@go-to-k/cdkd 0.308.0 → 0.308.1

package/dist/{deploy-engine-DSpxEUjC.js → deploy-engine-CDjAtIrn.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-DzajQDkv.js";
+import { t as getCdkdVersion } from "./version-BWqrjGBS.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12557,6 +12557,43 @@ function lambdaFunctionNameForMask(value) {
 
 //#endregion
 //#region src/analyzer/replacement-rules.ts
+function vpcInstanceTenancyChangeReplaces(oldValue, newValue) {
+	const tenancyOf = (v) => v == null ? "default" : String(v);
+	return tenancyOf(newValue) !== "default" && tenancyOf(newValue) !== tenancyOf(oldValue);
+}
+function instanceSecurityGroupIdsChangeReplaces(oldValue, newValue, siblings) {
+	if (siblings === void 0) return false;
+	if (Array.isArray(oldValue) && Array.isArray(newValue)) {
+		const before = new Set(oldValue.map(String));
+		const after = new Set(newValue.map(String));
+		if (before.size === after.size && [...before].every((g) => after.has(g))) return false;
+	}
+	return siblings.newProperties["SubnetId"] == null;
+}
+function instanceBlockDeviceMappingsChangeReplaces(oldValue, newValue) {
+	return !blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue);
+}
+function blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue) {
+	if (!Array.isArray(oldValue) || !Array.isArray(newValue)) return false;
+	if (oldValue.length !== newValue.length) return false;
+	const strip = (m) => {
+		if (m === null || typeof m !== "object" || Array.isArray(m)) return m;
+		const out = { ...m };
+		const ebs = out["Ebs"];
+		if (ebs !== null && typeof ebs === "object" && !Array.isArray(ebs)) {
+			const rest = { ...ebs };
+			delete rest["DeleteOnTermination"];
+			out["Ebs"] = rest;
+		}
+		return out;
+	};
+	return oldValue.every((m, i) => isDeepStrictEqual(scalarsAsStrings(strip(m)), scalarsAsStrings(strip(newValue[i]))));
+}
+function scalarsAsStrings(value) {
+	if (Array.isArray(value)) return value.map(scalarsAsStrings);
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, scalarsAsStrings(v)]));
+	return typeof value === "number" || typeof value === "boolean" ? String(value) : value;
+}
 function durableConfigPresenceToggled(oldValue, newValue) {
 	return oldValue == null !== (newValue == null);
 }
@@ -12653,7 +12690,7 @@ var ReplacementRulesRegistry = class {
 	constructor() {
 		this.initializeRules();
 	}
-	requiresReplacement(resourceType, propertyPath, oldValue, newValue) {
+	requiresReplacement(resourceType, propertyPath, oldValue, newValue, siblings) {
 		const rule = this.rules.get(resourceType);
 		if (!rule) {
 			this.logger.debug(`No replacement rule for ${resourceType}, conservatively assuming replacement may be required for ${propertyPath}`);
@@ -12667,16 +12704,16 @@ var ReplacementRulesRegistry = class {
 		if (rule.conditionalReplacements?.has(propertyPath)) {
 			const condition = rule.conditionalReplacements.get(propertyPath);
 			if (condition) {
-				const requires = condition(oldValue, newValue);
+				const requires = condition(oldValue, newValue, siblings);
 				this.logger.debug(`Conditional replacement for ${propertyPath} of ${resourceType}: ${requires}`);
 				return requires;
 			}
 		}
 		return false;
 	}
-	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
+	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings) {
 		const condition = this.rules.get(resourceType)?.conditionalReplacements?.get(propertyPath);
-		return condition === void 0 ? void 0 : condition(oldValue, newValue);
+		return condition === void 0 ? void 0 : condition(oldValue, newValue, siblings);
 	}
 	isClassified(resourceType, propertyPath) {
 		const rule = this.rules.get(resourceType);
@@ -12955,6 +12992,15 @@ var ReplacementRulesRegistry = class {
 			"TargetRole"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
+		this.rules.set("AWS::EC2::VPC", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"CidrBlock",
+				"Ipv4IpamPoolId",
+				"Ipv4NetmaskLength",
+				"VpcEncryptionControl"
+			]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["InstanceTenancy", vpcInstanceTenancyChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::Subnet", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"VpcId",
@@ -12963,14 +13009,17 @@ var ReplacementRulesRegistry = class {
 			]),
 			updateableProperties: /* @__PURE__ */ new Set(["MapPublicIpOnLaunch", "Tags"])
 		});
-		this.rules.set("AWS::EC2::Instance", { replacementProperties: /* @__PURE__ */ new Set([
-			"EbsOptimized",
-			"AvailabilityZone",
-			"ImageId",
-			"SubnetId",
-			"KeyName",
-			"NetworkInterfaces"
-		]) });
+		this.rules.set("AWS::EC2::Instance", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"EbsOptimized",
+				"AvailabilityZone",
+				"ImageId",
+				"SubnetId",
+				"KeyName",
+				"NetworkInterfaces"
+			]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["SecurityGroupIds", instanceSecurityGroupIdsChangeReplaces], ["BlockDeviceMappings", instanceBlockDeviceMappingsChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::NatGateway", {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", natZoneAddressesAddedToAutomaticGateway]])
@@ -15304,8 +15353,8 @@ async function findReplacedReadersOfRecreateTargets(input) {
 		}
 		return pending;
 	};
-	const isCreateOnly = async (type, key, plainReference) => {
-		if (rules.requiresReplacement(type, key, void 0, void 0)) return true;
+	const isCreateOnly = async (type, key, plainReference, siblings) => {
+		if (rules.requiresReplacement(type, key, void 0, void 0, siblings)) return true;
 		if (rules.isClassified(type, key)) return false;
 		const keys = await wholeCreateOnlyKeys(type);
 		return plainReference ? keys.whole.has(key) : keys.confirmable.has(key);
@@ -15324,7 +15373,11 @@ async function findReplacedReadersOfRecreateTargets(input) {
 			for (const key of keys) {
 				if (stableTargets.has(replacedId) && idOnly.get(replacedId)?.get(readerId)?.has(key)) continue;
 				const plain = isPlainReferenceTo(resource.Properties?.[key], replacedId, resources[replacedId]?.Type);
-				if (await isCreateOnly(resource.Type, key, plain)) properties.push(key);
+				const siblings = {
+					oldProperties: record.properties ?? {},
+					newProperties: resource.Properties ?? {}
+				};
+				if (await isCreateOnly(resource.Type, key, plain, siblings)) properties.push(key);
 			}
 			if (properties.length === 0) continue;
 			replaced.add(readerId);
@@ -25991,7 +26044,10 @@ const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Fn::Or",
 	"Fn::Not"
 ]);
-const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
+const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({
+	"AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]),
+	"AWS::EC2::Instance": /* @__PURE__ */ new Set(["PublicIp", "PublicDnsName"])
+});
 const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
 const REF_READ = "<Ref>";
 function containsIntrinsic(value, seen = /* @__PURE__ */ new Set()) {
@@ -26009,12 +26065,19 @@ function replacementSidesForLog(oldValue, newValue, mask) {
 	if (newText !== maskedJsonForLog(newValue, (text) => text)) return ["***", newText];
