@go-to-k/cdkd 0.307.0 → 0.308.0

package/dist/{deploy-engine-BOgsnnk0.js → deploy-engine-DSpxEUjC.js}

@@ -2,7 +2,7 @@ import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js"
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
 import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-Dhhyrf1v.js";
+import { t as getCdkdVersion } from "./version-DzajQDkv.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11,7 +11,7 @@ import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionConfigurationCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeNatGatewaysCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, ListTagsOfResourceCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
 import { DescribeApiDestinationCommand, DescribeConnectionCommand } from "@aws-sdk/client-eventbridge";
@@ -7845,7 +7845,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$7(value) {
+function isPlainObject$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -8101,7 +8101,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$7(args)) return void 0;
+		if (!isPlainObject$9(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -8147,7 +8147,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$7(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$9(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -8441,12 +8441,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
+	if (!isPlainObject$9(resolvedProperties) || !isPlainObject$9(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
+	if (!isPlainObject$9(resolvedParameters) || !isPlainObject$9(sourceParameters)) return;
 	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -8495,7 +8495,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$7(sourceLeaf)) return void 0;
+		if (!isPlainObject$9(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -8832,7 +8832,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 		}
 		return { value: out };
 	}
-	if (!isPlainObject$7(node)) return void 0;
+	if (!isPlainObject$9(node)) return void 0;
 	const keys = Object.keys(node);
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
@@ -8873,7 +8873,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 }
 function evaluatePureSub(args, bind, pseudo, evaluate) {
 	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
-	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$9(variables)) return;
 	const bound = /* @__PURE__ */ new Map();
 	for (const [name, variable] of Object.entries(variables)) {
 		const evaluated = evaluate(variable);
@@ -8906,7 +8906,7 @@ function bindReadName(name, bind, pseudo) {
 function collectRereadConditions(node, names, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
-	if (!isPlainObject$7(node)) return true;
+	if (!isPlainObject$9(node)) return true;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
@@ -8917,7 +8917,7 @@ function collectRereadConditions(node, names, depth = 0) {
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
-	if (!isPlainObject$7(node)) return false;
+	if (!isPlainObject$9(node)) return false;
 	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
 }
 function rendersReadTo(spelling, parentSecrets, value) {
@@ -8960,7 +8960,7 @@ function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return true;
 	if (typeof node === "string") return node.includes("{{resolve:");
 	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
-	if (!isPlainObject$7(node)) return false;
+	if (!isPlainObject$9(node)) return false;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (Object.keys(node).length !== 1) return true;
@@ -9073,7 +9073,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$7(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$9(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -9105,7 +9105,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$7(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$9(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -9268,7 +9268,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$7(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$9(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -9296,7 +9296,7 @@ const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 ]);
 function arrayElementDrop(element, depth = 0) {
 	if (depth > 16) return "unknown";
-	if (!isPlainObject$7(element)) return "never";
+	if (!isPlainObject$9(element)) return "never";
 	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
 	const keys = Object.keys(element);
 	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
@@ -9332,7 +9332,7 @@ function keptLiteralsCorroborate(kept, bag, secrets) {
 	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
 }
 function isIntrinsicNode(value) {
-	if (!isPlainObject$7(value)) return false;
+	if (!isPlainObject$9(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
 }
@@ -9345,7 +9345,7 @@ function keptElementCorroborates(source, bag, secrets, depth = 0) {
 	if (source === null || typeof source !== "object") return source === bag;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
-	if (!isPlainObject$7(source) || !isPlainObject$7(bag)) return false;
+	if (!isPlainObject$9(source) || !isPlainObject$9(bag)) return false;
 	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
 	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
 }
@@ -9355,12 +9355,12 @@ function corroboratesWhateverResolves(source, depth = 0) {
 	if (source === null || typeof source !== "object") return true;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
-	if (!isPlainObject$7(source)) return false;
+	if (!isPlainObject$9(source)) return false;
 	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
 	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
 }
 function arrayPairsWhateverDrops(source) {
-	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	if (!source.some((element) => isPlainObject$9(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
 	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -9377,13 +9377,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$7(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$9(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 		const reread = positionByParameterReread(bag, source, secrets);
 		if (reread !== void 0) return reread;
 	}
-	if (typeof bag === "string" && isPlainObject$7(source)) {
+	if (typeof bag === "string" && isPlainObject$9(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -9393,7 +9393,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$7(source)) {
+	if (Array.isArray(bag) && isPlainObject$9(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -9428,7 +9428,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) {
 			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
@@ -9450,7 +9450,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$7(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$9(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -9487,7 +9487,7 @@ function nameScalarSecrets(value, secrets) {
 			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
 		}
 		if (Array.isArray(node)) return node.map(walk);
-		if (isPlainObject$7(node) && hasPlainPrototype(node)) {
+		if (isPlainObject$9(node) && hasPlainPrototype(node)) {
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
 			return out;
@@ -9504,13 +9504,13 @@ function substitutionIsSecret(value) {
 function sentinelDefinitionOf(source) {
 	const subs = source["DefinitionSubstitutions"];
 	const values = /* @__PURE__ */ new Map();
-	if (isPlainObject$7(subs)) {
+	if (isPlainObject$9(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
 	}
 	for (const key of ["DefinitionString", "Definition"]) {
 		if (!Object.hasOwn(source, key)) continue;
 		const raw = source[key];
-		const body = typeof raw === "string" ? raw : isPlainObject$7(raw) ? JSON.stringify(raw) : void 0;
+		const body = typeof raw === "string" ? raw : isPlainObject$9(raw) ? JSON.stringify(raw) : void 0;
 		if (body === void 0) continue;
 		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
 		const names = [];
@@ -9581,7 +9581,7 @@ function sentinelDefinitionOf(source) {
 				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
 				return;
 			}
-			if (isPlainObject$7(node)) {
+			if (isPlainObject$9(node)) {
 				const own = new Set(Object.keys(node).map(written));
 				for (const [k, v] of Object.entries(node)) {
 					if (!marked(k)) keys.add(k);
@@ -9609,7 +9609,7 @@ function alignedSecretLeaf(root, leaf) {
 			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
 			cursor = cursor[segment];
 		} else {
-			if (!isPlainObject$7(cursor)) return void 0;
+			if (!isPlainObject$9(cursor)) return void 0;
 			const own = Object.keys(cursor);
 			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
 			if (!Object.hasOwn(cursor, segment)) return void 0;
@@ -9620,7 +9620,7 @@ function alignedSecretLeaf(root, leaf) {
 }
 function collectObjectKeys(value, into) {
 	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
-	else if (isPlainObject$7(value)) for (const [k, v] of Object.entries(value)) {
+	else if (isPlainObject$9(value)) for (const [k, v] of Object.entries(value)) {
 		into.add(k);
 		collectObjectKeys(v, into);
 	}
@@ -9633,7 +9633,7 @@ function spelledKeysOf(properties) {
 }
 function someKeyIsUnspelled(value, spelled) {
 	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
-	if (isPlainObject$7(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	if (isPlainObject$9(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
 	return false;
 }
 function nameDefinitionSecrets(value, source, secrets) {
@@ -9728,8 +9728,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$7(a)) {
-		if (!isPlainObject$7(b)) return false;
+	if (isPlainObject$9(a)) {
+		if (!isPlainObject$9(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -9746,7 +9746,7 @@ function renderedDefinitionLiterals(source) {
 	const keyKeep = /* @__PURE__ */ new Set();
 	const subs = source["DefinitionSubstitutions"];
 	const scalars = [];
-	if (isPlainObject$7(subs)) {
+	if (isPlainObject$9(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
 			scalars.push([name, String(value)]);
 			if (typeof value === "string") keep.add(value);
@@ -9758,7 +9758,7 @@ function renderedDefinitionLiterals(source) {
 		if (!Object.hasOwn(source, key)) continue;
 		const body = source[key];
 		if (typeof body === "string") bodies.push(body);
-		else if (isPlainObject$7(body)) bodies.push(JSON.stringify(body));
+		else if (isPlainObject$9(body)) bodies.push(JSON.stringify(body));
 	}
 	for (const body of bodies) {
 		let rendered = body;
@@ -9809,7 +9809,7 @@ function collectScalarLeaves(value, into) {
 		return;
 	}
 	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
-	else if (isPlainObject$7(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+	else if (isPlainObject$9(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
 }
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
 	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9827,7 +9827,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, s
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
-	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$9(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
@@ -9854,7 +9854,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
-	if (failClosed === true && isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+	if (failClosed === true && isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
 		const keep = renderedDefinitionLiterals(source);
 		const out = Object.create(null);
 		const rest = Object.create(null);
@@ -9888,7 +9888,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return out;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -9915,14 +9915,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$7(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$9(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$7(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$9(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -9932,8 +9932,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$7(source)) {
-		if (!isPlainObject$7(bag)) return false;
+	if (isPlainObject$9(source)) {
+		if (!isPlainObject$9(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -10024,13 +10024,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$7(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$9(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(refused) && isPlainObject$7(scanned)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(refused) && isPlainObject$9(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -11520,7 +11520,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$7(variables) ? variables : void 0;
+				const vars = isPlainObject$9(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -11554,7 +11554,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$7(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$9(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -11570,7 +11570,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$7(value)) {
+				if (!isPlainObject$9(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -11619,7 +11619,7 @@ function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, con
 	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
 		parameters: noEchoParameters,
 		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), {
+	}, (coordinate, node) => nodes.set(canonicalJson$4(coordinate), {
 		coordinate,
 		node
 	}));
@@ -11631,7 +11631,7 @@ function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames
 	if (properties === null || typeof properties !== "object") return bag;
 	const coordinates = /* @__PURE__ */ new Map();
 	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
-	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$3(coordinate), coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$4(coordinate), coordinate);
 	const recordLeaf = (leaf) => {
 		if (typeof leaf === "string") {
 			if (leaf === "***" || leaf.includes("{{resolve:")) return;
@@ -11655,7 +11655,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$7(value)) {
+	if (isPlainObject$9(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -11678,7 +11678,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$7(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$9(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -11694,7 +11694,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$7(node)) return { ...node };
+	if (isPlainObject$9(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -11761,20 +11761,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$7(element)) return path;
+			if (key === void 0 || !isPlainObject$9(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$7(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$9(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$7(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$9(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$7(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$9(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -11803,7 +11803,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$7(v) ? !isPlainObject$7(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$9(v) ? !isPlainObject$9(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -11832,8 +11832,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$7(v) && isPlainObject$7(s)) {
-			const tt = isPlainObject$7(t) ? t : {};
+		if (isPlainObject$9(v) && isPlainObject$9(s)) {
+			const tt = isPlainObject$9(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -11856,13 +11856,13 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$7(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$9(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
-	return canonicalJson$3(a) === canonicalJson$3(b);
+	return canonicalJson$4(a) === canonicalJson$4(b);
 }
-function canonicalJson$3(value) {
+function canonicalJson$4(value) {
 	return JSON.stringify(value, (_key, node) => {
 		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
 		const sorted = Object.create(null);
@@ -11900,7 +11900,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$7(node)) {
+				if (isPlainObject$9(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11943,8 +11943,8 @@ function noEchoOutputsComparison(templateValues, sources) {
 	return (current, desired) => {
 		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
 		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
-		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$3(desired[key])));
-		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$3(desired[key]))) maskedKeys.add(key);
+		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$4(desired[key])));
+		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$4(desired[key]))) maskedKeys.add(key);
 		if (maskedKeys.size === 0) return {
 			current,
 			desired,
