@go-to-k/cdkd 0.307.0 → 0.308.1

package/dist/{deploy-engine-BOgsnnk0.js → deploy-engine-CDjAtIrn.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-Dhhyrf1v.js";
+import { t as getCdkdVersion } from "./version-BWqrjGBS.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11,7 +11,7 @@ import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionConfigurationCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstanceAttributeCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeNatGatewaysCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, ListTagsOfResourceCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
 import { DescribeApiDestinationCommand, DescribeConnectionCommand } from "@aws-sdk/client-eventbridge";
@@ -7845,7 +7845,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$7(value) {
+function isPlainObject$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -8101,7 +8101,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$7(args)) return void 0;
+		if (!isPlainObject$9(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -8147,7 +8147,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$7(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$9(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -8441,12 +8441,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
+	if (!isPlainObject$9(resolvedProperties) || !isPlainObject$9(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
+	if (!isPlainObject$9(resolvedParameters) || !isPlainObject$9(sourceParameters)) return;
 	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -8495,7 +8495,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$7(sourceLeaf)) return void 0;
+		if (!isPlainObject$9(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -8832,7 +8832,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 		}
 		return { value: out };
 	}
-	if (!isPlainObject$7(node)) return void 0;
+	if (!isPlainObject$9(node)) return void 0;
 	const keys = Object.keys(node);
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
@@ -8873,7 +8873,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 }
 function evaluatePureSub(args, bind, pseudo, evaluate) {
 	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
-	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$9(variables)) return;
 	const bound = /* @__PURE__ */ new Map();
 	for (const [name, variable] of Object.entries(variables)) {
 		const evaluated = evaluate(variable);
@@ -8906,7 +8906,7 @@ function bindReadName(name, bind, pseudo) {
 function collectRereadConditions(node, names, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
-	if (!isPlainObject$7(node)) return true;
+	if (!isPlainObject$9(node)) return true;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
@@ -8917,7 +8917,7 @@ function collectRereadConditions(node, names, depth = 0) {
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
-	if (!isPlainObject$7(node)) return false;
+	if (!isPlainObject$9(node)) return false;
 	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
 }
 function rendersReadTo(spelling, parentSecrets, value) {
@@ -8960,7 +8960,7 @@ function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return true;
 	if (typeof node === "string") return node.includes("{{resolve:");
 	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
-	if (!isPlainObject$7(node)) return false;
+	if (!isPlainObject$9(node)) return false;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (Object.keys(node).length !== 1) return true;
@@ -9073,7 +9073,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$7(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$9(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -9105,7 +9105,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$7(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$9(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -9268,7 +9268,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$7(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$9(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -9296,7 +9296,7 @@ const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 ]);
 function arrayElementDrop(element, depth = 0) {
 	if (depth > 16) return "unknown";
-	if (!isPlainObject$7(element)) return "never";
+	if (!isPlainObject$9(element)) return "never";
 	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
 	const keys = Object.keys(element);
 	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
@@ -9332,7 +9332,7 @@ function keptLiteralsCorroborate(kept, bag, secrets) {
 	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
 }
 function isIntrinsicNode(value) {
-	if (!isPlainObject$7(value)) return false;
+	if (!isPlainObject$9(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
 }
@@ -9345,7 +9345,7 @@ function keptElementCorroborates(source, bag, secrets, depth = 0) {
 	if (source === null || typeof source !== "object") return source === bag;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
-	if (!isPlainObject$7(source) || !isPlainObject$7(bag)) return false;
+	if (!isPlainObject$9(source) || !isPlainObject$9(bag)) return false;
 	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
 	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
 }
@@ -9355,12 +9355,12 @@ function corroboratesWhateverResolves(source, depth = 0) {
 	if (source === null || typeof source !== "object") return true;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
-	if (!isPlainObject$7(source)) return false;
+	if (!isPlainObject$9(source)) return false;
 	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
 	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
 }
 function arrayPairsWhateverDrops(source) {
-	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	if (!source.some((element) => isPlainObject$9(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
 	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -9377,13 +9377,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$7(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$9(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 		const reread = positionByParameterReread(bag, source, secrets);
 		if (reread !== void 0) return reread;
 	}
-	if (typeof bag === "string" && isPlainObject$7(source)) {
+	if (typeof bag === "string" && isPlainObject$9(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -9393,7 +9393,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$7(source)) {
+	if (Array.isArray(bag) && isPlainObject$9(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -9428,7 +9428,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) {
 			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
@@ -9450,7 +9450,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$7(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$9(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -9487,7 +9487,7 @@ function nameScalarSecrets(value, secrets) {
 			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
 		}
 		if (Array.isArray(node)) return node.map(walk);
-		if (isPlainObject$7(node) && hasPlainPrototype(node)) {
+		if (isPlainObject$9(node) && hasPlainPrototype(node)) {
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
 			return out;
@@ -9504,13 +9504,13 @@ function substitutionIsSecret(value) {
 function sentinelDefinitionOf(source) {
 	const subs = source["DefinitionSubstitutions"];
 	const values = /* @__PURE__ */ new Map();
-	if (isPlainObject$7(subs)) {
+	if (isPlainObject$9(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
 	}
 	for (const key of ["DefinitionString", "Definition"]) {
 		if (!Object.hasOwn(source, key)) continue;
 		const raw = source[key];
-		const body = typeof raw === "string" ? raw : isPlainObject$7(raw) ? JSON.stringify(raw) : void 0;
+		const body = typeof raw === "string" ? raw : isPlainObject$9(raw) ? JSON.stringify(raw) : void 0;
 		if (body === void 0) continue;
 		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
 		const names = [];
@@ -9581,7 +9581,7 @@ function sentinelDefinitionOf(source) {
 				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
 				return;
 			}
-			if (isPlainObject$7(node)) {
+			if (isPlainObject$9(node)) {
 				const own = new Set(Object.keys(node).map(written));
 				for (const [k, v] of Object.entries(node)) {
 					if (!marked(k)) keys.add(k);
@@ -9609,7 +9609,7 @@ function alignedSecretLeaf(root, leaf) {
 			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
 			cursor = cursor[segment];
 		} else {
-			if (!isPlainObject$7(cursor)) return void 0;
+			if (!isPlainObject$9(cursor)) return void 0;
 			const own = Object.keys(cursor);
 			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
 			if (!Object.hasOwn(cursor, segment)) return void 0;
@@ -9620,7 +9620,7 @@ function alignedSecretLeaf(root, leaf) {
 }
 function collectObjectKeys(value, into) {
 	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
-	else if (isPlainObject$7(value)) for (const [k, v] of Object.entries(value)) {
+	else if (isPlainObject$9(value)) for (const [k, v] of Object.entries(value)) {
 		into.add(k);
 		collectObjectKeys(v, into);
 	}
@@ -9633,7 +9633,7 @@ function spelledKeysOf(properties) {
 }
 function someKeyIsUnspelled(value, spelled) {
 	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
-	if (isPlainObject$7(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	if (isPlainObject$9(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
 	return false;
 }
 function nameDefinitionSecrets(value, source, secrets) {
@@ -9728,8 +9728,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$7(a)) {
-		if (!isPlainObject$7(b)) return false;
+	if (isPlainObject$9(a)) {
+		if (!isPlainObject$9(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -9746,7 +9746,7 @@ function renderedDefinitionLiterals(source) {
 	const keyKeep = /* @__PURE__ */ new Set();
 	const subs = source["DefinitionSubstitutions"];
 	const scalars = [];
-	if (isPlainObject$7(subs)) {
+	if (isPlainObject$9(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
 			scalars.push([name, String(value)]);
 			if (typeof value === "string") keep.add(value);
@@ -9758,7 +9758,7 @@ function renderedDefinitionLiterals(source) {
 		if (!Object.hasOwn(source, key)) continue;
 		const body = source[key];
 		if (typeof body === "string") bodies.push(body);
-		else if (isPlainObject$7(body)) bodies.push(JSON.stringify(body));
+		else if (isPlainObject$9(body)) bodies.push(JSON.stringify(body));
 	}
 	for (const body of bodies) {
 		let rendered = body;
@@ -9809,7 +9809,7 @@ function collectScalarLeaves(value, into) {
 		return;
 	}
 	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
-	else if (isPlainObject$7(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+	else if (isPlainObject$9(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
 }
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
 	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9827,7 +9827,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, s
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
-	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$9(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
@@ -9854,7 +9854,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
-	if (failClosed === true && isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+	if (failClosed === true && isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
 		const keep = renderedDefinitionLiterals(source);
 		const out = Object.create(null);
 		const rest = Object.create(null);
@@ -9888,7 +9888,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return out;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -9915,14 +9915,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$7(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$9(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$7(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$9(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -9932,8 +9932,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$7(source)) {
-		if (!isPlainObject$7(bag)) return false;
+	if (isPlainObject$9(source)) {
+		if (!isPlainObject$9(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -10024,13 +10024,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$7(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$9(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(refused) && isPlainObject$7(scanned)) {
+	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(refused) && isPlainObject$9(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -11520,7 +11520,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$7(variables) ? variables : void 0;
+				const vars = isPlainObject$9(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -11554,7 +11554,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$7(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$9(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -11570,7 +11570,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$7(value)) {
+				if (!isPlainObject$9(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -11619,7 +11619,7 @@ function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, con
 	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
 		parameters: noEchoParameters,
 		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), {
+	}, (coordinate, node) => nodes.set(canonicalJson$4(coordinate), {
 		coordinate,
 		node
 	}));
@@ -11631,7 +11631,7 @@ function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames
 	if (properties === null || typeof properties !== "object") return bag;
 	const coordinates = /* @__PURE__ */ new Map();
 	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
-	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$3(coordinate), coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$4(coordinate), coordinate);
 	const recordLeaf = (leaf) => {
 		if (typeof leaf === "string") {
 			if (leaf === "***" || leaf.includes("{{resolve:")) return;
@@ -11655,7 +11655,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$7(value)) {
+	if (isPlainObject$9(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -11678,7 +11678,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$7(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$9(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -11694,7 +11694,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$7(node)) return { ...node };
+	if (isPlainObject$9(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -11761,20 +11761,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$7(element)) return path;
+			if (key === void 0 || !isPlainObject$9(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$7(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$9(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$7(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$9(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$7(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$9(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -11803,7 +11803,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$7(v) ? !isPlainObject$7(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$9(v) ? !isPlainObject$9(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -11832,8 +11832,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$7(v) && isPlainObject$7(s)) {
-			const tt = isPlainObject$7(t) ? t : {};
+		if (isPlainObject$9(v) && isPlainObject$9(s)) {
+			const tt = isPlainObject$9(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -11856,13 +11856,13 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$7(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$9(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
-	return canonicalJson$3(a) === canonicalJson$3(b);
+	return canonicalJson$4(a) === canonicalJson$4(b);
 }
-function canonicalJson$3(value) {
+function canonicalJson$4(value) {
 	return JSON.stringify(value, (_key, node) => {
 		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
 		const sorted = Object.create(null);
@@ -11900,7 +11900,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$7(node)) {
+				if (isPlainObject$9(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11943,8 +11943,8 @@ function noEchoOutputsComparison(templateValues, sources) {
 	return (current, desired) => {
 		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
 		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
-		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$3(desired[key])));
-		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$3(desired[key]))) maskedKeys.add(key);
+		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$4(desired[key])));
+		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$4(desired[key]))) maskedKeys.add(key);
 		if (maskedKeys.size === 0) return {
 			current,
 			desired,
@@ -11958,7 +11958,7 @@ function noEchoOutputsComparison(templateValues, sources) {
 			const stored = current[key];
 			if (containsMask(stored)) continue;
 			normalized = { ...normalized ?? {} };
-			normalized[key] = canonicalJson$3(stored) === canonicalJson$3(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+			normalized[key] = canonicalJson$4(stored) === canonicalJson$4(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
 		}
 		return {
 			current: normalized,
@@ -12557,6 +12557,43 @@ function lambdaFunctionNameForMask(value) {
 
 //#endregion
 //#region src/analyzer/replacement-rules.ts
+function vpcInstanceTenancyChangeReplaces(oldValue, newValue) {
+	const tenancyOf = (v) => v == null ? "default" : String(v);
+	return tenancyOf(newValue) !== "default" && tenancyOf(newValue) !== tenancyOf(oldValue);
+}
+function instanceSecurityGroupIdsChangeReplaces(oldValue, newValue, siblings) {
+	if (siblings === void 0) return false;
+	if (Array.isArray(oldValue) && Array.isArray(newValue)) {
+		const before = new Set(oldValue.map(String));
+		const after = new Set(newValue.map(String));
+		if (before.size === after.size && [...before].every((g) => after.has(g))) return false;
+	}
+	return siblings.newProperties["SubnetId"] == null;
+}
+function instanceBlockDeviceMappingsChangeReplaces(oldValue, newValue) {
+	return !blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue);
+}
+function blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue) {
+	if (!Array.isArray(oldValue) || !Array.isArray(newValue)) return false;
+	if (oldValue.length !== newValue.length) return false;
+	const strip = (m) => {
+		if (m === null || typeof m !== "object" || Array.isArray(m)) return m;
+		const out = { ...m };
+		const ebs = out["Ebs"];
+		if (ebs !== null && typeof ebs === "object" && !Array.isArray(ebs)) {
+			const rest = { ...ebs };
+			delete rest["DeleteOnTermination"];
+			out["Ebs"] = rest;
+		}
+		return out;
+	};
+	return oldValue.every((m, i) => isDeepStrictEqual(scalarsAsStrings(strip(m)), scalarsAsStrings(strip(newValue[i]))));
+}
+function scalarsAsStrings(value) {
+	if (Array.isArray(value)) return value.map(scalarsAsStrings);
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, scalarsAsStrings(v)]));
+	return typeof value === "number" || typeof value === "boolean" ? String(value) : value;