 	return [maskedJsonForLog(oldValue, mask), newText];
 }
+function siblingsOf(change) {
+	if (change.currentProperties === void 0 || change.desiredProperties === void 0) return;
+	return {
+		oldProperties: change.currentProperties,
+		newProperties: change.desiredProperties
+	};
+}
 var DiffCalculator = class DiffCalculator {
 	logger = getLogger().child("DiffCalculator");
 	replacementRules = new ReplacementRulesRegistry();
 	parser = new TemplateParser();
-	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
-		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
+	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings) {
+		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings);
 	}
 	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare, readProvenance) {
 		const changes = /* @__PURE__ */ new Map();
@@ -26103,7 +26166,10 @@ var DiffCalculator = class DiffCalculator {
 						path: key,
 						oldValue,
 						newValue,
-						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
+						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue, {
+							oldProperties: currentCompared,
+							newProperties: desiredCompared
+						}),
 						maskedExpressionChanged: true
 					});
 					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
@@ -26150,7 +26216,7 @@ var DiffCalculator = class DiffCalculator {
 		const syntheticCreateOnlyPaths = await this.loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements);
 		for (const { change, pc, upstreams } of provenanceChanges) {
 			const templateValue = desiredTemplate.Resources[change.logicalId]?.Properties?.[pc.path];
-			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)));
+			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)), siblingsOf(change));
 		}
 		do
 			this.promoteReplacementDependents(changes, desiredTemplate, syntheticCreateOnlyPaths, forcedReplacements);
@@ -26268,8 +26334,8 @@ var DiffCalculator = class DiffCalculator {
 		}));
 		return loaded;
 	}
-	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference) {
-		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0)) return true;
+	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference, siblings) {
+		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0, siblings)) return true;
 		if (this.replacementRules.isClassified(resourceType, propKey)) return false;
 		const createOnly = syntheticCreateOnlyPaths.get(resourceType);
 		if (createOnly === void 0 || !createOnly.whole.has(propKey)) return false;
@@ -26318,7 +26384,7 @@ var DiffCalculator = class DiffCalculator {
 						oldValue,
 						newValue,
 						replacementPropagated: true,
-						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
+						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type), siblingsOf(change)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
 					});
 				}
 				if (syntheticChanges.length === 0) continue;
@@ -26393,7 +26459,7 @@ var DiffCalculator = class DiffCalculator {
 					path: propKey,
 					oldValue: change.currentProperties?.[propKey],
 					newValue: change.desiredProperties?.[propKey],
-					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false),
+					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false, siblingsOf(change)),
 					inPlacePropagated: true,
 					...noEchoPromoted && { noEchoPromoted: true }
 				});
@@ -26509,7 +26575,10 @@ var DiffCalculator = class DiffCalculator {
 			const oldValue = currentProperties[key];
 			const newValue = desiredProperties[key];
 			if (!this.valuesEqual(oldValue, newValue)) {
-				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
+				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue, {
+					oldProperties: currentProperties,
+					newProperties: desiredProperties
+				});
 				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
 					if (createOnlyPaths === void 0) createOnlyPaths = await getCreateOnlyPropertyPaths(resourceType);
 					if (createOnlyChangeRequiresReplacement(createOnlyPaths, key, oldValue, newValue, (a, b) => this.valuesEqual(a, b))) {
@@ -26532,9 +26601,9 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
-	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue) {
-		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue)) return true;
-		if (this.replacementRules.isClassified(resourceType, key) && this.replacementRules.conditionalReplacementVerdict(resourceType, key, oldValue, newValue) === void 0) return false;
+	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue, siblings) {
+		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue, siblings)) return true;
+		if (this.replacementRules.isClassified(resourceType, key) && this.replacementRules.conditionalReplacementVerdict(resourceType, key, oldValue, newValue, siblings) === void 0) return false;
 		return (await getCreateOnlyPropertyPaths(resourceType)).some((path) => path.length === 1 && path[0] === key);
 	}
 	static INTRINSIC_KEYS = INTRINSIC_KEYS;
@@ -27954,6 +28023,8 @@ const SLOW_CC_OPERATION_TIMEOUTS = {
 		create: 60 * MINUTE_MS,
 		delete: 60 * MINUTE_MS
 	},
+	"AWS::DynamoDB::Table": { update: 75 * MINUTE_MS },
+	"AWS::DynamoDB::GlobalTable": { update: 75 * MINUTE_MS },
 	"AWS::EKS::Cluster": {
 		create: 30 * MINUTE_MS,
 		delete: 30 * MINUTE_MS
@@ -28502,7 +28573,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CsRMe_zh.js");
+			const { ASGProvider } = await import("./asg-provider-B7pAjRIc.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28611,7 +28682,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BPs9JSk_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-p59T8CFv.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CZhBLQgJ.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Y3Ii8oYI.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -46280,6 +46351,38 @@ function planTimeToLive(spec, previousSpec, mode) {
 function isTtlAlreadyDisabled(awsDetail) {
 	return /TimeToLive is already disabled/i.test(awsDetail);
 }
+function isTtlRateLimited(awsDetail) {
+	return /Time to live has been modified multiple times/i.test(awsDetail);
+}
+const TTL_RATE_LIMIT_RETRY_MS = 6e4;
+const TTL_RATE_LIMIT_SLICE_MS = 1e3;
+async function sendTtlWaitingOutRateLimit(send, options) {
+	const retryMs = options.retryMs ?? 6e4;
+	const watch = startInterruptWatch(options.what);
+	let announced = false;
+	try {
+		for (;;) try {
+			await send();
+			return;
+		} catch (error) {
+			if (!isTtlRateLimited(describeAwsFailure(error).detail)) throw error;
+			if (enclosingDeadlineRemainingMs() <= 0) throw error;
+			if (!announced) {
+				options.announce();
+				announced = true;
+			}
+			const until = Date.now() + Math.min(retryMs, enclosingDeadlineRemainingMs());
+			while (Date.now() < until) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await new Promise((resolve) => setTimeout(resolve, Math.min(TTL_RATE_LIMIT_SLICE_MS, until - Date.now())));
+			}
+			if (watch.isInterrupted()) throw watch.onInterrupted();
+			if (enclosingDeadlineRemainingMs() <= 0) throw error;
+		}
+	} finally {
+		watch.dispose();
+	}
+}
 
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
@@ -47314,7 +47417,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
