion as ma, dynamicReferenceTokens as mc, waitForLambdaFunctionActive as mi, WorkGraph as ml, retiredNameGenerationsAfter as mn, previewableOrphanRecords as mo, supersededAfterRollback as mr, configBooleanRefusal as ms, getCurrentNestedStackContext as mt, findLargeInlineResources as mu, recordedProtectionEvidence as n, recordedReferenceRegions as na, recordLogOnlyParameterValue as nc, planTagDiff as ni, importableOutputs as nl, getCurrentProducerRegions as nn, malformedOrphanRecordsWarning as no, replacedDeleteFailureVerdict as nr, shownType as ns, recordRetainedForReadoption as nt, resolveAutoAssetStorage as nu, perType as o, explicitRoleArnOrThrow as oa, createSecretMasker as oc, tagPlanWarning as oi, shouldRetainResource as ol, redactedDeleteAddressFields as on, malformedOutputsRefusalMessage as oo, green as or, renderStatefulReason as os, dropSettledNestedJournals as ot, resolveStateBucketWithDefaultAndSource as ou, resolveDynamoDbDeleteBudgetClock as p, classifyRecordedSecretRegion as pa, DYNAMIC_REFERENCE_TOKEN_SCAN as pc, wouldReturnToSdkProvider as pi, stringifyValue as pl, retiredAfterRollback as pn, malformedStateRefusalMessage as po, removeSuperseded as pr, coerceCfnInteger as ps, collectNestedChildUnaddressed as pt, MIGRATE_TMP_PREFIX as pu, isSecretBearingReferenceString as q, isReadableOrphanRecord as qa, withStackInstanceIdWithheld as qc, s3BucketDualStackDomainName as qi, warnFinchArgvExposure as ql, isPairableType as qn, unreadableResourceEntries as qo, withCreateTokenLedger as qr, redactForState as qs, planFailedOps as qt, recordedProtectionNote as r, applyRoleArnIfSet as ra, recordLogOnlyValue as rc, readTagList as ri, isReadableBag as rl, inheritProducerRegions as rn, malformedOrphanRowsKeptWarning as ro, bold as rr, MULTI_REGION_RECREATE_BLOCKED_TYPES as rs, NESTED_PENDING_PARENT_REASON as rt, resolveCaptureObservedState as ru, readProtection as s, isIamRoleArn as sa, errorCauseChain as sc, definedAttributes as si, stackInstanceIdCarriedFrom as sl, redactedDeleteAddressSkip as sn, malformedOutputsWarning as so, red as sr, WARM_THROUGHPUT_MEMBERS as ss, getNestedRevertRun as st, resolveUseCdkBootstrapAssets as su, DeployEngine as t, recordedOutputReferenceRegions as ta, printingCorpusOf as tc, DBPROXY_TAG_OPTIONS as ti, importableOutputKeys as tl, findNestedStackTypeChanges as tn, malformedOrphanRecordsRefusalMessage as to, withStackRecords as tr, findReplacedReadersOfRecreateTargets as ts, keptForRetainedRecord as tt, resolveApp as tu, beginDeleteWait as u, applyCallerIdentityCredentials as ua, scrubResourceRecord as uc, ProviderRegistry as ui, timePhase as ul, nameGenerationCarriedFrom as un, malformedResourcePropertiesWarning as uo, deleteSupersededEntry as ur, toCfnInteger as us, revertNestedChildFromJournal as ut, ssmResolvedValueType as uu, maskedLogger as v, isUnboundTemplateParameter as va, identityKeyFor as vc, getCurrentResourceSecrets as vi, rewriteTemplateAssetReferences as vl, namesAnyDeclaredParameter as vn, refuseMalformedOrphanRecordsForDestroy as vo, withoutSuperseded as vr, replayWarn as vs, dropFailedHint as vt, expectedOwnerParam as vu, isTruthyCfnBoolean as w, isNamelessDynamicReferenceError as wa, recordPhysicalNameCopy as wc, slowCcOperationTimeoutMs as wi, isCrossRegionRedirect as wl, secretBearing as wn, refuseMalformedResourceAttributesForOrphan