@@ -11958,7 +11958,7 @@ function noEchoOutputsComparison(templateValues, sources) {
 			const stored = current[key];
 			if (containsMask(stored)) continue;
 			normalized = { ...normalized ?? {} };
-			normalized[key] = canonicalJson$3(stored) === canonicalJson$3(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+			normalized[key] = canonicalJson$4(stored) === canonicalJson$4(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
 		}
 		return {
 			current: normalized,
@@ -12617,6 +12617,36 @@ function glueTableNameChanged(oldValue, newValue) {
 function natZoneAddressesAddedToAutomaticGateway(oldValue, newValue) {
 	return oldValue == null && newValue != null;
 }
+function ecsServiceLaunchTypeSetOrChanged(oldValue, newValue) {
+	return newValue != null && !isDeepStrictEqual(oldValue, newValue);
+}
+const EMR_INSTANCES_IN_PLACE_MEMBERS = ["TerminationProtected", "UnhealthyNodeReplacement"];
+const EMR_GROUP_IN_PLACE_MEMBERS = ["InstanceCount", "AutoScalingPolicy"];
+const EMR_FLEET_IN_PLACE_MEMBERS = ["TargetOnDemandCapacity", "TargetSpotCapacity"];
+function withoutKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+	const copy = { ...value };
+	for (const key of keys) delete copy[key];
+	return copy;
+}
+function emrInstancesReplacingPart(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+	const instances = withoutKeys(value, EMR_INSTANCES_IN_PLACE_MEMBERS);
+	const strip = (key, keys) => {
+		if (!(key in instances)) return;
+		const member = instances[key];
+		instances[key] = Array.isArray(member) ? member.map((entry) => withoutKeys(entry, keys)) : withoutKeys(member, keys);
+	};
+	strip("CoreInstanceGroup", EMR_GROUP_IN_PLACE_MEMBERS);
+	strip("TaskInstanceGroups", EMR_GROUP_IN_PLACE_MEMBERS);
+	strip("CoreInstanceFleet", EMR_FLEET_IN_PLACE_MEMBERS);
+	strip("TaskInstanceFleets", EMR_FLEET_IN_PLACE_MEMBERS);
+	return instances;
+}
+function emrClusterInstancesReplaced(oldValue, newValue) {
+	if (oldValue === void 0 && newValue === void 0) return true;
+	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
@@ -12974,6 +13004,14 @@ var ReplacementRulesRegistry = class {
 			"TaskRoleArn",
 			"Volumes"
 		]) });
+		this.rules.set("AWS::ECS::Service", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["LaunchType", ecsServiceLaunchTypeSetOrChanged]])
+		});
+		this.rules.set("AWS::EMR::Cluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Instances", emrClusterInstancesReplaced]])
+		});
 		this.rules.set("AWS::ElasticLoadBalancingV2::ListenerRule", { replacementProperties: /* @__PURE__ */ new Set(["ListenerArn"]) });
 		this.logger.debug(`Initialized replacement rules for ${this.rules.size} resource types`);
 	}
@@ -14853,7 +14891,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -14893,7 +14931,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$6(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$8(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -14905,7 +14943,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -14918,7 +14956,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -14932,7 +14970,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -14946,10 +14984,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$6(value) {
+function isPlainObject$8(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -14976,7 +15014,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -15153,6 +15191,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AIOps::InvestigationGroup",
 	"AWS::IoTSiteWise::Workspace",
+	"AWS::CloudWatch::Space",
 	"AWS::Rbin::Rule",
 	"AWS::SMSVOICE::PhoneNumber",
 	"AWS::SMSVOICE::SenderId"
@@ -17013,19 +17052,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::EFS::MountTarget", {
 		handled: /* @__PURE__ */ new Set([
 			"FileSystemId",
-			"SecurityGroups",
-			"SubnetId"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["IpAddress", "not yet implemented by cdkd"],
-			["IpAddressType", "not yet implemented by cdkd"],
-			["Ipv6Address", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
 			"IpAddress",
 			"IpAddressType",
-			"Ipv6Address"
+			"Ipv6Address",
+			"SecurityGroups",
+			"SubnetId"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Id"]),
 		ccRouteUnavailable: false
 	}],
@@ -18249,6 +18283,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Route53::HostedZone", {
 		handled: /* @__PURE__ */ new Set([
+			"DelegationSetId",
 			"HostedZoneConfig",
 			"HostedZoneFeatures",
 			"HostedZoneTags",
@@ -18256,8 +18291,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"QueryLoggingConfig",
 			"VPCs"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["DelegationSetId", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["DelegationSetId"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Id", "NameServers"]),
 		ccRouteUnavailable: false
 	}],
@@ -19981,12 +20016,12 @@ function declaresNoEcho(definition) {
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	if (value === void 0) return "null";
-	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$3).join(",")}]`;
 	if (value !== null && typeof value === "object") {
 		const record = value;
-		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$2(record[key])}`).join(",")}}`;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$3(record[key])}`).join(",")}}`;
 	}
 	return JSON.stringify(value) ?? "null";
 }
@@ -20007,7 +20042,7 @@ function splitInputFingerprint(entry) {
 	};
 }
 function templateCarriesNeedle(templateValue, secrets) {
-	const text = canonicalJson$2(templateValue);
+	const text = canonicalJson$3(templateValue);
 	for (const needle of printingCorpusOf(secrets).keys()) {
 		if (needle.length < 4) continue;
 		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
@@ -20015,14 +20050,14 @@ function templateCarriesNeedle(templateValue, secrets) {
 	return false;
 }
 function maskedPropertyFingerprint(templateValue) {
-	const digest = createHash("sha256").update(canonicalJson$2({
+	const digest = createHash("sha256").update(canonicalJson$3({
 		layout: FINGERPRINT_LAYOUT$1,
 		value: templateValue
 	})).digest("hex");
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -20030,7 +20065,7 @@ const NESTED_STACK_TYPE$4 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
-	const text = canonicalJson$2(value);
+	const text = canonicalJson$3(value);
 	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
 	for (const corpus of corpora) {
 		if (corpus === void 0) continue;
@@ -20042,7 +20077,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$5(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$7(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -20053,7 +20088,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$5(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$7(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -20104,7 +20139,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$5(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$7(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -20129,7 +20164,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$5(value)) return false;
+		if (!isPlainObject$7(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -20141,7 +20176,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -20155,7 +20190,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$5(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$7(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -20171,7 +20206,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$5(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$7(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -20186,7 +20221,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$5(value)) return;
+		if (!isPlainObject$7(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -20219,7 +20254,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -20248,8 +20283,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$5(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$5(map)) return "unknown";
+	const map = isPlainObject$7(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$7(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -20317,7 +20352,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$5(value)) return {
+	if (!isPlainObject$7(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -20380,7 +20415,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -20433,8 +20468,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$5(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$5(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$7(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$7(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -20458,34 +20493,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$5(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$7(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$5(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$7(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$5(properties)) return "unknown";
+	if (!isPlainObject$7(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$5(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$7(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$5(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$7(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$5(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$7(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$5(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$7(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -20502,7 +20537,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$5(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$7(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -20515,8 +20550,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$5(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$5(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$7(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$7(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -20588,7 +20623,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$5(value)) return "clean";
+	if (!isPlainObject$7(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -20603,7 +20638,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -20667,7 +20702,7 @@ async function maskedInputFingerprint(templateValue, sources) {
 		if (error instanceof UnknownInput) return void 0;
 		throw error;
 	}
-	const digest = createHash("sha256").update(canonicalJson$2({
+	const digest = createHash("sha256").update(canonicalJson$3({
 		layout: INPUT_FINGERPRINT_LAYOUT,
 		value: form
 	})).digest("hex");
@@ -20681,7 +20716,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$5(parameters)) return classes;
+	if (!isPlainObject$7(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -20722,13 +20757,13 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$5(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$7(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
 		const value = resolvedProps[key];
 		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
-		const text = canonicalJson$2(value);
+		const text = canonicalJson$3(value);
 		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
 	});
 }
@@ -20753,7 +20788,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$5(field)) return read;
+	if (!isPlainObject$7(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -20761,7 +20796,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$5(field)) return read;
+	if (!isPlainObject$7(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -20808,7 +20843,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$5(field) ? Object.entries(field) : [];
+	const next = isPlainObject$7(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -20841,10 +20876,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$5(previous)) return scrubbed;
+		if (!isPlainObject$7(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$5(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$7(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -22185,11 +22220,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$4(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$6(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -22207,11 +22242,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$4(field)) return void 0;
+	if (!isPlainObject$6(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -22220,9 +22255,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$4(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$6(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -22244,7 +22279,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$4(field)) return record;
+	if (!isPlainObject$6(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -22256,12 +22291,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$4(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$6(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$4(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$6(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$4(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$6(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -22279,7 +22314,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$4(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$6(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -22322,7 +22357,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$4(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$6(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -25844,17 +25879,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 
 //#endregion
 //#region src/analyzer/read-provenance-promotion.ts
-function isPlainObject$3(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readsAcrossStacks(value) {
 	if (Array.isArray(value)) return value.some(readsAcrossStacks);
-	if (!isPlainObject$3(value)) return false;
+	if (!isPlainObject$5(value)) return false;
 	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
 	return Object.values(value).some(readsAcrossStacks);
 }
 function recordedReadVersions(record) {
-	if (!isPlainObject$3(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$5(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = referenceProvenanceOf(record);
 	if (field === void 0) return void 0;
 	let out;
@@ -25865,7 +25900,7 @@ async function readProvenancePromotions(args) {
 	const { currentState, desiredTemplate, sources } = args;
 	const parser = args.parser ?? new TemplateParser();
 	const records = currentState.resources;
-	const parameters = isPlainObject$3(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const parameters = isPlainObject$5(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
 	const out = [];
 	for (const { logicalId, changeType } of args.rows) {
 		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
@@ -25873,7 +25908,7 @@ async function readProvenancePromotions(args) {
 		const readVersions = recordedReadVersions(record);
 		if (readVersions === void 0) continue;
 		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
-		const properties = isPlainObject$3(resource?.Properties) ? resource.Properties : {};
+		const properties = isPlainObject$5(resource?.Properties) ? resource.Properties : {};
 		const reads = [];
 		for (const [key, value] of Object.entries(properties)) {
 			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
@@ -25916,7 +25951,7 @@ async function readProvenancePromotions(args) {
 			if (recorded.some((version) => !domain.has(version))) moved.push(token);
 		}
 		if (moved.length === 0) continue;
-		const recordProperties = isPlainObject$3(record?.properties) ? record.properties : {};
+		const recordProperties = isPlainObject$5(record?.properties) ? record.properties : {};
 		const keys = [];
 		for (const r of reads) {
 			if (!Object.hasOwn(recordProperties, r.key)) continue;
@@ -27489,8 +27524,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$2(previous)) {
-		if (!isPlainObject$2(desired)) return "differs";
+	if (isPlainObject$4(previous)) {
+		if (!isPlainObject$4(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -27516,7 +27551,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$2(value) {
+function isPlainObject$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -27908,6 +27943,7 @@ const SLOW_CC_OPERATION_TIMEOUTS = {
 	},
 	"AWS::ElastiCache::CacheCluster": {
 		create: 60 * MINUTE_MS,
+		update: 60 * MINUTE_MS,
 		delete: 60 * MINUTE_MS
 	},
 	"AWS::RDS::DBInstance": {
@@ -28466,7 +28502,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-oKlrkJeO.js");
+			const { ASGProvider } = await import("./asg-provider-CsRMe_zh.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28575,7 +28611,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DcBsBQLi.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DvuvSkfJ.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BPs9JSk_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-p59T8CFv.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29731,11 +29767,11 @@ function applyNoEchoDeleteValues(properties, recordedLeaves, values) {