+}
 function durableConfigPresenceToggled(oldValue, newValue) {
 	return oldValue == null !== (newValue == null);
 }
@@ -12617,13 +12654,43 @@ function glueTableNameChanged(oldValue, newValue) {
 function natZoneAddressesAddedToAutomaticGateway(oldValue, newValue) {
 	return oldValue == null && newValue != null;
 }
+function ecsServiceLaunchTypeSetOrChanged(oldValue, newValue) {
+	return newValue != null && !isDeepStrictEqual(oldValue, newValue);
+}
+const EMR_INSTANCES_IN_PLACE_MEMBERS = ["TerminationProtected", "UnhealthyNodeReplacement"];
+const EMR_GROUP_IN_PLACE_MEMBERS = ["InstanceCount", "AutoScalingPolicy"];
+const EMR_FLEET_IN_PLACE_MEMBERS = ["TargetOnDemandCapacity", "TargetSpotCapacity"];
+function withoutKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+	const copy = { ...value };
+	for (const key of keys) delete copy[key];
+	return copy;
+}
+function emrInstancesReplacingPart(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+	const instances = withoutKeys(value, EMR_INSTANCES_IN_PLACE_MEMBERS);
+	const strip = (key, keys) => {
+		if (!(key in instances)) return;
+		const member = instances[key];
+		instances[key] = Array.isArray(member) ? member.map((entry) => withoutKeys(entry, keys)) : withoutKeys(member, keys);
+	};
+	strip("CoreInstanceGroup", EMR_GROUP_IN_PLACE_MEMBERS);
+	strip("TaskInstanceGroups", EMR_GROUP_IN_PLACE_MEMBERS);
+	strip("CoreInstanceFleet", EMR_FLEET_IN_PLACE_MEMBERS);
+	strip("TaskInstanceFleets", EMR_FLEET_IN_PLACE_MEMBERS);
+	return instances;
+}
+function emrClusterInstancesReplaced(oldValue, newValue) {
+	if (oldValue === void 0 && newValue === void 0) return true;
+	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
 	constructor() {
 		this.initializeRules();
 	}
-	requiresReplacement(resourceType, propertyPath, oldValue, newValue) {
+	requiresReplacement(resourceType, propertyPath, oldValue, newValue, siblings) {
 		const rule = this.rules.get(resourceType);
 		if (!rule) {
 			this.logger.debug(`No replacement rule for ${resourceType}, conservatively assuming replacement may be required for ${propertyPath}`);
@@ -12637,16 +12704,16 @@ var ReplacementRulesRegistry = class {
 		if (rule.conditionalReplacements?.has(propertyPath)) {
 			const condition = rule.conditionalReplacements.get(propertyPath);
 			if (condition) {
-				const requires = condition(oldValue, newValue);
+				const requires = condition(oldValue, newValue, siblings);
 				this.logger.debug(`Conditional replacement for ${propertyPath} of ${resourceType}: ${requires}`);
 				return requires;
 			}
 		}
 		return false;
 	}
-	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
+	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings) {
 		const condition = this.rules.get(resourceType)?.conditionalReplacements?.get(propertyPath);
-		return condition === void 0 ? void 0 : condition(oldValue, newValue);
+		return condition === void 0 ? void 0 : condition(oldValue, newValue, siblings);
 	}
 	isClassified(resourceType, propertyPath) {
 		const rule = this.rules.get(resourceType);
@@ -12925,6 +12992,15 @@ var ReplacementRulesRegistry = class {
 			"TargetRole"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
+		this.rules.set("AWS::EC2::VPC", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"CidrBlock",
+				"Ipv4IpamPoolId",
+				"Ipv4NetmaskLength",
+				"VpcEncryptionControl"
+			]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["InstanceTenancy", vpcInstanceTenancyChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::Subnet", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"VpcId",
@@ -12933,14 +13009,17 @@ var ReplacementRulesRegistry = class {
 			]),
 			updateableProperties: /* @__PURE__ */ new Set(["MapPublicIpOnLaunch", "Tags"])
 		});
-		this.rules.set("AWS::EC2::Instance", { replacementProperties: /* @__PURE__ */ new Set([
-			"EbsOptimized",
-			"AvailabilityZone",
-			"ImageId",
-			"SubnetId",
-			"KeyName",
-			"NetworkInterfaces"
-		]) });
+		this.rules.set("AWS::EC2::Instance", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"EbsOptimized",
+				"AvailabilityZone",
+				"ImageId",
+				"SubnetId",
+				"KeyName",
+				"NetworkInterfaces"
+			]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["SecurityGroupIds", instanceSecurityGroupIdsChangeReplaces], ["BlockDeviceMappings", instanceBlockDeviceMappingsChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::NatGateway", {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", natZoneAddressesAddedToAutomaticGateway]])
@@ -12974,6 +13053,14 @@ var ReplacementRulesRegistry = class {
 			"TaskRoleArn",
 			"Volumes"
 		]) });
+		this.rules.set("AWS::ECS::Service", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["LaunchType", ecsServiceLaunchTypeSetOrChanged]])
+		});
+		this.rules.set("AWS::EMR::Cluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Instances", emrClusterInstancesReplaced]])
+		});
 		this.rules.set("AWS::ElasticLoadBalancingV2::ListenerRule", { replacementProperties: /* @__PURE__ */ new Set(["ListenerArn"]) });
 		this.logger.debug(`Initialized replacement rules for ${this.rules.size} resource types`);
 	}
@@ -14853,7 +14940,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -14893,7 +14980,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$6(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$8(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -14905,7 +14992,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -14918,7 +15005,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -14932,7 +15019,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -14946,10 +15033,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$6(value) {
+function isPlainObject$8(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -14976,7 +15063,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -15153,6 +15240,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AIOps::InvestigationGroup",
 	"AWS::IoTSiteWise::Workspace",
+	"AWS::CloudWatch::Space",
 	"AWS::Rbin::Rule",
 	"AWS::SMSVOICE::PhoneNumber",
 	"AWS::SMSVOICE::SenderId"
@@ -15265,8 +15353,8 @@ async function findReplacedReadersOfRecreateTargets(input) {
 		}
 		return pending;
 	};
-	const isCreateOnly = async (type, key, plainReference) => {
-		if (rules.requiresReplacement(type, key, void 0, void 0)) return true;
+	const isCreateOnly = async (type, key, plainReference, siblings) => {
+		if (rules.requiresReplacement(type, key, void 0, void 0, siblings)) return true;
 		if (rules.isClassified(type, key)) return false;
 		const keys = await wholeCreateOnlyKeys(type);
 		return plainReference ? keys.whole.has(key) : keys.confirmable.has(key);
@@ -15285,7 +15373,11 @@ async function findReplacedReadersOfRecreateTargets(input) {
 			for (const key of keys) {
 				if (stableTargets.has(replacedId) && idOnly.get(replacedId)?.get(readerId)?.has(key)) continue;
 				const plain = isPlainReferenceTo(resource.Properties?.[key], replacedId, resources[replacedId]?.Type);
-				if (await isCreateOnly(resource.Type, key, plain)) properties.push(key);
+				const siblings = {
+					oldProperties: record.properties ?? {},
+					newProperties: resource.Properties ?? {}
+				};
+				if (await isCreateOnly(resource.Type, key, plain, siblings)) properties.push(key);
 			}
 			if (properties.length === 0) continue;
 			replaced.add(readerId);
@@ -17013,19 +17105,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::EFS::MountTarget", {
 		handled: /* @__PURE__ */ new Set([
 			"FileSystemId",
-			"SecurityGroups",
-			"SubnetId"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["IpAddress", "not yet implemented by cdkd"],
-			["IpAddressType", "not yet implemented by cdkd"],
-			["Ipv6Address", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
 			"IpAddress",
 			"IpAddressType",
-			"Ipv6Address"
+			"Ipv6Address",
+			"SecurityGroups",
+			"SubnetId"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Id"]),
 		ccRouteUnavailable: false
 	}],
@@ -18249,6 +18336,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Route53::HostedZone", {
 		handled: /* @__PURE__ */ new Set([
+			"DelegationSetId",
 			"HostedZoneConfig",
 			"HostedZoneFeatures",
 			"HostedZoneTags",
@@ -18256,8 +18344,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"QueryLoggingConfig",
 			"VPCs"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["DelegationSetId", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["DelegationSetId"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Id", "NameServers"]),
 		ccRouteUnavailable: false
 	}],
@@ -19981,12 +20069,12 @@ function declaresNoEcho(definition) {
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	if (value === void 0) return "null";
-	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$3).join(",")}]`;
 	if (value !== null && typeof value === "object") {
 		const record = value;
-		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$2(record[key])}`).join(",")}}`;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$3(record[key])}`).join(",")}}`;
 	}
 	return JSON.stringify(value) ?? "null";
 }
@@ -20007,7 +20095,7 @@ function splitInputFingerprint(entry) {
 	};
 }
 function templateCarriesNeedle(templateValue, secrets) {
-	const text = canonicalJson$2(templateValue);
+	const text = canonicalJson$3(templateValue);
 	for (const needle of printingCorpusOf(secrets).keys()) {
 		if (needle.length < 4) continue;
 		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
@@ -20015,14 +20103,14 @@ function templateCarriesNeedle(templateValue, secrets) {
 	return false;
 }
 function maskedPropertyFingerprint(templateValue) {
-	const digest = createHash("sha256").update(canonicalJson$2({
+	const digest = createHash("sha256").update(canonicalJson$3({
 		layout: FINGERPRINT_LAYOUT$1,
 		value: templateValue
 	})).digest("hex");
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -20030,7 +20118,7 @@ const NESTED_STACK_TYPE$4 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
-	const text = canonicalJson$2(value);
+	const text = canonicalJson$3(value);
 	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
 	for (const corpus of corpora) {
 		if (corpus === void 0) continue;
@@ -20042,7 +20130,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$5(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$7(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -20053,7 +20141,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$5(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$7(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -20104,7 +20192,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$5(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$7(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -20129,7 +20217,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$5(value)) return false;
+		if (!isPlainObject$7(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -20141,7 +20229,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -20155,7 +20243,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$5(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$7(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -20171,7 +20259,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$5(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$7(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -20186,7 +20274,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$5(value)) return;
+		if (!isPlainObject$7(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -20219,7 +20307,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -20248,8 +20336,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$5(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$5(map)) return "unknown";
+	const map = isPlainObject$7(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$7(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -20317,7 +20405,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$5(value)) return {
+	if (!isPlainObject$7(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -20380,7 +20468,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -20433,8 +20521,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$5(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$5(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$7(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$7(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -20458,34 +20546,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$5(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$7(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$5(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$7(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$5(properties)) return "unknown";
+	if (!isPlainObject$7(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$5(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$7(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$5(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$7(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$5(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$7(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$5(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$7(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -20502,7 +20590,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$5(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$7(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -20515,8 +20603,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$5(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$5(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$7(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$7(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -20588,7 +20676,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$5(value)) return "clean";
+	if (!isPlainObject$7(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -20603,7 +20691,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -20667,7 +20755,7 @@ async function maskedInputFingerprint(templateValue, sources) {
 		if (error instanceof UnknownInput) return void 0;
 		throw error;
 	}
-	const digest = createHash("sha256").update(canonicalJson$2({
+	const digest = createHash("sha256").update(canonicalJson$3({
 		layout: INPUT_FINGERPRINT_LAYOUT,
 		value: form
 	})).digest("hex");
@@ -20681,7 +20769,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$5(parameters)) return classes;
+	if (!isPlainObject$7(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -20722,13 +20810,13 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$5(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$7(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
 		const value = resolvedProps[key];
 		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
-		const text = canonicalJson$2(value);
+		const text = canonicalJson$3(value);
 		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
 	});
 }
@@ -20753,7 +20841,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$5(field)) return read;
+	if (!isPlainObject$7(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -20761,7 +20849,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$5(field)) return read;
+	if (!isPlainObject$7(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -20808,7 +20896,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$5(field) ? Object.entries(field) : [];
+	const next = isPlainObject$7(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -20841,10 +20929,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$5(previous)) return scrubbed;
+		if (!isPlainObject$7(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$5(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$7(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -22185,11 +22273,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$4(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$6(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -22207,11 +22295,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$4(field)) return void 0;
+	if (!isPlainObject$6(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -22220,9 +22308,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$4(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$6(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -22244,7 +22332,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$4(field)) return record;
+	if (!isPlainObject$6(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -22256,12 +22344,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$4(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$6(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$4(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$6(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$4(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$6(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -22279,7 +22367,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$4(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$6(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -22322,7 +22410,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$4(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$6(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -25844,17 +25932,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 
 //#endregion
 //#region src/analyzer/read-provenance-promotion.ts
-function isPlainObject$3(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readsAcrossStacks(value) {
 	if (Array.isArray(value)) return value.some(readsAcrossStacks);
-	if (!isPlainObject$3(value)) return false;
+	if (!isPlainObject$5(value)) return false;
 	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
 	return Object.values(value).some(readsAcrossStacks);
 }
 function recordedReadVersions(record) {
-	if (!isPlainObject$3(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$5(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = referenceProvenanceOf(record);
 	if (field === void 0) return void 0;
 	let out;
@@ -25865,7 +25953,7 @@ async function readProvenancePromotions(args) {
 	const { currentState, desiredTemplate, sources } = args;
 	const parser = args.parser ?? new TemplateParser();
 	const records = currentState.resources;
-	const parameters = isPlainObject$3(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const parameters = isPlainObject$5(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
 	const out = [];
 	for (const { logicalId, changeType } of args.rows) {
 		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
@@ -25873,7 +25961,7 @@ async function readProvenancePromotions(args) {
 		const readVersions = recordedReadVersions(record);
 		if (readVersions === void 0) continue;
 		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
-		const properties = isPlainObject$3(resource?.Properties) ? resource.Properties : {};
+		const properties = isPlainObject$5(resource?.Properties) ? resource.Properties : {};
 		const reads = [];
 		for (const [key, value] of Object.entries(properties)) {
 			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