as wo, completedReplayEntries as wr, describeTypeWithThrottleRetry as ws, formatResourceLine as wt, processStackMessages as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, isImpossibleEmptyStoredAttribute as xa, recoverMaskedOutput as xc, applyCustomResourceResponseExpiration as xi, assertAssetBucketRegion as xl, WITHHELD_NAME_DISPLAY as xn, refuseMalformedOrphansForOrphan as xo, noEchoExactEchoLeavesOf as xr, requireConfigString as xs, loadJournaledOrphans as xt, derivePartitionAndUrlSuffix as xu, relayedIndexBusyDelete as y, parameterTypeMayLoseSecretIdentity as ya, inheritNestedStackParameterAssociations as yc, withPrintingSecrets as yi, AssetModeResolver as yl, reachableDivergentParameters as yn, refuseMalformedOrphans as yo, noEchoAttributeNamesOf as yr, requireConfigArray as ys, isHandledOrphan as yt, PARTITION_TABLE as yu, templateIdentity as z, UNREADABLE_ORPHANS_CONTAINER_ROW as za, rebuildClientForBucketRegion as zc, reEnableInstanceApiTermination as zi, isDockerClientEnvKey as zl, constructPathOf as zn, repairMalformedOrphanRecordsForReadOnly as zo, createPreDeleteFinalSnapshot as zr, noEchoOutputsComparison as zs, refusePendingMovesOut as zt, injectedAwsRegionValue as zu };
-//# sourceMappingURL=deploy-engine-Bjr-FAuZ.js.map
+export { inheritedProvenanceForChildDiff as $, isStalePlaceholderArnAttribute as $a, carriesSecretMask as $c, deleteIndeterminateGuards as $i, readBootstrapMarkerBody as $l, exportNameSecretExposure as $n, refuseMalformedResourceEntriesForImport as $o, secretNamePrintingBag as $r, canonicalLambdaFunctionName as $s, readRefactorMarker as $t, parseFailureDebugDetail as $u, beginDeleteWait as A, assertSendableRoleArn as Aa, recordLogOnlyValue as Ac, tagPlanWarning as Ai, isReadableBag as Al, redactedDeleteAddressFields as An, malformedOrphansWarning as Ao, green as Ar, isStatefulRecreateTargetSync as As, dropSettledNestedJournals as At, resolveCaptureObservedState as Au, waitForIndexesSettled as B, producerRegionsFromState as Ba, DYNAMIC_REFERENCE_TOKEN_SCAN as Bc, readsNoEchoDeleteValues as Bi, stringifyValue as Bl, withNameGenerationReached as Bn, refuseDivergentRecordRegionForDestroy as Bo, supersededHolderOf as Br, configIntegerRefusal as Bs, deleteJournaledOrphans as Bt, MIGRATE_TMP_PREFIX as Bu, planContributorInsightsOp as C, refuseUnreadableCdkCrossAccountRefs as Ca, carryLogOnlyValues as Cc, markDeleteStarted as Ci, describeRegionValueKind as Cl, seedsDeleteFirstGuard as Cn, malformedLocalOutputsWarning as Co, destroyStackRecordsView as Cr, withoutSilentDropProperties as Cs, pendingRequestCount as Ct, Synthesizer as Cu, reverseMapTableContributorInsights as D, recordedReferenceRegions as Da, logOnlyValueCount as Dc, readTagList as Di, hasUnverifiableParameterRefusal as Dl, inheritProducerRegions as Dn, malformedOrphanRecordsWarning as Do, bold as Dr, shownType as Ds, NESTED_PENDING_PARENT_REASON as Dt, loadCdkJson as Du, reverseMapIndexContributorInsights as E, recordedOutputReferenceRegions as Ea, literalSplitDelimitersOf as Ec, planTagDiff as Ei, hasReasonlessBaselineRefusal as El, getCurrentProducerRegions as En, malformedOrphanRecordsRefusalMessage as Eo, replacedDeleteFailureVerdict as Er, findReplacedReadersOfRecreateTargets as Es, recordRetainedForReadoption as Et, getLegacyStateBucketName