 		log.debug(build(log.mask(failure.detail)).message);
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}`);
+		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}` + relayedEncryptionChangeLimit(failure.detail));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	cleanupFailureText(log, head, error) {
@@ -47900,6 +48003,30 @@ var DynamoDBGlobalTableProvider = class {
 			throw refusal;
 		}
 	}
+	kinesisDisableSettleDelaysMs = Array(30).fill(2e3);
+	async waitForKinesisDisableSettled(client, tableName, streamArn, scope, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`Kinesis streaming disable on ${scope}`));
+		let last = "none read";
+		try {
+			for (const delayMs of [0, ...this.kinesisDisableSettleDelaysMs]) {
+				if (enclosingDeadlineRemainingMs() <= 0) break;
+				if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(delayMs, enclosingDeadlineRemainingMs()))));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				let unsettled;
+				try {
+					unsettled = ((await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }))).KinesisDataStreamDestinations ?? []).find((d) => d.StreamArn === streamArn && KINESIS_DISABLE_UNSETTLED.has(d.DestinationStatus ?? ""))?.DestinationStatus;
+				} catch (error) {
+					this.logger.debug(maskSecrets(`Could not confirm the Kinesis streaming disable on ${scope}: ` + describeAwsFailure(error).detail));
+					return;
+				}
+				if (unsettled === void 0) return;
+				last = unsettled;
+			}
+			this.logger.warn(maskSecrets(`The Kinesis streaming destination on ${scope} had not settled (last status: ${last}); 'cdkd drift' may report it on this replica until it does`));
+		} finally {
+			watch.dispose();
+		}
+	}
 	async activeKinesisStreamArns(client, tableName) {
 		const out = await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }));
 		return new Set((out.KinesisDataStreamDestinations ?? []).filter((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING").flatMap((d) => d.StreamArn !== void 0 ? [d.StreamArn] : []));
@@ -47950,6 +48077,7 @@ var DynamoDBGlobalTableProvider = class {
 				} catch (error) {
 					if (await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
 				}
+				await this.waitForKinesisDisableSettled(client, tableName, op.streamArn, scope, maskSecrets);
 				break;
 			case "kinesisPrecision":
 				await send(() => client.send(new UpdateKinesisStreamingDestinationCommand({
@@ -48008,7 +48136,7 @@ var DynamoDBGlobalTableProvider = class {
 		} catch (error) {
 			if (fromTemplate || isInterruptedWaitError(error)) throw error;
 			this.logger.debug(maskSecrets(`Could not bring the ${what} of ${tableName} to the declared one: ` + describeAwsFailure(error).detail));
-			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}). The next deploy that updates this table tries again.`));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}).` + relayedEncryptionChangeLimit(describeAwsFailure(error).detail) + ` The next deploy that updates this table tries again.`));
 		}
 	}
 	async waitForGlobalTableSettled(tableName, logicalId, maskSecrets, opts = {}) {
@@ -48595,14 +48723,17 @@ var DynamoDBGlobalTableProvider = class {
 			if (!deepEqual(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
 					try {
-						await this.dynamoDBClient.send(cmd);
+						await sendTtlWaitingOutRateLimit(() => this.dynamoDBClient.send(cmd), {
+							what: maskSecrets(`DynamoDB TimeToLive rate-limit wait on ${physicalId}`),
+							announce: () => this.logger.info(maskSecrets(`DynamoDB global table ${logicalId}: TimeToLive was changed recently, and AWS refuses another change until its rate-limit interval passes (up to about an hour). Retrying every minute, like CloudFormation, within the resource timeout.`))
+						});
 					} catch (ttlErr) {
 						const msg = describeAwsFailure(ttlErr).detail;
 						if (cmd.input.TimeToLiveSpecification?.Enabled === false && isTtlAlreadyDisabled(msg)) {
 							this.logger.debug(maskSecrets(`TimeToLive already disabled on ${physicalId}`));
 							return;
 						}
-						if (msg.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table (the interval can last up to about an hour); wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						if (isTtlRateLimited(msg)) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table, and kept refusing until the resource timeout ran out; redeploy once the interval has passed (up to about an hour), or raise --resource-timeout.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
@@ -49414,6 +49545,12 @@ var DynamoDBGlobalTableProvider = class {
 			aws
 		};
 	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return [];
+		const declared = properties["SSESpecification"];
+		if (declared === void 0) return ["SSESpecification"];
+		return coerceCfnBoolean(asRecord(declared)?.["SSEEnabled"]) === false ? ["SSESpecification"] : [];
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
 		if (explicit) try {
@@ -49719,6 +49856,15 @@ function collectAutoScalingTargets(properties, localRegion) {
 const REPLICA_COPY_RELEASE_POLLS = 180;
 const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
 const DELETION_PROTECTION_REFLIP_MS = 16e3;
+function relayedEncryptionChangeLimit(withheldText) {
+	return /Encryption mode changes are limited/i.test(withheldText) ? " AWS limits a table to 4 encryption changes in 24 hours, then one every 6 hours; retry the change later (--verbose shows when AWS allows the next one)." : "";
+}
+const KINESIS_DISABLE_UNSETTLED = /* @__PURE__ */ new Set([
+	"ACTIVE",
+	"ENABLING",
+	"UPDATING",
+	"DISABLING"
+]);
 const REPLICA_PROTECTION_SETTLE_POLLS = 60;
 const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
 const SETTLING_RETRY_ATTEMPTS = 8;
@@ -51570,7 +51716,10 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 				continue;
 			}
 			const moved = movedAsWritten(pc.path);
-			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
+			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path], {
+				oldProperties: currentPropsAsWritten,
+				newProperties: desiredForSkipCheckAsWritten
+			}) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
 				lowered.push(pc);