@@ -25916,7 +26004,7 @@ async function readProvenancePromotions(args) {
 			if (recorded.some((version) => !domain.has(version))) moved.push(token);
 		}
 		if (moved.length === 0) continue;
-		const recordProperties = isPlainObject$3(record?.properties) ? record.properties : {};
+		const recordProperties = isPlainObject$5(record?.properties) ? record.properties : {};
 		const keys = [];
 		for (const r of reads) {
 			if (!Object.hasOwn(recordProperties, r.key)) continue;
@@ -25956,7 +26044,10 @@ const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Fn::Or",
 	"Fn::Not"
 ]);
-const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
+const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({
+	"AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]),
+	"AWS::EC2::Instance": /* @__PURE__ */ new Set(["PublicIp", "PublicDnsName"])
+});
 const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
 const REF_READ = "<Ref>";
 function containsIntrinsic(value, seen = /* @__PURE__ */ new Set()) {
@@ -25974,12 +26065,19 @@ function replacementSidesForLog(oldValue, newValue, mask) {
 	if (newText !== maskedJsonForLog(newValue, (text) => text)) return ["***", newText];
 	return [maskedJsonForLog(oldValue, mask), newText];
 }
+function siblingsOf(change) {
+	if (change.currentProperties === void 0 || change.desiredProperties === void 0) return;
+	return {
+		oldProperties: change.currentProperties,
+		newProperties: change.desiredProperties
+	};
+}
 var DiffCalculator = class DiffCalculator {
 	logger = getLogger().child("DiffCalculator");
 	replacementRules = new ReplacementRulesRegistry();
 	parser = new TemplateParser();
-	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
-		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
+	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings) {
+		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings);
 	}
 	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare, readProvenance) {
 		const changes = /* @__PURE__ */ new Map();
@@ -26068,7 +26166,10 @@ var DiffCalculator = class DiffCalculator {
 						path: key,
 						oldValue,
 						newValue,
-						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
+						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue, {
+							oldProperties: currentCompared,
+							newProperties: desiredCompared
+						}),
 						maskedExpressionChanged: true
 					});
 					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
@@ -26115,7 +26216,7 @@ var DiffCalculator = class DiffCalculator {
 		const syntheticCreateOnlyPaths = await this.loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements);
 		for (const { change, pc, upstreams } of provenanceChanges) {
 			const templateValue = desiredTemplate.Resources[change.logicalId]?.Properties?.[pc.path];
-			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)));
+			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)), siblingsOf(change));
 		}
 		do
 			this.promoteReplacementDependents(changes, desiredTemplate, syntheticCreateOnlyPaths, forcedReplacements);
@@ -26233,8 +26334,8 @@ var DiffCalculator = class DiffCalculator {
 		}));
 		return loaded;
 	}
-	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference) {
-		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0)) return true;
+	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference, siblings) {
+		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0, siblings)) return true;
 		if (this.replacementRules.isClassified(resourceType, propKey)) return false;
 		const createOnly = syntheticCreateOnlyPaths.get(resourceType);
 		if (createOnly === void 0 || !createOnly.whole.has(propKey)) return false;
@@ -26283,7 +26384,7 @@ var DiffCalculator = class DiffCalculator {
 						oldValue,
 						newValue,
 						replacementPropagated: true,
-						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
+						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type), siblingsOf(change)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
 					});
 				}
 				if (syntheticChanges.length === 0) continue;
@@ -26358,7 +26459,7 @@ var DiffCalculator = class DiffCalculator {
 					path: propKey,
 					oldValue: change.currentProperties?.[propKey],
 					newValue: change.desiredProperties?.[propKey],
-					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false),
+					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false, siblingsOf(change)),
 					inPlacePropagated: true,
 					...noEchoPromoted && { noEchoPromoted: true }
 				});
@@ -26474,7 +26575,10 @@ var DiffCalculator = class DiffCalculator {
 			const oldValue = currentProperties[key];
 			const newValue = desiredProperties[key];
 			if (!this.valuesEqual(oldValue, newValue)) {
-				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
+				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue, {
+					oldProperties: currentProperties,
+					newProperties: desiredProperties
+				});
 				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
 					if (createOnlyPaths === void 0) createOnlyPaths = await getCreateOnlyPropertyPaths(resourceType);
 					if (createOnlyChangeRequiresReplacement(createOnlyPaths, key, oldValue, newValue, (a, b) => this.valuesEqual(a, b))) {
@@ -26497,9 +26601,9 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
-	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue) {
-		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue)) return true;
-		if (this.replacementRules.isClassified(resourceType, key) && this.replacementRules.conditionalReplacementVerdict(resourceType, key, oldValue, newValue) === void 0) return false;
+	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue, siblings) {
+		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue, siblings)) return true;
+		if (this.replacementRules.isClassified(resourceType, key) && this.replacementRules.conditionalReplacementVerdict(resourceType, key, oldValue, newValue, siblings) === void 0) return false;
 		return (await getCreateOnlyPropertyPaths(resourceType)).some((path) => path.length === 1 && path[0] === key);
 	}
 	static INTRINSIC_KEYS = INTRINSIC_KEYS;
@@ -27489,8 +27593,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$2(previous)) {
-		if (!isPlainObject$2(desired)) return "differs";
+	if (isPlainObject$4(previous)) {
+		if (!isPlainObject$4(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -27516,7 +27620,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$2(value) {
+function isPlainObject$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -27908,6 +28012,7 @@ const SLOW_CC_OPERATION_TIMEOUTS = {
 	},
 	"AWS::ElastiCache::CacheCluster": {
 		create: 60 * MINUTE_MS,
+		update: 60 * MINUTE_MS,
 		delete: 60 * MINUTE_MS
 	},
 	"AWS::RDS::DBInstance": {
@@ -27918,6 +28023,8 @@ const SLOW_CC_OPERATION_TIMEOUTS = {
 		create: 60 * MINUTE_MS,
 		delete: 60 * MINUTE_MS
 	},
+	"AWS::DynamoDB::Table": { update: 75 * MINUTE_MS },
+	"AWS::DynamoDB::GlobalTable": { update: 75 * MINUTE_MS },
 	"AWS::EKS::Cluster": {
 		create: 30 * MINUTE_MS,
 		delete: 30 * MINUTE_MS
@@ -28466,7 +28573,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-oKlrkJeO.js");
+			const { ASGProvider } = await import("./asg-provider-B7pAjRIc.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28575,7 +28682,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DcBsBQLi.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DvuvSkfJ.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CZhBLQgJ.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Y3Ii8oYI.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29731,11 +29838,11 @@ function applyNoEchoDeleteValues(properties, recordedLeaves, values) {
 		payload: properties,
 		unresolved: []
 	};
-	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$3(leaf.coordinate), leaf]));
+	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$4(leaf.coordinate), leaf]));
 	const entries = [];
 	const unresolved = [];
 	for (const coordinate of masked) {
-		const leaf = byKey.get(canonicalJson$3(coordinate));
+		const leaf = byKey.get(canonicalJson$4(coordinate));
 		if (leaf === void 0) unresolved.push(coordinate);
 		else entries.push({
 			coordinate,
@@ -29786,7 +29893,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	const fingerprinter = options.inputSources === void 0 ? void 0 : inputFingerprinter(templateProps, options.inputSources);
 	const leaves = [];
 	for (const coordinate of masked) {
-		if (!nodes.has(canonicalJson$3(coordinate))) continue;
+		if (!nodes.has(canonicalJson$4(coordinate))) continue;
 		if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 		const value = valueAtCoordinate(resolvedProperties, coordinate);
 		if (value === void 0 || carriesSecretMask(value)) continue;
@@ -29965,7 +30072,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const bag = await this.noEchoNeedles();
 		const leaves = [];
 		for (const coordinate of masked) {
-			const key = canonicalJson$3(coordinate);
+			const key = canonicalJson$4(coordinate);
 			if (!nodes.has(key)) continue;
 			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
@@ -37056,7 +37163,7 @@ const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
-function canonicalJson$1(value) {
+function canonicalJson$2(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
 			const sorted = Object.create(null);
@@ -37086,7 +37193,7 @@ function skippedOutputDigest(template, outputKey) {
 		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
 	}
 	const entry = template.Outputs?.[outputKey];
-	return createHash("sha256").update(canonicalJson$1({
+	return createHash("sha256").update(canonicalJson$2({
 		output: entry,
 		template: sections
 	})).digest("hex");
@@ -38959,7 +39066,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	const marked = noEchoLeavesOf(baseline) ?? [];
 	const names = declaredNoEchoAttributeNames(baseline);
 	if (marked.length === 0 && names.length === 0 && substituted.length === 0) return record;
-	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$3(leaf.value) === canonicalJson$3(value));
+	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$4(leaf.value) === canonicalJson$4(value));
 	let attributes = record.attributes;
 	if (attributes !== void 0 && attributes !== null && typeof attributes === "object") for (const [name, value] of Object.entries(attributes)) {
 		if (!names.includes(name) && !echoes(name, value)) continue;
@@ -38970,7 +39077,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 		const list = coordinate.findIndex((segment) => typeof segment === "number");
 		if (list < 0) return false;
 		const path = coordinate.slice(0, list);
-		return canonicalJson$3(valueAtCoordinate(byIndex, path)) !== canonicalJson$3(valueAtCoordinate(baseline.properties, path));
+		return canonicalJson$4(valueAtCoordinate(byIndex, path)) !== canonicalJson$4(valueAtCoordinate(baseline.properties, path));
 	});
 	const properties = reshaped.length === 0 ? byIndex : maskReadbackAtCoordinates(byIndex, baseline.properties, reshaped);
 	const widened = reshaped.map((coordinate) => readbackPathFor(byIndex, baseline.properties, coordinate)).filter((path, i) => path !== void 0 && path.length < reshaped[i].length);
@@ -44819,18 +44926,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject$1(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function canonicalJson(value) {
-	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+function canonicalJson$1(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
+	if (isPlainObject$3(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject$1(value)) return false;
+	if (!isPlainObject$3(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44853,8 +44960,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject$1(definitions)) return void 0;
-	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$3(definitions)) return void 0;
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44876,7 +44983,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject$1(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -44894,7 +45001,7 @@ function conditionFingerprint(template, name, inputOf) {
 		}
 	}
 	return {
-		fingerprint: `sha256:${createHash("sha256").update(canonicalJson({
+		fingerprint: `sha256:${createHash("sha256").update(canonicalJson$1({
 			layout: FINGERPRINT_LAYOUT,
 			conditions: closure,
 			parameters: inputs
@@ -44907,7 +45014,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject$1(value)) return;
+	if (!isPlainObject$3(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -44921,9 +45028,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject$1(section)) continue;
+		if (!isPlainObject$3(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject$1(entry)) continue;
+			if (!isPlainObject$3(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -44955,10 +45062,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject$1(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject$1(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$3(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -45004,11 +45111,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject$1(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$3(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45343,7 +45450,7 @@ function deferredServiceTokenWarning(row) {
 
 //#endregion
 //#region src/deployment/read-provenance-sources.ts
-function isPlainObject(value) {
+function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function crossStackNodes(value, into = []) {
@@ -45351,7 +45458,7 @@ function crossStackNodes(value, into = []) {
 		for (const item of value) crossStackNodes(item, into);
 		return into;
 	}
-	if (!isPlainObject(value)) return into;
+	if (!isPlainObject$2(value)) return into;
 	const keys = Object.keys(value);
 	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
 	for (const item of Object.values(value)) crossStackNodes(item, into);
@@ -45375,11 +45482,11 @@ function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
 function inheritedProvenanceForChildDiff(args) {
 	const { row, rowRecord, parentRecords, parentTemplate } = args;
 	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
-	const recordedParameters = isPlainObject(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const recordedParameters = isPlainObject$2(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
 	const tokens = referenceTokensIn(recordedParameters);
 	if (tokens.size === 0) return void 0;
 	const own = referenceProvenanceOf(rowRecord);
-	const upstreams = [...new TemplateParser().extractReferences(isPlainObject(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$2(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
 	const out = /* @__PURE__ */ new Map();
 	for (const token of tokens) {
 		const versions = /* @__PURE__ */ new Set();
@@ -46210,6 +46317,73 @@ function isTruthyCfnBoolean(value) {
 	return value === true || value === "true";
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-ttl.ts
+function readTtlSpec(spec) {
+	if (spec === void 0 || spec === null) return {
+		enabled: false,
+		attributeName: void 0
+	};
+	const s = spec;
+	const rawName = s["AttributeName"];
+	const attributeName = typeof rawName === "string" && rawName !== "" ? rawName : void 0;
+	const rawEnabled = s["Enabled"];
+	return {
+		enabled: rawEnabled === void 0 ? true : typeof rawEnabled === "string" ? rawEnabled.toLowerCase() === "true" : Boolean(rawEnabled),
+		attributeName
+	};
+}
+function planTimeToLive(spec, previousSpec, mode) {
+	const desired = readTtlSpec(spec);
+	if (spec !== void 0 && spec !== null && desired.enabled) return desired.attributeName ? {
+		kind: "enable",
+		attributeName: desired.attributeName
+	} : { kind: "none" };
+	if (mode === "create") return { kind: "none" };
+	const previousPresent = previousSpec !== void 0 && previousSpec !== null;
+	const previous = readTtlSpec(previousSpec);
+	if (previousPresent && previous.enabled && previous.attributeName) return {
+		kind: "disable",
+		attributeName: previous.attributeName
+	};
+	return { kind: "disable-live" };
+}
+function isTtlAlreadyDisabled(awsDetail) {
+	return /TimeToLive is already disabled/i.test(awsDetail);
+}
+function isTtlRateLimited(awsDetail) {
+	return /Time to live has been modified multiple times/i.test(awsDetail);
+}
+const TTL_RATE_LIMIT_RETRY_MS = 6e4;
+const TTL_RATE_LIMIT_SLICE_MS = 1e3;
+async function sendTtlWaitingOutRateLimit(send, options) {
+	const retryMs = options.retryMs ?? 6e4;
+	const watch = startInterruptWatch(options.what);
+	let announced = false;
+	try {
+		for (;;) try {
+			await send();
+			return;
+		} catch (error) {
+			if (!isTtlRateLimited(describeAwsFailure(error).detail)) throw error;
+			if (enclosingDeadlineRemainingMs() <= 0) throw error;
+			if (!announced) {
+				options.announce();
+				announced = true;
+			}
+			const until = Date.now() + Math.min(retryMs, enclosingDeadlineRemainingMs());
+			while (Date.now() < until) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await new Promise((resolve) => setTimeout(resolve, Math.min(TTL_RATE_LIMIT_SLICE_MS, until - Date.now())));
+			}
+			if (watch.isInterrupted()) throw watch.onInterrupted();
+			if (enclosingDeadlineRemainingMs() <= 0) throw error;
+		}
+	} finally {
+		watch.dispose();
+	}
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
@@ -46428,6 +46602,718 @@ function isResourceNotFoundError(error) {
 	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-contributor-insights.ts
+const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
+function readContributorInsightsSpec(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "Enabled", path) ?? configStringRefusal(value, "Mode", "", path);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["Enabled"]) ?? false;
+	const mode = block["Mode"];
+	return typeof mode === "string" && mode.length > 0 ? {
+		kind: "usable",
+		enabled,
+		mode
+	} : {
+		kind: "usable",
+		enabled
+	};
+}
+function planContributorInsightsOp(desired, previous, onUnusable) {
+	if (desired.kind === "unusable") {
+		onUnusable(desired.reason);
+		return;
+	}
+	if (desired.kind === "absent") return previous.kind === "absent" ? void 0 : { action: "DISABLE" };
+	if (previous.kind === "usable" && previous.enabled === desired.enabled && (!desired.enabled || previous.mode === desired.mode)) return;
+	if (!desired.enabled) return { action: "DISABLE" };
+	return desired.mode === void 0 ? { action: "ENABLE" } : {
+		action: "ENABLE",
+		mode: desired.mode
+	};
+}
+const INDEX_CONTRIBUTOR_INSIGHTS_PATH = `GlobalSecondaryIndexes[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+function indexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
+}
+function planIndexContributorInsightsOps(desiredIndexes, previousIndexes, onUnusable) {
+	const previousByName = indexEntriesByName(previousIndexes);
+	const ops = [];
+	for (const [indexName, entry] of indexEntriesByName(desiredIndexes)) {
+		const path = INDEX_CONTRIBUTOR_INSIGHTS_PATH;