as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, applyCallerIdentityCredentials as Fa, maskSecretsInError as Fc, ccBrokenReason as Fi, PhaseClock as Fl, nameGenerationHighWaterOf as Fn, malformedResourcePropertiesWarning as Fo, holdsSupersededResources as Fr, toCfnInteger as Fs, revertedNestedRowIds as Ft, stateBucketExistenceConfirmed as Fu, S3_AUTO_DELETE_OBJECTS_TAG as G, getAccountInfo as Ga, identityKeyFor as Gc, applyCustomResourceResponseExpiration as Gi, rewriteTemplateAssetReferences as Gl, WITHHELD_NAME_DISPLAY as Gn, refuseMalformedOrphansForDestroy as Go, noEchoExactEchoLeavesOf as Gr, requireConfigObject as Gs, loadJournaledOrphans as Gt, expectedOwnerParam as Gu, planTimeToLive as H, coerceParameterTypedValue as Ha, isUncertifiedBaselineMaskPosition as Hc, getCurrentResourceSecrets as Hi, buildAssetRedirectMap as Hl, namesAnyDeclaredParameter as Hn, refuseMalformedOrphanRecords as Ho, withoutSuperseded as Hr, readConfigString as Hs, dropFailedHint as Ht, uploadCfnTemplate as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, callerEnvCredentials as Ia, maskSecretsInText as Ic, isCustomResource as Ii, renderPhaseTimings as Il, nameScopeOf as In, malformedResourcesWarning as Io, isSupersededResourceRecord as Ir, toFiniteNumber as Is, withNestedRevertRun as It, warnDeprecatedNoPrefixCliFlag as Iu, getPriorAttempts as J, carriesFetchableDynamicReference as Ja, recoverMaskedOutput as Jc, slowCcOperationTimeoutMs as Ji, assertAssetBucketRegion as Jl, secretBearing as Jn, refuseMalformedOutputsForDestroy as Jo, completedReplayEntries as Jr, templateResourceTypes as Js, formatResourceLine as Jt, derivePartitionAndUrlSuffix as Ju, hasCdkAutoDeleteTag as K, isImpossibleEmptyStoredAttribute as Ka, inheritNestedStackParameterAssociations as Kc, customResourceResponseExpirationWarning as Ki, AssetModeResolver as Kl, displayTextOrWithheld as Kn, refuseMalformedOrphansForOrphan as Ko, noEchoParameterNamesOf as Kr, requireConfigString as Ks, makeForeignHolderScan as Kt, PARTITION_TABLE as Ku, deleteTableWithIndexBusyRetry as L, envCredentialsAreAssumedRole as La, scrubResourceRecord as Lc, wouldReturnToSdkProvider as Li, timePhase as Ll, retiredAfterRollback as Ln, malformedScrubResourceEntriesRefusalMessage as Lo, removeSuperseded as Lr, coerceCfnBoolean as Ls, collectNestedChildUnaddressed as Lt, ssmResolvedValueType as Lu, deleteBudgetKey as M, isIamRoleArn as Ma, unionOfSecretBags as Mc, stringifyIfAssigned as Mi, orphansCarriedFrom as Ml, updatePartialMessage as Mn, malformedOutputsWarning as Mo, yellow as Mr, WARM_THROUGHPUT_MEMBERS as Ms, nestedChildStackName as Mt, resolveStateBucketWithDefault as Mu, resolveDynamoDbDeleteBudgetClock as N, sendableAssumeRoleCommand as Na, createSecretMasker as Nc, CC_BROKEN_REASON as Ni, shouldRetainResource as Nl, updatePartialReason as Nn, malformedRenderedContainersWarning as No, addSuperseded as Nr, coerceWarmThroughput as Ns, recordDisplacedSkips as Nt, resolveStateBucketWithDefaultAndSource as Nu, stripIndexContributorInsights as O, applyRoleArnIfSet as Oa, printingCorpusOf as Oc, refuseMalformedDesiredTags as Oi, importableOutputKeys as Ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as On, malformedOrphanRowsKeptWarning as Oo, cyan as Or, MULTI_REGION_RECREATE_BLOCKED_TYPES as Os, displacedOpClause as Ot, resolveApp as