 		payload: properties,
 		unresolved: []
 	};
-	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$3(leaf.coordinate), leaf]));
+	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$4(leaf.coordinate), leaf]));
 	const entries = [];
 	const unresolved = [];
 	for (const coordinate of masked) {
-		const leaf = byKey.get(canonicalJson$3(coordinate));
+		const leaf = byKey.get(canonicalJson$4(coordinate));
 		if (leaf === void 0) unresolved.push(coordinate);
 		else entries.push({
 			coordinate,
@@ -29786,7 +29822,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	const fingerprinter = options.inputSources === void 0 ? void 0 : inputFingerprinter(templateProps, options.inputSources);
 	const leaves = [];
 	for (const coordinate of masked) {
-		if (!nodes.has(canonicalJson$3(coordinate))) continue;
+		if (!nodes.has(canonicalJson$4(coordinate))) continue;
 		if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 		const value = valueAtCoordinate(resolvedProperties, coordinate);
 		if (value === void 0 || carriesSecretMask(value)) continue;
@@ -29965,7 +30001,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const bag = await this.noEchoNeedles();
 		const leaves = [];
 		for (const coordinate of masked) {
-			const key = canonicalJson$3(coordinate);
+			const key = canonicalJson$4(coordinate);
 			if (!nodes.has(key)) continue;
 			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
@@ -37056,7 +37092,7 @@ const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
-function canonicalJson$1(value) {
+function canonicalJson$2(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
 			const sorted = Object.create(null);
@@ -37086,7 +37122,7 @@ function skippedOutputDigest(template, outputKey) {
 		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
 	}
 	const entry = template.Outputs?.[outputKey];
-	return createHash("sha256").update(canonicalJson$1({
+	return createHash("sha256").update(canonicalJson$2({
 		output: entry,
 		template: sections
 	})).digest("hex");
@@ -38959,7 +38995,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	const marked = noEchoLeavesOf(baseline) ?? [];
 	const names = declaredNoEchoAttributeNames(baseline);
 	if (marked.length === 0 && names.length === 0 && substituted.length === 0) return record;
-	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$3(leaf.value) === canonicalJson$3(value));
+	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$4(leaf.value) === canonicalJson$4(value));
 	let attributes = record.attributes;
 	if (attributes !== void 0 && attributes !== null && typeof attributes === "object") for (const [name, value] of Object.entries(attributes)) {
 		if (!names.includes(name) && !echoes(name, value)) continue;
@@ -38970,7 +39006,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 		const list = coordinate.findIndex((segment) => typeof segment === "number");
 		if (list < 0) return false;
 		const path = coordinate.slice(0, list);
-		return canonicalJson$3(valueAtCoordinate(byIndex, path)) !== canonicalJson$3(valueAtCoordinate(baseline.properties, path));
+		return canonicalJson$4(valueAtCoordinate(byIndex, path)) !== canonicalJson$4(valueAtCoordinate(baseline.properties, path));
 	});
 	const properties = reshaped.length === 0 ? byIndex : maskReadbackAtCoordinates(byIndex, baseline.properties, reshaped);
 	const widened = reshaped.map((coordinate) => readbackPathFor(byIndex, baseline.properties, coordinate)).filter((path, i) => path !== void 0 && path.length < reshaped[i].length);
@@ -44819,18 +44855,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject$1(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function canonicalJson(value) {
-	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+function canonicalJson$1(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
+	if (isPlainObject$3(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject$1(value)) return false;
+	if (!isPlainObject$3(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44853,8 +44889,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject$1(definitions)) return void 0;
-	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$3(definitions)) return void 0;
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44876,7 +44912,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject$1(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -44894,7 +44930,7 @@ function conditionFingerprint(template, name, inputOf) {
 		}
 	}
 	return {
-		fingerprint: `sha256:${createHash("sha256").update(canonicalJson({
+		fingerprint: `sha256:${createHash("sha256").update(canonicalJson$1({
 			layout: FINGERPRINT_LAYOUT,
 			conditions: closure,
 			parameters: inputs
@@ -44907,7 +44943,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject$1(value)) return;
+	if (!isPlainObject$3(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -44921,9 +44957,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject$1(section)) continue;
+		if (!isPlainObject$3(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject$1(entry)) continue;
+			if (!isPlainObject$3(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -44955,10 +44991,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject$1(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject$1(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$3(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -45004,11 +45040,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject$1(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$3(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45343,7 +45379,7 @@ function deferredServiceTokenWarning(row) {
 
 //#endregion
 //#region src/deployment/read-provenance-sources.ts
-function isPlainObject(value) {
+function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function crossStackNodes(value, into = []) {
@@ -45351,7 +45387,7 @@ function crossStackNodes(value, into = []) {
 		for (const item of value) crossStackNodes(item, into);
 		return into;
 	}
-	if (!isPlainObject(value)) return into;
+	if (!isPlainObject$2(value)) return into;
 	const keys = Object.keys(value);
 	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
 	for (const item of Object.values(value)) crossStackNodes(item, into);
@@ -45375,11 +45411,11 @@ function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
 function inheritedProvenanceForChildDiff(args) {
 	const { row, rowRecord, parentRecords, parentTemplate } = args;
 	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
-	const recordedParameters = isPlainObject(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const recordedParameters = isPlainObject$2(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
 	const tokens = referenceTokensIn(recordedParameters);
 	if (tokens.size === 0) return void 0;
 	const own = referenceProvenanceOf(rowRecord);
-	const upstreams = [...new TemplateParser().extractReferences(isPlainObject(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$2(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
 	const out = /* @__PURE__ */ new Map();
 	for (const token of tokens) {
 		const versions = /* @__PURE__ */ new Set();
@@ -46210,6 +46246,41 @@ function isTruthyCfnBoolean(value) {
 	return value === true || value === "true";
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-ttl.ts
+function readTtlSpec(spec) {
+	if (spec === void 0 || spec === null) return {
+		enabled: false,
+		attributeName: void 0
+	};
+	const s = spec;
+	const rawName = s["AttributeName"];
+	const attributeName = typeof rawName === "string" && rawName !== "" ? rawName : void 0;
+	const rawEnabled = s["Enabled"];
+	return {
+		enabled: rawEnabled === void 0 ? true : typeof rawEnabled === "string" ? rawEnabled.toLowerCase() === "true" : Boolean(rawEnabled),
+		attributeName
+	};
+}
+function planTimeToLive(spec, previousSpec, mode) {
+	const desired = readTtlSpec(spec);
+	if (spec !== void 0 && spec !== null && desired.enabled) return desired.attributeName ? {
+		kind: "enable",
+		attributeName: desired.attributeName
+	} : { kind: "none" };
+	if (mode === "create") return { kind: "none" };
+	const previousPresent = previousSpec !== void 0 && previousSpec !== null;
+	const previous = readTtlSpec(previousSpec);
+	if (previousPresent && previous.enabled && previous.attributeName) return {
+		kind: "disable",
+		attributeName: previous.attributeName
+	};
+	return { kind: "disable-live" };
+}
+function isTtlAlreadyDisabled(awsDetail) {
+	return /TimeToLive is already disabled/i.test(awsDetail);
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
@@ -46428,6 +46499,718 @@ function isResourceNotFoundError(error) {
 	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-contributor-insights.ts
+const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
+function readContributorInsightsSpec(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "Enabled", path) ?? configStringRefusal(value, "Mode", "", path);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["Enabled"]) ?? false;
+	const mode = block["Mode"];
+	return typeof mode === "string" && mode.length > 0 ? {
+		kind: "usable",
+		enabled,
+		mode
+	} : {
+		kind: "usable",
+		enabled
+	};
+}
+function planContributorInsightsOp(desired, previous, onUnusable) {
+	if (desired.kind === "unusable") {
+		onUnusable(desired.reason);
+		return;
+	}
+	if (desired.kind === "absent") return previous.kind === "absent" ? void 0 : { action: "DISABLE" };
+	if (previous.kind === "usable" && previous.enabled === desired.enabled && (!desired.enabled || previous.mode === desired.mode)) return;
+	if (!desired.enabled) return { action: "DISABLE" };
+	return desired.mode === void 0 ? { action: "ENABLE" } : {
+		action: "ENABLE",
+		mode: desired.mode
+	};
+}
+const INDEX_CONTRIBUTOR_INSIGHTS_PATH = `GlobalSecondaryIndexes[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+function indexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
+}
+function planIndexContributorInsightsOps(desiredIndexes, previousIndexes, onUnusable) {
+	const previousByName = indexEntriesByName(previousIndexes);
+	const ops = [];
+	for (const [indexName, entry] of indexEntriesByName(desiredIndexes)) {
+		const path = INDEX_CONTRIBUTOR_INSIGHTS_PATH;
+		const op = planContributorInsightsOp(readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], path), readContributorInsightsSpec(previousByName.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], path), (reason) => onUnusable(indexName, reason));
+		if (op !== void 0) ops.push({
+			indexName,
+			...op
+		});
+	}
+	return ops;
+}
+function contributorInsightsRefusals(tableBlock, indexes) {
+	const refusals = [];
+	const table = readContributorInsightsSpec(tableBlock, CONTRIBUTOR_INSIGHTS_KEY);
+	if (table.kind === "unusable") refusals.push(table.reason);
+	if (!Array.isArray(indexes)) return refusals;
+	indexes.forEach((entry, position) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `GlobalSecondaryIndexes[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		if (read.kind === "unusable") refusals.push(read.reason);
+	});
+	return refusals;
+}
+function stripIndexContributorInsights(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+	if (!("ContributorInsightsSpecification" in entry)) return entry;
+	const { [CONTRIBUTOR_INSIGHTS_KEY]: _stripped, ...rest } = entry;
+	return rest;
+}
+function indexDeclaresContributorInsights(desiredEntry) {
+	return readContributorInsightsSpec(desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY], "").kind === "usable";
+}
+function enabledForStatus(status, transientAsTarget) {
+	if (status === "ENABLED" || transientAsTarget && status === "ENABLING") return true;
+	if (status === "DISABLED" || transientAsTarget && status === "DISABLING") return false;
+}
+function reverseMapTableContributorInsights(status, mode) {
+	const enabled = enabledForStatus(status, false);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	if (enabled && mode !== void 0) block["Mode"] = mode;
+	return block;
+}
+function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
+	const declared = readContributorInsightsSpec(declaredBlock, INDEX_CONTRIBUTOR_INSIGHTS_PATH);
+	if (declared.kind !== "usable") return void 0;
+	const enabled = enabledForStatus(status, true);
+	if (enabled === void 0) return void 0;
+	const declaredEnabled = declaredBlock["Enabled"];
+	const block = { Enabled: typeof declaredEnabled !== "string" ? enabled : declared.enabled === enabled ? declaredEnabled : String(enabled) };
+	if (enabled && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-replica-settings.ts
+const PITR_KEY = "PointInTimeRecoverySpecification";
+const KINESIS_KEY = "KinesisStreamSpecification";
+const TABLE_POLICY_KEY = "ResourcePolicy";
+const REPLICA_STREAM_KEY = "ReplicaStreamSpecification";
+const DEFAULT_RECOVERY_PERIOD_DAYS = 35;
+const DEFAULT_KINESIS_PRECISION = "MILLISECOND";
+const PITR_PATH = `Replicas[].${PITR_KEY}`;
+const CI_PATH = `Replicas[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+const KINESIS_PATH = `Replicas[].${KINESIS_KEY}`;
+const TABLE_POLICY_PATH = `Replicas[].${TABLE_POLICY_KEY}`;
+const STREAM_POLICY_PATH = `Replicas[].${REPLICA_STREAM_KEY}.ResourcePolicy`;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readPitrSpec(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "PointInTimeRecoveryEnabled", PITR_PATH) ?? configIntegerRefusal(value, "RecoveryPeriodInDays", PITR_PATH, 1, 35);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["PointInTimeRecoveryEnabled"]) ?? false;
+	const period = enabled ? coerceCfnInteger(block["RecoveryPeriodInDays"]) : void 0;
+	return period === void 0 ? {
+		kind: "usable",
+		enabled
+	} : {
+		kind: "usable",
+		enabled,
+		recoveryPeriodInDays: period
+	};
+}
+function readKinesisSpec(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configStringRefusal(value, "StreamArn", "required", KINESIS_PATH) ?? configStringRefusal(value, "ApproximateCreationDateTimePrecision", "", KINESIS_PATH);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const streamArn = block["StreamArn"];
+	if (typeof streamArn !== "string") return {
+		kind: "unusable",
+		reason: `${KINESIS_PATH}.StreamArn is required`
+	};
+	const precision = block["ApproximateCreationDateTimePrecision"];
+	return typeof precision === "string" && precision.length > 0 ? {
+		kind: "usable",
+		streamArn,
+		precision
+	} : {
+		kind: "usable",
+		streamArn
+	};
+}
+function readPolicyBlock(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!isPlainObject$1(value)) return {
+		kind: "unusable",
+		reason: `${path} must be an object with a PolicyDocument`
+	};
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (!isPlainObject$1(document)) return {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument must be a policy object or a JSON string`
+	};
+	const keys = Object.keys(document);
+	if (keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"))) return {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument is an unresolved intrinsic`
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+function readTablePolicy(replica) {
+	return readPolicyBlock(replica?.[TABLE_POLICY_KEY], TABLE_POLICY_PATH);
+}
+function readStreamPolicy$1(replica) {
+	const stream = replica?.[REPLICA_STREAM_KEY];
+	if (stream === void 0 || stream === null) return { kind: "absent" };
+	if (!isPlainObject$1(stream)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
+	};
+	return readPolicyBlock(stream["ResourcePolicy"], STREAM_POLICY_PATH);
+}
+function replicaSettingRefusals(replica) {
+	return [
+		readPitrSpec(replica?.[PITR_KEY]),
+		readContributorInsightsSpec(replica?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH),
+		readKinesisSpec(replica?.[KINESIS_KEY]),
+		readTablePolicy(replica),
+		readStreamPolicy$1(replica)
+	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []);
+}
+function settingOf(op) {
+	switch (op.kind) {
+		case "pitr": return "pitr";
+		case "contributorInsights": return "contributorInsights";
+		case "kinesisDisable":
+		case "kinesisEnable":
+		case "kinesisPrecision": return "kinesis";
+		case "deleteTablePolicy":
+		case "putTablePolicy": return "tablePolicy";
+		case "deleteStreamPolicy":
+		case "putStreamPolicy": return "streamPolicy";
+	}
+}
+const SETTING_MEMBER = {
+	pitr: PITR_KEY,
+	contributorInsights: CONTRIBUTOR_INSIGHTS_KEY,
+	kinesis: KINESIS_KEY,
+	tablePolicy: TABLE_POLICY_KEY,
+	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`
+};
+function samePolicyDocument$1(left, right) {
+	if (left === right) return true;
+	try {
+		return JSON.stringify(JSON.parse(left)) === JSON.stringify(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+function planReplicaSettingOps(desired, previous, options, onUnusable) {