@@ -53630,5 +53779,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { inheritedProvenanceForChildDiff as $, isStalePlaceholderArnAttribute as $a, carriesSecretMask as $c, deleteIndeterminateGuards as $i, readBootstrapMarkerBody as $l, exportNameSecretExposure as $n, refuseMalformedResourceEntriesForImport as $o, secretNamePrintingBag as $r, canonicalLambdaFunctionName as $s, readRefactorMarker as $t, parseFailureDebugDetail as $u, beginDeleteWait as A, assertSendableRoleArn as Aa, recordLogOnlyValue as Ac, tagPlanWarning as Ai, isReadableBag as Al, redactedDeleteAddressFields as An, malformedOrphansWarning as Ao, green as Ar, isStatefulRecreateTargetSync as As, dropSettledNestedJournals as At, resolveCaptureObservedState as Au, waitForIndexesSettled as B, producerRegionsFromState as Ba, DYNAMIC_REFERENCE_TOKEN_SCAN as Bc, readsNoEchoDeleteValues as Bi, stringifyValue as Bl, withNameGenerationReached as Bn, refuseDivergentRecordRegionForDestroy as Bo, supersededHolderOf as Br, configIntegerRefusal as Bs, deleteJournaledOrphans as Bt, MIGRATE_TMP_PREFIX as Bu, planContributorInsightsOp as C, refuseUnreadableCdkCrossAccountRefs as Ca, carryLogOnlyValues as Cc, markDeleteStarted as Ci, describeRegionValueKind as Cl, seedsDeleteFirstGuard as Cn, malformedLocalOutputsWarning as Co, destroyStackRecordsView as Cr, withoutSilentDropProperties as Cs, pendingRequestCount as Ct, Synthesizer as Cu, reverseMapTableContributorInsights as D, recordedReferenceRegions as Da, logOnlyValueCount as Dc, readTagList as Di, hasUnverifiableParameterRefusal as Dl, inheritProducerRegions as Dn, malformedOrphanRecordsWarning as Do, bold as Dr, shownType as Ds, NESTED_PENDING_PARENT_REASON as Dt, loadCdkJson as Du, reverseMapIndexContributorInsights as E, recordedOutputReferenceRegions as Ea, literalSplitDelimitersOf as Ec, planTagDiff as Ei, hasReasonlessBaselineRefusal as El, getCurrentProducerRegions as En, malformedOrphanRecordsRefusalMessage as Eo, replacedDeleteFailureVerdict as Er, findReplacedReadersOfRecreateTargets as Es, recordRetainedForReadoption as Et, getLegacyStateBucketName as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, applyCallerIdentityCredentials as Fa, maskSecretsInError as Fc, ccBrokenReason as Fi, PhaseClock as Fl, nameGenerationHighWaterOf as Fn, malformedResourcePropertiesWarning as Fo, holdsSupersededResources as Fr, toCfnInteger as Fs, revertedNestedRowIds as Ft, stateBucketExistenceConfirmed as Fu, S3_AUTO_DELETE_OBJECTS_TAG as G, getAccountInfo as Ga, identityKeyFor as Gc, applyCustomResourceResponseExpiration as Gi, rewriteTemplateAssetReferences as Gl, WITHHELD_NAME_DISPLAY as Gn, refuseMalformedOrphansForDestroy as Go, noEchoExactEchoLeavesOf as Gr, requireConfigObject as Gs, loadJournaledOrphans as Gt, expectedOwnerParam as Gu, planTimeToLive as H, coerceParameterTypedValue as Ha, isUncertifiedBaselineMaskPosition as Hc, getCurrentResourceSecrets as Hi, buildAssetRedirectMap as Hl, namesAnyDeclaredParameter as Hn, refuseMalformedOrphanRecords as Ho, withoutSuperseded as Hr, readConfigString as Hs, dropFailedHint as Ht, uploadCfnTemplate as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, callerEnvCredentials as Ia, maskSecretsInText as Ic, isCustomResource as Ii, renderPhaseTimings as Il, nameScopeOf as In, malformedResourcesWarning as Io, isSupersededResourceRecord as Ir, toFiniteNumber as Is, withNestedRevertRun as It, warnDeprecatedNoPrefixCliFlag as Iu, getPriorAttempts as J, carriesFetchableDynamicReference as Ja, recoverMaskedOutput as Jc, slowCcOperationTimeoutMs as Ji, assertAssetBucketRegion as Jl, secretBearing as Jn, refuseMalformedOutputsForDestroy as Jo, completedReplayEntries as Jr, templateResourceTypes as Js, formatResourceLine as Jt, derivePartitionAndUrlSuffix as Ju, hasCdkAutoDeleteTag as K, isImpossibleEmptyStoredAttribute as Ka, inheritNestedStackParameterAssociations as Kc, customResourceResponseExpirationWarning as Ki, AssetModeResolver as Kl, displayTextOrWithheld as Kn, refuseMalformedOrphansForOrphan as Ko, noEchoParameterNamesOf as Kr, requireConfigString as Ks, makeForeignHolderScan as Kt, PARTITION_TABLE as Ku, deleteTableWithIndexBusyRetry as L, envCredentialsAreAssumedRole as La, scrubResourceRecord as Lc, wouldReturnToSdkProvider as Li, timePhase as Ll, retiredAfterRollback as Ln, malformedScrubResourceEntriesRefusalMessage as Lo, removeSuperseded as Lr, coerceCfnBoolean as Ls, collectNestedChildUnaddressed as Lt, ssmResolvedValueType as Lu, deleteBudgetKey as M, isIamRoleArn as Ma, unionOfSecretBags as Mc, stringifyIfAssigned as Mi, orphansCarriedFrom as Ml, updatePartialMessage as Mn, malformedOutputsWarning as Mo, yellow as Mr, WARM_THROUGHPUT_MEMBERS as Ms, nestedChildStackName as Mt, resolveStateBucketWithDefault as Mu, resolveDynamoDbDeleteBudgetClock as N, sendableAssumeRoleCommand as Na, createSecretMasker as Nc, CC_BROKEN_REASON as Ni, shouldRetainResource as Nl, updatePartialReason as Nn, malformedRenderedContainersWarning as No, addSuperseded as Nr, coerceWarmThroughput as Ns, recordDisplacedSkips as Nt, resolveStateBucketWithDefaultAndSource as Nu, stripIndexContributorInsights as O, applyRoleArnIfSet as Oa, printingCorpusOf as Oc, refuseMalformedDesiredTags as Oi, importableOutputKeys as Ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as On, malformedOrphanRowsKeptWarning as Oo, cyan as Or, MULTI_REGION_RECREATE_BLOCKED_TYPES as Os, displacedOpClause as Ot, resolveApp as Ou, resolveDynamoDbDeleteBudgetMs as P, AWS_CREDENTIAL_ENV_KEYS as Pa, errorCauseChain as Pc, ProviderRegistry as Pi, stackInstanceIdCarriedFrom as Pl, nameGenerationCarriedFrom as Pn, malformedResourceEntriesWarning as Po, deleteSupersededEntry as Pr, isWarmThroughputDecrease as Ps, revertNestedChildFromJournal as Pt, resolveUseCdkBootstrapAssets as Pu, crossStackOutputProvenanceSource as Q, cfnRefValueFromPhysicalId as Qa, splitGetAttStringForm as Qc, UNSPECIFIED_SKIP_REASON as Qi, parseBootstrapMarker as Ql, exportNameNoEchoParameters as Qn, refuseMalformedResourceEntriesForDestroy as Qo, orphanRecordsPrintingBag as Qr, emrClusterInstancesReplaced as Qs, withApiLimit as Qt, describeJsonParseFailure as Qu, maskedLogger as R, classifyRecordedSecretRegion as Ra, withPhysicalNameCopies as Rc, waitForLambdaFunctionActive as Ri, AssetPublisher as Rl, retiredNameGenerationsAfter as Rn, malformedStateRefusalMessage as Ro, supersededAfterRollback as Rr, coerceCfnInteger as Rs, getCurrentNestedStackContext as Rt, CFN_TEMPLATE_BODY_LIMIT as Ru, indexDeclaresContributorInsights as S, producerLookupOver as Sa, snapshotPassProvenance as Sc, isRefusedByName as Si, acceptedCreateOnlyDropsOf as Sl, resolveReplacementOldType as Sn, malformedExportSourceWarning as So, awaitInFlightSibling as Sr, unwrittenCreateOnlyReplacement as Ss, planOrphanAdoption as St, getDockerImageBySourceHash as Su, readContributorInsightsSpec as T, outputReferenceProvenanceOf as Ta, hasMaskableValues as Tc, DBPROXY_TAG_OPTIONS as Ti, hasReadableExportSet as Tl, findNestedStackTypeChanges as Tn, malformedLocalResourcesWarning as To, withStackRecords as Tr, hasNoCloudControlHandlers as Ts, keptForRetainedRecord as Tt, getDefaultStateBucketName as Tu, readTtlSpec as U, isUnboundTemplateParameter as Ua, pathCrossesDottedKey as Uc, withPrintingSecrets as Ui, createAssetRedirectResolver as Ul, reachableDivergentParameters as Un, refuseMalformedOrphanRecordsForDestroy as Uo, noEchoAttributeNamesOf as Ur, replayWarn as Us, isHandledOrphan as Ut, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Uu, isTtlAlreadyDisabled as V, regionLessSecretName as Va, dynamicReferenceTokens as Vc, isCustomResourceType as Vi, WorkGraph as Vl, computeParameterTaint as Vn, refuseMalformedNestedChildOutputs as Vo, supersededResourcesOf as Vr, configStringRefusal as Vs, dropFailedCommands as Vt, findLargeInlineResources as Vu, ECR_AUTO_DELETE_IMAGES_TAG as W, parameterTypeMayLoseSecretIdentity as Wa, spelledKeysOf as Wc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Wi, loadPublishableAssetManifest as Wl, resourcesNamingDeclaredParameter as Wn, refuseMalformedOrphans as