Ou, resolveDynamoDbDeleteBudgetMs as P, AWS_CREDENTIAL_ENV_KEYS as Pa, errorCauseChain as Pc, ProviderRegistry as Pi, stackInstanceIdCarriedFrom as Pl, nameGenerationCarriedFrom as Pn, malformedResourceEntriesWarning as Po, deleteSupersededEntry as Pr, isWarmThroughputDecrease as Ps, revertNestedChildFromJournal as Pt, resolveUseCdkBootstrapAssets as Pu, crossStackOutputProvenanceSource as Q, cfnRefValueFromPhysicalId as Qa, splitGetAttStringForm as Qc, UNSPECIFIED_SKIP_REASON as Qi, parseBootstrapMarker as Ql, exportNameNoEchoParameters as Qn, refuseMalformedResourceEntriesForDestroy as Qo, orphanRecordsPrintingBag as Qr, emrClusterInstancesReplaced as Qs, withApiLimit as Qt, describeJsonParseFailure as Qu, maskedLogger as R, classifyRecordedSecretRegion as Ra, withPhysicalNameCopies as Rc, waitForLambdaFunctionActive as Ri, AssetPublisher as Rl, retiredNameGenerationsAfter as Rn, malformedStateRefusalMessage as Ro, supersededAfterRollback as Rr, coerceCfnInteger as Rs, getCurrentNestedStackContext as Rt, CFN_TEMPLATE_BODY_LIMIT as Ru, indexDeclaresContributorInsights as S, producerLookupOver as Sa, snapshotPassProvenance as Sc, isRefusedByName as Si, acceptedCreateOnlyDropsOf as Sl, resolveReplacementOldType as Sn, malformedExportSourceWarning as So, awaitInFlightSibling as Sr, unwrittenCreateOnlyReplacement as Ss, planOrphanAdoption as St, getDockerImageBySourceHash as Su, readContributorInsightsSpec as T, outputReferenceProvenanceOf as Ta, hasMaskableValues as Tc, DBPROXY_TAG_OPTIONS as Ti, hasReadableExportSet as Tl, findNestedStackTypeChanges as Tn, malformedLocalResourcesWarning as To, withStackRecords as Tr, hasNoCloudControlHandlers as Ts, keptForRetainedRecord as Tt, getDefaultStateBucketName as Tu, readTtlSpec as U, isUnboundTemplateParameter as Ua, pathCrossesDottedKey as Uc, withPrintingSecrets as Ui, createAssetRedirectResolver as Ul, reachableDivergentParameters as Un, refuseMalformedOrphanRecordsForDestroy as Uo, noEchoAttributeNamesOf as Ur, replayWarn as Us, isHandledOrphan as Ut, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Uu, isTtlAlreadyDisabled as V, regionLessSecretName as Va, dynamicReferenceTokens as Vc, isCustomResourceType as Vi, WorkGraph as Vl, computeParameterTaint as Vn, refuseMalformedNestedChildOutputs as Vo, supersededResourcesOf as Vr, configStringRefusal as Vs, dropFailedCommands as Vt, findLargeInlineResources as Vu, ECR_AUTO_DELETE_IMAGES_TAG as W, parameterTypeMayLoseSecretIdentity as Wa, spelledKeysOf as Wc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Wi, loadPublishableAssetManifest as Wl, resourcesNamingDeclaredParameter as Wn, refuseMalformedOrphans as Wo, noEchoComparisonForTemplate as Wr, requireConfigArray as Ws, journaledOrphanLines as Wt, decodeListingKey as Wu, IMPLICIT_DELETE_DEPENDENCIES as X, keepsSecretReferenceToken as Xa, recordAttributeIdCopy as Xc, unchangedBehindSecretReference as Xi, getBootstrapMarkerKey as Xl, secretSafeKeyDisplay as Xn, refuseMalformedResourceEntries as Xo, maskEventTextWithBoundBags as Xr, withRetry as Xs, isAccessDeniedError as Xt, StageLoadError as Xu, markRefusedBeforeApplying as Y, isNamelessDynamicReferenceError as Ya, physicalNameCopiesOf as Yc, onlySecretReferencesDiffer as Yi, ensureAssetStorage as Yl, secretBearingStateKeyWarning as Yn, refuseMalformedResourceAttributesForOrphan