+	const prev = options.fresh ? void 0 : previous;
+	const ops = [];
+	const removes = (setting) => options.keepOnRemoval?.has(setting) !== true;
+	const pitr = readPitrSpec(desired?.[PITR_KEY]);
+	const prevPitr = readPitrSpec(prev?.[PITR_KEY]);
+	if (pitr.kind === "unusable") onUnusable(pitr.reason);
+	else if (pitr.kind === "absent") {
+		if (prevPitr.kind !== "absent" && removes("pitr")) ops.push({
+			kind: "pitr",
+			enabled: false
+		});
+	} else {
+		const unchanged = prevPitr.kind === "usable" && prevPitr.enabled === pitr.enabled && prevPitr.recoveryPeriodInDays === pitr.recoveryPeriodInDays;
+		const noop = options.fresh && !pitr.enabled;
+		if (!unchanged && !noop) ops.push(pitr.recoveryPeriodInDays === void 0 ? {
+			kind: "pitr",
+			enabled: pitr.enabled
+		} : {
+			kind: "pitr",
+			enabled: pitr.enabled,
+			recoveryPeriodInDays: pitr.recoveryPeriodInDays
+		});
+	}
+	const desiredCi = readContributorInsightsSpec(desired?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH);
+	const ci = planContributorInsightsOp(desiredCi, readContributorInsightsSpec(prev?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH), onUnusable);
+	if (ci !== void 0 && !(options.fresh && ci.action === "DISABLE") && !(desiredCi.kind === "absent" && !removes("contributorInsights"))) ops.push(ci.mode === void 0 ? {
+		kind: "contributorInsights",
+		action: ci.action
+	} : {
+		kind: "contributorInsights",
+		action: ci.action,
+		mode: ci.mode
+	});
+	const kinesis = readKinesisSpec(desired?.[KINESIS_KEY]);
+	const prevKinesis = readKinesisSpec(prev?.[KINESIS_KEY]);
+	if (kinesis.kind === "unusable") onUnusable(kinesis.reason);
+	else if (kinesis.kind === "absent") {
+		if (prevKinesis.kind === "usable" && removes("kinesis")) ops.push({
+			kind: "kinesisDisable",
+			streamArn: prevKinesis.streamArn
+		});
+	} else if (prevKinesis.kind === "usable" && prevKinesis.streamArn === kinesis.streamArn) {
+		if (kinesis.precision !== void 0 && kinesis.precision !== prevKinesis.precision) ops.push({
+			kind: "kinesisPrecision",
+			streamArn: kinesis.streamArn,
+			precision: kinesis.precision
+		});
+		else if (kinesis.precision === void 0 && prevKinesis.precision !== void 0 && prevKinesis.precision !== DEFAULT_KINESIS_PRECISION && removes("kinesis")) ops.push({
+			kind: "kinesisPrecision",
+			streamArn: kinesis.streamArn,
+			precision: DEFAULT_KINESIS_PRECISION
+		});
+	} else {
+		if (prevKinesis.kind === "usable") ops.push({
+			kind: "kinesisDisable",
+			streamArn: prevKinesis.streamArn
+		});
+		ops.push(kinesis.precision === void 0 ? {
+			kind: "kinesisEnable",
+			streamArn: kinesis.streamArn
+		} : {
+			kind: "kinesisEnable",
+			streamArn: kinesis.streamArn,
+			precision: kinesis.precision
+		});
+	}
+	const policyOps = (want, had, replaced, put, del, setting) => {
+		if (want.kind === "unusable") {
+			onUnusable(want.reason);
+			return;
+		}
+		if (want.kind === "absent") {
+			if (had.kind !== "absent" && removes(setting)) ops.push(del);
+			return;
+		}
+		if (!replaced && had.kind === "usable" && samePolicyDocument$1(had.document, want.document)) return;
+		ops.push(put(want.document));
+	};
+	policyOps(readTablePolicy(desired), readTablePolicy(prev), false, (document) => ({
+		kind: "putTablePolicy",
+		document
+	}), { kind: "deleteTablePolicy" }, "tablePolicy");
+	policyOps(readStreamPolicy$1(desired), readStreamPolicy$1(prev), options.streamReplaced === true, (document) => ({
+		kind: "putStreamPolicy",
+		document
+	}), { kind: "deleteStreamPolicy" }, "streamPolicy");
+	return ops;
+}
+function planReplicaSettingCorrections(desired, live, only) {
+	const ops = [];
+	const pitr = readPitrSpec(desired?.[PITR_KEY]);
+	if (only.has("pitr") && pitr.kind === "usable" && live.pitr !== void 0) {
+		if (pitr.enabled && !live.pitr.enabled) ops.push(pitr.recoveryPeriodInDays === void 0 ? {
+			kind: "pitr",
+			enabled: pitr.enabled
+		} : {
+			kind: "pitr",
+			enabled: pitr.enabled,
+			recoveryPeriodInDays: pitr.recoveryPeriodInDays
+		});
+	}
+	const ci = readContributorInsightsSpec(desired?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH);
+	if (only.has("contributorInsights") && ci.kind === "usable" && live.contributorInsightsEnabled !== void 0 && live.contributorInsightsEnabled !== ci.enabled) ops.push(!ci.enabled ? {
+		kind: "contributorInsights",
+		action: "DISABLE"
+	} : ci.mode === void 0 ? {
+		kind: "contributorInsights",
+		action: "ENABLE"
+	} : {
+		kind: "contributorInsights",
+		action: "ENABLE",
+		mode: ci.mode
+	});
+	const kinesis = readKinesisSpec(desired?.[KINESIS_KEY]);
+	if (only.has("kinesis") && kinesis.kind === "usable" && live.kinesisStreamArns !== void 0 && !live.kinesisStreamArns.has(kinesis.streamArn)) ops.push(kinesis.precision === void 0 ? {
+		kind: "kinesisEnable",
+		streamArn: kinesis.streamArn
+	} : {
+		kind: "kinesisEnable",
+		streamArn: kinesis.streamArn,
+		precision: kinesis.precision
+	});
+	const tablePolicy = readTablePolicy(desired);
+	if (only.has("tablePolicy") && tablePolicy.kind === "usable" && live.hasTablePolicy === false) ops.push({
+		kind: "putTablePolicy",
+		document: tablePolicy.document
+	});
+	const streamPolicy = readStreamPolicy$1(desired);
+	if (only.has("streamPolicy") && streamPolicy.kind === "usable" && live.hasStreamPolicy === false) ops.push({
+		kind: "putStreamPolicy",
+		document: streamPolicy.document
+	});
+	return ops;
+}
+function declaredReplicaSettings(desired) {
+	const declared = /* @__PURE__ */ new Set();
+	if (readPitrSpec(desired?.["PointInTimeRecoverySpecification"]).kind === "usable") declared.add("pitr");
+	if (readContributorInsightsSpec(desired?.["ContributorInsightsSpecification"], CI_PATH).kind === "usable") declared.add("contributorInsights");
+	if (readKinesisSpec(desired?.["KinesisStreamSpecification"]).kind === "usable") declared.add("kinesis");
+	if (readTablePolicy(desired).kind === "usable") declared.add("tablePolicy");
+	if (readStreamPolicy$1(desired).kind === "usable") declared.add("streamPolicy");
+	return declared;
+}
+function enabledForReadStatus(status) {
+	if (status === "ENABLED" || status === "ENABLING") return true;
+	if (status === "DISABLED" || status === "DISABLING") return false;
+}
+function reverseMapReplicaPitr(status, recoveryPeriodInDays, declaredBlock) {
+	const enabled = enabledForReadStatus(status);
+	if (enabled === void 0) return void 0;
+	const block = { PointInTimeRecoveryEnabled: enabled };
+	if (!enabled) return block;
+	const declared = readPitrSpec(declaredBlock);
+	const period = recoveryPeriodInDays ?? (status === "ENABLING" ? (declared.kind === "usable" ? declared.recoveryPeriodInDays : void 0) ?? DEFAULT_RECOVERY_PERIOD_DAYS : void 0);
+	if (period !== void 0) block["RecoveryPeriodInDays"] = period;
+	return block;
+}
+function reverseMapReplicaContributorInsights(status, mode, declaredBlock) {
+	const enabled = enabledForReadStatus(status);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	const declared = readContributorInsightsSpec(declaredBlock, CI_PATH);
+	if (enabled && declared.kind === "usable" && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+const READBACK_5381_MEMBERS = [
+	"SSESpecification",
+	"TableClass",
+	"DeletionProtectionEnabled",
+	TABLE_POLICY_KEY,
+	REPLICA_STREAM_KEY
+];
+const READBACK_5381_NESTED = [[
+	PITR_KEY,
+	"RecoveryPeriodInDays",
+	"PointInTimeRecoveryEnabled"
+], [
+	CONTRIBUTOR_INSIGHTS_KEY,
+	"Mode",
+	"Enabled"
+]];
+function isPre5381ReplicaBaseline(baseline) {
+	if ("TableClass" in baseline || "DeletionProtectionEnabled" in baseline) return true;
+	const replicas = baseline["Replicas"];
+	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$1(r) && "KMSMasterKeyId" in r);
+}
+function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFromReadback = false) {
+	if (!isPre5381ReplicaBaseline(baseline)) return baseline;
+	const result = { ...baseline };
+	const topLevel = {};
+	for (const key of ["TableClass", "DeletionProtectionEnabled"]) if (key in result) {
+		topLevel[key] = result[key];
+		delete result[key];
+	}
+	const replicas = result["Replicas"];
+	if (!Array.isArray(replicas)) return result;
+	const awsReplicas = Array.isArray(aws["Replicas"]) ? aws["Replicas"] : [];
+	result["Replicas"] = replicas.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const region = element["Region"];
+		const entry = { ...element };
+		if (region === localRegion && localRegion !== "") {
+			for (const [key, value] of Object.entries(topLevel)) if (localFromReadback || !(key in entry)) entry[key] = value;
+		}
+		if ("KMSMasterKeyId" in entry) {
+			const key = entry["KMSMasterKeyId"];
+			delete entry["KMSMasterKeyId"];
+			if (!("SSESpecification" in entry)) entry["SSESpecification"] = { KMSMasterKeyId: key };
+		}
+		const live = awsReplicas.find((r) => isPlainObject$1(r) && r["Region"] === region);
+		if (live !== void 0) {
+			for (const member of READBACK_5381_MEMBERS) if (!(member in entry) && member in live) entry[member] = structuredClone(live[member]);
+			for (const [block, member, flag] of READBACK_5381_NESTED) {
+				const mine = entry[block];
+				const theirs = live[block];
+				if (isPlainObject$1(mine) && isPlainObject$1(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
+					...mine,
+					[member]: theirs[member]
+				};
+			}
+		}
+		return entry;
+	});
+	return result;
+}
+const UNREAD_REPLICA_MEMBERS = [
+	"TableClass",
+	"DeletionProtectionEnabled",
+	"SSESpecification"
+];
+function keepUnreadReplicaMembers(desired, previous) {
+	const replicas = desired["Replicas"];
+	const prevReplicas = previous["Replicas"];
+	if (!Array.isArray(replicas) || !Array.isArray(prevReplicas)) return desired;
+	const sse = desired["SSESpecification"];
+	const sseOn = isPlainObject$1(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
+	let changed = false;
+	const completed = replicas.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const live = prevReplicas.find((r) => isPlainObject$1(r) && r["Region"] === element["Region"]);
+		if (live === void 0) return element;
+		const entry = { ...element };
+		let touched = false;
+		for (const member of UNREAD_REPLICA_MEMBERS) {
+			if (member === "SSESpecification" && !sseOn) continue;
+			if (!(member in entry) && member in live) {
+				entry[member] = structuredClone(live[member]);
+				touched = true;
+			}
+		}
+		const pitr = entry[PITR_KEY];
+		const wantPitr = readPitrSpec(pitr);
+		const livePitr = readPitrSpec(live[PITR_KEY]);
+		if (isPlainObject$1(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
+			entry[PITR_KEY] = {
+				...pitr,
+				RecoveryPeriodInDays: livePitr.recoveryPeriodInDays
+			};
+			touched = true;
+		}
+		if (!touched) return element;
+		changed = true;
+		return entry;
+	});
+	return changed ? {
+		...desired,
+		Replicas: completed
+	} : desired;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-stream-members.ts
+const STREAM_SPECIFICATION_KEY$1 = "StreamSpecification";
+const STREAM_POLICY_KEY = "ResourcePolicy";
+const STREAM_TAGS_KEY = "Tags";
+const POLICY_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_POLICY_KEY}`;
+const TAGS_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_TAGS_KEY}`;
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function refusalOf(guard) {
+	try {
+		guard();
+		return;
+	} catch (error) {
+		return describeAwsFailure(error).detail;
+	}
+}
+function blockMembers(block) {
+	return isPlainObject(block) ? block : {};
+}
+function readStreamPolicy(block) {
+	const value = blockMembers(block)[STREAM_POLICY_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const containerRefusal = refusalOf(() => requireConfigObject(value, POLICY_PATH));
+	if (containerRefusal !== void 0) return {
+		kind: "unusable",
+		reason: containerRefusal
+	};
+	const documentPath = `${POLICY_PATH}.PolicyDocument`;
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${documentPath} must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (document === void 0 || document === null) return {
+		kind: "unusable",
+		reason: `${documentPath} is required when ${POLICY_PATH} is declared`
+	};
+	const documentRefusal = refusalOf(() => requireConfigObject(document, documentPath));
+	if (documentRefusal !== void 0) return {
+		kind: "unusable",
+		reason: documentRefusal
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+function readStreamTags(block) {
+	const value = blockMembers(block)[STREAM_TAGS_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!Array.isArray(value)) return {
+		kind: "unusable",
+		reason: `${TAGS_PATH} must be an array of {Key, Value} entries`
+	};
+	const tags = /* @__PURE__ */ new Map();
+	for (const [position, entry] of value.entries()) {
+		const entryPath = `${TAGS_PATH}[${position}]`;
+		const refusal = refusalOf(() => requireConfigObject(entry, entryPath)) ?? configStringRefusal(entry, "Key", "required", entryPath) ?? configStringRefusal(entry, "Value", "", entryPath);
+		if (refusal !== void 0) return {
+			kind: "unusable",
+			reason: refusal
+		};
+		const { Key: key, Value: tagValue } = entry;
+		if (typeof key !== "string") return {
+			kind: "unusable",
+			reason: `${entryPath}.Key is required`
+		};
+		tags.set(key, typeof tagValue === "string" ? tagValue : "");
+	}
+	return {
+		kind: "usable",
+		tags
+	};
+}
+function streamMemberRefusals(block) {
+	const refusals = [];
+	const policy = readStreamPolicy(block);
+	if (policy.kind === "unusable") refusals.push(policy.reason);
+	const tags = readStreamTags(block);
+	if (tags.kind === "unusable") refusals.push(tags.reason);
+	return refusals;
+}
+function planStreamMemberOps(desiredBlock, previousBlock, options, onUnusable) {
+	let desiredPolicy = readStreamPolicy(desiredBlock);
+	let desiredTags = readStreamTags(desiredBlock);
+	if (desiredPolicy.kind === "unusable") onUnusable(desiredPolicy.reason);
+	if (desiredTags.kind === "unusable") onUnusable(desiredTags.reason);
+	let previousPolicy = readStreamPolicy(previousBlock);
+	let previousTags = readStreamTags(previousBlock);
+	if (options.freshStream) {
+		if (desiredPolicy.kind === "unusable" && previousPolicy.kind === "usable") desiredPolicy = previousPolicy;
+		if (desiredTags.kind === "unusable" && previousTags.kind === "usable") desiredTags = previousTags;
+		previousPolicy = { kind: "absent" };
+		previousTags = { kind: "absent" };
+	} else if (options.contentsUnknown === true) {
+		previousPolicy = {
+			kind: "unusable",
+			reason: ""
+		};
+		previousTags = { kind: "absent" };
+	}
+	const tagOps = [];
+	if (desiredTags.kind !== "unusable") {
+		const desired = desiredTags.kind === "usable" ? desiredTags.tags : /* @__PURE__ */ new Map();
+		const previous = previousTags.kind === "usable" ? previousTags.tags : /* @__PURE__ */ new Map();
+		const keysToRemove = [...previous.keys()].filter((key) => !desired.has(key));
+		if (keysToRemove.length > 0) tagOps.push({
+			kind: "untag",
+			keys: keysToRemove
+		});
+		const tagsToSet = [...desired].filter(([key, value]) => previous.get(key) !== value).map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		if (tagsToSet.length > 0) tagOps.push({
+			kind: "tag",
+			tags: tagsToSet
+		});
+	}
+	const policyPut = desiredPolicy.kind === "usable" && !(previousPolicy.kind === "usable" && samePolicyDocument(previousPolicy.document, desiredPolicy.document));
+	const policyDelete = previousPolicy.kind !== "absent" && (desiredPolicy.kind === "absent" || policyPut && tagOps.length > 0);
+	const ops = [];
+	if (policyDelete) ops.push({ kind: "deletePolicy" });
+	ops.push(...tagOps);
+	if (policyPut && desiredPolicy.kind === "usable") ops.push({
+		kind: "putPolicy",
+		document: desiredPolicy.document
+	});
+	return ops;
+}
+function samePolicyDocument(left, right) {
+	if (left === right) return true;
+	try {
+		return canonicalJson(JSON.parse(left)) === canonicalJson(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+function streamDeclaresPolicy(desiredBlock) {
+	return readStreamPolicy(desiredBlock).kind === "usable";
+}
+function streamDeclaresTags(desiredBlock) {
+	return readStreamTags(desiredBlock).kind === "usable";
+}
+function reverseMapStreamPolicy(livePolicy, desiredBlock) {
+	if (livePolicy === void 0 || livePolicy === "") return void 0;
+	const declared = blockMembers(blockMembers(desiredBlock)[STREAM_POLICY_KEY])["PolicyDocument"];
+	let parsed;
+	try {
+		parsed = JSON.parse(livePolicy);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	if (typeof declared !== "string") return { PolicyDocument: parsed };
+	let declaredParsed;
+	try {
+		declaredParsed = JSON.parse(declared);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	return { PolicyDocument: canonicalJson(declaredParsed) === canonicalJson(parsed) ? declared : livePolicy };
+}