+		const op = planContributorInsightsOp(readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], path), readContributorInsightsSpec(previousByName.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], path), (reason) => onUnusable(indexName, reason));
+		if (op !== void 0) ops.push({
+			indexName,
+			...op
+		});
+	}
+	return ops;
+}
+function contributorInsightsRefusals(tableBlock, indexes) {
+	const refusals = [];
+	const table = readContributorInsightsSpec(tableBlock, CONTRIBUTOR_INSIGHTS_KEY);
+	if (table.kind === "unusable") refusals.push(table.reason);
+	if (!Array.isArray(indexes)) return refusals;
+	indexes.forEach((entry, position) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `GlobalSecondaryIndexes[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		if (read.kind === "unusable") refusals.push(read.reason);
+	});
+	return refusals;
+}
+function stripIndexContributorInsights(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+	if (!("ContributorInsightsSpecification" in entry)) return entry;
+	const { [CONTRIBUTOR_INSIGHTS_KEY]: _stripped, ...rest } = entry;
+	return rest;
+}
+function indexDeclaresContributorInsights(desiredEntry) {
+	return readContributorInsightsSpec(desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY], "").kind === "usable";
+}
+function enabledForStatus(status, transientAsTarget) {
+	if (status === "ENABLED" || transientAsTarget && status === "ENABLING") return true;
+	if (status === "DISABLED" || transientAsTarget && status === "DISABLING") return false;
+}
+function reverseMapTableContributorInsights(status, mode) {
+	const enabled = enabledForStatus(status, false);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	if (enabled && mode !== void 0) block["Mode"] = mode;
+	return block;
+}
+function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
+	const declared = readContributorInsightsSpec(declaredBlock, INDEX_CONTRIBUTOR_INSIGHTS_PATH);
+	if (declared.kind !== "usable") return void 0;
+	const enabled = enabledForStatus(status, true);
+	if (enabled === void 0) return void 0;
+	const declaredEnabled = declaredBlock["Enabled"];
+	const block = { Enabled: typeof declaredEnabled !== "string" ? enabled : declared.enabled === enabled ? declaredEnabled : String(enabled) };
+	if (enabled && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-replica-settings.ts
+const PITR_KEY = "PointInTimeRecoverySpecification";
+const KINESIS_KEY = "KinesisStreamSpecification";
+const TABLE_POLICY_KEY = "ResourcePolicy";
+const REPLICA_STREAM_KEY = "ReplicaStreamSpecification";
+const DEFAULT_RECOVERY_PERIOD_DAYS = 35;
+const DEFAULT_KINESIS_PRECISION = "MILLISECOND";
+const PITR_PATH = `Replicas[].${PITR_KEY}`;
+const CI_PATH = `Replicas[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+const KINESIS_PATH = `Replicas[].${KINESIS_KEY}`;
+const TABLE_POLICY_PATH = `Replicas[].${TABLE_POLICY_KEY}`;
+const STREAM_POLICY_PATH = `Replicas[].${REPLICA_STREAM_KEY}.ResourcePolicy`;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readPitrSpec(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "PointInTimeRecoveryEnabled", PITR_PATH) ?? configIntegerRefusal(value, "RecoveryPeriodInDays", PITR_PATH, 1, 35);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["PointInTimeRecoveryEnabled"]) ?? false;
+	const period = enabled ? coerceCfnInteger(block["RecoveryPeriodInDays"]) : void 0;
+	return period === void 0 ? {
+		kind: "usable",
+		enabled
+	} : {
+		kind: "usable",
+		enabled,
+		recoveryPeriodInDays: period
+	};
+}
+function readKinesisSpec(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configStringRefusal(value, "StreamArn", "required", KINESIS_PATH) ?? configStringRefusal(value, "ApproximateCreationDateTimePrecision", "", KINESIS_PATH);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const streamArn = block["StreamArn"];
+	if (typeof streamArn !== "string") return {
+		kind: "unusable",
+		reason: `${KINESIS_PATH}.StreamArn is required`
+	};
+	const precision = block["ApproximateCreationDateTimePrecision"];
+	return typeof precision === "string" && precision.length > 0 ? {
+		kind: "usable",
+		streamArn,
+		precision
+	} : {
+		kind: "usable",
+		streamArn
+	};
+}
+function readPolicyBlock(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!isPlainObject$1(value)) return {
+		kind: "unusable",
+		reason: `${path} must be an object with a PolicyDocument`
+	};
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (!isPlainObject$1(document)) return {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument must be a policy object or a JSON string`
+	};
+	const keys = Object.keys(document);
+	if (keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"))) return {
+		kind: "unusable",
+		reason: `${path}.PolicyDocument is an unresolved intrinsic`
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+function readTablePolicy(replica) {
+	return readPolicyBlock(replica?.[TABLE_POLICY_KEY], TABLE_POLICY_PATH);
+}
+function readStreamPolicy$1(replica) {
+	const stream = replica?.[REPLICA_STREAM_KEY];
+	if (stream === void 0 || stream === null) return { kind: "absent" };
+	if (!isPlainObject$1(stream)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
+	};
+	return readPolicyBlock(stream["ResourcePolicy"], STREAM_POLICY_PATH);
+}
+function replicaSettingRefusals(replica) {
+	return [
+		readPitrSpec(replica?.[PITR_KEY]),
+		readContributorInsightsSpec(replica?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH),
+		readKinesisSpec(replica?.[KINESIS_KEY]),
+		readTablePolicy(replica),
+		readStreamPolicy$1(replica)
+	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []);
+}
+function settingOf(op) {
+	switch (op.kind) {
+		case "pitr": return "pitr";
+		case "contributorInsights": return "contributorInsights";
+		case "kinesisDisable":
+		case "kinesisEnable":
+		case "kinesisPrecision": return "kinesis";
+		case "deleteTablePolicy":
+		case "putTablePolicy": return "tablePolicy";
+		case "deleteStreamPolicy":
+		case "putStreamPolicy": return "streamPolicy";
+	}
+}
+const SETTING_MEMBER = {
+	pitr: PITR_KEY,
+	contributorInsights: CONTRIBUTOR_INSIGHTS_KEY,
+	kinesis: KINESIS_KEY,
+	tablePolicy: TABLE_POLICY_KEY,
+	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`
+};
+function samePolicyDocument$1(left, right) {
+	if (left === right) return true;
+	try {
+		return JSON.stringify(JSON.parse(left)) === JSON.stringify(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+function planReplicaSettingOps(desired, previous, options, onUnusable) {
+	const prev = options.fresh ? void 0 : previous;
+	const ops = [];
+	const removes = (setting) => options.keepOnRemoval?.has(setting) !== true;
+	const pitr = readPitrSpec(desired?.[PITR_KEY]);
+	const prevPitr = readPitrSpec(prev?.[PITR_KEY]);
+	if (pitr.kind === "unusable") onUnusable(pitr.reason);
+	else if (pitr.kind === "absent") {
+		if (prevPitr.kind !== "absent" && removes("pitr")) ops.push({
+			kind: "pitr",
+			enabled: false
+		});
+	} else {
+		const unchanged = prevPitr.kind === "usable" && prevPitr.enabled === pitr.enabled && prevPitr.recoveryPeriodInDays === pitr.recoveryPeriodInDays;
+		const noop = options.fresh && !pitr.enabled;
+		if (!unchanged && !noop) ops.push(pitr.recoveryPeriodInDays === void 0 ? {
+			kind: "pitr",
+			enabled: pitr.enabled
+		} : {
+			kind: "pitr",
+			enabled: pitr.enabled,
+			recoveryPeriodInDays: pitr.recoveryPeriodInDays
+		});
+	}
+	const desiredCi = readContributorInsightsSpec(desired?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH);
+	const ci = planContributorInsightsOp(desiredCi, readContributorInsightsSpec(prev?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH), onUnusable);
+	if (ci !== void 0 && !(options.fresh && ci.action === "DISABLE") && !(desiredCi.kind === "absent" && !removes("contributorInsights"))) ops.push(ci.mode === void 0 ? {
+		kind: "contributorInsights",
+		action: ci.action
+	} : {
+		kind: "contributorInsights",
+		action: ci.action,
+		mode: ci.mode
+	});
+	const kinesis = readKinesisSpec(desired?.[KINESIS_KEY]);
+	const prevKinesis = readKinesisSpec(prev?.[KINESIS_KEY]);
+	if (kinesis.kind === "unusable") onUnusable(kinesis.reason);
+	else if (kinesis.kind === "absent") {
+		if (prevKinesis.kind === "usable" && removes("kinesis")) ops.push({
+			kind: "kinesisDisable",
+			streamArn: prevKinesis.streamArn
+		});
+	} else if (prevKinesis.kind === "usable" && prevKinesis.streamArn === kinesis.streamArn) {
+		if (kinesis.precision !== void 0 && kinesis.precision !== prevKinesis.precision) ops.push({
+			kind: "kinesisPrecision",
+			streamArn: kinesis.streamArn,
+			precision: kinesis.precision
+		});
+		else if (kinesis.precision === void 0 && prevKinesis.precision !== void 0 && prevKinesis.precision !== DEFAULT_KINESIS_PRECISION && removes("kinesis")) ops.push({
+			kind: "kinesisPrecision",
+			streamArn: kinesis.streamArn,
+			precision: DEFAULT_KINESIS_PRECISION
+		});
+	} else {
+		if (prevKinesis.kind === "usable") ops.push({
+			kind: "kinesisDisable",
+			streamArn: prevKinesis.streamArn
+		});
+		ops.push(kinesis.precision === void 0 ? {
+			kind: "kinesisEnable",
+			streamArn: kinesis.streamArn
+		} : {
+			kind: "kinesisEnable",
+			streamArn: kinesis.streamArn,
+			precision: kinesis.precision
+		});
+	}
+	const policyOps = (want, had, replaced, put, del, setting) => {
+		if (want.kind === "unusable") {
+			onUnusable(want.reason);
+			return;
+		}
+		if (want.kind === "absent") {
+			if (had.kind !== "absent" && removes(setting)) ops.push(del);
+			return;
+		}
+		if (!replaced && had.kind === "usable" && samePolicyDocument$1(had.document, want.document)) return;
+		ops.push(put(want.document));
+	};
+	policyOps(readTablePolicy(desired), readTablePolicy(prev), false, (document) => ({
+		kind: "putTablePolicy",
+		document
+	}), { kind: "deleteTablePolicy" }, "tablePolicy");
+	policyOps(readStreamPolicy$1(desired), readStreamPolicy$1(prev), options.streamReplaced === true, (document) => ({
+		kind: "putStreamPolicy",
+		document
+	}), { kind: "deleteStreamPolicy" }, "streamPolicy");
+	return ops;
+}
+function planReplicaSettingCorrections(desired, live, only) {
+	const ops = [];
+	const pitr = readPitrSpec(desired?.[PITR_KEY]);
+	if (only.has("pitr") && pitr.kind === "usable" && live.pitr !== void 0) {
+		if (pitr.enabled && !live.pitr.enabled) ops.push(pitr.recoveryPeriodInDays === void 0 ? {
+			kind: "pitr",
+			enabled: pitr.enabled
+		} : {
+			kind: "pitr",
+			enabled: pitr.enabled,
+			recoveryPeriodInDays: pitr.recoveryPeriodInDays
+		});
+	}
+	const ci = readContributorInsightsSpec(desired?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH);
+	if (only.has("contributorInsights") && ci.kind === "usable" && live.contributorInsightsEnabled !== void 0 && live.contributorInsightsEnabled !== ci.enabled) ops.push(!ci.enabled ? {
+		kind: "contributorInsights",
+		action: "DISABLE"
+	} : ci.mode === void 0 ? {
+		kind: "contributorInsights",
+		action: "ENABLE"
+	} : {
+		kind: "contributorInsights",
+		action: "ENABLE",
+		mode: ci.mode
+	});
+	const kinesis = readKinesisSpec(desired?.[KINESIS_KEY]);
+	if (only.has("kinesis") && kinesis.kind === "usable" && live.kinesisStreamArns !== void 0 && !live.kinesisStreamArns.has(kinesis.streamArn)) ops.push(kinesis.precision === void 0 ? {
+		kind: "kinesisEnable",
+		streamArn: kinesis.streamArn
+	} : {
+		kind: "kinesisEnable",
+		streamArn: kinesis.streamArn,
+		precision: kinesis.precision
+	});
+	const tablePolicy = readTablePolicy(desired);
+	if (only.has("tablePolicy") && tablePolicy.kind === "usable" && live.hasTablePolicy === false) ops.push({
+		kind: "putTablePolicy",
+		document: tablePolicy.document
+	});
+	const streamPolicy = readStreamPolicy$1(desired);
+	if (only.has("streamPolicy") && streamPolicy.kind === "usable" && live.hasStreamPolicy === false) ops.push({
+		kind: "putStreamPolicy",
+		document: streamPolicy.document
+	});
+	return ops;
+}
+function declaredReplicaSettings(desired) {
+	const declared = /* @__PURE__ */ new Set();
+	if (readPitrSpec(desired?.["PointInTimeRecoverySpecification"]).kind === "usable") declared.add("pitr");
+	if (readContributorInsightsSpec(desired?.["ContributorInsightsSpecification"], CI_PATH).kind === "usable") declared.add("contributorInsights");
+	if (readKinesisSpec(desired?.["KinesisStreamSpecification"]).kind === "usable") declared.add("kinesis");
+	if (readTablePolicy(desired).kind === "usable") declared.add("tablePolicy");
+	if (readStreamPolicy$1(desired).kind === "usable") declared.add("streamPolicy");
+	return declared;
+}
+function enabledForReadStatus(status) {
+	if (status === "ENABLED" || status === "ENABLING") return true;
+	if (status === "DISABLED" || status === "DISABLING") return false;
+}
+function reverseMapReplicaPitr(status, recoveryPeriodInDays, declaredBlock) {
+	const enabled = enabledForReadStatus(status);
+	if (enabled === void 0) return void 0;
+	const block = { PointInTimeRecoveryEnabled: enabled };
+	if (!enabled) return block;
+	const declared = readPitrSpec(declaredBlock);
+	const period = recoveryPeriodInDays ?? (status === "ENABLING" ? (declared.kind === "usable" ? declared.recoveryPeriodInDays : void 0) ?? DEFAULT_RECOVERY_PERIOD_DAYS : void 0);
+	if (period !== void 0) block["RecoveryPeriodInDays"] = period;
+	return block;
+}
+function reverseMapReplicaContributorInsights(status, mode, declaredBlock) {
+	const enabled = enabledForReadStatus(status);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	const declared = readContributorInsightsSpec(declaredBlock, CI_PATH);
+	if (enabled && declared.kind === "usable" && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+const READBACK_5381_MEMBERS = [
+	"SSESpecification",
+	"TableClass",
+	"DeletionProtectionEnabled",
+	TABLE_POLICY_KEY,
+	REPLICA_STREAM_KEY
+];
+const READBACK_5381_NESTED = [[
+	PITR_KEY,
+	"RecoveryPeriodInDays",
+	"PointInTimeRecoveryEnabled"
+], [
+	CONTRIBUTOR_INSIGHTS_KEY,
+	"Mode",
+	"Enabled"
+]];
+function isPre5381ReplicaBaseline(baseline) {
+	if ("TableClass" in baseline || "DeletionProtectionEnabled" in baseline) return true;
+	const replicas = baseline["Replicas"];
+	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$1(r) && "KMSMasterKeyId" in r);
+}
+function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFromReadback = false) {
+	if (!isPre5381ReplicaBaseline(baseline)) return baseline;
+	const result = { ...baseline };
+	const topLevel = {};
+	for (const key of ["TableClass", "DeletionProtectionEnabled"]) if (key in result) {
+		topLevel[key] = result[key];
+		delete result[key];
+	}
+	const replicas = result["Replicas"];
+	if (!Array.isArray(replicas)) return result;
+	const awsReplicas = Array.isArray(aws["Replicas"]) ? aws["Replicas"] : [];
+	result["Replicas"] = replicas.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const region = element["Region"];
+		const entry = { ...element };
+		if (region === localRegion && localRegion !== "") {
+			for (const [key, value] of Object.entries(topLevel)) if (localFromReadback || !(key in entry)) entry[key] = value;
+		}
+		if ("KMSMasterKeyId" in entry) {
+			const key = entry["KMSMasterKeyId"];
+			delete entry["KMSMasterKeyId"];
+			if (!("SSESpecification" in entry)) entry["SSESpecification"] = { KMSMasterKeyId: key };
+		}
+		const live = awsReplicas.find((r) => isPlainObject$1(r) && r["Region"] === region);
+		if (live !== void 0) {
+			for (const member of READBACK_5381_MEMBERS) if (!(member in entry) && member in live) entry[member] = structuredClone(live[member]);
+			for (const [block, member, flag] of READBACK_5381_NESTED) {
+				const mine = entry[block];
+				const theirs = live[block];
+				if (isPlainObject$1(mine) && isPlainObject$1(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
+					...mine,
+					[member]: theirs[member]
+				};
+			}
+		}
+		return entry;
+	});
+	return result;
+}
+const UNREAD_REPLICA_MEMBERS = [
+	"TableClass",
+	"DeletionProtectionEnabled",
+	"SSESpecification"
+];
+function keepUnreadReplicaMembers(desired, previous) {
+	const replicas = desired["Replicas"];
+	const prevReplicas = previous["Replicas"];
+	if (!Array.isArray(replicas) || !Array.isArray(prevReplicas)) return desired;
+	const sse = desired["SSESpecification"];
+	const sseOn = isPlainObject$1(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
+	let changed = false;
+	const completed = replicas.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const live = prevReplicas.find((r) => isPlainObject$1(r) && r["Region"] === element["Region"]);
+		if (live === void 0) return element;
+		const entry = { ...element };
+		let touched = false;
+		for (const member of UNREAD_REPLICA_MEMBERS) {
+			if (member === "SSESpecification" && !sseOn) continue;
+			if (!(member in entry) && member in live) {
+				entry[member] = structuredClone(live[member]);
+				touched = true;
+			}
+		}
+		const pitr = entry[PITR_KEY];
+		const wantPitr = readPitrSpec(pitr);
+		const livePitr = readPitrSpec(live[PITR_KEY]);
+		if (isPlainObject$1(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
+			entry[PITR_KEY] = {
+				...pitr,
+				RecoveryPeriodInDays: livePitr.recoveryPeriodInDays
+			};
+			touched = true;
+		}
+		if (!touched) return element;
+		changed = true;
+		return entry;
+	});
+	return changed ? {
+		...desired,
+		Replicas: completed
+	} : desired;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-stream-members.ts
+const STREAM_SPECIFICATION_KEY$1 = "StreamSpecification";
+const STREAM_POLICY_KEY = "ResourcePolicy";
+const STREAM_TAGS_KEY = "Tags";
+const POLICY_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_POLICY_KEY}`;
+const TAGS_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_TAGS_KEY}`;
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function refusalOf(guard) {
+	try {
+		guard();
+		return;
+	} catch (error) {
+		return describeAwsFailure(error).detail;
+	}
+}
+function blockMembers(block) {
+	return isPlainObject(block) ? block : {};
+}
+function readStreamPolicy(block) {
+	const value = blockMembers(block)[STREAM_POLICY_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const containerRefusal = refusalOf(() => requireConfigObject(value, POLICY_PATH));
+	if (containerRefusal !== void 0) return {
+		kind: "unusable",
+		reason: containerRefusal
+	};
+	const documentPath = `${POLICY_PATH}.PolicyDocument`;
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${documentPath} must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (document === void 0 || document === null) return {
+		kind: "unusable",
+		reason: `${documentPath} is required when ${POLICY_PATH} is declared`
+	};
+	const documentRefusal = refusalOf(() => requireConfigObject(document, documentPath));
+	if (documentRefusal !== void 0) return {
+		kind: "unusable",
+		reason: documentRefusal
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+function readStreamTags(block) {
+	const value = blockMembers(block)[STREAM_TAGS_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!Array.isArray(value)) return {
+		kind: "unusable",
+		reason: `${TAGS_PATH} must be an array of {Key, Value} entries`
+	};
+	const tags = /* @__PURE__ */ new Map();