as Yo, journaledOrphanPrintingBag as Yr, describeTypeWithThrottleRetry as Ys, chunks as Yt, AssemblyReader as Yu, computeImplicitDeleteEdges as Z, AWS_NO_VALUE as Za, recordPhysicalNameCopy as Zc, RollbackInlinePolicyWriters as Zi, isCrossRegionRedirect as Zl, carriedExportAliasExposure as Zn, refuseMalformedResourceEntriesForDeploy as Zo, namingSecretsWithRecordedNoEcho as Zr, ecsServiceLaunchTypeSetOrChanged as Zs, lookupEachName as Zt, processStackMessages as Zu, streamMemberRefusals as _, s3BucketDomainName as _a, valueAtCoordinate as _c, withCreateTokenLedger as _i, isAccessDenied$1 as _l, planFailedOps as _n, hasReadableResources as _o, isPairableType as _r, unreadableOrphanRecords as _s, isSecretBearingReferenceString as _t, redactedDockerCause as _u, isProtectionValueActive as a, disableInstanceApiTermination as aa, isMarkedCoordinate as ac, ownValue as ad, ATOMIC_FINAL_SNAPSHOT_TYPES as ai, recordProvenPublicExpression as al, updateRefactorMarker as an, passedParameterClassesOf as ao, bindingSkippedOutputs as ar, refuseMalformedResourcePropertiesForOrphan as as, isAbsoluteAssetPath as at, describeDockerCapturedOutput as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketWebsiteUrl as ba, redactForState as bc, DeploymentEventsStore as bi, withStackInstanceIdWithheld as bl, recordUnderIdIsNotOwn as bn, malformedDriftResourcePropertiesWarning as bo, parseMappingFile as br, findActionableSilentDrops as bs, makeCanonicalizePropertiesFn as bt, warnFinchArgvExposure as bu, DynamoDBGlobalTableProvider as c, observeThenDisableInstanceApiTermination as ca, maskWholeValue as cc, displayAssemblyPath as cd, ccRoutedFinalSnapshotError as ci, isSingleDynamicReferenceToken as cl, pendingMovesRefusalMessage as cn, STATE_REGION_DIVERGED as co, maskingRetryLogger as cr, refuseMalformedResourcesForExport as cs, templateIdentity as ct, dockerSpawnEnvWithSensitive as cu, declaredStreamPolicyMember as d, DiffCalculator as da, noEchoLeavesOf as dc, injectAwsRegion as dd, isFinalSnapshotError as di, S3StateBackend as dl, replayRollback as dn, UNREADABLE_RESOURCES_MAP_ROW as do, formatDestructiveChange as dr, repairMalformedOrphansForReadOnly as ds, parentSuppliedValues as dt, getDockerCmd as du, deleteLeftInPlace as ea, lambdaFunctionNameForMask as ec, utf8ByteLength as ed, secretNamePrintingBags as ei, provenPublicValue as el, readRefactorMarkerOnce as en, lacksRecordedTableArn as eo, isWholeDynamicReferenceValue as er, refuseMalformedResourceEntriesForImportSave as es, deferredServiceTokenWarning as et, validateAssetBucketName as eu, declaredStreamTagsMember as f, INTRINSIC_KEYS as fa, noEchoOutputsComparison as fc, injectedAwsRegionValue as fd, refusesFinalSnapshot as fi, rebuildClientForBucketRegion as fl, removeProtectionTypeList as fn, accountArgs as fo, findRefactorHints as fr, repairMalformedOutputsForReadOnly as fs, readRecordedConditionVerdicts as ft, isDockerClientEnvKey as fu, streamDeclaresTags as g, s3BucketArn as ga, recordedNoEchoValuesOf as gc, reserveStackCreateToken as gi, crossPrefixDeniedWarning as gl, isReplacementOrphan as gn, hasReadableOutputs as go, withMovedTo as gr, unpreviewableOrphanRecords as gs, diffSecurity as gt, redactedCause as gu, streamDeclaresPolicy as h, isSettledInstanceState as ha, readsNoEchoSource as hc, ledgerForStack as