Wo, noEchoComparisonForTemplate as Wr, requireConfigArray as Ws, journaledOrphanLines as Wt, decodeListingKey as Wu, IMPLICIT_DELETE_DEPENDENCIES as X, keepsSecretReferenceToken as Xa, recordAttributeIdCopy as Xc, unchangedBehindSecretReference as Xi, getBootstrapMarkerKey as Xl, secretSafeKeyDisplay as Xn, refuseMalformedResourceEntries as Xo, maskEventTextWithBoundBags as Xr, withRetry as Xs, isAccessDeniedError as Xt, StageLoadError as Xu, markRefusedBeforeApplying as Y, isNamelessDynamicReferenceError as Ya, physicalNameCopiesOf as Yc, onlySecretReferencesDiffer as Yi, ensureAssetStorage as Yl, secretBearingStateKeyWarning as Yn, refuseMalformedResourceAttributesForOrphan as Yo, journaledOrphanPrintingBag as Yr, describeTypeWithThrottleRetry as Ys, chunks as Yt, AssemblyReader as Yu, computeImplicitDeleteEdges as Z, AWS_NO_VALUE as Za, recordPhysicalNameCopy as Zc, RollbackInlinePolicyWriters as Zi, isCrossRegionRedirect as Zl, carriedExportAliasExposure as Zn, refuseMalformedResourceEntriesForDeploy as Zo, namingSecretsWithRecordedNoEcho as Zr, ecsServiceLaunchTypeSetOrChanged as Zs, lookupEachName as Zt, processStackMessages as Zu, streamMemberRefusals as _, s3BucketDomainName as _a, valueAtCoordinate as _c, withCreateTokenLedger as _i, isAccessDenied$1 as _l, planFailedOps as _n, hasReadableResources as _o, isPairableType as _r, unreadableOrphanRecords as _s, isSecretBearingReferenceString as _t, redactedDockerCause as _u, isProtectionValueActive as a, disableInstanceApiTermination as aa, isMarkedCoordinate as ac, ownValue as ad, ATOMIC_FINAL_SNAPSHOT_TYPES as ai, recordProvenPublicExpression as al, updateRefactorMarker as an, passedParameterClassesOf as ao, bindingSkippedOutputs as ar, refuseMalformedResourcePropertiesForOrphan as as, isAbsoluteAssetPath as at, describeDockerCapturedOutput as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketWebsiteUrl as ba, redactForState as bc, DeploymentEventsStore as bi, withStackInstanceIdWithheld as bl, recordUnderIdIsNotOwn as bn, malformedDriftResourcePropertiesWarning as bo, parseMappingFile as br, findActionableSilentDrops as bs, makeCanonicalizePropertiesFn as bt, warnFinchArgvExposure as bu, DynamoDBGlobalTableProvider as c, observeThenDisableInstanceApiTermination as ca, maskWholeValue as cc, displayAssemblyPath as cd, ccRoutedFinalSnapshotError as ci, isSingleDynamicReferenceToken as cl, pendingMovesRefusalMessage as cn, STATE_REGION_DIVERGED as co, maskingRetryLogger as cr, refuseMalformedResourcesForExport as cs, templateIdentity as ct, dockerSpawnEnvWithSensitive as cu, declaredStreamPolicyMember as d, DiffCalculator as da, noEchoLeavesOf as dc, injectAwsRegion as dd, isFinalSnapshotError as di, S3StateBackend as dl, replayRollback as dn, UNREADABLE_RESOURCES_MAP_ROW as do, formatDestructiveChange as dr, repairMalformedOrphansForReadOnly as ds, parentSuppliedValues as dt, getDockerCmd as du, deleteLeftInPlace as ea, lambdaFunctionNameForMask as ec, utf8ByteLength as ed, secretNamePrintingBags as ei, provenPublicValue as el, readRefactorMarkerOnce as en, lacksRecordedTableArn as eo, isWholeDynamicReferenceValue as er, refuseMalformedResourceEntriesForImportSave as es, deferredServiceTokenWarning as et, validateAssetBucketName as eu, declaredStreamTagsMember as f, INTRINSIC_KEYS as fa, noEchoOutputsComparison as fc, injectedAwsRegionValue as fd, refusesFinalSnapshot as fi, rebuildClientForBucketRegion as fl, removeProtectionTypeList as fn, accountArgs as fo, findRefactorHints as fr, repairMalformedOutputsForReadOnly as fs, readRecordedConditionVerdicts as ft, isDockerClientEnvKey as fu, streamDeclaresTags as g, s3BucketArn as ga, recordedNoEchoValuesOf as gc, reserveStackCreateToken as gi, crossPrefixDeniedWarning as gl, isReplacementOrphan as gn, hasReadableOutputs as go, withMovedTo as gr, unpreviewableOrphanRecords as gs, diffSecurity as gt, redactedCause as gu, streamDeclaresPolicy as h, isSettledInstanceState as ha, readsNoEchoSource as hc, ledgerForStack as hi, applyCrossPrefixScan as hl, isJournaledOrphan as hn, hasReadableOrphans as ho, rollbackOrphanIds as hr, repairMalformedResourcesForReadOnly as hs, withResourceDeadline as ht, redactDockerArgvValues as hu, PROTECTION_PROPERTY_BY_TYPE as i, markWaitAbandoned as ia, canonicalCoordinates as ic, nullPrototypeRecord as id, storedSecretNameNeedles as ii, recordNoEchoParameterFreshValue as il, sameMove as in, parameterInputsFor as io, isExportAliasCollision as ir, refuseMalformedResourcePropertiesForExport as is, findNestedTemplateTreeDefect as it, resolveDockerContextDirectory as iu, compensateRemovedDeletionProtection as j, explicitRoleArnOrThrow as ja, shareLogOnlyValues as jc, definedAttributes as ji, orphansAfterRollback as jl, redactedDeleteAddressSkip as jn, malformedOutputsRefusalMessage as jo, red as jr, renderStatefulReason as js, getNestedRevertRun as jt, resolveSkipPrefix as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, assertFlagRoleArn as ka, recordLogOnlyParameterValue as kc, tagMapAsList as ki, importableOutputs as kl, isRedactedRecordedValue as kn, malformedOrphansRefusalMessage as ko, gray as kr, isStatefulRecreateTargetForReplace as ks, displacedPhysicalIdShown as kt, resolveAutoAssetStorage as ku, STREAM_POLICY_KEY as l, reDisableInstanceApiTermination as la, maskedLeafCoordinatesOf as lc, renderAssemblyPathEscape as ld, createPreDeleteFinalSnapshot as li, LockManager as ll, refusePendingMovesOut as ln, STATE_RESOURCES_MALFORMED as lo, constructPathOf as lr, refuseMalformedState as ls, conditionFingerprint as lt, finchSecretArgvRefusal as lu, reverseMapStreamPolicy as m, poisonRenderedSpellingsCollidingIn as ma, readbackPathFor as mc, resolveBucketRegion as md, earliestDefined as mi, CrossPrefixScanCache as ml, demoteSupersededOrphans as mn, displayLogicalId as mo, movedToHint as mr, repairMalformedResourcePropertiesForReadOnly as ms, enclosingDeadlineRemainingMs as mt, partitionSensitiveEnv as mu, recordedProtectionEvidence as n, withIndeterminateGuard as na, DagBuilder as nc, hasOwnKey as nd, secretNamedRecordNeedles as ni, recordMaskOnlyValuesIn as nl, refactorMarkerRefusalMessage as nn, parseWebACLArn as no, collectDeclaredOutputNames as nr, refuseMalformedResourcePropertiesForDestroy as ns, serviceTokenBlockingReason as nt, buildDenyExternalAccessPolicy as nu, perType as o, ec2InstanceProtectionSite as oa, maskAtCoordinates as oc, absoluteAssemblyPathEscape as od, PRE_DELETE_SNAPSHOT_TYPES as oi, wholeStringLeavesOf as ol, hasPendingMovesOut as on, declaresNoEcho as oo, DEFAULT_RESOURCE_TIMEOUT_MS as or, refuseMalformedResourcesForDeploy as os, listNestedTemplateRows as ot, describeDockerExecFailure as ou, planStreamMemberOps as p, IntrinsicFunctionResolver as pa, passedNoEchoParametersOf as pc, clearBucketRegionCache as pd, unsupportedFinalSnapshotError as pi, CrossPrefixReadError as pl, recordAfterRollbackUpdate as pn, deployRefusesOrphanRowsReason as po, hintSidesOf as pr, repairMalformedResourceEntriesForReadOnly as ps, enclosingDeadlineExpired as pt, isMalformedEnvKey as pu, isTruthyCfnBoolean as q, carriesDynamicReference as qa, recordNestedStackParameterExpressions