+	for (const [position, entry] of value.entries()) {
+		const entryPath = `${TAGS_PATH}[${position}]`;
+		const refusal = refusalOf(() => requireConfigObject(entry, entryPath)) ?? configStringRefusal(entry, "Key", "required", entryPath) ?? configStringRefusal(entry, "Value", "", entryPath);
+		if (refusal !== void 0) return {
+			kind: "unusable",
+			reason: refusal
+		};
+		const { Key: key, Value: tagValue } = entry;
+		if (typeof key !== "string") return {
+			kind: "unusable",
+			reason: `${entryPath}.Key is required`
+		};
+		tags.set(key, typeof tagValue === "string" ? tagValue : "");
+	}
+	return {
+		kind: "usable",
+		tags
+	};
+}
+function streamMemberRefusals(block) {
+	const refusals = [];
+	const policy = readStreamPolicy(block);
+	if (policy.kind === "unusable") refusals.push(policy.reason);
+	const tags = readStreamTags(block);
+	if (tags.kind === "unusable") refusals.push(tags.reason);
+	return refusals;
+}
+function planStreamMemberOps(desiredBlock, previousBlock, options, onUnusable) {
+	let desiredPolicy = readStreamPolicy(desiredBlock);
+	let desiredTags = readStreamTags(desiredBlock);
+	if (desiredPolicy.kind === "unusable") onUnusable(desiredPolicy.reason);
+	if (desiredTags.kind === "unusable") onUnusable(desiredTags.reason);
+	let previousPolicy = readStreamPolicy(previousBlock);
+	let previousTags = readStreamTags(previousBlock);
+	if (options.freshStream) {
+		if (desiredPolicy.kind === "unusable" && previousPolicy.kind === "usable") desiredPolicy = previousPolicy;
+		if (desiredTags.kind === "unusable" && previousTags.kind === "usable") desiredTags = previousTags;
+		previousPolicy = { kind: "absent" };
+		previousTags = { kind: "absent" };
+	} else if (options.contentsUnknown === true) {
+		previousPolicy = {
+			kind: "unusable",
+			reason: ""
+		};
+		previousTags = { kind: "absent" };
+	}
+	const tagOps = [];
+	if (desiredTags.kind !== "unusable") {
+		const desired = desiredTags.kind === "usable" ? desiredTags.tags : /* @__PURE__ */ new Map();
+		const previous = previousTags.kind === "usable" ? previousTags.tags : /* @__PURE__ */ new Map();
+		const keysToRemove = [...previous.keys()].filter((key) => !desired.has(key));
+		if (keysToRemove.length > 0) tagOps.push({
+			kind: "untag",
+			keys: keysToRemove
+		});
+		const tagsToSet = [...desired].filter(([key, value]) => previous.get(key) !== value).map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		if (tagsToSet.length > 0) tagOps.push({
+			kind: "tag",
+			tags: tagsToSet
+		});
+	}
+	const policyPut = desiredPolicy.kind === "usable" && !(previousPolicy.kind === "usable" && samePolicyDocument(previousPolicy.document, desiredPolicy.document));
+	const policyDelete = previousPolicy.kind !== "absent" && (desiredPolicy.kind === "absent" || policyPut && tagOps.length > 0);
+	const ops = [];
+	if (policyDelete) ops.push({ kind: "deletePolicy" });
+	ops.push(...tagOps);
+	if (policyPut && desiredPolicy.kind === "usable") ops.push({
+		kind: "putPolicy",
+		document: desiredPolicy.document
+	});
+	return ops;
+}
+function samePolicyDocument(left, right) {
+	if (left === right) return true;
+	try {
+		return canonicalJson(JSON.parse(left)) === canonicalJson(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+function streamDeclaresPolicy(desiredBlock) {
+	return readStreamPolicy(desiredBlock).kind === "usable";
+}
+function streamDeclaresTags(desiredBlock) {
+	return readStreamTags(desiredBlock).kind === "usable";
+}
+function reverseMapStreamPolicy(livePolicy, desiredBlock) {
+	if (livePolicy === void 0 || livePolicy === "") return void 0;
+	const declared = blockMembers(blockMembers(desiredBlock)[STREAM_POLICY_KEY])["PolicyDocument"];
+	let parsed;
+	try {
+		parsed = JSON.parse(livePolicy);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	if (typeof declared !== "string") return { PolicyDocument: parsed };
+	let declaredParsed;
+	try {
+		declaredParsed = JSON.parse(declared);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	return { PolicyDocument: canonicalJson(declaredParsed) === canonicalJson(parsed) ? declared : livePolicy };
+}
+function streamPolicyMatchesDeclared(livePolicy, desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	if (declared.kind !== "usable" || livePolicy === void 0) return false;
+	try {
+		return canonicalJson(JSON.parse(livePolicy)) === canonicalJson(JSON.parse(declared.document));
+	} catch {
+		return false;
+	}
+}
+function declaredStreamPolicyMember(desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	return declared.kind === "usable" ? reverseMapStreamPolicy(declared.document, desiredBlock) : void 0;
+}
+function declaredStreamTagsMember(desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	return declared.kind === "usable" ? [...declared.tags].map(([Key, Value]) => ({
+		Key,
+		Value
+	})) : void 0;
+}
+function streamTagsMatchDeclared(liveTags, desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	if (declared.kind !== "usable" || liveTags.length !== declared.tags.size) return false;
+	return liveTags.every((tag) => declared.tags.get(tag.Key) === tag.Value);
+}
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
 function isTableName(id) {
@@ -46531,7 +47417,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
 		log.debug(build(log.mask(failure.detail)).message);
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}`);
+		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}` + relayedEncryptionChangeLimit(failure.detail));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	cleanupFailureText(log, head, error) {
@@ -46668,6 +47554,8 @@ var DynamoDBGlobalTableProvider = class {
 			if (!onReplay) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${sseEnabledRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
 			onReplay(`${sseEnabledRefusal}. Encryption is enabled, the block's default.`);
 		}
+		const replicaSettingRefusal = replicaSettingsRefusal(properties, void 0, currentRegion);
+		if (replicaSettingRefusal !== void 0 && !replayWarn(log, context).onUnusable) throw new ProvisioningError(log.mask(`AWS::DynamoDB::GlobalTable ${logicalId}: ${replicaSettingRefusal}. Nothing was created; fix the template value`), resourceType, logicalId);
 		if (properties["SSESpecification"]) createParams.SSESpecification = toSdkTableSseSpecification(properties["SSESpecification"], readReplicaKmsMasterKeyId(localReplicaEntry(properties, currentRegion)));
 		const dpeResolved = extractLocalDeletionProtection(properties, currentRegion);
 		if (dpeResolved !== void 0) createParams.DeletionProtectionEnabled = dpeResolved;
@@ -46715,18 +47603,15 @@ var DynamoDBGlobalTableProvider = class {
 				if (!replicaTags || replicaTags.length === 0) continue;
 				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, resourceType, logicalId, tableName, maskSecrets);
 			}
-			if (properties["TimeToLiveSpecification"]) {
-				const ttl = properties["TimeToLiveSpecification"];
-				const attributeName = ttl["AttributeName"];
-				const enabled = ttl["Enabled"] !== void 0 ? Boolean(ttl["Enabled"]) : true;
-				if (attributeName) await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
-					TableName: tableName,
-					TimeToLiveSpecification: {
-						Enabled: enabled,
-						AttributeName: attributeName
-					}
-				}));
-			}
+			await this.applyReplicaSettings(tableName, logicalId, currentRegion, wiringProperties, void 0, /* @__PURE__ */ new Set(), false, replayWarn(log, context).onUnusable !== void 0, /* @__PURE__ */ new Set(), void 0, warn, maskSecrets);
+			const createTtl = planTimeToLive(properties["TimeToLiveSpecification"], void 0, "create");
+			if (createTtl.kind === "enable") await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
+				TableName: tableName,
+				TimeToLiveSpecification: {
+					Enabled: true,
+					AttributeName: createTtl.attributeName
+				}
+			}));
 			if (billingMode === "PROVISIONED") try {
 				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(wiringProperties, currentRegion), currentRegion, void 0, maskSecrets);
 			} catch (autoScalingErr) {
@@ -46859,7 +47744,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
-	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, warn, maskSecrets) {
+	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, desiredFromReadback, warn, maskSecrets) {
 		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 		for (const entry of desired) {
 			const replica = asRecord(entry);
@@ -46867,6 +47752,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (typeof region !== "string" || region === currentRegion || addedRegions.has(region)) continue;
 			const declared = readReplicaDeletionProtection(replica, region, warn);
 			if (declared === UNUSABLE) continue;
+			if (declared === void 0 && desiredFromReadback) continue;
 			const previous = readReplicaDeletionProtection(localReplicaEntry(previousProperties, region), region);
 			const newDpe = declared ?? false;
 			const oldDpe = previous === UNUSABLE ? void 0 : previous ?? false;
@@ -46997,6 +47883,252 @@ var DynamoDBGlobalTableProvider = class {
 			ReplicaUpdates: entries
 		};
 	}
+	async applyReplicaSettings(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, streamReplaced, replaying, keepOnRemoval, previousLocalStreamArn, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const fresh = previousProperties === void 0 || freshRegions.has(region);
+			const previous = previousProperties === void 0 ? void 0 : localReplicaEntry(previousProperties, region);
+			const ops = planReplicaSettingOps(replica, previous, {
+				fresh,
+				streamReplaced,
+				keepOnRemoval
+			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
+			if (!fresh && keepOnRemoval.has("pitr") && replica?.["PointInTimeRecoverySpecification"] == null && (() => {
+				const prior = readPitrSpec(previous?.["PointInTimeRecoverySpecification"]);
+				return prior.kind === "usable" && prior.enabled;
+			})()) warn(`The ${region} replica of ${tableName}: point-in-time recovery was not turned off, although the properties being applied (a rollback's recorded state, or a drift --revert read-back) declare none — turning it off would delete every recovery point. Turn it off by hand if that is intended.`);
+			const unchanged = fresh ? /* @__PURE__ */ new Set() : declaredReplicaSettings(replica);
+			for (const op of ops) unchanged.delete(settingOf(op));
+			if (ops.length === 0 && unchanged.size === 0) continue;
+			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, { ...region !== currentRegion && { region } });
+			let arns;
+			const describe = async () => {
+				if (arns === void 0) {
+					const described = await client.send(new DescribeTableCommand({ TableName: tableName }));
+					arns = {
+						...described.Table?.TableArn !== void 0 && { tableArn: described.Table.TableArn },
+						...described.Table?.LatestStreamArn !== void 0 && { streamArn: described.Table.LatestStreamArn }
+					};
+				}
+				return arns;
+			};
+			for (const op of ops) try {
+				await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			} catch (error) {
+				if (!replaying || !fresh || op.kind !== "putTablePolicy" || isInterruptedWaitError(error)) throw error;
+				warn(`The ${region} replica of ${tableName} was created without its ResourcePolicy: ${describeAwsFailure(error).summary}. The next deploy that updates this table puts it.`);
+			}
+			const priorStreamPolicy = readStreamPolicy$1(previous);
+			const desiredStreamPolicy = readStreamPolicy$1(replica);
+			const streamPolicyChanged = priorStreamPolicy.kind !== "absent" && desiredStreamPolicy.kind !== "unusable" && !(desiredStreamPolicy.kind === "absent" && keepOnRemoval.has("streamPolicy")) && !(priorStreamPolicy.kind === "usable" && desiredStreamPolicy.kind === "usable" && samePolicyDocument$1(priorStreamPolicy.document, desiredStreamPolicy.document));
+			if (region === currentRegion && streamReplaced && previousLocalStreamArn !== void 0 && streamPolicyChanged && (await describe()).streamArn !== previousLocalStreamArn) await this.deleteOldStreamPolicy(client, previousLocalStreamArn, tableName, warn, maskSecrets);
+			if (unchanged.size === 0) continue;
+			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets);
+			for (const op of planReplicaSettingCorrections(replica, live, unchanged)) {
+				const member = SETTING_MEMBER[settingOf(op)];
+				this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared ${member}`));
+				try {
+					await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+				} catch (convergeError) {
+					if (isInterruptedWaitError(convergeError)) throw convergeError;
+					this.logger.debug(maskSecrets(`Could not bring the ${region} replica of ${tableName} to its declared ${member}: ` + describeAwsFailure(convergeError).detail));
+					this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold its declared ${member}, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+				}
+			}
+		}
+	}
+	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets) {
+		const live = {};
+		const attempt = async (what, read) => {
+			try {
+				await read();
+			} catch (readError) {
+				this.logger.debug(maskSecrets(`Could not read ${what} of the ${region} replica of ${tableName}: ` + describeAwsFailure(readError).detail));
+			}
+		};
+		if (wanted.has("pitr")) await attempt("point-in-time recovery", async () => {
+			const pitr = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const status = pitr?.PointInTimeRecoveryStatus;
+			if (status === "ENABLED" || status === "DISABLED") live.pitr = {
+				enabled: status === "ENABLED",
+				...pitr?.RecoveryPeriodInDays !== void 0 && { recoveryPeriodInDays: pitr.RecoveryPeriodInDays }
+			};
+		});
+		if (wanted.has("contributorInsights")) await attempt("Contributor Insights", async () => {
+			const status = (await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }))).ContributorInsightsStatus;
+			if (status === "ENABLED" || status === "ENABLING") live.contributorInsightsEnabled = true;
+			else if (status === "DISABLED" || status === "DISABLING") live.contributorInsightsEnabled = false;
+		});
+		if (wanted.has("kinesis")) await attempt("the Kinesis streaming destination", async () => {
+			live.kinesisStreamArns = await this.activeKinesisStreamArns(client, tableName);
+		});
+		const hasPolicy = async (arn) => {
+			if (arn === void 0) return void 0;
+			try {
+				await client.send(new GetResourcePolicyCommand({ ResourceArn: arn }));
+				return true;
+			} catch (error) {
+				if (error instanceof PolicyNotFoundException) return false;
+				throw error;
+			}
+		};
+		if (wanted.has("tablePolicy")) await attempt("the resource policy", async () => {
+			const answer = await hasPolicy((await describe()).tableArn);
+			if (answer !== void 0) live.hasTablePolicy = answer;
+		});
+		if (wanted.has("streamPolicy")) await attempt("the stream resource policy", async () => {
+			const answer = await hasPolicy((await describe()).streamArn);
+			if (answer !== void 0) live.hasStreamPolicy = answer;
+		});
+		return live;
+	}
+	async deleteOldStreamPolicy(client, streamArn, tableName, warn, maskSecrets) {
+		try {
+			await this.retrySettlingRefusal(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the policy of the retired stream of ${tableName}`, maskSecrets);
+		} catch (error) {
+			if (isInterruptedWaitError(error)) throw error;
+			if (error instanceof PolicyNotFoundException || error instanceof ResourceNotFoundException$1) return;
+			warn(`The previous stream of ${tableName} (retired by the StreamViewType change) keeps its old resource policy until it expires: deleting it failed (${describeAwsFailure(error).summary}).`);
+		}
+	}
+	async kinesisStreaming(client, tableName, streamArn, refusal) {
+		if (isInterruptedWaitError(refusal)) throw refusal;
+		try {
+			return (await this.activeKinesisStreamArns(client, tableName)).has(streamArn);
+		} catch {
+			throw refusal;
+		}
+	}
+	kinesisDisableSettleDelaysMs = Array(30).fill(2e3);
+	async waitForKinesisDisableSettled(client, tableName, streamArn, scope, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`Kinesis streaming disable on ${scope}`));
+		let last = "none read";
+		try {
+			for (const delayMs of [0, ...this.kinesisDisableSettleDelaysMs]) {
+				if (enclosingDeadlineRemainingMs() <= 0) break;
+				if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(delayMs, enclosingDeadlineRemainingMs()))));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				let unsettled;
+				try {
+					unsettled = ((await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }))).KinesisDataStreamDestinations ?? []).find((d) => d.StreamArn === streamArn && KINESIS_DISABLE_UNSETTLED.has(d.DestinationStatus ?? ""))?.DestinationStatus;
+				} catch (error) {
+					this.logger.debug(maskSecrets(`Could not confirm the Kinesis streaming disable on ${scope}: ` + describeAwsFailure(error).detail));
+					return;
+				}
+				if (unsettled === void 0) return;
+				last = unsettled;
+			}
+			this.logger.warn(maskSecrets(`The Kinesis streaming destination on ${scope} had not settled (last status: ${last}); 'cdkd drift' may report it on this replica until it does`));
+		} finally {
+			watch.dispose();
+		}
+	}
+	async activeKinesisStreamArns(client, tableName) {
+		const out = await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }));
+		return new Set((out.KinesisDataStreamDestinations ?? []).filter((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING").flatMap((d) => d.StreamArn !== void 0 ? [d.StreamArn] : []));
+	}
+	async sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets) {
+		const scope = `the ${region} replica of ${tableName}`;
+		const arnFor = async (which) => {
+			const arn = (await describe())[which];
+			if (arn === void 0 || arn === "") throw new ProvisioningError(maskSecrets(`Cannot apply ${SETTING_MEMBER[settingOf(op)]} to ${scope}: DescribeTable returned no ${which === "tableArn" ? "TableArn" : "LatestStreamArn (the table has no stream)"}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+			return arn;
+		};
+		const send = (call) => this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		switch (op.kind) {
+			case "pitr":
+				await send(() => client.send(new UpdateContinuousBackupsCommand({
+					TableName: tableName,
+					PointInTimeRecoverySpecification: {
+						PointInTimeRecoveryEnabled: op.enabled,
+						...op.recoveryPeriodInDays !== void 0 && { RecoveryPeriodInDays: op.recoveryPeriodInDays }
+					}
+				})));
+				break;
+			case "contributorInsights":
+				await send(() => client.send(new UpdateContributorInsightsCommand({
+					TableName: tableName,
+					ContributorInsightsAction: op.action,
+					...op.mode !== void 0 && { ContributorInsightsMode: op.mode }
+				})));
+				break;
+			case "kinesisEnable":
+				if (await this.activeKinesisStreamArns(client, tableName).then((arns) => arns.has(op.streamArn), () => false)) break;
+				try {
+					await send(() => client.send(new EnableKinesisStreamingDestinationCommand({
+						TableName: tableName,
+						StreamArn: op.streamArn,