hi, applyCrossPrefixScan as hl, isJournaledOrphan as hn, hasReadableOrphans as ho, rollbackOrphanIds as hr, repairMalformedResourcesForReadOnly as hs, withResourceDeadline as ht, redactDockerArgvValues as hu, PROTECTION_PROPERTY_BY_TYPE as i, markWaitAbandoned as ia, canonicalCoordinates as ic, nullPrototypeRecord as id, storedSecretNameNeedles as ii, recordNoEchoParameterFreshValue as il, sameMove as in, parameterInputsFor as io, isExportAliasCollision as ir, refuseMalformedResourcePropertiesForExport as is, findNestedTemplateTreeDefect as it, resolveDockerContextDirectory as iu, compensateRemovedDeletionProtection as j, explicitRoleArnOrThrow as ja, shareLogOnlyValues as jc, definedAttributes as ji, orphansAfterRollback as jl, redactedDeleteAddressSkip as jn, malformedOutputsRefusalMessage as jo, red as jr, renderStatefulReason as js, getNestedRevertRun as jt, resolveSkipPrefix as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, assertFlagRoleArn as ka, recordLogOnlyParameterValue as kc, tagMapAsList as ki, importableOutputs as kl, isRedactedRecordedValue as kn, malformedOrphansRefusalMessage as ko, gray as kr, isStatefulRecreateTargetForReplace as ks, displacedPhysicalIdShown as kt, resolveAutoAssetStorage as ku, STREAM_POLICY_KEY as l, reDisableInstanceApiTermination as la, maskedLeafCoordinatesOf as lc, renderAssemblyPathEscape as ld, createPreDeleteFinalSnapshot as li, LockManager as ll, refusePendingMovesOut as ln, STATE_RESOURCES_MALFORMED as lo, constructPathOf as lr, refuseMalformedState as ls, conditionFingerprint as lt, finchSecretArgvRefusal as lu, reverseMapStreamPolicy as m, poisonRenderedSpellingsCollidingIn as ma, readbackPathFor as mc, resolveBucketRegion as md, earliestDefined as mi, CrossPrefixScanCache as ml, demoteSupersededOrphans as mn, displayLogicalId as mo, movedToHint as mr, repairMalformedResourcePropertiesForReadOnly as ms, enclosingDeadlineRemainingMs as mt, partitionSensitiveEnv as mu, recordedProtectionEvidence as n, withIndeterminateGuard as na, DagBuilder as nc, hasOwnKey as nd, secretNamedRecordNeedles as ni, recordMaskOnlyValuesIn as nl, refactorMarkerRefusalMessage as nn, parseWebACLArn as no, collectDeclaredOutputNames as nr, refuseMalformedResourcePropertiesForDestroy as ns, serviceTokenBlockingReason as nt, buildDenyExternalAccessPolicy as nu, perType as o, ec2InstanceProtectionSite as oa, maskAtCoordinates as oc, absoluteAssemblyPathEscape as od, PRE_DELETE_SNAPSHOT_TYPES as oi, wholeStringLeavesOf as ol, hasPendingMovesOut as on, declaresNoEcho as oo, DEFAULT_RESOURCE_TIMEOUT_MS as or, refuseMalformedResourcesForDeploy as os, listNestedTemplateRows as ot, describeDockerExecFailure as ou, planStreamMemberOps as p, IntrinsicFunctionResolver as pa, passedNoEchoParametersOf as pc, clearBucketRegionCache as pd, unsupportedFinalSnapshotError as pi, CrossPrefixReadError as pl, recordAfterRollbackUpdate as pn, deployRefusesOrphanRowsReason as po, hintSidesOf as pr, repairMalformedResourceEntriesForReadOnly as ps, enclosingDeadlineExpired as pt, isMalformedEnvKey as pu, isTruthyCfnBoolean as q, carriesDynamicReference as qa, recordNestedStackParameterExpressions as qc, CloudControlProvider as qi, BOOTSTRAP_MARKER_PREFIX as ql, exportAliasCollisionScrubWarning as qn, refuseMalformedOutputs as qo, createReadOnlyAttributeHealerFactory as