as qc, CloudControlProvider as qi, BOOTSTRAP_MARKER_PREFIX as ql, exportAliasCollisionScrubWarning as qn, refuseMalformedOutputs as qo, createReadOnlyAttributeHealerFactory as qr, prefetchCreateOnlyPropertyPaths as qs, sameJournaledOrphans as qt, canonicalizeRegion as qu, recordedProtectionNote as r, isWaitAbandonedError as ra, TemplateParser as rc, hasPlainPrototype$1 as rd, stateSecretNameNeedles as ri, recordNoEchoAttributeValues as rl, refuseRefactorMarker as rn, withSharedDrainBudget as ro, collectPublishedOutputNames as rr, refuseMalformedResourcePropertiesForDrift as rs, childTemplateLoader as rt, buildDockerImage as ru, readProtection as s, isTerminationProtectionPropagationError as sa, maskReadbackAtCoordinates as sc, describeFileReadFailure as sd, buildFinalSnapshotIdentifier as si, WHOLE_DYNAMIC_REFERENCE_PATTERN as sl, pendingMovesOutOf as sn, JSON_LISTING_HOLE_VALUE as so, DEFAULT_RESOURCE_WARN_AFTER_MS as sr, refuseMalformedResourcesForDestroy as ss, renderNestedTemplateTreeDefect as st, describeDockerFailure as su, DeployEngine as t, deleteSkipReason as ta, sameLambdaFunctionAddress as tc, defineOwnKey as td, secretNamedAttributeNamesOf as ti, recordMaskOnlyValue as tl, refactorMarkerMovesOf as tn, refStateLookupFromResource as to, noEchoParameterValueSeed as tr, refuseMalformedResourceEntriesForOrphan as ts, findServiceTokenRefusals as tt, validateContainerRepoName as tu, STREAM_TAGS_KEY as u, reEnableInstanceApiTermination as ua, noEchoCoordinatesOf as uc, resolveAssemblyPath as ud, effectiveDeletionPolicy as ui, isLockInfoExpired as ul, replayFailedOperations as un, UNREADABLE_ORPHANS_CONTAINER_ROW as uo, findDestructiveChanges as ur, repairMalformedOrphanRecordsForReadOnly as us, conditionInputsFrom as ut, formatDockerLoginError as uu, streamPolicyMatchesDeclared as v, s3BucketDualStackDomainName as va, liveMatchesUnresolvedTokenFrame as vc, acquireIdempotencyToken as vi, isNotImplemented as vl, planRollback as vn, isReadableOrphanRecord as vo, looselyEqual as vr, unreadableResourceEntries as vs, keptWholeReasonText as vt, runDockerForeground as vu, planIndexContributorInsightsOps as w, keepHeldTokenProvenance as wa, createUnionSecretMasker as wc, DBPROXY_TAGS_WHAT as wi, exportNamesCarriedFrom as wl, orphanNeedsIdentity as wn, malformedLocalResourceEntriesWarning as wo, getStackRecords as wr, NO_CC_HANDLERS_REASON as ws, resolvePendingCloudControlRequests as wt, synthesisStatusMessage as wu, contributorInsightsRefusals as x, resolveDynamicReferences as xa, recordReferenceProvenanceEntry as xc, extractDeploymentEventError as xi, splitImportedOps as xl, replacementNeverSwapped as xn, malformedExportNamesWarning as xo, proposeRenames as xr, findSilentDropProperties as xs, makeSiblingClaimReader as xt, AssetManifestLoader as xu, streamTagsMatchDeclared as y, s3BucketRegionalDomainName as ya, markSameGenerationBag as yc, DeploymentEventsReader as yi, stackInstanceIdOf as yl, recheckFailedPlan as yn, isReadableResourceEntry as yo, mappingPairs as yr, withheldAccountClause as ys, mergeNoChangeOutputs as yt, runDockerStreaming as yu, relayedIndexBusyDelete as z, classifyReplaySecretRegion as za, withoutPhysicalNameCopies as zc, TemplateNoEchoReresolver as zi, isSensitiveAttributeName as zl, retiredNameGenerationsLeaving as zn, previewableOrphanRecords as zo, supersededHeldByOtherTypeWarning as zr, configBooleanRefusal as zs, withNestedStackContext as zt, CFN_TEMPLATE_URL_LIMIT as zu };
-//# sourceMappingURL=deploy-engine-DSpxEUjC.js.map
+export { computeImplicitDeleteEdges as $, AWS_NO_VALUE as $a, recordAttributeIdCopy as $c, RollbackInlinePolicyWriters as $i, getBootstrapMarkerKey as $l, carriedExportAliasExposure as $n, refuseMalformedResourceEntriesForDeploy as $o, namingSecretsWithRecordedNoEcho as $r, blockDeviceMappingsDifferOnlyInDeleteOnTermination as $s, lookupEachName as $t, StageLoadError as $u, beginDeleteWait as A, applyRoleArnIfSet as Aa, logOnlyValueCount as Ac, refuseMalformedDesiredTags as Ai, hasUnverifiableParameterRefusal as Al, REDACTED_DELETE_ADDRESS_SKIP_REASON as An, malformedOrphanRowsKeptWarning as Ao, cyan as Ar, MULTI_REGION_RECREATE_BLOCKED_TYPES as As, displacedOpClause as At, loadCdkJson as Au, waitForIndexesSettled as B, classifyRecordedSecretRegion as Ba, scrubResourceRecord as Bc, waitForLambdaFunctionActive as Bi, timePhase as Bl, retiredNameGenerationsAfter as Bn, malformedStateRefusalMessage as Bo, supersededAfterRollback as Br, coerceCfnInteger as Bs, getCurrentNestedStackContext as Bt, ssmResolvedValueType as Bu, planContributorInsightsOp as C, resolveDynamicReferences as Ca, redactForState as Cc, extractDeploymentEventError as Ci, withStackInstanceIdWithheld as Cl, replacementNeverSwapped as Cn, malformedExportNamesWarning as Co, proposeRenames as Cr, findSilentDropProperties as Cs, makeSiblingClaimReader as Ct, warnFinchArgvExposure as Cu, reverseMapTableContributorInsights as D, outputReferenceProvenanceOf as Da, createUnionSecretMasker as Dc, DBPROXY_TAG_OPTIONS as Di, exportNamesCarriedFrom as Dl, findNestedStackTypeChanges as Dn, malformedLocalResourcesWarning as Do, withStackRecords as Dr, hasNoCloudControlHandlers as Ds, keptForRetainedRecord as Dt, synthesisStatusMessage as Du, reverseMapIndexContributorInsights as E, keepHeldTokenProvenance as Ea, carryLogOnlyValues as Ec, DBPROXY_TAGS_WHAT as Ei, describeRegionValueKind as El, orphanNeedsIdentity as En, malformedLocalResourceEntriesWarning as Eo, getStackRecords as Er, NO_CC_HANDLERS_REASON as Es, resolvePendingCloudControlRequests as Et, Synthesizer as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, sendableAssumeRoleCommand as Fa, unionOfSecretBags as Fc, CC_BROKEN_REASON as Fi, orphansCarriedFrom as Fl, updatePartialReason as Fn, malformedRenderedContainersWarning as Fo, addSuperseded as Fr, coerceWarmThroughput as Fs, recordDisplacedSkips as Ft, resolveStateBucketWithDefault as Fu, sendTtlWaitingOutRateLimit as G, isUnboundTemplateParameter as Ga, isUncertifiedBaselineMaskPosition as Gc, withPrintingSecrets as Gi, buildAssetRedirectMap as Gl, reachableDivergentParameters as Gn, refuseMalformedOrphanRecordsForDestroy as Go, noEchoAttributeNamesOf as Gr, replayWarn as Gs, isHandledOrphan as Gt, uploadCfnTemplate as Gu, isTtlRateLimited as H, producerRegionsFromState as Ha, withoutPhysicalNameCopies as Hc, readsNoEchoDeleteValues as Hi, isSensitiveAttributeName as Hl, withNameGenerationReached as Hn, refuseDivergentRecordRegionForDestroy as Ho, supersededHolderOf as Hr, configIntegerRefusal as Hs, deleteJournaledOrphans as Ht, CFN_TEMPLATE_URL_LIMIT as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, AWS_CREDENTIAL_ENV_KEYS as Ia, createSecretMasker as Ic, ProviderRegistry as Ii, shouldRetainResource as Il, nameGenerationCarriedFrom as In, malformedResourceEntriesWarning as Io, deleteSupersededEntry as Ir, isWarmThroughputDecrease as Is, revertNestedChildFromJournal as It, resolveStateBucketWithDefaultAndSource as Iu, hasCdkAutoDeleteTag as J, isImpossibleEmptyStoredAttribute as Ja, identityKeyFor as Jc, customResourceResponseExpirationWarning as Ji, rewriteTemplateAssetReferences