+						...op.precision !== void 0 && { EnableKinesisStreamingConfiguration: { ApproximateCreationDateTimePrecision: op.precision } }
+					})));
+				} catch (error) {
+					if (!await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
+				}
+				break;
+			case "kinesisDisable":
+				try {
+					await send(() => client.send(new DisableKinesisStreamingDestinationCommand({
+						TableName: tableName,
+						StreamArn: op.streamArn
+					})));
+				} catch (error) {
+					if (await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
+				}
+				await this.waitForKinesisDisableSettled(client, tableName, op.streamArn, scope, maskSecrets);
+				break;
+			case "kinesisPrecision":
+				await send(() => client.send(new UpdateKinesisStreamingDestinationCommand({
+					TableName: tableName,
+					StreamArn: op.streamArn,
+					UpdateKinesisStreamingConfiguration: { ApproximateCreationDateTimePrecision: op.precision }
+				})));
+				break;
+			case "putTablePolicy":
+			case "putStreamPolicy": {
+				const arn = await arnFor(op.kind === "putTablePolicy" ? "tableArn" : "streamArn");
+				await send(() => client.send(new PutResourcePolicyCommand({
+					ResourceArn: arn,
+					Policy: op.document
+				})));
+				break;
+			}
+			case "deleteTablePolicy":
+			case "deleteStreamPolicy": {
+				if (op.kind === "deleteStreamPolicy" && (await describe()).streamArn === void 0) break;
+				const arn = await arnFor(op.kind === "deleteTablePolicy" ? "tableArn" : "streamArn");
+				try {
+					await send(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: arn })));
+				} catch (error) {
+					if (!(error instanceof PolicyNotFoundException)) throw error;
+				}
+				break;
+			}
+		}
+		this.logger.debug(maskSecrets(`Applied ${op.kind} to ${scope}`));
+	}
+	async retrySettlingRefusal(call, label, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB ${label}`));
+		try {
+			let delayMs = SETTLING_RETRY_INITIAL_MS;
+			for (let attempt = 1;; attempt++) try {
+				await call();
+				return;
+			} catch (error) {
+				const detail = describeAwsFailure(error).detail;
+				const name = error instanceof Error ? error.name : "";
+				if (!(/being enabled|being updated|please retry later|backups are being/i.test(detail) || name === "ResourceInUseException" || name === "LimitExceededException") || attempt >= 8) throw error;
+				this.logger.debug(maskSecrets(`Transient refusal of ${label} (attempt ${attempt}/${8}): ${detail} - retrying in ${delayMs}ms`));
+				await new Promise((resolve) => setTimeout(resolve, delayMs));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				delayMs = Math.min(delayMs * 2, 3e4);
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
 	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
 		try {
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
@@ -47004,7 +48136,7 @@ var DynamoDBGlobalTableProvider = class {
 		} catch (error) {
 			if (fromTemplate || isInterruptedWaitError(error)) throw error;
 			this.logger.debug(maskSecrets(`Could not bring the ${what} of ${tableName} to the declared one: ` + describeAwsFailure(error).detail));
-			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}). The next deploy that updates this table tries again.`));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}).` + relayedEncryptionChangeLimit(describeAwsFailure(error).detail) + ` The next deploy that updates this table tries again.`));
 		}
 	}
 	async waitForGlobalTableSettled(tableName, logicalId, maskSecrets, opts = {}) {
@@ -47105,6 +48237,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback === true) properties = keepUnreadReplicaMembers(properties, previousProperties);
 		const log = this.operationSinks(context, [[properties["TableName"], physicalId], [previousProperties["TableName"], physicalId]]);
 		const maskSecrets = log.mask;
 		const warn = log.warn;
@@ -47170,6 +48303,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
 			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
+			if (refusal === void 0) refusal = replicaSettingsRefusal(properties, previousProperties);
 			if (refusal !== void 0) refuse(refusal);
 		} else {
 			const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
@@ -47484,9 +48618,16 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
 			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
-			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, warn, maskSecrets);
+			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, context?.desiredFromAwsReadback === true, warn, maskSecrets);
 			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
 			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
+			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, new Set(context?.desiredFromAwsReadback === true ? [
+				"pitr",
+				"contributorInsights",
+				"kinesis",
+				"tablePolicy",
+				"streamPolicy"
+			] : context?.replayingState === true ? ["pitr"] : []), describeResp.Table?.LatestStreamArn, warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -47582,30 +48723,44 @@ var DynamoDBGlobalTableProvider = class {
 			if (!deepEqual(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
 					try {
-						await this.dynamoDBClient.send(cmd);
+						await sendTtlWaitingOutRateLimit(() => this.dynamoDBClient.send(cmd), {
+							what: maskSecrets(`DynamoDB TimeToLive rate-limit wait on ${physicalId}`),
+							announce: () => this.logger.info(maskSecrets(`DynamoDB global table ${logicalId}: TimeToLive was changed recently, and AWS refuses another change until its rate-limit interval passes (up to about an hour). Retrying every minute, like CloudFormation, within the resource timeout.`))
+						});
 					} catch (ttlErr) {
-						if (describeAwsFailure(ttlErr).detail.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						const msg = describeAwsFailure(ttlErr).detail;
+						if (cmd.input.TimeToLiveSpecification?.Enabled === false && isTtlAlreadyDisabled(msg)) {
+							this.logger.debug(maskSecrets(`TimeToLive already disabled on ${physicalId}`));
+							return;
+						}
+						if (isTtlRateLimited(msg)) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table, and kept refusing until the resource timeout ran out; redeploy once the interval has passed (up to about an hour), or raise --resource-timeout.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
-				const ttl = properties["TimeToLiveSpecification"];
-				if (ttl?.["AttributeName"]) await sendTtl(new UpdateTimeToLiveCommand({
+				const ttlPlan = planTimeToLive(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"], "update");
+				let ttlTarget;
+				if (ttlPlan.kind === "enable" || ttlPlan.kind === "disable") ttlTarget = {
+					enabled: ttlPlan.kind === "enable",
+					attributeName: ttlPlan.attributeName
+				};
+				else if (ttlPlan.kind === "disable-live") {
+					let live;
+					await this.retrySettlingRefusal(async () => {
+						live = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
+					}, `TimeToLive read on ${physicalId}`, maskSecrets);
+					const status = live?.TimeToLiveStatus;
+					if ((status === "ENABLED" || status === "ENABLING") && live?.AttributeName) ttlTarget = {
+						enabled: false,
+						attributeName: live.AttributeName
+					};
+				}
+				if (ttlTarget) await sendTtl(new UpdateTimeToLiveCommand({
 					TableName: physicalId,
 					TimeToLiveSpecification: {
-						Enabled: ttl["Enabled"] !== void 0 ? Boolean(ttl["Enabled"]) : true,
-						AttributeName: ttl["AttributeName"]
+						Enabled: ttlTarget.enabled,
+						AttributeName: ttlTarget.attributeName
 					}
 				}));
-				else if (previousProperties["TimeToLiveSpecification"]) {
-					const prevTtl = previousProperties["TimeToLiveSpecification"];
-					if (prevTtl["AttributeName"]) await sendTtl(new UpdateTimeToLiveCommand({
-						TableName: physicalId,
-						TimeToLiveSpecification: {
-							Enabled: false,
-							AttributeName: prevTtl["AttributeName"]
-						}
-					}));
-				}
 			}
 			const finalDescribe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const impliedStream = replicationImpliedStreamSpecification(properties);
@@ -48088,7 +49243,8 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
+		const afterOwnWrite = context?.afterOwnWrite === true;
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			if (!table) return void 0;
@@ -48108,21 +49264,37 @@ var DynamoDBGlobalTableProvider = class {
 				if (table.SSEDescription.SSEType !== void 0) sse["SSEType"] = table.SSEDescription.SSEType;
 				result["SSESpecification"] = sse;
 			}
-			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
-			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 			const tableNameForSubs = table.TableName ?? physicalId;
 			const sdkReplicas = table.Replicas && table.Replicas.length > 0 ? currentRegion && !table.Replicas.some((r) => r.RegionName === currentRegion) ? [...table.Replicas, { RegionName: currentRegion }] : table.Replicas : [{ RegionName: currentRegion }];
 			const replicas = await Promise.all(sdkReplicas.map(async (r) => {
 				const entry = { Region: r.RegionName };
-				if (r.KMSMasterKeyId !== void 0) entry["KMSMasterKeyId"] = r.KMSMasterKeyId;
 				if (!r.RegionName) return entry;
 				const isLocal = r.RegionName === currentRegion;
+				const kmsKey = isLocal ? table.SSEDescription?.Status === "ENABLED" ? table.SSEDescription.KMSMasterKeyArn : void 0 : r.KMSMasterKeyId;
+				if (kmsKey !== void 0 && kmsKey !== "") entry["SSESpecification"] = { KMSMasterKeyId: kmsKey };
+				entry["TableClass"] = (isLocal ? void 0 : r.ReplicaTableClassSummary?.TableClass) ?? table.TableClassSummary?.TableClass ?? "STANDARD";
+				const declaredReplica = properties ? localReplicaEntry(properties, r.RegionName) : void 0;
 				const client = isLocal ? this.dynamoDBClient : this.getRegionalClient(r.RegionName);
 				const regionLabel = r.RegionName;
 				const replicaArn = isLocal ? table.TableArn : table.TableArn ? this.replicaArnForRegion(table.TableArn, r.RegionName) : void 0;
-				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel);
+				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel, declaredReplica);
 				Object.assign(entry, subs);
+				let protection;
+				let streamArn;
+				if (isLocal) {
+					protection = table.DeletionProtectionEnabled;
+					streamArn = table.LatestStreamArn;
+				} else try {
+					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
+					protection = regional.Table?.DeletionProtectionEnabled;
+					streamArn = regional.Table?.LatestStreamArn;
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) this.logger.debug(safeMsg`Cross-region replica ${regionLabel} returned RNF on DescribeTable; omitting its protection and stream policy`);
+					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
+				}
+				if (typeof protection === "boolean") entry["DeletionProtectionEnabled"] = protection;
+				await this.readReplicaPolicies(client, tableNameForSubs, regionLabel, replicaArn, streamArn, declaredReplica, afterOwnWrite, entry);
 				if (replicaArn) try {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
 					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
@@ -48207,17 +49379,19 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readReplicaSubSpecs(client, tableName, regionLabel) {
+	async readReplicaSubSpecs(client, tableName, regionLabel, declaredReplica) {
 		const out = {};
 		try {
 			const ci = await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }));
-			if (ci.ContributorInsightsStatus) out["ContributorInsightsSpecification"] = { Enabled: ci.ContributorInsightsStatus === "ENABLED" };
+			const block = reverseMapReplicaContributorInsights(ci.ContributorInsightsStatus, ci.ContributorInsightsMode, declaredReplica?.["ContributorInsightsSpecification"]);
+			if (block !== void 0) out["ContributorInsightsSpecification"] = block;
 		} catch (err) {
 			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
-			const pitrStatus = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus;
-			if (pitrStatus) out["PointInTimeRecoverySpecification"] = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
+			const description = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
+			const block = reverseMapReplicaPitr(description?.PointInTimeRecoveryStatus, description?.RecoveryPeriodInDays, declaredReplica?.["PointInTimeRecoverySpecification"]);
+			if (block !== void 0) out["PointInTimeRecoverySpecification"] = block;
 		} catch (err) {
 			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
@@ -48233,6 +49407,54 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		return out;
 	}
+	policyRereadDelaysMs = [
+		500,
+		1e3,
+		2e3
+	];
+	async readReplicaPolicies(client, tableName, regionLabel, tableArn, streamArn, declaredReplica, afterOwnWrite, entry) {
+		if (declaredReplica === void 0) return;
+		const readOne = async (what, arn, container) => {
+			if (arn === void 0 || arn === "") return void 0;
+			const declaredMember = () => declaredStreamPolicyMember(container);
+			let last;
+			const read = async () => {
+				try {
+					last = (await client.send(new GetResourcePolicyCommand({ ResourceArn: arn }))).Policy;
+				} catch (err) {
+					if (!(err instanceof PolicyNotFoundException)) throw err;
+					last = void 0;
+				}
+				return last;
+			};
+			try {
+				let live = await read();
+				for (const delayMs of afterOwnWrite ? this.policyRereadDelaysMs : []) {
+					if (streamPolicyMatchesDeclared(live, container)) break;
+					await new Promise((resolve) => setTimeout(resolve, delayMs));
+					live = await read();
+				}
+				if (afterOwnWrite && (live === void 0 || live === "")) {
+					this.logger.debug(safeMsg`Kept the declared ${what} of the ${regionLabel} replica of ${tableName} in the baseline captured after its write: the read still found no policy`);
+					return declaredMember();
+				}
+				return reverseMapStreamPolicy(live, container);
+			} catch (err) {
+				this.logger.debug(safeMsg`Could not read the ${what} of the ${regionLabel} replica of ${tableName}: ${describeAwsFailure(err).detail}`);
+				if (afterOwnWrite && last !== void 0 && last !== "") return reverseMapStreamPolicy(last, container);
+				if (afterOwnWrite && (isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1)) return declaredMember();
+				return;
+			}
+		};
+		if (readTablePolicy(declaredReplica).kind === "usable") {
+			const member = await readOne("ResourcePolicy", tableArn, declaredReplica);
+			if (member !== void 0) entry["ResourcePolicy"] = member;
+		}
+		if (readStreamPolicy$1(declaredReplica).kind === "usable") {
+			const member = await readOne("stream ResourcePolicy", streamArn, declaredReplica["ReplicaStreamSpecification"]);
+			if (member !== void 0) entry["ReplicaStreamSpecification"] = { ResourcePolicy: member };
+		}
+	}
 	async readAutoScalingSettings(tableName, scalableDimension, client, indexName) {
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
@@ -48312,36 +49534,23 @@ var DynamoDBGlobalTableProvider = class {
 			baseline,
 			aws
 		};
-		const key = "Replicas";
-		const baselineReplicas = baseline[key];
-		const awsReplicas = aws[key];
-		if (!Array.isArray(baselineReplicas) || !Array.isArray(awsReplicas)) return {
-			baseline,
-			aws
-		};
 		const localRegion = await this.dynamoDBClient.config.region() ?? "";
-		if (!localRegion) return {
+		const completed = completeLegacyLocalReplica(baseline, aws, localRegion);
+		const converted = canonicalizePre5381ReplicaBaseline(completed, aws, localRegion, completed !== baseline);
+		return converted === baseline ? {
 			baseline,
 			aws
-		};
-		const isLocal = (element) => asRecord(element)?.["Region"] === localRegion;
-		if (baselineReplicas.some(isLocal)) return {
-			baseline,
-			aws
-		};
-		const liveLocal = awsReplicas.find(isLocal);
-		if (liveLocal === void 0) return {
-			baseline,
-			aws
-		};
-		return {
-			baseline: {
-				...baseline,
-				[key]: [...baselineReplicas, structuredClone(liveLocal)]
-			},
+		} : {
+			baseline: converted,
 			aws
 		};
 	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return [];
+		const declared = properties["SSESpecification"];
+		if (declared === void 0) return ["SSESpecification"];
+		return coerceCfnBoolean(asRecord(declared)?.["SSEEnabled"]) === false ? ["SSESpecification"] : [];
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
 		if (explicit) try {
@@ -48473,11 +49682,50 @@ function refuseMalformedReplicaTags(properties, resourceType, logicalId, physica
 	});
 	return tagsByReplica;
 }
+function completeLegacyLocalReplica(baseline, aws, localRegion) {
+	const key = "Replicas";
+	const baselineReplicas = baseline[key];
+	const awsReplicas = aws[key];
+	if (!Array.isArray(baselineReplicas) || !Array.isArray(awsReplicas)) return baseline;
+	if (!localRegion) return baseline;
+	const isLocal = (element) => asRecord(element)?.["Region"] === localRegion;
+	if (baselineReplicas.some(isLocal)) return baseline;
+	const liveLocal = awsReplicas.find(isLocal);
+	if (liveLocal === void 0) return baseline;
+	return {
+		...baseline,
+		[key]: [...baselineReplicas, structuredClone(liveLocal)]
+	};
+}
 function localReplicaEntry(props, region) {
 	const raw = props["Replicas"];
 	if (!Array.isArray(raw)) return void 0;
 	return raw.find((r) => r?.["Region"] === region);
 }
+const REPLICA_SETTING_MEMBERS = [
+	"PointInTimeRecoverySpecification",
+	"ContributorInsightsSpecification",
+	"KinesisStreamSpecification",
+	"ResourcePolicy",
+	"ReplicaStreamSpecification"
+];
+function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
+	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
+		const region = asRecord(entry)?.["Region"];
+		return typeof region === "string" && region !== currentRegion;
+	});
+	for (const entry of desired) {
+		const replica = asRecord(entry);
+		const region = replica?.["Region"];
+		if (typeof region !== "string") continue;
+		const previous = previousProperties === void 0 ? void 0 : localReplicaEntry(previousProperties, region);
+		if (!(previous === void 0 || REPLICA_SETTING_MEMBERS.some((member) => !deepEqual(replica?.[member], previous[member])))) continue;
+		const [refusal] = replicaSettingRefusals(replica);
+		if (refusal !== void 0) return `The ${region} replica: ${refusal}`;
+		if ((previousProperties === void 0 ? crossRegionCreate : previous === void 0) && replica?.["ResourcePolicy"] !== void 0 && replica["ResourcePolicy"] !== null) return `The ${region} replica: Replicas[].ResourcePolicy cannot be set in the deploy that creates the replica — CloudFormation refuses it ("A replica cannot be created in the same stack update as putting a resource-based policy on that new replica"). ` + (previousProperties === void 0 ? `Deploy the table and its replicas without it` : `Deploy the replica without it`) + `, then add the policy in a later deploy`;
+	}
+}
 function extractLocalDeletionProtection(props, region) {
 	const local = localReplicaEntry(props, region);
 	const perReplica = coerceCfnBoolean(local?.["DeletionProtectionEnabled"]);
@@ -48608,8 +49856,19 @@ function collectAutoScalingTargets(properties, localRegion) {