+function streamPolicyMatchesDeclared(livePolicy, desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	if (declared.kind !== "usable" || livePolicy === void 0) return false;
+	try {
+		return canonicalJson(JSON.parse(livePolicy)) === canonicalJson(JSON.parse(declared.document));
+	} catch {
+		return false;
+	}
+}
+function declaredStreamPolicyMember(desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	return declared.kind === "usable" ? reverseMapStreamPolicy(declared.document, desiredBlock) : void 0;
+}
+function declaredStreamTagsMember(desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	return declared.kind === "usable" ? [...declared.tags].map(([Key, Value]) => ({
+		Key,
+		Value
+	})) : void 0;
+}
+function streamTagsMatchDeclared(liveTags, desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	if (declared.kind !== "usable" || liveTags.length !== declared.tags.size) return false;
+	return liveTags.every((tag) => declared.tags.get(tag.Key) === tag.Value);
+}
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
 function isTableName(id) {
@@ -46668,6 +47451,8 @@ var DynamoDBGlobalTableProvider = class {
 			if (!onReplay) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${sseEnabledRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
 			onReplay(`${sseEnabledRefusal}. Encryption is enabled, the block's default.`);
 		}
+		const replicaSettingRefusal = replicaSettingsRefusal(properties, void 0, currentRegion);
+		if (replicaSettingRefusal !== void 0 && !replayWarn(log, context).onUnusable) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${replicaSettingRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
 		if (properties["SSESpecification"]) createParams.SSESpecification = toSdkTableSseSpecification(properties["SSESpecification"], readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion)));
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
@@ -46715,18 +47500,15 @@ var DynamoDBGlobalTableProvider = class {
 				if (!replicaTags || replicaTags.length === 0) continue;
 				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, resourceType, logicalId, tableName, maskSecrets);
 			}
-			if (properties["TimeToLiveSpecification"]) {
-				const ttl = properties["TimeToLiveSpecification"];
-				const attributeName = ttl["AttributeName"];
-				const enabled = ttl["Enabled"] !== void 0 ? Boolean(ttl["Enabled"]) : true;
-				if (attributeName) await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
-					TableName: tableName,
-					TimeToLiveSpecification: {
-						Enabled: enabled,
-						AttributeName: attributeName
-					}
-				}));
-			}
+			await this.applyReplicaSettings(tableName, logicalId, currentRegion, wiringProperties, void 0, /* @__PURE__ */ new Set(), false, replayWarn(log, context).onUnusable !== void 0, /* @__PURE__ */ new Set(), void 0, warn, maskSecrets);
+			const createTtl = planTimeToLive(properties["TimeToLiveSpecification"], void 0, "create");
+			if (createTtl.kind === "enable") await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
+				TableName: tableName,
+				TimeToLiveSpecification: {
+					Enabled: true,
+					AttributeName: createTtl.attributeName
+				}
+			}));
 			if (billingMode === "PROVISIONED") try {
 				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(wiringProperties, currentRegion), currentRegion, void 0, maskSecrets);
 			} catch (autoScalingErr) {
@@ -46859,7 +47641,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
-	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, warn, maskSecrets) {
+	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, desiredFromReadback, warn, maskSecrets) {
 		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 		for (const entry of desired) {
 			const replica = asRecord(entry);
@@ -46867,6 +47649,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (typeof region !== "string" || region === currentRegion || addedRegions.has(region)) continue;
 			const declared = readReplicaDeletionProtection(replica, region, warn);
 			if (declared === UNUSABLE) continue;
+			if (declared === void 0 && desiredFromReadback) continue;
 			const previous = readReplicaDeletionProtection(localReplicaEntry(previousProperties, region), region);
 			const newDpe = declared ?? false;
 			const oldDpe = previous === UNUSABLE ? void 0 : previous ?? false;
@@ -46997,6 +47780,227 @@ var DynamoDBGlobalTableProvider = class {
 			ReplicaUpdates: entries
 		};
 	}
+	async applyReplicaSettings(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, streamReplaced, replaying, keepOnRemoval, previousLocalStreamArn, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const fresh = previousProperties === void 0 || freshRegions.has(region);
+			const previous = previousProperties === void 0 ? void 0 : localReplicaEntry(previousProperties, region);
+			const ops = planReplicaSettingOps(replica, previous, {
+				fresh,
+				streamReplaced,
+				keepOnRemoval
+			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
+			if (!fresh && keepOnRemoval.has("pitr") && replica?.["PointInTimeRecoverySpecification"] == null && (() => {
+				const prior = readPitrSpec(previous?.["PointInTimeRecoverySpecification"]);
+				return prior.kind === "usable" && prior.enabled;
+			})()) warn(`The ${region} replica of ${tableName}: point-in-time recovery was not turned off, although the properties being applied (a rollback's recorded state, or a drift --revert read-back) declare none — turning it off would delete every recovery point. Turn it off by hand if that is intended.`);
+			const unchanged = fresh ? /* @__PURE__ */ new Set() : declaredReplicaSettings(replica);
+			for (const op of ops) unchanged.delete(settingOf(op));
+			if (ops.length === 0 && unchanged.size === 0) continue;
+			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, { ...region !== currentRegion && { region } });
+			let arns;
+			const describe = async () => {
+				if (arns === void 0) {
+					const described = await client.send(new DescribeTableCommand({ TableName: tableName }));
+					arns = {
+						...described.Table?.TableArn !== void 0 && { tableArn: described.Table.TableArn },
+						...described.Table?.LatestStreamArn !== void 0 && { streamArn: described.Table.LatestStreamArn }
+					};
+				}
+				return arns;
+			};
+			for (const op of ops) try {
+				await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			} catch (error) {
+				if (!replaying || !fresh || op.kind !== "putTablePolicy" || isInterruptedWaitError(error)) throw error;
+				warn(`The ${region} replica of ${tableName} was created without its ResourcePolicy: ${describeAwsFailure(error).summary}. The next deploy that updates this table puts it.`);
+			}
+			const priorStreamPolicy = readStreamPolicy$1(previous);
+			const desiredStreamPolicy = readStreamPolicy$1(replica);
+			const streamPolicyChanged = priorStreamPolicy.kind !== "absent" && desiredStreamPolicy.kind !== "unusable" && !(desiredStreamPolicy.kind === "absent" && keepOnRemoval.has("streamPolicy")) && !(priorStreamPolicy.kind === "usable" && desiredStreamPolicy.kind === "usable" && samePolicyDocument$1(priorStreamPolicy.document, desiredStreamPolicy.document));
+			if (region === currentRegion && streamReplaced && previousLocalStreamArn !== void 0 && streamPolicyChanged && (await describe()).streamArn !== previousLocalStreamArn) await this.deleteOldStreamPolicy(client, previousLocalStreamArn, tableName, warn, maskSecrets);
+			if (unchanged.size === 0) continue;
+			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets);
+			for (const op of planReplicaSettingCorrections(replica, live, unchanged)) {
+				const member = SETTING_MEMBER[settingOf(op)];
+				this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared ${member}`));
+				try {
+					await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+				} catch (convergeError) {
+					if (isInterruptedWaitError(convergeError)) throw convergeError;
+					this.logger.debug(maskSecrets(`Could not bring the ${region} replica of ${tableName} to its declared ${member}: ` + describeAwsFailure(convergeError).detail));
+					this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold its declared ${member}, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+				}
+			}
+		}
+	}
+	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets) {
+		const live = {};
+		const attempt = async (what, read) => {
+			try {
+				await read();
+			} catch (readError) {
+				this.logger.debug(maskSecrets(`Could not read ${what} of the ${region} replica of ${tableName}: ` + describeAwsFailure(readError).detail));
+			}
+		};
+		if (wanted.has("pitr")) await attempt("point-in-time recovery", async () => {
+			const pitr = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const status = pitr?.PointInTimeRecoveryStatus;
+			if (status === "ENABLED" || status === "DISABLED") live.pitr = {
+				enabled: status === "ENABLED",
+				...pitr?.RecoveryPeriodInDays !== void 0 && { recoveryPeriodInDays: pitr.RecoveryPeriodInDays }
+			};
+		});
+		if (wanted.has("contributorInsights")) await attempt("Contributor Insights", async () => {
+			const status = (await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }))).ContributorInsightsStatus;
+			if (status === "ENABLED" || status === "ENABLING") live.contributorInsightsEnabled = true;
+			else if (status === "DISABLED" || status === "DISABLING") live.contributorInsightsEnabled = false;
+		});
+		if (wanted.has("kinesis")) await attempt("the Kinesis streaming destination", async () => {
+			live.kinesisStreamArns = await this.activeKinesisStreamArns(client, tableName);
+		});
+		const hasPolicy = async (arn) => {
+			if (arn === void 0) return void 0;
+			try {
+				await client.send(new GetResourcePolicyCommand({ ResourceArn: arn }));
+				return true;
+			} catch (error) {
+				if (error instanceof PolicyNotFoundException) return false;
+				throw error;
+			}
+		};
+		if (wanted.has("tablePolicy")) await attempt("the resource policy", async () => {
+			const answer = await hasPolicy((await describe()).tableArn);
+			if (answer !== void 0) live.hasTablePolicy = answer;
+		});
+		if (wanted.has("streamPolicy")) await attempt("the stream resource policy", async () => {
+			const answer = await hasPolicy((await describe()).streamArn);
+			if (answer !== void 0) live.hasStreamPolicy = answer;
+		});
+		return live;
+	}
+	async deleteOldStreamPolicy(client, streamArn, tableName, warn, maskSecrets) {
+		try {
+			await this.retrySettlingRefusal(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the policy of the retired stream of ${tableName}`, maskSecrets);
+		} catch (error) {
+			if (isInterruptedWaitError(error)) throw error;
+			if (error instanceof PolicyNotFoundException || error instanceof ResourceNotFoundException$1) return;
+			warn(`The previous stream of ${tableName} (retired by the StreamViewType change) keeps its old resource policy until it expires: deleting it failed (${describeAwsFailure(error).summary}).`);
+		}
+	}
+	async kinesisStreaming(client, tableName, streamArn, refusal) {
+		if (isInterruptedWaitError(refusal)) throw refusal;
+		try {
+			return (await this.activeKinesisStreamArns(client, tableName)).has(streamArn);
+		} catch {
+			throw refusal;
+		}
+	}
+	async activeKinesisStreamArns(client, tableName) {
+		const out = await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }));
+		return new Set((out.KinesisDataStreamDestinations ?? []).filter((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING").flatMap((d) => d.StreamArn !== void 0 ? [d.StreamArn] : []));
+	}
+	async sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets) {
+		const scope = `the ${region} replica of ${tableName}`;
+		const arnFor = async (which) => {
+			const arn = (await describe())[which];
+			if (arn === void 0 || arn === "") throw new ProvisioningError(maskSecrets(`Cannot apply ${SETTING_MEMBER[settingOf(op)]} to ${scope}: DescribeTable returned no ${which === "tableArn" ? "TableArn" : "LatestStreamArn (the table has no stream)"}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+			return arn;
+		};
+		const send = (call) => this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		switch (op.kind) {
+			case "pitr":
+				await send(() => client.send(new UpdateContinuousBackupsCommand({
+					TableName: tableName,
+					PointInTimeRecoverySpecification: {
+						PointInTimeRecoveryEnabled: op.enabled,
+						...op.recoveryPeriodInDays !== void 0 && { RecoveryPeriodInDays: op.recoveryPeriodInDays }
+					}
+				})));
+				break;
+			case "contributorInsights":
+				await send(() => client.send(new UpdateContributorInsightsCommand({
+					TableName: tableName,
+					ContributorInsightsAction: op.action,
+					...op.mode !== void 0 && { ContributorInsightsMode: op.mode }
+				})));
+				break;
+			case "kinesisEnable":
+				if (await this.activeKinesisStreamArns(client, tableName).then((arns) => arns.has(op.streamArn), () => false)) break;
+				try {
+					await send(() => client.send(new EnableKinesisStreamingDestinationCommand({
+						TableName: tableName,
+						StreamArn: op.streamArn,
+						...op.precision !== void 0 && { EnableKinesisStreamingConfiguration: { ApproximateCreationDateTimePrecision: op.precision } }
+					})));
+				} catch (error) {
+					if (!await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
+				}
+				break;
+			case "kinesisDisable":
+				try {
+					await send(() => client.send(new DisableKinesisStreamingDestinationCommand({
+						TableName: tableName,
+						StreamArn: op.streamArn
+					})));
+				} catch (error) {
+					if (await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
+				}
+				break;
+			case "kinesisPrecision":
+				await send(() => client.send(new UpdateKinesisStreamingDestinationCommand({
+					TableName: tableName,
+					StreamArn: op.streamArn,
+					UpdateKinesisStreamingConfiguration: { ApproximateCreationDateTimePrecision: op.precision }
+				})));
+				break;
+			case "putTablePolicy":
+			case "putStreamPolicy": {
+				const arn = await arnFor(op.kind === "putTablePolicy" ? "tableArn" : "streamArn");
+				await send(() => client.send(new PutResourcePolicyCommand({
+					ResourceArn: arn,
+					Policy: op.document
+				})));
+				break;
+			}
+			case "deleteTablePolicy":
+			case "deleteStreamPolicy": {
+				if (op.kind === "deleteStreamPolicy" && (await describe()).streamArn === void 0) break;
+				const arn = await arnFor(op.kind === "deleteTablePolicy" ? "tableArn" : "streamArn");
+				try {
+					await send(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: arn })));
+				} catch (error) {
+					if (!(error instanceof PolicyNotFoundException)) throw error;
+				}
+				break;
+			}
+		}
+		this.logger.debug(maskSecrets(`Applied ${op.kind} to ${scope}`));
+	}
+	async retrySettlingRefusal(call, label, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB ${label}`));
+		try {
+			let delayMs = SETTLING_RETRY_INITIAL_MS;
+			for (let attempt = 1;; attempt++) try {
+				await call();
+				return;
+			} catch (error) {
+				const detail = describeAwsFailure(error).detail;
+				const name = error instanceof Error ? error.name : "";
+				if (!(/being enabled|being updated|please retry later|backups are being/i.test(detail) || name === "ResourceInUseException" || name === "LimitExceededException") || attempt >= 8) throw error;
+				this.logger.debug(maskSecrets(`Transient refusal of ${label} (attempt ${attempt}/${8}): ${detail} - retrying in ${delayMs}ms`));
+				await new Promise((resolve) => setTimeout(resolve, delayMs));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				delayMs = Math.min(delayMs * 2, 3e4);
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
 	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
 		try {
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
@@ -47105,6 +48109,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback === true) properties = keepUnreadReplicaMembers(properties, previousProperties);
 		const log = this.operationSinks(context, [[properties["TableName"], physicalId], [previousProperties["TableName"], physicalId]]);
 		const maskSecrets = log.mask;
 		const warn = log.warn;
@@ -47170,6 +48175,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
 			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
+			if (refusal === void 0) refusal = replicaSettingsRefusal(properties, previousProperties);
 			if (refusal !== void 0) refuse(refusal);
 		} else {
 			const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
@@ -47484,9 +48490,16 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
 			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
-			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, warn, maskSecrets);
+			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, context?.desiredFromAwsReadback === true, warn, maskSecrets);
 			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