qr, prefetchCreateOnlyPropertyPaths as qs, sameJournaledOrphans as qt, canonicalizeRegion as qu, recordedProtectionNote as r, isWaitAbandonedError as ra, TemplateParser as rc, hasPlainPrototype$1 as rd, stateSecretNameNeedles as ri, recordNoEchoAttributeValues as rl, refuseRefactorMarker as rn, withSharedDrainBudget as ro, collectPublishedOutputNames as rr, refuseMalformedResourcePropertiesForDrift as rs, childTemplateLoader as rt, buildDockerImage as ru, readProtection as s, isTerminationProtectionPropagationError as sa, maskReadbackAtCoordinates as sc, describeFileReadFailure as sd, buildFinalSnapshotIdentifier as si, WHOLE_DYNAMIC_REFERENCE_PATTERN as sl, pendingMovesOutOf as sn, JSON_LISTING_HOLE_VALUE as so, DEFAULT_RESOURCE_WARN_AFTER_MS as sr, refuseMalformedResourcesForDestroy as ss, renderNestedTemplateTreeDefect as st, describeDockerFailure as su, DeployEngine as t, deleteSkipReason as ta, sameLambdaFunctionAddress as tc, defineOwnKey as td, secretNamedAttributeNamesOf as ti, recordMaskOnlyValue as tl, refactorMarkerMovesOf as tn, refStateLookupFromResource as to, noEchoParameterValueSeed as tr, refuseMalformedResourceEntriesForOrphan as ts, findServiceTokenRefusals as tt, validateContainerRepoName as tu, STREAM_TAGS_KEY as u, reEnableInstanceApiTermination as ua, noEchoCoordinatesOf as uc, resolveAssemblyPath as ud, effectiveDeletionPolicy as ui, isLockInfoExpired as ul, replayFailedOperations as un, UNREADABLE_ORPHANS_CONTAINER_ROW as uo, findDestructiveChanges as ur, repairMalformedOrphanRecordsForReadOnly as us, conditionInputsFrom as ut, formatDockerLoginError as uu, streamPolicyMatchesDeclared as v, s3BucketDualStackDomainName as va, liveMatchesUnresolvedTokenFrame as vc, acquireIdempotencyToken as vi, isNotImplemented as vl, planRollback as vn, isReadableOrphanRecord as vo, looselyEqual as vr, unreadableResourceEntries as vs, keptWholeReasonText as vt, runDockerForeground as vu, planIndexContributorInsightsOps as w, keepHeldTokenProvenance as wa, createUnionSecretMasker as wc, DBPROXY_TAGS_WHAT as wi, exportNamesCarriedFrom as wl, orphanNeedsIdentity as wn, malformedLocalResourceEntriesWarning as wo, getStackRecords as wr, NO_CC_HANDLERS_REASON as ws, resolvePendingCloudControlRequests as wt, synthesisStatusMessage as wu, contributorInsightsRefusals as x, resolveDynamicReferences as xa, recordReferenceProvenanceEntry as xc, extractDeploymentEventError as xi, splitImportedOps as xl, replacementNeverSwapped as xn, malformedExportNamesWarning as xo, proposeRenames as xr, findSilentDropProperties as xs, makeSiblingClaimReader as xt, AssetManifestLoader as xu, streamTagsMatchDeclared as y, s3BucketRegionalDomainName as ya, markSameGenerationBag as yc, DeploymentEventsReader as yi, stackInstanceIdOf as yl, recheckFailedPlan as yn, isReadableResourceEntry as yo, mappingPairs as yr, withheldAccountClause as ys, mergeNoChangeOutputs as yt, runDockerStreaming as yu, relayedIndexBusyDelete as z, classifyReplaySecretRegion as za, withoutPhysicalNameCopies as zc, TemplateNoEchoReresolver as zi, isSensitiveAttributeName as zl, retiredNameGenerationsLeaving as zn, previewableOrphanRecords as zo, supersededHeldByOtherTypeWarning as zr, configBooleanRefusal as zs, withNestedStackContext as zt, CFN_TEMPLATE_URL_LIMIT as zu };
+//# sourceMappingURL=deploy-engine-DSpxEUjC.js.map