 const REPLICA_COPY_RELEASE_POLLS = 180;
 const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
 const DELETION_PROTECTION_REFLIP_MS = 16e3;
+function relayedEncryptionChangeLimit(withheldText) {
+	return /Encryption mode changes are limited/i.test(withheldText) ? " AWS limits a table to 4 encryption changes in 24 hours, then one every 6 hours; retry the change later (--verbose shows when AWS allows the next one)." : "";
+}
+const KINESIS_DISABLE_UNSETTLED = /* @__PURE__ */ new Set([
+	"ACTIVE",
+	"ENABLING",
+	"UPDATING",
+	"DISABLING"
+]);
 const REPLICA_PROTECTION_SETTLE_POLLS = 60;
 const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
+const SETTLING_RETRY_ATTEMPTS = 8;
+const SETTLING_RETRY_INITIAL_MS = 2e3;
 const REPLICA_COPY_RELEASE_ATTEMPTS = 3;
 function isReplicaCopyExistsRefusal(error) {
 	return error instanceof Error && /one or more replicas already existed as tables/i.test(error.message);
@@ -50457,7 +51716,10 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 				continue;
 			}
 			const moved = movedAsWritten(pc.path);
-			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
+			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path], {
+				oldProperties: currentPropsAsWritten,
+				newProperties: desiredForSkipCheckAsWritten
+			}) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
 				lowered.push(pc);
@@ -52517,5 +53779,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { planOrphanAdoption as $, malformedLocalOutputsWarning as $a, hasReadableExportSet as $c, refuseUnreadableCdkCrossAccountRefs as $i, getDefaultStateBucketName as $l, awaitInFlightSibling as $n, withoutSilentDropProperties as $o, isRefusedByName as $r, hasMaskableValues as $s, resolveReplacementOldType as $t, inheritedProvenanceForChildDiff as A, lacksRecordedTableArn as Aa, recordMaskOnlyValuesIn as Ac, deleteLeftInPlace as Ai, buildDenyExternalAccessPolicy as Al, exportNameSecretExposure as An, refuseMalformedResourceEntriesForImportSave as Ao, secretNamePrintingBag as Ar, DagBuilder as As, readRefactorMarker as At, hasOwnKey as Au, conditionFingerprint as B, UNREADABLE_ORPHANS_CONTAINER_ROW as Ba, rebuildClientForBucketRegion as Bc, reEnableInstanceApiTermination as Bi, isDockerClientEnvKey as Bl, constructPathOf as Bn, repairMalformedOrphanRecordsForReadOnly as Bo, createPreDeleteFinalSnapshot as Br, noEchoOutputsComparison as Bs, refusePendingMovesOut as Bt, injectedAwsRegionValue as Bu, hasCdkAutoDeleteTag as C, carriesDynamicReference as Ca, physicalNameCopiesOf as Cc, customResourceResponseExpirationWarning as Ci, ensureAssetStorage as Cl, displayTextOrWithheld as Cn, refuseMalformedOutputs as Co, noEchoParameterNamesOf as Cr, prefetchCreateOnlyPropertyPaths as Cs, makeForeignHolderScan as Ct, AssemblyReader as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, AWS_NO_VALUE as Da, carriesSecretMask as Dc, RollbackInlinePolicyWriters as Di, readBootstrapMarkerBody as Dl, secretSafeKeyDisplay as Dn, refuseMalformedResourceEntriesForDeploy as Do, maskEventTextWithBoundBags as Dr, canonicalLambdaFunctionName as Ds, isAccessDeniedError as Dt, parseFailureDebugDetail as Du, markRefusedBeforeApplying as E, keepsSecretReferenceToken as Ea, splitGetAttStringForm as Ec, unchangedBehindSecretReference as Ei, parseBootstrapMarker as El, secretBearingStateKeyWarning as En, refuseMalformedResourceEntries as Eo, journaledOrphanPrintingBag as Er, withRetry as Es, chunks as Et, describeJsonParseFailure as Eu, findNestedTemplateTreeDefect as F, passedParameterClassesOf as Fa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fc, disableInstanceApiTermination as Fi, describeDockerFailure as Fl, isExportAliasCollision as Fn, refuseMalformedResourcePropertiesForOrphan as Fo, storedSecretNameNeedles as Fr, maskReadbackAtCoordinates as Fs, sameMove as Ft, describeFileReadFailure as Fu, enclosingDeadlineRemainingMs as G, hasReadableOrphans as Ga, isAccessDenied$1 as Gc, isSettledInstanceState as Gi, redactedDockerCause as Gl, movedToHint as Gn, repairMalformedResourcesForReadOnly as Go, earliestDefined as Gr, valueAtCoordinate as Gs, demoteSupersededOrphans as Gt, parentSuppliedValues as H, accountArgs as Ha, CrossPrefixScanCache as Hc, INTRINSIC_KEYS as Hi, partitionSensitiveEnv as Hl, formatDestructiveChange as Hn, repairMalformedOutputsForReadOnly as Ho, isFinalSnapshotError as Hr, readbackPathFor as Hs, replayRollback as Ht, resolveBucketRegion as Hu, isAbsoluteAssetPath as I, declaresNoEcho as Ia, isSingleDynamicReferenceToken as Ic, ec2InstanceProtectionSite as Ii, dockerSpawnEnvWithSensitive as Il, bindingSkippedOutputs as In, refuseMalformedResourcesForDeploy as Io, ATOMIC_FINAL_SNAPSHOT_TYPES as Ir, maskWholeValue as Is, updateRefactorMarker as It, displayAssemblyPath as Iu, isSecretBearingReferenceString as J, isReadableOrphanRecord as Ja, withStackInstanceIdWithheld as Jc, s3BucketDualStackDomainName as Ji, warnFinchArgvExposure as Jl, isPairableType as Jn, unreadableResourceEntries as Jo, withCreateTokenLedger as Jr, redactForState as Js, planFailedOps as Jt, withResourceDeadline as K, hasReadableOutputs as Ka, isNotImplemented as Kc, s3BucketArn as Ki, runDockerForeground as Kl, rollbackOrphanIds as Kn, unpreviewableOrphanRecords as Ko, ledgerForStack as Kr, liveMatchesUnresolvedTokenFrame as Ks, isJournaledOrphan as Kt, listNestedTemplateRows as L, JSON_LISTING_HOLE_VALUE as La, LockManager as Lc, isTerminationProtectionPropagationError as Li, finchSecretArgvRefusal as Ll, DEFAULT_RESOURCE_TIMEOUT_MS as Ln, refuseMalformedResourcesForDestroy as Lo, PRE_DELETE_SNAPSHOT_TYPES as Lr, maskedLeafCoordinatesOf as Ls, hasPendingMovesOut as Lt, renderAssemblyPathEscape as Lu, findServiceTokenRefusals as M, parseWebACLArn as Ma, recordNoEchoParameterFreshValue as Mc, withIndeterminateGuard as Mi, resolveDockerContextDirectory as Ml, noEchoParameterValueSeed as Mn, refuseMalformedResourcePropertiesForDestroy as Mo, secretNamedAttributeNamesOf as Mr, canonicalCoordinates as Ms, refactorMarkerMovesOf as Mt, nullPrototypeRecord as Mu, serviceTokenBlockingReason as N, withSharedDrainBudget as Na, recordProvenPublicExpression as Nc, isWaitAbandonedError as Ni, describeDockerCapturedOutput as Nl, collectDeclaredOutputNames as Nn, refuseMalformedResourcePropertiesForDrift as No, secretNamedRecordNeedles as Nr, isMarkedCoordinate as Ns, refactorMarkerRefusalMessage as Nt, ownValue as Nu, computeImplicitDeleteEdges as O, cfnRefValueFromPhysicalId as Oa, provenPublicValue as Oc, UNSPECIFIED_SKIP_REASON as Oi, validateAssetBucketName as Ol, carriedExportAliasExposure as On, refuseMalformedResourceEntriesForDestroy as Oo, namingSecretsWithRecordedNoEcho as Or, lambdaFunctionNameForMask as Os, lookupEachName as Ot, utf8ByteLength as Ou, childTemplateLoader as P, parameterInputsFor as Pa, wholeStringLeavesOf as Pc, markWaitAbandoned as Pi, describeDockerExecFailure as Pl, collectPublishedOutputNames as Pn, refuseMalformedResourcePropertiesForExport as Po, stateSecretNameNeedles as Pr, maskAtCoordinates as Ps, refuseRefactorMarker as Pt, absoluteAssemblyPathEscape as Pu, makeSiblingClaimReader as Q, malformedExportSourceWarning as Qa, exportNamesCarriedFrom as Qc, producerLookupOver as Qi, synthesisStatusMessage as Ql, proposeRenames as Qn, unwrittenCreateOnlyReplacement as Qo, extractDeploymentEventError as Qr, createUnionSecretMasker as Qs, replacementNeverSwapped as Qt, renderNestedTemplateTreeDefect as R, STATE_REGION_DIVERGED as Ra, isLockInfoExpired as Rc, observeThenDisableInstanceApiTermination as Ri, formatDockerLoginError as Rl, DEFAULT_RESOURCE_WARN_AFTER_MS as Rn, refuseMalformedResourcesForExport as Ro, buildFinalSnapshotIdentifier as Rr, noEchoCoordinatesOf as Rs, pendingMovesOutOf as Rt, resolveAssemblyPath as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, isImpossibleEmptyStoredAttribute as Sa, recoverMaskedOutput as Sc, applyCustomResourceResponseExpiration as Si, assertAssetBucketRegion as Sl, WITHHELD_NAME_DISPLAY as Sn, refuseMalformedOrphansForOrphan as So, noEchoExactEchoLeavesOf as Sr, requireConfigString as Ss, loadJournaledOrphans as St, derivePartitionAndUrlSuffix as Su, getPriorAttempts as T, isNamelessDynamicReferenceError as Ta, recordPhysicalNameCopy as Tc, slowCcOperationTimeoutMs as Ti, isCrossRegionRedirect as Tl, secretBearing as Tn, refuseMalformedResourceAttributesForOrphan as To, completedReplayEntries as Tr, describeTypeWithThrottleRetry as Ts, formatResourceLine as Tt, processStackMessages as Tu, readRecordedConditionVerdicts as U, deployRefusesOrphanRowsReason as Ua, applyCrossPrefixScan as Uc, IntrinsicFunctionResolver as Ui, redactDockerArgvValues as Ul, findRefactorHints as Un, repairMalformedResourceEntriesForReadOnly as Uo, refusesFinalSnapshot as Ur, readsNoEchoSource as Us, removeProtectionTypeList as Ut, conditionInputsFrom as V, UNREADABLE_RESOURCES_MAP_ROW as Va, CrossPrefixReadError as Vc, DiffCalculator as Vi, isMalformedEnvKey as Vl, findDestructiveChanges as Vn, repairMalformedOrphansForReadOnly as Vo, effectiveDeletionPolicy as Vr, passedNoEchoParametersOf as Vs, replayFailedOperations as Vt, clearBucketRegionCache as Vu, enclosingDeadlineExpired as W, displayLogicalId as Wa, crossPrefixDeniedWarning as Wc, poisonRenderedSpellingsCollidingIn as Wi, redactedCause as Wl, hintSidesOf as Wn, repairMalformedResourcePropertiesForReadOnly as Wo, unsupportedFinalSnapshotError as Wr, recordedNoEchoValuesOf as Ws, recordAfterRollbackUpdate as Wt, mergeNoChangeOutputs as X, malformedDriftResourcePropertiesWarning as Xa, acceptedCreateOnlyDropsOf as Xc, s3BucketWebsiteUrl as Xi, getDockerImageBySourceHash as Xl, mappingPairs as Xn, findActionableSilentDrops as Xo, DeploymentEventsReader as Xr, snapshotPassProvenance as Xs, recheckFailedPlan as Xt, keptWholeReasonText as Y, isReadableResourceEntry as Ya, splitImportedOps as Yc, s3BucketRegionalDomainName as Yi, AssetManifestLoader as Yl, looselyEqual as Yn, withheldAccountClause as Yo, acquireIdempotencyToken as Yr, recordReferenceProvenanceEntry as Ys, planRollback as Yt, makeCanonicalizePropertiesFn as Z, malformedExportNamesWarning as Za, describeRegionValueKind as Zc, resolveDynamicReferences as Zi, Synthesizer as Zl, parseMappingFile as Zn, findSilentDropProperties as Zo, DeploymentEventsStore as Zr, carryLogOnlyValues as Zs, recordUnderIdIsNotOwn as Zt, deleteTableWithIndexBusyRetry as _, regionLessSecretName as _a, pathCrossesDottedKey as _c, readsNoEchoDeleteValues as _i, createAssetRedirectResolver as _l, withNameGenerationReached as _n, refuseMalformedNestedChildOutputs as _o, supersededHolderOf as _r, configStringRefusal as _s, deleteJournaledOrphans as _t, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _u, isProtectionValueActive as a, assertFlagRoleArn as aa, shareLogOnlyValues as ac, refuseMalformedDesiredTags as ai, orphansAfterRollback as al, REDACTED_DELETE_ADDRESS_SKIP_REASON as an, malformedOrphansRefusalMessage as ao, cyan as ar, isStatefulRecreateTargetForReplace as as, displacedOpClause as at, resolveSkipPrefix as au, waitForIndexesSettled as b, parameterTypeMayLoseSecretIdentity as ba, inheritNestedStackParameterAssociations as bc, withPrintingSecrets as bi, AssetModeResolver as bl, reachableDivergentParameters as bn, refuseMalformedOrphans as bo, noEchoAttributeNamesOf as br, requireConfigArray as bs, isHandledOrphan as bt, PARTITION_TABLE as bu, DynamoDBGlobalTableProvider as c, isIamRoleArn as ca, errorCauseChain as cc, definedAttributes as ci, stackInstanceIdCarriedFrom as cl, redactedDeleteAddressSkip as cn, malformedOutputsWarning as co, red as cr, WARM_THROUGHPUT_MEMBERS as cs, getNestedRevertRun as ct, resolveUseCdkBootstrapAssets as cu, compensateRemovedDeletionProtection as d, applyCallerIdentityCredentials as da, scrubResourceRecord as dc, ProviderRegistry as di, timePhase as dl, nameGenerationCarriedFrom as dn, malformedResourcePropertiesWarning as do, deleteSupersededEntry as dr, toCfnInteger as ds, revertNestedChildFromJournal as dt, ssmResolvedValueType as du, keepHeldTokenProvenance as ea, literalSplitDelimitersOf as ec, markDeleteStarted as ei, hasReasonlessBaselineRefusal as el, seedsDeleteFirstGuard as en, malformedLocalResourceEntriesWarning as eo, destroyStackRecordsView as er, NO_CC_HANDLERS_REASON as es, pendingRequestCount as et, getLegacyStateBucketName as eu, deleteBudgetKey as f, callerEnvCredentials as fa, withPhysicalNameCopies as fc, ccBrokenReason as fi, AssetPublisher as fl, nameGenerationHighWaterOf as fn, malformedResourcesWarning as fo, holdsSupersededResources as fr, toFiniteNumber as fs, revertedNestedRowIds as ft, CFN_TEMPLATE_BODY_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, producerRegionsFromState as ga, isUncertifiedBaselineMaskPosition as gc, TemplateNoEchoReresolver as gi, buildAssetRedirectMap as gl, retiredNameGenerationsLeaving as gn, refuseDivergentRecordRegionForDestroy as go, supersededHeldByOtherTypeWarning as gr, configIntegerRefusal as gs, withNestedStackContext as gt, uploadCfnTemplate as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, classifyReplaySecretRegion as ha, dynamicReferenceTokens as hc, waitForLambdaFunctionActive as hi, WorkGraph as hl, retiredNameGenerationsAfter as hn, previewableOrphanRecords as ho, supersededAfterRollback as hr, configBooleanRefusal as hs, getCurrentNestedStackContext as ht, findLargeInlineResources as hu, PROTECTION_PROPERTY_BY_TYPE as i, applyRoleArnIfSet as ia, recordLogOnlyValue as ic, readTagList as ii, isReadableBag as il, inheritProducerRegions as in, malformedOrphanRowsKeptWarning as io, bold as ir, MULTI_REGION_RECREATE_BLOCKED_TYPES as is, NESTED_PENDING_PARENT_REASON as it, resolveCaptureObservedState as iu, deferredServiceTokenWarning as j, refStateLookupFromResource as ja, recordNoEchoAttributeValues as jc, deleteSkipReason as ji, buildDockerImage as jl, isWholeDynamicReferenceValue as jn, refuseMalformedResourceEntriesForOrphan as jo, secretNamePrintingBags as jr, TemplateParser as js, readRefactorMarkerOnce as jt, hasPlainPrototype$1 as ju, crossStackOutputProvenanceSource as k, isStalePlaceholderArnAttribute as ka, recordMaskOnlyValue as kc, deleteIndeterminateGuards as ki, validateContainerRepoName as kl, exportNameNoEchoParameters as kn, refuseMalformedResourceEntriesForImport as ko, orphanRecordsPrintingBag as kr, sameLambdaFunctionAddress as ks, withApiLimit as kt, defineOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, sendableAssumeRoleCommand as la, maskSecretsInError as lc, stringifyIfAssigned as li, PhaseClock as ll, updatePartialMessage as ln, malformedRenderedContainersWarning as lo, yellow as lr, coerceWarmThroughput as ls, nestedChildStackName as lt, stateBucketExistenceConfirmed as lu, resolveDynamoDbDeleteBudgetMs as m, classifyRecordedSecretRegion as ma, DYNAMIC_REFERENCE_TOKEN_SCAN as mc, wouldReturnToSdkProvider as mi, stringifyValue as ml, retiredAfterRollback as mn, malformedStateRefusalMessage as mo, removeSuperseded as mr, coerceCfnInteger as ms, collectNestedChildUnaddressed as mt, MIGRATE_TMP_PREFIX as mu, recordedProtectionEvidence as n, recordedOutputReferenceRegions as na, printingCorpusOf as nc, DBPROXY_TAG_OPTIONS as ni, importableOutputKeys as nl, findNestedStackTypeChanges as nn, malformedOrphanRecordsRefusalMessage as no, withStackRecords as nr, findReplacedReadersOfRecreateTargets as ns, keptForRetainedRecord as nt, resolveApp as nu, perType as o, assertSendableRoleArn as oa, unionOfSecretBags as oc, tagMapAsList as oi, orphansCarriedFrom as ol, isRedactedRecordedValue as on, malformedOrphansWarning as oo, gray as or, isStatefulRecreateTargetSync as os, displacedPhysicalIdShown as ot, resolveStateBucketWithDefault as ou, resolveDynamoDbDeleteBudgetClock as p, envCredentialsAreAssumedRole as pa, withoutPhysicalNameCopies as pc, isCustomResource as pi, isSensitiveAttributeName as pl, nameScopeOf as pn, malformedScrubResourceEntriesRefusalMessage as po, isSupersededResourceRecord as pr, coerceCfnBoolean as ps, withNestedRevertRun as pt, CFN_TEMPLATE_URL_LIMIT as pu, diffSecurity as q, hasReadableResources as qa, stackInstanceIdOf as qc, s3BucketDomainName as qi, runDockerStreaming as ql, withMovedTo as qn, unreadableOrphanRecords as qo, reserveStackCreateToken as qr, markSameGenerationBag as qs, isReplacementOrphan as qt, recordedProtectionNote as r, recordedReferenceRegions as ra, recordLogOnlyParameterValue as rc, planTagDiff as ri, importableOutputs as rl, getCurrentProducerRegions as rn, malformedOrphanRecordsWarning as ro, replacedDeleteFailureVerdict as rr, shownType as rs, recordRetainedForReadoption as rt, resolveAutoAssetStorage as ru, readProtection as s, explicitRoleArnOrThrow as sa, createSecretMasker as sc, tagPlanWarning as si, shouldRetainResource as sl, redactedDeleteAddressFields as sn, malformedOutputsRefusalMessage as so, green as sr, renderStatefulReason as ss, dropSettledNestedJournals as st, resolveStateBucketWithDefaultAndSource as su, DeployEngine as t, outputReferenceProvenanceOf as ta, logOnlyValueCount as tc, DBPROXY_TAGS_WHAT as ti, hasUnverifiableParameterRefusal as tl, orphanNeedsIdentity as tn, malformedLocalResourcesWarning as to, getStackRecords as tr, hasNoCloudControlHandlers as ts, resolvePendingCloudControlRequests as tt, loadCdkJson as tu, beginDeleteWait as u, AWS_CREDENTIAL_ENV_KEYS as ua, maskSecretsInText as uc, CC_BROKEN_REASON as ui, renderPhaseTimings as ul, updatePartialReason as un, malformedResourceEntriesWarning as uo, addSuperseded as ur, isWarmThroughputDecrease as us, recordDisplacedSkips as ut, warnDeprecatedNoPrefixCliFlag as uu, maskedLogger as v, coerceParameterTypedValue as va, spelledKeysOf as vc, isCustomResourceType as vi, loadPublishableAssetManifest as vl, computeParameterTaint as vn, refuseMalformedOrphanRecords as vo, supersededResourcesOf as vr, readConfigString as vs, dropFailedCommands as vt, decodeListingKey as vu, isTruthyCfnBoolean as w, carriesFetchableDynamicReference as wa, recordAttributeIdCopy as wc, CloudControlProvider as wi, getBootstrapMarkerKey as wl, exportAliasCollisionScrubWarning as wn, refuseMalformedOutputsForDestroy as wo, createReadOnlyAttributeHealerFactory as wr, templateResourceTypes as ws, sameJournaledOrphans as wt, StageLoadError as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, getAccountInfo as xa, recordNestedStackParameterExpressions as xc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xi, BOOTSTRAP_MARKER_PREFIX as xl, resourcesNamingDeclaredParameter as xn, refuseMalformedOrphansForDestroy as xo, noEchoComparisonForTemplate as xr, requireConfigObject as xs, journaledOrphanLines as xt, canonicalizeRegion as xu, relayedIndexBusyDelete as y, isUnboundTemplateParameter as ya, identityKeyFor as yc, getCurrentResourceSecrets as yi, rewriteTemplateAssetReferences as yl, namesAnyDeclaredParameter as yn, refuseMalformedOrphanRecordsForDestroy as yo, withoutSuperseded as yr, replayWarn as ys, dropFailedHint as yt, expectedOwnerParam as yu, templateIdentity as z, STATE_RESOURCES_MALFORMED as za, S3StateBackend as zc, reDisableInstanceApiTermination as zi, getDockerCmd as zl, maskingRetryLogger as zn, refuseMalformedState as zo, ccRoutedFinalSnapshotError as zr, noEchoLeavesOf as zs, pendingMovesRefusalMessage as zt, injectAwsRegion as zu };