as Jl, displayTextOrWithheld as Jn, refuseMalformedOrphansForOrphan as Jo, noEchoParameterNamesOf as Jr, requireConfigString as Js, makeForeignHolderScan as Jt, expectedOwnerParam as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, parameterTypeMayLoseSecretIdentity as Ka, pathCrossesDottedKey as Kc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Ki, createAssetRedirectResolver as Kl, resourcesNamingDeclaredParameter as Kn, refuseMalformedOrphans as Ko, noEchoComparisonForTemplate as Kr, requireConfigArray as Ks, journaledOrphanLines as Kt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ku, deleteTableWithIndexBusyRetry as L, applyCallerIdentityCredentials as La, errorCauseChain as Lc, ccBrokenReason as Li, stackInstanceIdCarriedFrom as Ll, nameGenerationHighWaterOf as Ln, malformedResourcePropertiesWarning as Lo, holdsSupersededResources as Lr, toCfnInteger as Ls, revertedNestedRowIds as Lt, resolveUseCdkBootstrapAssets as Lu, deleteBudgetKey as M, assertSendableRoleArn as Ma, recordLogOnlyParameterValue as Mc, tagPlanWarning as Mi, importableOutputs as Ml, redactedDeleteAddressFields as Mn, malformedOrphansWarning as Mo, green as Mr, isStatefulRecreateTargetSync as Ms, dropSettledNestedJournals as Mt, resolveAutoAssetStorage as Mu, resolveDynamoDbDeleteBudgetClock as N, explicitRoleArnOrThrow as Na, recordLogOnlyValue as Nc, definedAttributes as Ni, isReadableBag as Nl, redactedDeleteAddressSkip as Nn, malformedOutputsRefusalMessage as No, red as Nr, renderStatefulReason as Ns, getNestedRevertRun as Nt, resolveCaptureObservedState as Nu, stripIndexContributorInsights as O, recordedOutputReferenceRegions as Oa, hasMaskableValues as Oc, planTagDiff as Oi, hasReadableExportSet as Ol, getCurrentProducerRegions as On, malformedOrphanRecordsRefusalMessage as Oo, replacedDeleteFailureVerdict as Or, findReplacedReadersOfRecreateTargets as Os, recordRetainedForReadoption as Ot, getDefaultStateBucketName as Ou, resolveDynamoDbDeleteBudgetMs as P, isIamRoleArn as Pa, shareLogOnlyValues as Pc, stringifyIfAssigned as Pi, orphansAfterRollback as Pl, updatePartialMessage as Pn, malformedOutputsWarning as Po, yellow as Pr, WARM_THROUGHPUT_MEMBERS as Ps, nestedChildStackName as Pt, resolveSkipPrefix as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, keepsSecretReferenceToken as Qa, physicalNameCopiesOf as Qc, unchangedBehindSecretReference as Qi, ensureAssetStorage as Ql, secretSafeKeyDisplay as Qn, refuseMalformedResourceEntries as Qo, maskEventTextWithBoundBags as Qr, withRetry as Qs, isAccessDeniedError as Qt, AssemblyReader as Qu, maskedLogger as R, callerEnvCredentials as Ra, maskSecretsInError as Rc, isCustomResource as Ri, PhaseClock as Rl, nameScopeOf as Rn, malformedResourcesWarning as Ro, isSupersededResourceRecord as Rr, toFiniteNumber as Rs, withNestedRevertRun as Rt, stateBucketExistenceConfirmed as Ru, indexDeclaresContributorInsights as S, s3BucketWebsiteUrl as Sa, markSameGenerationBag as Sc, DeploymentEventsStore as Si, stackInstanceIdOf as Sl, recordUnderIdIsNotOwn as Sn, malformedDriftResourcePropertiesWarning as So, parseMappingFile as Sr, findActionableSilentDrops as Ss, makeCanonicalizePropertiesFn as St, runDockerStreaming as Su, readContributorInsightsSpec as T, refuseUnreadableCdkCrossAccountRefs as Ta, snapshotPassProvenance as Tc, markDeleteStarted as Ti, acceptedCreateOnlyDropsOf as Tl, seedsDeleteFirstGuard as Tn, malformedLocalOutputsWarning as To, destroyStackRecordsView as Tr, withoutSilentDropProperties as Ts, pendingRequestCount as Tt, getDockerImageBySourceHash as Tu, planTimeToLive as U, regionLessSecretName as Ua, DYNAMIC_REFERENCE_TOKEN_SCAN as Uc, isCustomResourceType as Ui, stringifyValue as Ul, computeParameterTaint as Un, refuseMalformedNestedChildOutputs as Uo, supersededResourcesOf as Ur, configStringRefusal as Us, dropFailedCommands as Ut, MIGRATE_TMP_PREFIX as Uu, isTtlAlreadyDisabled as V, classifyReplaySecretRegion as Va, withPhysicalNameCopies as Vc, TemplateNoEchoReresolver as Vi, AssetPublisher as Vl, retiredNameGenerationsLeaving as Vn, previewableOrphanRecords as Vo, supersededHeldByOtherTypeWarning as Vr, configBooleanRefusal as Vs, withNestedStackContext as Vt, CFN_TEMPLATE_BODY_LIMIT as Vu, readTtlSpec as W, coerceParameterTypedValue as Wa, dynamicReferenceTokens as Wc, getCurrentResourceSecrets as Wi, WorkGraph as Wl, namesAnyDeclaredParameter as Wn, refuseMalformedOrphanRecords as Wo, withoutSuperseded as Wr, readConfigString as Ws, dropFailedHint as Wt, findLargeInlineResources as Wu, getPriorAttempts as X, carriesFetchableDynamicReference as Xa, recordNestedStackParameterExpressions as Xc, slowCcOperationTimeoutMs as Xi, BOOTSTRAP_MARKER_PREFIX as Xl, secretBearing as Xn, refuseMalformedOutputsForDestroy as Xo, completedReplayEntries as Xr, templateResourceTypes as Xs, formatResourceLine as Xt, canonicalizeRegion as Xu, isTruthyCfnBoolean as Y, carriesDynamicReference as Ya, inheritNestedStackParameterAssociations as Yc, CloudControlProvider as Yi, AssetModeResolver as Yl, exportAliasCollisionScrubWarning as Yn, refuseMalformedOutputs as Yo, createReadOnlyAttributeHealerFactory as Yr, prefetchCreateOnlyPropertyPaths as Ys, sameJournaledOrphans as Yt, PARTITION_TABLE as Yu, markRefusedBeforeApplying as Z, isNamelessDynamicReferenceError as Za, recoverMaskedOutput as Zc, onlySecretReferencesDiffer as Zi, assertAssetBucketRegion as Zl, secretBearingStateKeyWarning as Zn, refuseMalformedResourceAttributesForOrphan as Zo, journaledOrphanPrintingBag as Zr, describeTypeWithThrottleRetry as Zs, chunks as Zt, derivePartitionAndUrlSuffix as Zu, streamMemberRefusals as _, isSettledInstanceState as _a, readbackPathFor as _c, resolveBucketRegion as _d, ledgerForStack as _i, CrossPrefixScanCache as _l, isJournaledOrphan as _n, hasReadableOrphans as _o, rollbackOrphanIds as _r, repairMalformedResourcesForReadOnly as _s, withResourceDeadline as _t, partitionSensitiveEnv as _u, isProtectionValueActive as a, isWaitAbandonedError as aa, DagBuilder as ac, hasOwnKey as ad, stateSecretNameNeedles as ai, recordMaskOnlyValuesIn as al, refuseRefactorMarker as an, withSharedDrainBudget as ao, collectPublishedOutputNames as ar, refuseMalformedResourcePropertiesForDrift as as, childTemplateLoader as at, buildDenyExternalAccessPolicy as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketDualStackDomainName as ba, valueAtCoordinate as bc, acquireIdempotencyToken as bi, isAccessDenied$1 as bl, planRollback as bn, isReadableOrphanRecord as bo, looselyEqual as br, unreadableResourceEntries as bs, keptWholeReasonText as bt, redactedDockerCause as bu, DynamoDBGlobalTableProvider as c, ec2InstanceProtectionSite as ca, isMarkedCoordinate as cc, ownValue as cd, PRE_DELETE_SNAPSHOT_TYPES as ci, recordProvenPublicExpression as cl, hasPendingMovesOut as cn, declaresNoEcho as co, DEFAULT_RESOURCE_TIMEOUT_MS as cr, refuseMalformedResourcesForDeploy as cs, listNestedTemplateRows as ct, describeDockerCapturedOutput as cu, declaredStreamPolicyMember as d, reDisableInstanceApiTermination as da, maskWholeValue as dc, displayAssemblyPath as dd, createPreDeleteFinalSnapshot