 			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
+			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, new Set(context?.desiredFromAwsReadback === true ? [
+				"pitr",
+				"contributorInsights",
+				"kinesis",
+				"tablePolicy",
+				"streamPolicy"
+			] : context?.replayingState === true ? ["pitr"] : []), describeResp.Table?.LatestStreamArn, warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -47584,28 +48597,39 @@ var DynamoDBGlobalTableProvider = class {
 					try {
 						await this.dynamoDBClient.send(cmd);
 					} catch (ttlErr) {
-						if (describeAwsFailure(ttlErr).detail.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						const msg = describeAwsFailure(ttlErr).detail;
+						if (cmd.input.TimeToLiveSpecification?.Enabled === false && isTtlAlreadyDisabled(msg)) {
+							this.logger.debug(maskSecrets(`TimeToLive already disabled on ${physicalId}`));
+							return;
+						}
+						if (msg.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table (the interval can last up to about an hour); wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
-				const ttl = properties["TimeToLiveSpecification"];
-				if (ttl?.["AttributeName"]) await sendTtl(new UpdateTimeToLiveCommand({
+				const ttlPlan = planTimeToLive(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"], "update");
+				let ttlTarget;
+				if (ttlPlan.kind === "enable" || ttlPlan.kind === "disable") ttlTarget = {
+					enabled: ttlPlan.kind === "enable",
+					attributeName: ttlPlan.attributeName
+				};
+				else if (ttlPlan.kind === "disable-live") {
+					let live;
+					await this.retrySettlingRefusal(async () => {
+						live = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
+					}, `TimeToLive read on ${physicalId}`, maskSecrets);
+					const status = live?.TimeToLiveStatus;
+					if ((status === "ENABLED" || status === "ENABLING") && live?.AttributeName) ttlTarget = {
+						enabled: false,
+						attributeName: live.AttributeName
+					};
+				}
+				if (ttlTarget) await sendTtl(new UpdateTimeToLiveCommand({
 					TableName: physicalId,
 					TimeToLiveSpecification: {
-						Enabled: ttl["Enabled"] !== void 0 ? Boolean(ttl["Enabled"]) : true,
-						AttributeName: ttl["AttributeName"]
+						Enabled: ttlTarget.enabled,
+						AttributeName: ttlTarget.attributeName
 					}
 				}));
-				else if (previousProperties["TimeToLiveSpecification"]) {
-					const prevTtl = previousProperties["TimeToLiveSpecification"];
-					if (prevTtl["AttributeName"]) await sendTtl(new UpdateTimeToLiveCommand({
-						TableName: physicalId,
-						TimeToLiveSpecification: {
-							Enabled: false,
-							AttributeName: prevTtl["AttributeName"]
-						}
-					}));
-				}
 			}
 			const finalDescribe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const impliedStream = replicationImpliedStreamSpecification(properties);
@@ -48088,7 +49112,8 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
+		const afterOwnWrite = context?.afterOwnWrite === true;
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			if (!table) return void 0;
@@ -48108,21 +49133,37 @@ var DynamoDBGlobalTableProvider = class {
 				if (table.SSEDescription.SSEType !== void 0) sse["SSEType"] = table.SSEDescription.SSEType;
 				result["SSESpecification"] = sse;
 			}
-			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
-			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 			const tableNameForSubs = table.TableName ?? physicalId;
 			const sdkReplicas = table.Replicas && table.Replicas.length > 0 ? currentRegion && !table.Replicas.some((r) => r.RegionName === currentRegion) ? [...table.Replicas, { RegionName: currentRegion }] : table.Replicas : [{ RegionName: currentRegion }];
 			const replicas = await Promise.all(sdkReplicas.map(async (r) => {
 				const entry = { Region: r.RegionName };
-				if (r.KMSMasterKeyId !== void 0) entry["KMSMasterKeyId"] = r.KMSMasterKeyId;
 				if (!r.RegionName) return entry;
 				const isLocal = r.RegionName === currentRegion;
+				const kmsKey = isLocal ? table.SSEDescription?.Status === "ENABLED" ? table.SSEDescription.KMSMasterKeyArn : void 0 : r.KMSMasterKeyId;
+				if (kmsKey !== void 0 && kmsKey !== "") entry["SSESpecification"] = { KMSMasterKeyId: kmsKey };
+				entry["TableClass"] = (isLocal ? void 0 : r.ReplicaTableClassSummary?.TableClass) ?? table.TableClassSummary?.TableClass ?? "STANDARD";
+				const declaredReplica = properties ? localReplicaEntry(properties, r.RegionName) : void 0;
 				const client = isLocal ? this.dynamoDBClient : this.getRegionalClient(r.RegionName);
 				const regionLabel = r.RegionName;
 				const replicaArn = isLocal ? table.TableArn : table.TableArn ? this.replicaArnForRegion(table.TableArn, r.RegionName) : void 0;
-				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel);
+				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel, declaredReplica);
 				Object.assign(entry, subs);
+				let protection;
+				let streamArn;
+				if (isLocal) {
+					protection = table.DeletionProtectionEnabled;
+					streamArn = table.LatestStreamArn;
+				} else try {
+					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
+					protection = regional.Table?.DeletionProtectionEnabled;
+					streamArn = regional.Table?.LatestStreamArn;
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) this.logger.debug(safeMsg`Cross-region replica ${regionLabel} returned RNF on DescribeTable; omitting its protection and stream policy`);
+					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
+				}
+				if (typeof protection === "boolean") entry["DeletionProtectionEnabled"] = protection;
+				await this.readReplicaPolicies(client, tableNameForSubs, regionLabel, replicaArn, streamArn, declaredReplica, afterOwnWrite, entry);
 				if (replicaArn) try {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
 					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
@@ -48207,17 +49248,19 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readReplicaSubSpecs(client, tableName, regionLabel) {
+	async readReplicaSubSpecs(client, tableName, regionLabel, declaredReplica) {
 		const out = {};
 		try {
 			const ci = await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }));
-			if (ci.ContributorInsightsStatus) out["ContributorInsightsSpecification"] = { Enabled: ci.ContributorInsightsStatus === "ENABLED" };
+			const block = reverseMapReplicaContributorInsights(ci.ContributorInsightsStatus, ci.ContributorInsightsMode, declaredReplica?.["ContributorInsightsSpecification"]);
+			if (block !== void 0) out["ContributorInsightsSpecification"] = block;
 		} catch (err) {
 			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
-			const pitrStatus = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus;
-			if (pitrStatus) out["PointInTimeRecoverySpecification"] = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
+			const description = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const block = reverseMapReplicaPitr(description?.PointInTimeRecoveryStatus, description?.RecoveryPeriodInDays, declaredReplica?.["PointInTimeRecoverySpecification"]);
+			if (block !== void 0) out["PointInTimeRecoverySpecification"] = block;
 		} catch (err) {
 			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
@@ -48233,6 +49276,54 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		return out;
 	}
+	policyRereadDelaysMs = [
+		500,
+		1e3,
+		2e3
+	];
+	async readReplicaPolicies(client, tableName, regionLabel, tableArn, streamArn, declaredReplica, afterOwnWrite, entry) {
+		if (declaredReplica === void 0) return;
+		const readOne = async (what, arn, container) => {
+			if (arn === void 0 || arn === "") return void 0;
+			const declaredMember = () => declaredStreamPolicyMember(container);
+			let last;
+			const read = async () => {
+				try {
+					last = (await client.send(new GetResourcePolicyCommand({ ResourceArn: arn }))).Policy;
+				} catch (err) {
+					if (!(err instanceof PolicyNotFoundException)) throw err;
+					last = void 0;
+				}
+				return last;
+			};
+			try {
+				let live = await read();
+				for (const delayMs of afterOwnWrite ? this.policyRereadDelaysMs : []) {
+					if (streamPolicyMatchesDeclared(live, container)) break;
+					await new Promise((resolve) => setTimeout(resolve, delayMs));
+					live = await read();
+				}
+				if (afterOwnWrite && (live === void 0 || live === "")) {
+					this.logger.debug(safeMsg`Kept the declared ${what} of the ${regionLabel} replica of ${tableName} in the baseline captured after its write: the read still found no policy`);
+					return declaredMember();
+				}
+				return reverseMapStreamPolicy(live, container);
+			} catch (err) {
+				this.logger.debug(safeMsg`Could not read the ${what} of the ${regionLabel} replica of ${tableName}: ${describeAwsFailure(err).detail}`);
+				if (afterOwnWrite && last !== void 0 && last !== "") return reverseMapStreamPolicy(last, container);
+				if (afterOwnWrite && (isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1)) return declaredMember();
+				return;
+			}
+		};
+		if (readTablePolicy(declaredReplica).kind === "usable") {
+			const member = await readOne("ResourcePolicy", tableArn, declaredReplica);
+			if (member !== void 0) entry["ResourcePolicy"] = member;
+		}
+		if (readStreamPolicy$1(declaredReplica).kind === "usable") {
+			const member = await readOne("stream ResourcePolicy", streamArn, declaredReplica["ReplicaStreamSpecification"]);
+			if (member !== void 0) entry["ReplicaStreamSpecification"] = { ResourcePolicy: member };
+		}
+	}
 	async readAutoScalingSettings(tableName, scalableDimension, client, indexName) {
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
@@ -48312,33 +49403,14 @@ var DynamoDBGlobalTableProvider = class {
 			baseline,
 			aws
 		};
-		const key = "Replicas";
-		const baselineReplicas = baseline[key];
-		const awsReplicas = aws[key];
-		if (!Array.isArray(baselineReplicas) || !Array.isArray(awsReplicas)) return {
-			baseline,
-			aws
-		};
 		const localRegion = await this.dynamoDBClient.config.region() ?? "";
-		if (!localRegion) return {
-			baseline,
-			aws
-		};
-		const isLocal = (element) => asRecord(element)?.["Region"] === localRegion;
-		if (baselineReplicas.some(isLocal)) return {
+		const completed = completeLegacyLocalReplica(baseline, aws, localRegion);
+		const converted = canonicalizePre5381ReplicaBaseline(completed, aws, localRegion, completed !== baseline);
+		return converted === baseline ? {
 			baseline,
 			aws
-		};
-		const liveLocal = awsReplicas.find(isLocal);
-		if (liveLocal === void 0) return {
-			baseline,
-			aws
-		};
-		return {
-			baseline: {
-				...baseline,
-				[key]: [...baselineReplicas, structuredClone(liveLocal)]
-			},
+		} : {
+			baseline: converted,
 			aws
 		};
 	}
@@ -48473,11 +49545,50 @@ function refuseMalformedReplicaTags(properties, resourceType, logicalId, physica
 	});
 	return tagsByReplica;
 }
+function completeLegacyLocalReplica(baseline, aws, localRegion) {
+	const key = "Replicas";
+	const baselineReplicas = baseline[key];
+	const awsReplicas = aws[key];
+	if (!Array.isArray(baselineReplicas) || !Array.isArray(awsReplicas)) return baseline;
+	if (!localRegion) return baseline;
+	const isLocal = (element) => asRecord(element)?.["Region"] === localRegion;
+	if (baselineReplicas.some(isLocal)) return baseline;
+	const liveLocal = awsReplicas.find(isLocal);
+	if (liveLocal === void 0) return baseline;
+	return {
+		...baseline,
+		[key]: [...baselineReplicas, structuredClone(liveLocal)]
+	};
+}
 function localReplicaEntry(props, region) {
 	const raw = props["Replicas"];
 	if (!Array.isArray(raw)) return void 0;
 	return raw.find((r) => r?.["Region"] === region);
 }
+const REPLICA_SETTING_MEMBERS = [
+	"PointInTimeRecoverySpecification",
+	"ContributorInsightsSpecification",
+	"KinesisStreamSpecification",
+	"ResourcePolicy",
+	"ReplicaStreamSpecification"
+];
+function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
+	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
+		const region = asRecord(entry)?.["Region"];
+		return typeof region === "string" && region !== currentRegion;
+	});
+	for (const entry of desired) {
+		const replica = asRecord(entry);
+		const region = replica?.["Region"];
+		if (typeof region !== "string") continue;
+		const previous = previousProperties === void 0 ? void 0 : localReplicaEntry(previousProperties, region);
+		if (!(previous === void 0 || REPLICA_SETTING_MEMBERS.some((member) => !deepEqual(replica?.[member], previous[member])))) continue;
+		const [refusal] = replicaSettingRefusals(replica);
+		if (refusal !== void 0) return `The ${region} replica: ${refusal}`;
+		if ((previousProperties === void 0 ? crossRegionCreate : previous === void 0) && replica?.["ResourcePolicy"] !== void 0 && replica["ResourcePolicy"] !== null) return `The ${region} replica: Replicas[].ResourcePolicy cannot be set in the deploy that creates the replica — CloudFormation refuses it ("A replica cannot be created in the same stack update as putting a resource-based policy on that new replica"). ` + (previousProperties === void 0 ? `Deploy the table and its replicas without it` : `Deploy the replica without it`) + `, then add the policy in a later deploy`;
+	}
+}
 function extractLocalDeletionProtection(props, region) {
 	const local = localReplicaEntry(props, region);
 	const perReplica = coerceCfnBoolean(local?.["DeletionProtectionEnabled"]);
@@ -48610,6 +49721,8 @@ const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
 const DELETION_PROTECTION_REFLIP_MS = 16e3;
 const REPLICA_PROTECTION_SETTLE_POLLS = 60;
 const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
+const SETTLING_RETRY_ATTEMPTS = 8;
+const SETTLING_RETRY_INITIAL_MS = 2e3;
 const REPLICA_COPY_RELEASE_ATTEMPTS = 3;
 function isReplicaCopyExistsRefusal(error) {
 	return error instanceof Error && /one or more replicas already existed as tables/i.test(error.message);
@@ -52517,5 +53630,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { planOrphanAdoption as $, malformedLocalOutputsWarning as $a, hasReadableExportSet as $c, refuseUnreadableCdkCrossAccountRefs as $i, getDefaultStateBucketName as $l, awaitInFlightSibling as $n, withoutSilentDropProperties as $o, isRefusedByName as $r, hasMaskableValues as $s, resolveReplacementOldType as $t, inheritedProvenanceForChildDiff as A, lacksRecordedTableArn as Aa, recordMaskOnlyValuesIn as Ac, deleteLeftInPlace as Ai, buildDenyExternalAccessPolicy as Al, exportNameSecretExposure as An, refuseMalformedResourceEntriesForImportSave as Ao, secretNamePrintingBag as Ar, DagBuilder as As, readRefactorMarker as At, hasOwnKey as Au, conditionFingerprint as B, UNREADABLE_ORPHANS_CONTAINER_ROW as Ba, rebuildClientForBucketRegion as Bc, reEnableInstanceApiTermination as Bi, isDockerClientEnvKey as Bl, constructPathOf as Bn, repairMalformedOrphanRecordsForReadOnly as Bo, createPreDeleteFinalSnapshot as Br, noEchoOutputsComparison as Bs, refusePendingMovesOut as Bt, injectedAwsRegionValue as Bu, hasCdkAutoDeleteTag as C, carriesDynamicReference as Ca, physicalNameCopiesOf as Cc, customResourceResponseExpirationWarning as Ci, ensureAssetStorage as Cl, displayTextOrWithheld as Cn, refuseMalformedOutputs as Co, noEchoParameterNamesOf as Cr, prefetchCreateOnlyPropertyPaths as Cs, makeForeignHolderScan as Ct, AssemblyReader as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, AWS_NO_VALUE as Da, carriesSecretMask as Dc, RollbackInlinePolicyWriters as Di, readBootstrapMarkerBody as Dl, secretSafeKeyDisplay as Dn, refuseMalformedResourceEntriesForDeploy as Do, maskEventTextWithBoundBags as Dr, canonicalLambdaFunctionName as Ds, isAccessDeniedError as Dt, parseFailureDebugDetail as Du, markRefusedBeforeApplying as E, keepsSecretReferenceToken as Ea, splitGetAttStringForm as Ec, unchangedBehindSecretReference as Ei, parseBootstrapMarker as El, secretBearingStateKeyWarning as En, refuseMalformedResourceEntries as Eo, journaledOrphanPrintingBag as Er, withRetry as Es, chunks as Et, describeJsonParseFailure as Eu, findNestedTemplateTreeDefect as F, passedParameterClassesOf as Fa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fc, disableInstanceApiTermination as Fi, describeDockerFailure as Fl, isExportAliasCollision as Fn, refuseMalformedResourcePropertiesForOrphan as Fo, storedSecretNameNeedles as Fr, maskReadbackAtCoordinates as Fs, sameMove as Ft, describeFileReadFailure as Fu, enclosingDeadlineRemainingMs as G, hasReadableOrphans as Ga, isAccessDenied$1 as Gc, isSettledInstanceState as Gi, redactedDockerCause as Gl, movedToHint as Gn, repairMalformedResourcesForReadOnly as Go, earliestDefined as Gr, valueAtCoordinate as Gs, demoteSupersededOrphans as Gt, parentSuppliedValues as H, accountArgs as Ha, CrossPrefixScanCache as Hc, INTRINSIC_KEYS as Hi, partitionSensitiveEnv as Hl, formatDestructiveChange as Hn, repairMalformedOutputsForReadOnly