-//# sourceMappingURL=deploy-engine-BOgsnnk0.js.map
+export { computeImplicitDeleteEdges as $, AWS_NO_VALUE as $a, recordAttributeIdCopy as $c, RollbackInlinePolicyWriters as $i, getBootstrapMarkerKey as $l, carriedExportAliasExposure as $n, refuseMalformedResourceEntriesForDeploy as $o, namingSecretsWithRecordedNoEcho as $r, blockDeviceMappingsDifferOnlyInDeleteOnTermination as $s, lookupEachName as $t, StageLoadError as $u, beginDeleteWait as A, applyRoleArnIfSet as Aa, logOnlyValueCount as Ac, refuseMalformedDesiredTags as Ai, hasUnverifiableParameterRefusal as Al, REDACTED_DELETE_ADDRESS_SKIP_REASON as An, malformedOrphanRowsKeptWarning as Ao, cyan as Ar, MULTI_REGION_RECREATE_BLOCKED_TYPES as As, displacedOpClause as At, loadCdkJson as Au, waitForIndexesSettled as B, classifyRecordedSecretRegion as Ba, scrubResourceRecord as Bc, waitForLambdaFunctionActive as Bi, timePhase as Bl, retiredNameGenerationsAfter as Bn, malformedStateRefusalMessage as Bo, supersededAfterRollback as Br, coerceCfnInteger as Bs, getCurrentNestedStackContext as Bt, ssmResolvedValueType as Bu, planContributorInsightsOp as C, resolveDynamicReferences as Ca, redactForState as Cc, extractDeploymentEventError as Ci, withStackInstanceIdWithheld as Cl, replacementNeverSwapped as Cn, malformedExportNamesWarning as Co, proposeRenames as Cr, findSilentDropProperties as Cs, makeSiblingClaimReader as Ct, warnFinchArgvExposure as Cu, reverseMapTableContributorInsights as D, outputReferenceProvenanceOf as Da, createUnionSecretMasker as Dc, DBPROXY_TAG_OPTIONS as Di, exportNamesCarriedFrom as Dl, findNestedStackTypeChanges as Dn, malformedLocalResourcesWarning as Do, withStackRecords as Dr, hasNoCloudControlHandlers as Ds, keptForRetainedRecord as Dt, synthesisStatusMessage as Du, reverseMapIndexContributorInsights as E, keepHeldTokenProvenance as Ea, carryLogOnlyValues as Ec, DBPROXY_TAGS_WHAT as Ei, describeRegionValueKind as El, orphanNeedsIdentity as En, malformedLocalResourceEntriesWarning as Eo, getStackRecords as Er, NO_CC_HANDLERS_REASON as Es, resolvePendingCloudControlRequests as Et, Synthesizer as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, sendableAssumeRoleCommand as Fa, unionOfSecretBags as Fc, CC_BROKEN_REASON as Fi, orphansCarriedFrom as Fl, updatePartialReason as Fn, malformedRenderedContainersWarning as Fo, addSuperseded as Fr, coerceWarmThroughput as Fs, recordDisplacedSkips as Ft, resolveStateBucketWithDefault as Fu, sendTtlWaitingOutRateLimit as G, isUnboundTemplateParameter as Ga, isUncertifiedBaselineMaskPosition as Gc, withPrintingSecrets as Gi, buildAssetRedirectMap as Gl, reachableDivergentParameters as Gn, refuseMalformedOrphanRecordsForDestroy as Go, noEchoAttributeNamesOf as Gr, replayWarn as Gs, isHandledOrphan as Gt, uploadCfnTemplate as Gu, isTtlRateLimited as H, producerRegionsFromState as Ha, withoutPhysicalNameCopies as Hc, readsNoEchoDeleteValues as Hi, isSensitiveAttributeName as Hl, withNameGenerationReached as Hn, refuseDivergentRecordRegionForDestroy as Ho, supersededHolderOf as Hr, configIntegerRefusal as Hs, deleteJournaledOrphans as Ht, CFN_TEMPLATE_URL_LIMIT as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, AWS_CREDENTIAL_ENV_KEYS as Ia, createSecretMasker as Ic, ProviderRegistry as Ii, shouldRetainResource as Il, nameGenerationCarriedFrom as In, malformedResourceEntriesWarning as Io, deleteSupersededEntry as Ir, isWarmThroughputDecrease as Is, revertNestedChildFromJournal as It, resolveStateBucketWithDefaultAndSource as Iu, hasCdkAutoDeleteTag as J, isImpossibleEmptyStoredAttribute as Ja, identityKeyFor as Jc, customResourceResponseExpirationWarning as Ji, rewriteTemplateAssetReferences as Jl, displayTextOrWithheld as Jn, refuseMalformedOrphansForOrphan as Jo, noEchoParameterNamesOf as Jr, requireConfigString as Js, makeForeignHolderScan as Jt, expectedOwnerParam as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, parameterTypeMayLoseSecretIdentity as Ka, pathCrossesDottedKey as Kc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Ki, createAssetRedirectResolver as Kl, resourcesNamingDeclaredParameter as Kn, refuseMalformedOrphans as Ko, noEchoComparisonForTemplate as Kr, requireConfigArray as Ks, journaledOrphanLines as Kt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ku, deleteTableWithIndexBusyRetry as L, applyCallerIdentityCredentials as La, errorCauseChain as Lc, ccBrokenReason as Li, stackInstanceIdCarriedFrom as Ll, nameGenerationHighWaterOf as Ln, malformedResourcePropertiesWarning as Lo, holdsSupersededResources as Lr, toCfnInteger as Ls, revertedNestedRowIds as Lt, resolveUseCdkBootstrapAssets as Lu, deleteBudgetKey as M, assertSendableRoleArn as Ma, recordLogOnlyParameterValue as Mc, tagPlanWarning as Mi, importableOutputs as Ml, redactedDeleteAddressFields as Mn, malformedOrphansWarning as Mo, green as Mr, isStatefulRecreateTargetSync as Ms, dropSettledNestedJournals as Mt, resolveAutoAssetStorage as Mu, resolveDynamoDbDeleteBudgetClock as N, explicitRoleArnOrThrow as Na, recordLogOnlyValue as Nc, definedAttributes as Ni, isReadableBag as Nl, redactedDeleteAddressSkip as Nn, malformedOutputsRefusalMessage as No, red as Nr, renderStatefulReason as Ns, getNestedRevertRun as Nt, resolveCaptureObservedState as Nu, stripIndexContributorInsights as O, recordedOutputReferenceRegions as Oa, hasMaskableValues as Oc, planTagDiff as Oi, hasReadableExportSet as Ol, getCurrentProducerRegions as On, malformedOrphanRecordsRefusalMessage as Oo, replacedDeleteFailureVerdict as Or, findReplacedReadersOfRecreateTargets as Os, recordRetainedForReadoption as Ot, getDefaultStateBucketName as Ou, resolveDynamoDbDeleteBudgetMs as P, isIamRoleArn as Pa, shareLogOnlyValues as Pc, stringifyIfAssigned as Pi, orphansAfterRollback as Pl, updatePartialMessage as Pn, malformedOutputsWarning as Po, yellow as Pr, WARM_THROUGHPUT_MEMBERS as Ps, nestedChildStackName as Pt, resolveSkipPrefix as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, keepsSecretReferenceToken as Qa, physicalNameCopiesOf as Qc, unchangedBehindSecretReference as Qi, ensureAssetStorage as Ql, secretSafeKeyDisplay as Qn, refuseMalformedResourceEntries as Qo, maskEventTextWithBoundBags as Qr, withRetry as Qs, isAccessDeniedError as Qt, AssemblyReader as Qu, maskedLogger as R, callerEnvCredentials as Ra, maskSecretsInError as Rc, isCustomResource as Ri, PhaseClock as Rl, nameScopeOf as Rn, malformedResourcesWarning as Ro, isSupersededResourceRecord as Rr, toFiniteNumber as Rs, withNestedRevertRun as Rt, stateBucketExistenceConfirmed as Ru, indexDeclaresContributorInsights as S, s3BucketWebsiteUrl as Sa, markSameGenerationBag as Sc, DeploymentEventsStore as Si, stackInstanceIdOf as Sl, recordUnderIdIsNotOwn as Sn, malformedDriftResourcePropertiesWarning as So, parseMappingFile as Sr, findActionableSilentDrops as Ss, makeCanonicalizePropertiesFn as St, runDockerStreaming as Su, readContributorInsightsSpec as T, refuseUnreadableCdkCrossAccountRefs as Ta, snapshotPassProvenance as Tc, markDeleteStarted as Ti, acceptedCreateOnlyDropsOf as Tl, seedsDeleteFirstGuard as Tn, malformedLocalOutputsWarning as To, destroyStackRecordsView as Tr, withoutSilentDropProperties as Ts, pendingRequestCount as Tt, getDockerImageBySourceHash as Tu, planTimeToLive as U, regionLessSecretName as Ua, DYNAMIC_REFERENCE_TOKEN_SCAN as Uc, isCustomResourceType as Ui, stringifyValue as Ul, computeParameterTaint as Un, refuseMalformedNestedChildOutputs as Uo, supersededResourcesOf as Ur, configStringRefusal as Us, dropFailedCommands as Ut, MIGRATE_TMP_PREFIX as Uu, isTtlAlreadyDisabled as V, classifyReplaySecretRegion as Va, withPhysicalNameCopies as Vc, TemplateNoEchoReresolver as Vi, AssetPublisher as Vl, retiredNameGenerationsLeaving as Vn, previewableOrphanRecords as Vo, supersededHeldByOtherTypeWarning as Vr, configBooleanRefusal as Vs, withNestedStackContext as Vt, CFN_TEMPLATE_BODY_LIMIT as Vu, readTtlSpec as W, coerceParameterTypedValue as Wa, dynamicReferenceTokens as Wc, getCurrentResourceSecrets as Wi, WorkGraph as Wl, namesAnyDeclaredParameter as Wn, refuseMalformedOrphanRecords as Wo, withoutSuperseded as Wr, readConfigString as Ws, dropFailedHint as Wt, findLargeInlineResources as Wu, getPriorAttempts as X, carriesFetchableDynamicReference as Xa, recordNestedStackParameterExpressions as Xc, slowCcOperationTimeoutMs as Xi, BOOTSTRAP_MARKER_PREFIX as Xl, secretBearing as Xn, refuseMalformedOutputsForDestroy as Xo, completedReplayEntries as Xr, templateResourceTypes as Xs, formatResourceLine as Xt, canonicalizeRegion as Xu, isTruthyCfnBoolean as Y, carriesDynamicReference as Ya, inheritNestedStackParameterAssociations as Yc, CloudControlProvider as Yi, AssetModeResolver as Yl, exportAliasCollisionScrubWarning as Yn, refuseMalformedOutputs as Yo, createReadOnlyAttributeHealerFactory as Yr, prefetchCreateOnlyPropertyPaths as Ys, sameJournaledOrphans as Yt, PARTITION_TABLE as Yu, markRefusedBeforeApplying as Z, isNamelessDynamicReferenceError as Za, recoverMaskedOutput as Zc, onlySecretReferencesDiffer as Zi, assertAssetBucketRegion as Zl, secretBearingStateKeyWarning as Zn, refuseMalformedResourceAttributesForOrphan as Zo, journaledOrphanPrintingBag as Zr, describeTypeWithThrottleRetry as Zs, chunks as Zt, derivePartitionAndUrlSuffix as Zu, streamMemberRefusals as _, isSettledInstanceState as _a, readbackPathFor as _c, resolveBucketRegion as _d, ledgerForStack as _i, CrossPrefixScanCache as _l, isJournaledOrphan as _n, hasReadableOrphans as _o, rollbackOrphanIds as _r, repairMalformedResourcesForReadOnly as _s, withResourceDeadline as _t, partitionSensitiveEnv as _u, isProtectionValueActive as a, isWaitAbandonedError as aa, DagBuilder as ac, hasOwnKey as ad, stateSecretNameNeedles as ai, recordMaskOnlyValuesIn as al, refuseRefactorMarker as an, withSharedDrainBudget as ao, collectPublishedOutputNames as ar, refuseMalformedResourcePropertiesForDrift as as, childTemplateLoader as at, buildDenyExternalAccessPolicy as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketDualStackDomainName as ba, valueAtCoordinate as bc, acquireIdempotencyToken as bi, isAccessDenied$1 as bl, planRollback as bn, isReadableOrphanRecord as bo, looselyEqual as br, unreadableResourceEntries as bs, keptWholeReasonText as bt, redactedDockerCause as bu, DynamoDBGlobalTableProvider as c, ec2InstanceProtectionSite as ca, isMarkedCoordinate as cc, ownValue as cd, PRE_DELETE_SNAPSHOT_TYPES as ci, recordProvenPublicExpression as cl, hasPendingMovesOut as cn, declaresNoEcho as co, DEFAULT_RESOURCE_TIMEOUT_MS as cr, refuseMalformedResourcesForDeploy as cs, listNestedTemplateRows as ct, describeDockerCapturedOutput as cu, declaredStreamPolicyMember as d, reDisableInstanceApiTermination as da, maskWholeValue as dc, displayAssemblyPath as dd, createPreDeleteFinalSnapshot as di, isSingleDynamicReferenceToken as dl, refusePendingMovesOut as dn, STATE_RESOURCES_MALFORMED as do, constructPathOf as dr, refuseMalformedState as ds, conditionFingerprint as dt, dockerSpawnEnvWithSensitive as du, UNSPECIFIED_SKIP_REASON as ea, ecsServiceLaunchTypeSetOrChanged as ec, processStackMessages as ed, orphanRecordsPrintingBag as ei, recordPhysicalNameCopy as el, withApiLimit as en, cfnRefValueFromPhysicalId as eo, exportNameNoEchoParameters as er, refuseMalformedResourceEntriesForDestroy as es, crossStackOutputProvenanceSource as et, isCrossRegionRedirect as eu, declaredStreamTagsMember as f, reEnableInstanceApiTermination as fa, maskedLeafCoordinatesOf as fc, renderAssemblyPathEscape as fd, effectiveDeletionPolicy as fi, LockManager as fl, replayFailedOperations as fn, UNREADABLE_ORPHANS_CONTAINER_ROW as fo, findDestructiveChanges as fr, repairMalformedOrphanRecordsForReadOnly as fs, conditionInputsFrom as ft, finchSecretArgvRefusal as fu, streamDeclaresTags as g, poisonRenderedSpellingsCollidingIn as ga, passedNoEchoParametersOf as gc, clearBucketRegionCache as gd, earliestDefined as gi, CrossPrefixReadError as gl, demoteSupersededOrphans as gn, displayLogicalId as go, movedToHint as gr, repairMalformedResourcePropertiesForReadOnly as gs, enclosingDeadlineRemainingMs as gt, isMalformedEnvKey as gu, streamDeclaresPolicy as h, IntrinsicFunctionResolver as ha, noEchoOutputsComparison as hc, injectedAwsRegionValue as hd, unsupportedFinalSnapshotError as hi, rebuildClientForBucketRegion as hl, recordAfterRollbackUpdate as hn, deployRefusesOrphanRowsReason as ho, hintSidesOf as hr, repairMalformedResourceEntriesForReadOnly as hs, enclosingDeadlineExpired as ht, isDockerClientEnvKey as hu, PROTECTION_PROPERTY_BY_TYPE as i, withIndeterminateGuard as ia, sameLambdaFunctionAddress as ic, defineOwnKey as id, secretNamedRecordNeedles as ii, recordMaskOnlyValue as il, refactorMarkerRefusalMessage as in, parseWebACLArn as io, collectDeclaredOutputNames as ir, refuseMalformedResourcePropertiesForDestroy as is, serviceTokenBlockingReason as it, validateContainerRepoName as iu, compensateRemovedDeletionProtection as j, assertFlagRoleArn as ja, printingCorpusOf as jc, tagMapAsList as ji, importableOutputKeys as jl, isRedactedRecordedValue as jn, malformedOrphansRefusalMessage as jo, gray as jr, isStatefulRecreateTargetForReplace as js, displacedPhysicalIdShown as jt, resolveApp as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, recordedReferenceRegions as ka, literalSplitDelimitersOf as kc, readTagList as ki, hasReasonlessBaselineRefusal as kl, inheritProducerRegions as kn, malformedOrphanRecordsWarning as ko, bold as kr, shownType as ks, NESTED_PENDING_PARENT_REASON as kt, getLegacyStateBucketName as ku, STREAM_POLICY_KEY as l, isTerminationProtectionPropagationError as la, maskAtCoordinates as lc, absoluteAssemblyPathEscape as ld, buildFinalSnapshotIdentifier as li, wholeStringLeavesOf as ll, pendingMovesOutOf as ln, JSON_LISTING_HOLE_VALUE as lo, DEFAULT_RESOURCE_WARN_AFTER_MS as lr, refuseMalformedResourcesForDestroy as ls, renderNestedTemplateTreeDefect as lt, describeDockerExecFailure as lu, reverseMapStreamPolicy as m, INTRINSIC_KEYS as ma, noEchoLeavesOf as mc, injectAwsRegion as md, refusesFinalSnapshot as mi, S3StateBackend as ml, removeProtectionTypeList as mn, accountArgs as mo, findRefactorHints as mr, repairMalformedOutputsForReadOnly as ms, readRecordedConditionVerdicts as mt, getDockerCmd as mu, recordedProtectionEvidence as n, deleteLeftInPlace as na, canonicalLambdaFunctionName as nc, parseFailureDebugDetail as nd, secretNamePrintingBags as ni, carriesSecretMask as nl, readRefactorMarkerOnce as nn, lacksRecordedTableArn as no, isWholeDynamicReferenceValue as nr, refuseMalformedResourceEntriesForImportSave as ns, deferredServiceTokenWarning as nt, readBootstrapMarkerBody as nu, perType as o, markWaitAbandoned as oa, TemplateParser as oc, hasPlainPrototype$1 as od, storedSecretNameNeedles as oi, recordNoEchoAttributeValues as ol, sameMove as on, parameterInputsFor as oo, isExportAliasCollision as or, refuseMalformedResourcePropertiesForExport as os, findNestedTemplateTreeDefect as ot, buildDockerImage as ou, planStreamMemberOps as p, DiffCalculator as pa, noEchoCoordinatesOf as pc, resolveAssemblyPath as pd, isFinalSnapshotError as pi, isLockInfoExpired as pl, replayRollback as pn, UNREADABLE_RESOURCES_MAP_ROW as po, formatDestructiveChange as pr, repairMalformedOrphansForReadOnly as ps, parentSuppliedValues as pt, formatDockerLoginError as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, getAccountInfo as qa, spelledKeysOf as qc, applyCustomResourceResponseExpiration as qi, loadPublishableAssetManifest as ql, WITHHELD_NAME_DISPLAY as qn, refuseMalformedOrphansForDestroy as qo, noEchoExactEchoLeavesOf as qr, requireConfigObject as qs, loadJournaledOrphans as qt, decodeListingKey as qu, recordedProtectionNote as r, deleteSkipReason as ra, lambdaFunctionNameForMask as rc, utf8ByteLength as rd, secretNamedAttributeNamesOf as ri, provenPublicValue as rl, refactorMarkerMovesOf as rn, refStateLookupFromResource as ro, noEchoParameterValueSeed as rr, refuseMalformedResourceEntriesForOrphan as rs, findServiceTokenRefusals as rt, validateAssetBucketName as ru, readProtection as s, disableInstanceApiTermination as sa, canonicalCoordinates as sc, nullPrototypeRecord as sd, ATOMIC_FINAL_SNAPSHOT_TYPES as si, recordNoEchoParameterFreshValue as sl, updateRefactorMarker as sn, passedParameterClassesOf as so, bindingSkippedOutputs as sr, refuseMalformedResourcePropertiesForOrphan as ss, isAbsoluteAssetPath as st, resolveDockerContextDirectory as su, DeployEngine as t, deleteIndeterminateGuards as ta, emrClusterInstancesReplaced as tc, describeJsonParseFailure as td, secretNamePrintingBag as ti, splitGetAttStringForm as tl, readRefactorMarker as tn, isStalePlaceholderArnAttribute as to, exportNameSecretExposure as tr, refuseMalformedResourceEntriesForImport as ts, inheritedProvenanceForChildDiff as tt, parseBootstrapMarker as tu, STREAM_TAGS_KEY as u, observeThenDisableInstanceApiTermination as ua, maskReadbackAtCoordinates as uc, describeFileReadFailure as ud, ccRoutedFinalSnapshotError as ui, WHOLE_DYNAMIC_REFERENCE_PATTERN as ul, pendingMovesRefusalMessage as un, STATE_REGION_DIVERGED as uo, maskingRetryLogger as ur, refuseMalformedResourcesForExport as us, templateIdentity as ut, describeDockerFailure as uu, streamPolicyMatchesDeclared as v, s3BucketArn as va, readsNoEchoSource as vc, reserveStackCreateToken as vi, applyCrossPrefixScan as vl, isReplacementOrphan as vn, hasReadableOutputs as vo, withMovedTo as vr, unpreviewableOrphanRecords as vs, diffSecurity as vt, redactDockerArgvValues as vu, planIndexContributorInsightsOps as w, producerLookupOver as wa, recordReferenceProvenanceEntry as wc, isRefusedByName as wi, splitImportedOps as wl, resolveReplacementOldType as wn, malformedExportSourceWarning as wo, awaitInFlightSibling as wr, unwrittenCreateOnlyReplacement as ws, planOrphanAdoption as wt, AssetManifestLoader as wu, contributorInsightsRefusals as x, s3BucketRegionalDomainName as xa, liveMatchesUnresolvedTokenFrame as xc, DeploymentEventsReader as xi, isNotImplemented as xl, recheckFailedPlan as xn, isReadableResourceEntry as xo, mappingPairs as xr, withheldAccountClause as xs, mergeNoChangeOutputs as xt, runDockerForeground as xu, streamTagsMatchDeclared as y, s3BucketDomainName as ya, recordedNoEchoValuesOf as yc, withCreateTokenLedger as yi, crossPrefixDeniedWarning as yl, planFailedOps as yn, hasReadableResources as yo, isPairableType as yr, unreadableOrphanRecords as ys, isSecretBearingReferenceString as yt, redactedCause as yu, relayedIndexBusyDelete as z, envCredentialsAreAssumedRole as za, maskSecretsInText as zc, wouldReturnToSdkProvider as zi, renderPhaseTimings as zl, retiredAfterRollback as zn, malformedScrubResourceEntriesRefusalMessage as zo, removeSuperseded as zr, coerceCfnBoolean as zs, collectNestedChildUnaddressed as zt, warnDeprecatedNoPrefixCliFlag as zu };
+//# sourceMappingURL=deploy-engine-CDjAtIrn.js.map