as Ho, isFinalSnapshotError as Hr, readbackPathFor as Hs, replayRollback as Ht, resolveBucketRegion as Hu, isAbsoluteAssetPath as I, declaresNoEcho as Ia, isSingleDynamicReferenceToken as Ic, ec2InstanceProtectionSite as Ii, dockerSpawnEnvWithSensitive as Il, bindingSkippedOutputs as In, refuseMalformedResourcesForDeploy as Io, ATOMIC_FINAL_SNAPSHOT_TYPES as Ir, maskWholeValue as Is, updateRefactorMarker as It, displayAssemblyPath as Iu, isSecretBearingReferenceString as J, isReadableOrphanRecord as Ja, withStackInstanceIdWithheld as Jc, s3BucketDualStackDomainName as Ji, warnFinchArgvExposure as Jl, isPairableType as Jn, unreadableResourceEntries as Jo, withCreateTokenLedger as Jr, redactForState as Js, planFailedOps as Jt, withResourceDeadline as K, hasReadableOutputs as Ka, isNotImplemented as Kc, s3BucketArn as Ki, runDockerForeground as Kl, rollbackOrphanIds as Kn, unpreviewableOrphanRecords as Ko, ledgerForStack as Kr, liveMatchesUnresolvedTokenFrame as Ks, isJournaledOrphan as Kt, listNestedTemplateRows as L, JSON_LISTING_HOLE_VALUE as La, LockManager as Lc, isTerminationProtectionPropagationError as Li, finchSecretArgvRefusal as Ll, DEFAULT_RESOURCE_TIMEOUT_MS as Ln, refuseMalformedResourcesForDestroy as Lo, PRE_DELETE_SNAPSHOT_TYPES as Lr, maskedLeafCoordinatesOf as Ls, hasPendingMovesOut as Lt, renderAssemblyPathEscape as Lu, findServiceTokenRefusals as M, parseWebACLArn as Ma, recordNoEchoParameterFreshValue as Mc, withIndeterminateGuard as Mi, resolveDockerContextDirectory as Ml, noEchoParameterValueSeed as Mn, refuseMalformedResourcePropertiesForDestroy as Mo, secretNamedAttributeNamesOf as Mr, canonicalCoordinates as Ms, refactorMarkerMovesOf as Mt, nullPrototypeRecord as Mu, serviceTokenBlockingReason as N, withSharedDrainBudget as Na, recordProvenPublicExpression as Nc, isWaitAbandonedError as Ni, describeDockerCapturedOutput as Nl, collectDeclaredOutputNames as Nn, refuseMalformedResourcePropertiesForDrift as No, secretNamedRecordNeedles as Nr, isMarkedCoordinate as Ns, refactorMarkerRefusalMessage as Nt, ownValue as Nu, computeImplicitDeleteEdges as O, cfnRefValueFromPhysicalId as Oa, provenPublicValue as Oc, UNSPECIFIED_SKIP_REASON as Oi, validateAssetBucketName as Ol, carriedExportAliasExposure as On, refuseMalformedResourceEntriesForDestroy as Oo, namingSecretsWithRecordedNoEcho as Or, lambdaFunctionNameForMask as Os, lookupEachName as Ot, utf8ByteLength as Ou, childTemplateLoader as P, parameterInputsFor as Pa, wholeStringLeavesOf as Pc, markWaitAbandoned as Pi, describeDockerExecFailure as Pl, collectPublishedOutputNames as Pn, refuseMalformedResourcePropertiesForExport as Po, stateSecretNameNeedles as Pr, maskAtCoordinates as Ps, refuseRefactorMarker as Pt, absoluteAssemblyPathEscape as Pu, makeSiblingClaimReader as Q, malformedExportSourceWarning as Qa, exportNamesCarriedFrom as Qc, producerLookupOver as Qi, synthesisStatusMessage as Ql, proposeRenames as Qn, unwrittenCreateOnlyReplacement as Qo, extractDeploymentEventError as Qr, createUnionSecretMasker as Qs, replacementNeverSwapped as Qt, renderNestedTemplateTreeDefect as R, STATE_REGION_DIVERGED as Ra, isLockInfoExpired as Rc, observeThenDisableInstanceApiTermination as Ri, formatDockerLoginError as Rl, DEFAULT_RESOURCE_WARN_AFTER_MS as Rn, refuseMalformedResourcesForExport as Ro, buildFinalSnapshotIdentifier as Rr, noEchoCoordinatesOf as Rs, pendingMovesOutOf as Rt, resolveAssemblyPath as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, isImpossibleEmptyStoredAttribute as Sa, recoverMaskedOutput as Sc, applyCustomResourceResponseExpiration as Si, assertAssetBucketRegion as Sl, WITHHELD_NAME_DISPLAY as Sn, refuseMalformedOrphansForOrphan as So, noEchoExactEchoLeavesOf as Sr, requireConfigString as Ss, loadJournaledOrphans as St, derivePartitionAndUrlSuffix as Su, getPriorAttempts as T, isNamelessDynamicReferenceError as Ta, recordPhysicalNameCopy as Tc, slowCcOperationTimeoutMs as Ti, isCrossRegionRedirect as Tl, secretBearing as Tn, refuseMalformedResourceAttributesForOrphan as To, completedReplayEntries as Tr, describeTypeWithThrottleRetry as Ts, formatResourceLine as Tt, processStackMessages as Tu, readRecordedConditionVerdicts as U, deployRefusesOrphanRowsReason as Ua, applyCrossPrefixScan as Uc, IntrinsicFunctionResolver as Ui, redactDockerArgvValues as Ul, findRefactorHints as Un, repairMalformedResourceEntriesForReadOnly as Uo, refusesFinalSnapshot as Ur, readsNoEchoSource as Us, removeProtectionTypeList as Ut, conditionInputsFrom as V, UNREADABLE_RESOURCES_MAP_ROW as Va, CrossPrefixReadError as Vc, DiffCalculator as Vi, isMalformedEnvKey as Vl, findDestructiveChanges as Vn, repairMalformedOrphansForReadOnly as Vo, effectiveDeletionPolicy as Vr, passedNoEchoParametersOf as Vs, replayFailedOperations as Vt, clearBucketRegionCache as Vu, enclosingDeadlineExpired as W, displayLogicalId as Wa, crossPrefixDeniedWarning as Wc, poisonRenderedSpellingsCollidingIn as Wi, redactedCause as Wl, hintSidesOf as Wn, repairMalformedResourcePropertiesForReadOnly as Wo, unsupportedFinalSnapshotError as Wr, recordedNoEchoValuesOf as Ws, recordAfterRollbackUpdate as Wt, mergeNoChangeOutputs as X, malformedDriftResourcePropertiesWarning as Xa, acceptedCreateOnlyDropsOf as Xc, s3BucketWebsiteUrl as Xi, getDockerImageBySourceHash as Xl, mappingPairs as Xn, findActionableSilentDrops as Xo, DeploymentEventsReader as Xr, snapshotPassProvenance as Xs, recheckFailedPlan as Xt, keptWholeReasonText as Y, isReadableResourceEntry as Ya, splitImportedOps as Yc, s3BucketRegionalDomainName as Yi, AssetManifestLoader as Yl, looselyEqual as Yn, withheldAccountClause as Yo, acquireIdempotencyToken as Yr, recordReferenceProvenanceEntry as Ys, planRollback as Yt, makeCanonicalizePropertiesFn as Z, malformedExportNamesWarning as Za, describeRegionValueKind as Zc, resolveDynamicReferences as Zi, Synthesizer as Zl, parseMappingFile as Zn, findSilentDropProperties as Zo, DeploymentEventsStore as Zr, carryLogOnlyValues as Zs, recordUnderIdIsNotOwn as Zt, deleteTableWithIndexBusyRetry as _, regionLessSecretName as _a, pathCrossesDottedKey as _c, readsNoEchoDeleteValues as _i, createAssetRedirectResolver as _l, withNameGenerationReached as _n, refuseMalformedNestedChildOutputs as _o, supersededHolderOf as _r, configStringRefusal as _s, deleteJournaledOrphans as _t, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _u, isProtectionValueActive as a, assertFlagRoleArn as aa, shareLogOnlyValues as ac, refuseMalformedDesiredTags as ai, orphansAfterRollback as al, REDACTED_DELETE_ADDRESS_SKIP_REASON as an, malformedOrphansRefusalMessage as ao, cyan as ar, isStatefulRecreateTargetForReplace as as, displacedOpClause as at, resolveSkipPrefix as au, waitForIndexesSettled as b, parameterTypeMayLoseSecretIdentity as ba, inheritNestedStackParameterAssociations as bc, withPrintingSecrets as bi, AssetModeResolver as bl, reachableDivergentParameters as bn, refuseMalformedOrphans as bo, noEchoAttributeNamesOf as br, requireConfigArray as bs, isHandledOrphan as bt, PARTITION_TABLE as bu, DynamoDBGlobalTableProvider as c, isIamRoleArn as ca, errorCauseChain as cc, definedAttributes as ci, stackInstanceIdCarriedFrom as cl, redactedDeleteAddressSkip as cn, malformedOutputsWarning as co, red as cr, WARM_THROUGHPUT_MEMBERS as cs, getNestedRevertRun as ct, resolveUseCdkBootstrapAssets as cu, compensateRemovedDeletionProtection as d, applyCallerIdentityCredentials as da, scrubResourceRecord as dc, ProviderRegistry as di, timePhase as dl, nameGenerationCarriedFrom as dn, malformedResourcePropertiesWarning as do, deleteSupersededEntry as dr, toCfnInteger as ds, revertNestedChildFromJournal as dt, ssmResolvedValueType as du, keepHeldTokenProvenance as ea, literalSplitDelimitersOf as ec, markDeleteStarted as ei, hasReasonlessBaselineRefusal as el, seedsDeleteFirstGuard as en, malformedLocalResourceEntriesWarning as eo, destroyStackRecordsView as er, NO_CC_HANDLERS_REASON as es, pendingRequestCount as et, getLegacyStateBucketName as eu, deleteBudgetKey as f, callerEnvCredentials as fa, withPhysicalNameCopies as fc, ccBrokenReason as fi, AssetPublisher as fl, nameGenerationHighWaterOf as fn, malformedResourcesWarning as fo, holdsSupersededResources as fr, toFiniteNumber as fs, revertedNestedRowIds as ft, CFN_TEMPLATE_BODY_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, producerRegionsFromState as ga, isUncertifiedBaselineMaskPosition as gc, TemplateNoEchoReresolver as gi, buildAssetRedirectMap as gl, retiredNameGenerationsLeaving as gn, refuseDivergentRecordRegionForDestroy as go, supersededHeldByOtherTypeWarning as gr, configIntegerRefusal as gs, withNestedStackContext as gt, uploadCfnTemplate as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, classifyReplaySecretRegion as ha, dynamicReferenceTokens as hc, waitForLambdaFunctionActive as hi, WorkGraph as hl, retiredNameGenerationsAfter as hn, previewableOrphanRecords as ho, supersededAfterRollback as hr, configBooleanRefusal as hs, getCurrentNestedStackContext as ht, findLargeInlineResources as hu, PROTECTION_PROPERTY_BY_TYPE as i, applyRoleArnIfSet as ia, recordLogOnlyValue as ic, readTagList as ii, isReadableBag as il, inheritProducerRegions as in, malformedOrphanRowsKeptWarning as io, bold as ir, MULTI_REGION_RECREATE_BLOCKED_TYPES as is, NESTED_PENDING_PARENT_REASON as it, resolveCaptureObservedState as iu, deferredServiceTokenWarning as j, refStateLookupFromResource as ja, recordNoEchoAttributeValues as jc, deleteSkipReason as ji, buildDockerImage as jl, isWholeDynamicReferenceValue as jn, refuseMalformedResourceEntriesForOrphan as jo, secretNamePrintingBags as jr, TemplateParser as js, readRefactorMarkerOnce as jt, hasPlainPrototype$1 as ju, crossStackOutputProvenanceSource as k, isStalePlaceholderArnAttribute as ka, recordMaskOnlyValue as kc, deleteIndeterminateGuards as ki, validateContainerRepoName as kl, exportNameNoEchoParameters as kn, refuseMalformedResourceEntriesForImport as ko, orphanRecordsPrintingBag as kr, sameLambdaFunctionAddress as ks, withApiLimit as kt, defineOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, sendableAssumeRoleCommand as la, maskSecretsInError as lc, stringifyIfAssigned as li, PhaseClock as ll, updatePartialMessage as ln, malformedRenderedContainersWarning as lo, yellow as lr, coerceWarmThroughput as ls, nestedChildStackName as lt, stateBucketExistenceConfirmed as lu, resolveDynamoDbDeleteBudgetMs as m, classifyRecordedSecretRegion as ma, DYNAMIC_REFERENCE_TOKEN_SCAN as mc, wouldReturnToSdkProvider as mi, stringifyValue as ml, retiredAfterRollback as mn, malformedStateRefusalMessage as mo, removeSuperseded as mr, coerceCfnInteger as ms, collectNestedChildUnaddressed as mt, MIGRATE_TMP_PREFIX as mu, recordedProtectionEvidence as n, recordedOutputReferenceRegions as na, printingCorpusOf as nc, DBPROXY_TAG_OPTIONS as ni, importableOutputKeys as nl, findNestedStackTypeChanges as nn, malformedOrphanRecordsRefusalMessage as no, withStackRecords as nr, findReplacedReadersOfRecreateTargets as ns, keptForRetainedRecord as nt, resolveApp as nu, perType as o, assertSendableRoleArn as oa, unionOfSecretBags as oc, tagMapAsList as oi, orphansCarriedFrom as ol, isRedactedRecordedValue as on, malformedOrphansWarning as oo, gray as or, isStatefulRecreateTargetSync as os, displacedPhysicalIdShown as ot, resolveStateBucketWithDefault as ou, resolveDynamoDbDeleteBudgetClock as p, envCredentialsAreAssumedRole as pa, withoutPhysicalNameCopies as pc, isCustomResource as pi, isSensitiveAttributeName as pl, nameScopeOf as pn, malformedScrubResourceEntriesRefusalMessage as po, isSupersededResourceRecord as pr, coerceCfnBoolean as ps, withNestedRevertRun as pt, CFN_TEMPLATE_URL_LIMIT as pu, diffSecurity as q, hasReadableResources as qa, stackInstanceIdOf as qc, s3BucketDomainName as qi, runDockerStreaming as ql, withMovedTo as qn, unreadableOrphanRecords as qo, reserveStackCreateToken as qr, markSameGenerationBag as qs, isReplacementOrphan as qt, recordedProtectionNote as r, recordedReferenceRegions as ra, recordLogOnlyParameterValue as rc, planTagDiff as ri, importableOutputs as rl, getCurrentProducerRegions as rn, malformedOrphanRecordsWarning as ro, replacedDeleteFailureVerdict as rr, shownType as rs, recordRetainedForReadoption as rt, resolveAutoAssetStorage as ru, readProtection as s, explicitRoleArnOrThrow as sa, createSecretMasker as sc, tagPlanWarning as si, shouldRetainResource as sl, redactedDeleteAddressFields as sn, malformedOutputsRefusalMessage as so, green as sr, renderStatefulReason as ss, dropSettledNestedJournals as st, resolveStateBucketWithDefaultAndSource as su, DeployEngine as t, outputReferenceProvenanceOf as ta, logOnlyValueCount as tc, DBPROXY_TAGS_WHAT as ti, hasUnverifiableParameterRefusal as tl, orphanNeedsIdentity as tn, malformedLocalResourcesWarning as to, getStackRecords as tr, hasNoCloudControlHandlers as ts, resolvePendingCloudControlRequests as tt, loadCdkJson as tu, beginDeleteWait as u, AWS_CREDENTIAL_ENV_KEYS as ua, maskSecretsInText as uc, CC_BROKEN_REASON as ui, renderPhaseTimings as ul, updatePartialReason as un, malformedResourceEntriesWarning as uo, addSuperseded as ur, isWarmThroughputDecrease as us, recordDisplacedSkips as ut, warnDeprecatedNoPrefixCliFlag as uu, maskedLogger as v, coerceParameterTypedValue as va, spelledKeysOf as vc, isCustomResourceType as vi, loadPublishableAssetManifest as vl, computeParameterTaint as vn, refuseMalformedOrphanRecords as vo, supersededResourcesOf as vr, readConfigString as vs, dropFailedCommands as vt, decodeListingKey as vu, isTruthyCfnBoolean as w, carriesFetchableDynamicReference as wa, recordAttributeIdCopy as wc, CloudControlProvider as wi, getBootstrapMarkerKey as wl, exportAliasCollisionScrubWarning as wn, refuseMalformedOutputsForDestroy as wo, createReadOnlyAttributeHealerFactory as wr, templateResourceTypes as ws, sameJournaledOrphans as wt, StageLoadError as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, getAccountInfo as xa, recordNestedStackParameterExpressions as xc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xi, BOOTSTRAP_MARKER_PREFIX as xl, resourcesNamingDeclaredParameter as xn, refuseMalformedOrphansForDestroy as xo, noEchoComparisonForTemplate as xr, requireConfigObject as xs, journaledOrphanLines as xt, canonicalizeRegion as xu, relayedIndexBusyDelete as y, isUnboundTemplateParameter as ya, identityKeyFor as yc, getCurrentResourceSecrets as yi, rewriteTemplateAssetReferences as yl, namesAnyDeclaredParameter as yn, refuseMalformedOrphanRecordsForDestroy as yo, withoutSuperseded as yr, replayWarn as ys, dropFailedHint as yt, expectedOwnerParam as yu, templateIdentity as z, STATE_RESOURCES_MALFORMED as za, S3StateBackend as zc, reDisableInstanceApiTermination as zi, getDockerCmd as zl, maskingRetryLogger as zn, refuseMalformedState as zo, ccRoutedFinalSnapshotError as zr, noEchoLeavesOf as zs, pendingMovesRefusalMessage as zt, injectAwsRegion as zu };
-//# sourceMappingURL=deploy-engine-BOgsnnk0.js.map
+export { inheritedProvenanceForChildDiff as $, isStalePlaceholderArnAttribute as $a, carriesSecretMask as $c, deleteIndeterminateGuards as $i, readBootstrapMarkerBody as $l, exportNameSecretExposure as $n, refuseMalformedResourceEntriesForImport as $o, secretNamePrintingBag as $r, canonicalLambdaFunctionName as $s, readRefactorMarker as $t, parseFailureDebugDetail as $u, beginDeleteWait as A, assertSendableRoleArn as Aa, recordLogOnlyValue as Ac, tagPlanWarning as Ai, isReadableBag as Al, redactedDeleteAddressFields as An, malformedOrphansWarning as Ao, green as Ar, isStatefulRecreateTargetSync as As, dropSettledNestedJournals as At, resolveCaptureObservedState as Au, waitForIndexesSettled as B, producerRegionsFromState as Ba, DYNAMIC_REFERENCE_TOKEN_SCAN as Bc, readsNoEchoDeleteValues as Bi, stringifyValue as Bl, withNameGenerationReached as Bn, refuseDivergentRecordRegionForDestroy as Bo, supersededHolderOf as Br, configIntegerRefusal as Bs, deleteJournaledOrphans as Bt, MIGRATE_TMP_PREFIX as Bu, planContributorInsightsOp as C, refuseUnreadableCdkCrossAccountRefs as Ca, carryLogOnlyValues as Cc, markDeleteStarted as Ci, describeRegionValueKind as Cl, seedsDeleteFirstGuard as Cn, malformedLocalOutputsWarning as Co, destroyStackRecordsView as Cr, withoutSilentDropProperties as Cs, pendingRequestCount as Ct, Synthesizer as Cu, reverseMapTableContributorInsights as D, recordedReferenceRegions as Da, logOnlyValueCount as Dc, readTagList as Di, hasUnverifiableParameterRefusal as Dl, inheritProducerRegions as Dn, malformedOrphanRecordsWarning as Do, bold as Dr, shownType as Ds, NESTED_PENDING_PARENT_REASON as Dt, loadCdkJson as Du, reverseMapIndexContributorInsights as E, recordedOutputReferenceRegions as Ea, literalSplitDelimitersOf as Ec, planTagDiff as Ei, hasReasonlessBaselineRefusal as El, getCurrentProducerRegions as En, malformedOrphanRecordsRefusalMessage as Eo, replacedDeleteFailureVerdict as Er, findReplacedReadersOfRecreateTargets as Es, recordRetainedForReadoption as Et, getLegacyStateBucketName as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, applyCallerIdentityCredentials as Fa, maskSecretsInError as Fc, ccBrokenReason as Fi, PhaseClock as Fl, nameGenerationHighWaterOf as Fn, malformedResourcePropertiesWarning as Fo, holdsSupersededResources as Fr, toCfnInteger as Fs, revertedNestedRowIds as Ft, stateBucketExistenceConfirmed as Fu, S3_AUTO_DELETE_OBJECTS_TAG as G, getAccountInfo as Ga, identityKeyFor as Gc, applyCustomResourceResponseExpiration as Gi, rewriteTemplateAssetReferences as Gl, WITHHELD_NAME_DISPLAY as Gn, refuseMalformedOrphansForDestroy as Go, noEchoExactEchoLeavesOf as Gr, requireConfigObject as Gs, loadJournaledOrphans as Gt, expectedOwnerParam as Gu, planTimeToLive as H, coerceParameterTypedValue as Ha, isUncertifiedBaselineMaskPosition as Hc, getCurrentResourceSecrets as Hi, buildAssetRedirectMap as Hl, namesAnyDeclaredParameter as Hn, refuseMalformedOrphanRecords as Ho, withoutSuperseded as Hr, readConfigString as Hs, dropFailedHint as Ht, uploadCfnTemplate as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, callerEnvCredentials as Ia, maskSecretsInText as Ic, isCustomResource as Ii, renderPhaseTimings as Il, nameScopeOf as In, malformedResourcesWarning as Io, isSupersededResourceRecord as Ir, toFiniteNumber as Is, withNestedRevertRun as It, warnDeprecatedNoPrefixCliFlag as Iu, getPriorAttempts as J, carriesFetchableDynamicReference as Ja, recoverMaskedOutput as Jc, slowCcOperationTimeoutMs as Ji, assertAssetBucketRegion as Jl, secretBearing as Jn, refuseMalformedOutputsForDestroy as Jo, completedReplayEntries as Jr, templateResourceTypes as Js, formatResourceLine as Jt, derivePartitionAndUrlSuffix as Ju, hasCdkAutoDeleteTag as K, isImpossibleEmptyStoredAttribute as Ka, inheritNestedStackParameterAssociations as Kc, customResourceResponseExpirationWarning as Ki, AssetModeResolver as Kl, displayTextOrWithheld as Kn, refuseMalformedOrphansForOrphan as Ko, noEchoParameterNamesOf as Kr, requireConfigString as Ks, makeForeignHolderScan as Kt, PARTITION_TABLE as Ku, deleteTableWithIndexBusyRetry as L, envCredentialsAreAssumedRole as La, scrubResourceRecord as Lc, wouldReturnToSdkProvider as Li, timePhase as Ll, retiredAfterRollback as Ln, malformedScrubResourceEntriesRefusalMessage as Lo, removeSuperseded as Lr, coerceCfnBoolean as Ls, collectNestedChildUnaddressed as Lt, ssmResolvedValueType as Lu, deleteBudgetKey as M, isIamRoleArn as Ma, unionOfSecretBags as Mc, stringifyIfAssigned as Mi, orphansCarriedFrom as Ml, updatePartialMessage as Mn, malformedOutputsWarning as Mo, yellow as Mr, WARM_THROUGHPUT_MEMBERS as Ms, nestedChildStackName as Mt, resolveStateBucketWithDefault as Mu, resolveDynamoDbDeleteBudgetClock as N, sendableAssumeRoleCommand as Na, createSecretMasker as Nc, CC_BROKEN_REASON as Ni, shouldRetainResource as Nl, updatePartialReason as Nn, malformedRenderedContainersWarning as No, addSuperseded as Nr, coerceWarmThroughput as Ns, recordDisplacedSkips as Nt, resolveStateBucketWithDefaultAndSource as Nu, stripIndexContributorInsights as O, applyRoleArnIfSet as Oa, printingCorpusOf as Oc, refuseMalformedDesiredTags as Oi, importableOutputKeys as Ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as On, malformedOrphanRowsKeptWarning as Oo, cyan as Or, MULTI_REGION_RECREATE_BLOCKED_TYPES as Os, displacedOpClause as Ot, resolveApp as Ou, resolveDynamoDbDeleteBudgetMs as P, AWS_CREDENTIAL_ENV_KEYS as Pa, errorCauseChain as Pc, ProviderRegistry as Pi, stackInstanceIdCarriedFrom as Pl, nameGenerationCarriedFrom as Pn, malformedResourceEntriesWarning as Po, deleteSupersededEntry as Pr, isWarmThroughputDecrease as Ps, revertNestedChildFromJournal as Pt, resolveUseCdkBootstrapAssets as Pu, crossStackOutputProvenanceSource as Q, cfnRefValueFromPhysicalId as Qa, splitGetAttStringForm as Qc, UNSPECIFIED_SKIP_REASON as Qi, parseBootstrapMarker as Ql, exportNameNoEchoParameters as Qn, refuseMalformedResourceEntriesForDestroy as Qo, orphanRecordsPrintingBag as Qr, emrClusterInstancesReplaced as Qs, withApiLimit as Qt, describeJsonParseFailure as Qu, maskedLogger as R, classifyRecordedSecretRegion as Ra, withPhysicalNameCopies as Rc, waitForLambdaFunctionActive as Ri, AssetPublisher as Rl, retiredNameGenerationsAfter as Rn, malformedStateRefusalMessage as Ro, supersededAfterRollback as Rr, coerceCfnInteger as Rs, getCurrentNestedStackContext as Rt, CFN_TEMPLATE_BODY_LIMIT as Ru, indexDeclaresContributorInsights as S, producerLookupOver as Sa, snapshotPassProvenance as Sc, isRefusedByName as Si, acceptedCreateOnlyDropsOf as Sl, resolveReplacementOldType as Sn, malformedExportSourceWarning as So, awaitInFlightSibling as Sr, unwrittenCreateOnlyReplacement as Ss, planOrphanAdoption as St, getDockerImageBySourceHash as Su, readContributorInsightsSpec as T, outputReferenceProvenanceOf as Ta, hasMaskableValues as Tc, DBPROXY_TAG_OPTIONS as Ti, hasReadableExportSet as Tl, findNestedStackTypeChanges as Tn, malformedLocalResourcesWarning as To, withStackRecords as Tr, hasNoCloudControlHandlers as Ts, keptForRetainedRecord as Tt, getDefaultStateBucketName as Tu, readTtlSpec as U, isUnboundTemplateParameter as Ua, pathCrossesDottedKey as Uc, withPrintingSecrets as Ui, createAssetRedirectResolver as Ul, reachableDivergentParameters as Un, refuseMalformedOrphanRecordsForDestroy as Uo, noEchoAttributeNamesOf as Ur, replayWarn as Us, isHandledOrphan as Ut, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Uu, isTtlAlreadyDisabled as V, regionLessSecretName as Va, dynamicReferenceTokens as Vc, isCustomResourceType as Vi, WorkGraph as Vl, computeParameterTaint as Vn, refuseMalformedNestedChildOutputs as Vo, supersededResourcesOf as Vr, configStringRefusal as Vs, dropFailedCommands as Vt, findLargeInlineResources as Vu, ECR_AUTO_DELETE_IMAGES_TAG as W, parameterTypeMayLoseSecretIdentity as Wa, spelledKeysOf as Wc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Wi, loadPublishableAssetManifest as Wl, resourcesNamingDeclaredParameter as Wn, refuseMalformedOrphans as Wo, noEchoComparisonForTemplate as Wr, requireConfigArray as Ws, journaledOrphanLines as Wt, decodeListingKey as Wu, IMPLICIT_DELETE_DEPENDENCIES as X, keepsSecretReferenceToken as Xa, recordAttributeIdCopy as Xc, unchangedBehindSecretReference as Xi, getBootstrapMarkerKey as Xl, secretSafeKeyDisplay as Xn, refuseMalformedResourceEntries as Xo, maskEventTextWithBoundBags as Xr, withRetry as Xs, isAccessDeniedError as Xt, StageLoadError as Xu, markRefusedBeforeApplying as Y, isNamelessDynamicReferenceError as Ya, physicalNameCopiesOf as Yc, onlySecretReferencesDiffer as Yi, ensureAssetStorage as Yl, secretBearingStateKeyWarning as Yn, refuseMalformedResourceAttributesForOrphan as Yo, journaledOrphanPrintingBag as Yr, describeTypeWithThrottleRetry as Ys, chunks as Yt, AssemblyReader as Yu, computeImplicitDeleteEdges as Z, AWS_NO_VALUE as Za, recordPhysicalNameCopy as Zc, RollbackInlinePolicyWriters as Zi, isCrossRegionRedirect as Zl, carriedExportAliasExposure as Zn, refuseMalformedResourceEntriesForDeploy as Zo, namingSecretsWithRecordedNoEcho as Zr, ecsServiceLaunchTypeSetOrChanged as Zs, lookupEachName as Zt, processStackMessages as Zu, streamMemberRefusals as _, s3BucketDomainName as _a, valueAtCoordinate as _c, withCreateTokenLedger as _i, isAccessDenied$1 as _l, planFailedOps as _n, hasReadableResources as _o, isPairableType as _r, unreadableOrphanRecords as _s, isSecretBearingReferenceString as _t, redactedDockerCause as _u, isProtectionValueActive as a, disableInstanceApiTermination as aa, isMarkedCoordinate as ac, ownValue as ad, ATOMIC_FINAL_SNAPSHOT_TYPES as ai, recordProvenPublicExpression as al, updateRefactorMarker as an, passedParameterClassesOf as ao, bindingSkippedOutputs as ar, refuseMalformedResourcePropertiesForOrphan as as, isAbsoluteAssetPath as at, describeDockerCapturedOutput as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketWebsiteUrl as ba, redactForState as bc, DeploymentEventsStore as bi, withStackInstanceIdWithheld as bl, recordUnderIdIsNotOwn as bn, malformedDriftResourcePropertiesWarning as bo, parseMappingFile as br, findActionableSilentDrops as bs, makeCanonicalizePropertiesFn as bt, warnFinchArgvExposure as bu, DynamoDBGlobalTableProvider as c, observeThenDisableInstanceApiTermination as ca, maskWholeValue as cc, displayAssemblyPath as cd, ccRoutedFinalSnapshotError as ci, isSingleDynamicReferenceToken as cl, pendingMovesRefusalMessage as cn, STATE_REGION_DIVERGED as co, maskingRetryLogger as cr, refuseMalformedResourcesForExport as cs, templateIdentity as ct, dockerSpawnEnvWithSensitive as cu, declaredStreamPolicyMember as d, DiffCalculator as da, noEchoLeavesOf as dc, injectAwsRegion as dd, isFinalSnapshotError as di, S3StateBackend as dl, replayRollback as dn, UNREADABLE_RESOURCES_MAP_ROW as do, formatDestructiveChange as dr, repairMalformedOrphansForReadOnly as ds, parentSuppliedValues as dt, getDockerCmd as du, deleteLeftInPlace as ea, lambdaFunctionNameForMask as ec, utf8ByteLength as ed, secretNamePrintingBags as ei, provenPublicValue as el, readRefactorMarkerOnce as en, lacksRecordedTableArn as eo, isWholeDynamicReferenceValue as er, refuseMalformedResourceEntriesForImportSave as es, deferredServiceTokenWarning as et, validateAssetBucketName as eu, declaredStreamTagsMember as f, INTRINSIC_KEYS as fa, noEchoOutputsComparison as fc, injectedAwsRegionValue as fd, refusesFinalSnapshot as fi, rebuildClientForBucketRegion as fl, removeProtectionTypeList as fn, accountArgs as fo, findRefactorHints as fr, repairMalformedOutputsForReadOnly as fs, readRecordedConditionVerdicts as ft, isDockerClientEnvKey as fu, streamDeclaresTags as g, s3BucketArn as ga, recordedNoEchoValuesOf as gc, reserveStackCreateToken as gi, crossPrefixDeniedWarning as gl, isReplacementOrphan as gn, hasReadableOutputs as go, withMovedTo as gr, unpreviewableOrphanRecords as gs, diffSecurity as gt, redactedCause as gu, streamDeclaresPolicy as h, isSettledInstanceState as ha, readsNoEchoSource as hc, ledgerForStack as hi, applyCrossPrefixScan as hl, isJournaledOrphan as hn, hasReadableOrphans as ho, rollbackOrphanIds as hr, repairMalformedResourcesForReadOnly as hs, withResourceDeadline as ht, redactDockerArgvValues as hu, PROTECTION_PROPERTY_BY_TYPE as i, markWaitAbandoned as ia, canonicalCoordinates as ic, nullPrototypeRecord as id, storedSecretNameNeedles as ii, recordNoEchoParameterFreshValue as il, sameMove as in, parameterInputsFor as io, isExportAliasCollision as ir, refuseMalformedResourcePropertiesForExport as is, findNestedTemplateTreeDefect as it, resolveDockerContextDirectory as iu, compensateRemovedDeletionProtection as j, explicitRoleArnOrThrow as ja, shareLogOnlyValues as jc, definedAttributes as ji, orphansAfterRollback as jl, redactedDeleteAddressSkip as jn, malformedOutputsRefusalMessage as jo, red as jr, renderStatefulReason as js, getNestedRevertRun as jt, resolveSkipPrefix as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, assertFlagRoleArn as ka, recordLogOnlyParameterValue as kc, tagMapAsList as ki, importableOutputs as kl, isRedactedRecordedValue as kn, malformedOrphansRefusalMessage as ko, gray as kr, isStatefulRecreateTargetForReplace as ks, displacedPhysicalIdShown as kt, resolveAutoAssetStorage as ku, STREAM_POLICY_KEY as l, reDisableInstanceApiTermination as la, maskedLeafCoordinatesOf as lc, renderAssemblyPathEscape as ld, createPreDeleteFinalSnapshot as li, LockManager as ll, refusePendingMovesOut as ln, STATE_RESOURCES_MALFORMED as lo, constructPathOf as lr, refuseMalformedState as ls, conditionFingerprint as lt, finchSecretArgvRefusal as lu, reverseMapStreamPolicy as m, poisonRenderedSpellingsCollidingIn as ma, readbackPathFor as mc, resolveBucketRegion as md, earliestDefined as mi, CrossPrefixScanCache as ml, demoteSupersededOrphans as mn, displayLogicalId as mo, movedToHint as mr, repairMalformedResourcePropertiesForReadOnly as ms, enclosingDeadlineRemainingMs as mt, partitionSensitiveEnv as mu, recordedProtectionEvidence as n, withIndeterminateGuard as na, DagBuilder as nc, hasOwnKey as nd, secretNamedRecordNeedles as ni, recordMaskOnlyValuesIn as nl, refactorMarkerRefusalMessage as nn, parseWebACLArn as no, collectDeclaredOutputNames as nr, refuseMalformedResourcePropertiesForDestroy as ns, serviceTokenBlockingReason as nt, buildDenyExternalAccessPolicy as nu, perType as o, ec2InstanceProtectionSite as oa, maskAtCoordinates as oc, absoluteAssemblyPathEscape as od, PRE_DELETE_SNAPSHOT_TYPES as oi, wholeStringLeavesOf as ol, hasPendingMovesOut as on, declaresNoEcho as oo, DEFAULT_RESOURCE_TIMEOUT_MS as or, refuseMalformedResourcesForDeploy as os, listNestedTemplateRows as ot, describeDockerExecFailure as ou, planStreamMemberOps as p, IntrinsicFunctionResolver as pa, passedNoEchoParametersOf as pc, clearBucketRegionCache as pd, unsupportedFinalSnapshotError as pi, CrossPrefixReadError as pl, recordAfterRollbackUpdate as pn, deployRefusesOrphanRowsReason as po, hintSidesOf as pr, repairMalformedResourceEntriesForReadOnly as ps, enclosingDeadlineExpired as pt, isMalformedEnvKey as pu, isTruthyCfnBoolean as q, carriesDynamicReference as qa, recordNestedStackParameterExpressions as qc, CloudControlProvider as qi, BOOTSTRAP_MARKER_PREFIX as ql, exportAliasCollisionScrubWarning as qn, refuseMalformedOutputs as qo, createReadOnlyAttributeHealerFactory as qr, prefetchCreateOnlyPropertyPaths as qs, sameJournaledOrphans as qt, canonicalizeRegion as qu, recordedProtectionNote as r, isWaitAbandonedError as ra, TemplateParser as rc, hasPlainPrototype$1 as rd, stateSecretNameNeedles as ri, recordNoEchoAttributeValues as rl, refuseRefactorMarker as rn, withSharedDrainBudget as ro, collectPublishedOutputNames as rr, refuseMalformedResourcePropertiesForDrift as rs, childTemplateLoader as rt, buildDockerImage as ru, readProtection as s, isTerminationProtectionPropagationError as sa, maskReadbackAtCoordinates as sc, describeFileReadFailure as sd, buildFinalSnapshotIdentifier as si, WHOLE_DYNAMIC_REFERENCE_PATTERN as sl, pendingMovesOutOf as sn, JSON_LISTING_HOLE_VALUE as so, DEFAULT_RESOURCE_WARN_AFTER_MS as sr, refuseMalformedResourcesForDestroy as ss, renderNestedTemplateTreeDefect as st, describeDockerFailure as su, DeployEngine as t, deleteSkipReason as ta, sameLambdaFunctionAddress as tc, defineOwnKey as td, secretNamedAttributeNamesOf as ti, recordMaskOnlyValue as tl, refactorMarkerMovesOf as tn, refStateLookupFromResource as to, noEchoParameterValueSeed as tr, refuseMalformedResourceEntriesForOrphan as ts, findServiceTokenRefusals as tt, validateContainerRepoName as tu, STREAM_TAGS_KEY as u, reEnableInstanceApiTermination as ua, noEchoCoordinatesOf as uc, resolveAssemblyPath as ud, effectiveDeletionPolicy as ui, isLockInfoExpired as ul, replayFailedOperations as un, UNREADABLE_ORPHANS_CONTAINER_ROW as uo, findDestructiveChanges as ur, repairMalformedOrphanRecordsForReadOnly as us, conditionInputsFrom as ut, formatDockerLoginError as uu, streamPolicyMatchesDeclared as v, s3BucketDualStackDomainName as va, liveMatchesUnresolvedTokenFrame as vc, acquireIdempotencyToken as vi, isNotImplemented as vl, planRollback as vn, isReadableOrphanRecord as vo, looselyEqual as vr, unreadableResourceEntries as vs, keptWholeReasonText as vt, runDockerForeground as vu, planIndexContributorInsightsOps as w, keepHeldTokenProvenance as wa, createUnionSecretMasker as wc, DBPROXY_TAGS_WHAT as wi, exportNamesCarriedFrom as wl, orphanNeedsIdentity as wn, malformedLocalResourceEntriesWarning as wo, getStackRecords as wr, NO_CC_HANDLERS_REASON as ws, resolvePendingCloudControlRequests as wt, synthesisStatusMessage as wu, contributorInsightsRefusals as x, resolveDynamicReferences as xa, recordReferenceProvenanceEntry as xc, extractDeploymentEventError as xi, splitImportedOps as xl, replacementNeverSwapped as xn, malformedExportNamesWarning as xo, proposeRenames as xr, findSilentDropProperties as xs, makeSiblingClaimReader as xt, AssetManifestLoader as xu, streamTagsMatchDeclared as y, s3BucketRegionalDomainName as ya, markSameGenerationBag as yc, DeploymentEventsReader as yi, stackInstanceIdOf as yl, recheckFailedPlan as yn, isReadableResourceEntry as yo, mappingPairs as yr, withheldAccountClause as ys, mergeNoChangeOutputs as yt, runDockerStreaming as yu, relayedIndexBusyDelete as z, classifyReplaySecretRegion as za, withoutPhysicalNameCopies as zc, TemplateNoEchoReresolver as zi, isSensitiveAttributeName as zl, retiredNameGenerationsLeaving as zn, previewableOrphanRecords as zo, supersededHeldByOtherTypeWarning as zr, configBooleanRefusal as zs, withNestedStackContext as zt, CFN_TEMPLATE_URL_LIMIT as zu };
+//# sourceMappingURL=deploy-engine-DSpxEUjC.js.map