as di, isSingleDynamicReferenceToken as dl, refusePendingMovesOut as dn, STATE_RESOURCES_MALFORMED as do, constructPathOf as dr, refuseMalformedState as ds, conditionFingerprint as dt, dockerSpawnEnvWithSensitive as du, UNSPECIFIED_SKIP_REASON as ea, ecsServiceLaunchTypeSetOrChanged as ec, processStackMessages as ed, orphanRecordsPrintingBag as ei, recordPhysicalNameCopy as el, withApiLimit as en, cfnRefValueFromPhysicalId as eo, exportNameNoEchoParameters as er, refuseMalformedResourceEntriesForDestroy as es, crossStackOutputProvenanceSource as et, isCrossRegionRedirect as eu, declaredStreamTagsMember as f, reEnableInstanceApiTermination as fa, maskedLeafCoordinatesOf as fc, renderAssemblyPathEscape as fd, effectiveDeletionPolicy as fi, LockManager as fl, replayFailedOperations as fn, UNREADABLE_ORPHANS_CONTAINER_ROW as fo, findDestructiveChanges as fr, repairMalformedOrphanRecordsForReadOnly as fs, conditionInputsFrom as ft, finchSecretArgvRefusal as fu, streamDeclaresTags as g, poisonRenderedSpellingsCollidingIn as ga, passedNoEchoParametersOf as gc, clearBucketRegionCache as gd, earliestDefined as gi, CrossPrefixReadError as gl, demoteSupersededOrphans as gn, displayLogicalId as go, movedToHint as gr, repairMalformedResourcePropertiesForReadOnly as gs, enclosingDeadlineRemainingMs as gt, isMalformedEnvKey as gu, streamDeclaresPolicy as h, IntrinsicFunctionResolver as ha, noEchoOutputsComparison as hc, injectedAwsRegionValue as hd, unsupportedFinalSnapshotError as hi, rebuildClientForBucketRegion as hl, recordAfterRollbackUpdate as hn, deployRefusesOrphanRowsReason as ho, hintSidesOf as hr, repairMalformedResourceEntriesForReadOnly as hs, enclosingDeadlineExpired as ht, isDockerClientEnvKey as hu, PROTECTION_PROPERTY_BY_TYPE as i, withIndeterminateGuard as ia, sameLambdaFunctionAddress as ic, defineOwnKey as id, secretNamedRecordNeedles as ii, recordMaskOnlyValue as il, refactorMarkerRefusalMessage as in, parseWebACLArn as io, collectDeclaredOutputNames as ir, refuseMalformedResourcePropertiesForDestroy as is, serviceTokenBlockingReason as it, validateContainerRepoName as iu, compensateRemovedDeletionProtection as j, assertFlagRoleArn as ja, printingCorpusOf as jc, tagMapAsList as ji, importableOutputKeys as jl, isRedactedRecordedValue as jn, malformedOrphansRefusalMessage as jo, gray as jr, isStatefulRecreateTargetForReplace as js, displacedPhysicalIdShown as jt, resolveApp as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, recordedReferenceRegions as ka, literalSplitDelimitersOf as kc, readTagList as ki, hasReasonlessBaselineRefusal as kl, inheritProducerRegions as kn, malformedOrphanRecordsWarning as ko, bold as kr, shownType as ks, NESTED_PENDING_PARENT_REASON as kt, getLegacyStateBucketName as ku, STREAM_POLICY_KEY as l, isTerminationProtectionPropagationError as la, maskAtCoordinates as lc, absoluteAssemblyPathEscape as ld, buildFinalSnapshotIdentifier as li, wholeStringLeavesOf as ll, pendingMovesOutOf as ln, JSON_LISTING_HOLE_VALUE as lo, DEFAULT_RESOURCE_WARN_AFTER_MS as lr, refuseMalformedResourcesForDestroy as ls, renderNestedTemplateTreeDefect as lt, describeDockerExecFailure as lu, reverseMapStreamPolicy as m, INTRINSIC_KEYS as ma, noEchoLeavesOf as mc, injectAwsRegion as md, refusesFinalSnapshot as mi, S3StateBackend as ml, removeProtectionTypeList as mn, accountArgs as mo, findRefactorHints as mr, repairMalformedOutputsForReadOnly as ms, readRecordedConditionVerdicts as mt, getDockerCmd as mu, recordedProtectionEvidence as n, deleteLeftInPlace as na, canonicalLambdaFunctionName as nc, parseFailureDebugDetail as nd, secretNamePrintingBags as ni, carriesSecretMask as nl, readRefactorMarkerOnce as nn, lacksRecordedTableArn as no, isWholeDynamicReferenceValue as nr, refuseMalformedResourceEntriesForImportSave as ns, deferredServiceTokenWarning as nt, readBootstrapMarkerBody as nu, perType as o, markWaitAbandoned as oa, TemplateParser as oc, hasPlainPrototype$1 as od, storedSecretNameNeedles as oi, recordNoEchoAttributeValues as ol, sameMove as on, parameterInputsFor as oo, isExportAliasCollision as or, refuseMalformedResourcePropertiesForExport as os, findNestedTemplateTreeDefect as ot, buildDockerImage as ou, planStreamMemberOps as p, DiffCalculator as pa, noEchoCoordinatesOf as pc, resolveAssemblyPath as pd, isFinalSnapshotError as pi, isLockInfoExpired as pl, replayRollback as pn, UNREADABLE_RESOURCES_MAP_ROW as po, formatDestructiveChange as pr, repairMalformedOrphansForReadOnly as ps, parentSuppliedValues as pt, formatDockerLoginError as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, getAccountInfo as qa, spelledKeysOf as qc, applyCustomResourceResponseExpiration as qi, loadPublishableAssetManifest as ql, WITHHELD_NAME_DISPLAY as qn, refuseMalformedOrphansForDestroy as qo, noEchoExactEchoLeavesOf as qr, requireConfigObject as qs, loadJournaledOrphans as qt, decodeListingKey as qu, recordedProtectionNote as r, deleteSkipReason as ra, lambdaFunctionNameForMask as rc, utf8ByteLength as rd, secretNamedAttributeNamesOf as ri, provenPublicValue as rl, refactorMarkerMovesOf as rn, refStateLookupFromResource as ro, noEchoParameterValueSeed as rr, refuseMalformedResourceEntriesForOrphan as rs, findServiceTokenRefusals as rt, validateAssetBucketName as ru, readProtection as s, disableInstanceApiTermination as sa, canonicalCoordinates as sc, nullPrototypeRecord as sd, ATOMIC_FINAL_SNAPSHOT_TYPES as si, recordNoEchoParameterFreshValue as sl, updateRefactorMarker as sn, passedParameterClassesOf as so, bindingSkippedOutputs as sr, refuseMalformedResourcePropertiesForOrphan as ss, isAbsoluteAssetPath as st, resolveDockerContextDirectory as su, DeployEngine as t, deleteIndeterminateGuards as ta, emrClusterInstancesReplaced as tc, describeJsonParseFailure as td, secretNamePrintingBag as ti, splitGetAttStringForm as tl, readRefactorMarker as tn, isStalePlaceholderArnAttribute as to, exportNameSecretExposure as tr, refuseMalformedResourceEntriesForImport as ts, inheritedProvenanceForChildDiff as tt, parseBootstrapMarker as tu, STREAM_TAGS_KEY as u, observeThenDisableInstanceApiTermination as ua, maskReadbackAtCoordinates as uc, describeFileReadFailure as ud, ccRoutedFinalSnapshotError as ui, WHOLE_DYNAMIC_REFERENCE_PATTERN as ul, pendingMovesRefusalMessage as un, STATE_REGION_DIVERGED as uo, maskingRetryLogger as ur, refuseMalformedResourcesForExport as us, templateIdentity as ut, describeDockerFailure as uu, streamPolicyMatchesDeclared as v, s3BucketArn as va, readsNoEchoSource as vc, reserveStackCreateToken as vi, applyCrossPrefixScan as vl, isReplacementOrphan as vn, hasReadableOutputs as vo, withMovedTo as vr, unpreviewableOrphanRecords as vs, diffSecurity as vt, redactDockerArgvValues as vu, planIndexContributorInsightsOps as w, producerLookupOver as wa, recordReferenceProvenanceEntry as wc, isRefusedByName as wi, splitImportedOps as wl, resolveReplacementOldType as wn, malformedExportSourceWarning as wo, awaitInFlightSibling as wr, unwrittenCreateOnlyReplacement as ws, planOrphanAdoption as wt, AssetManifestLoader as wu, contributorInsightsRefusals as x, s3BucketRegionalDomainName as xa, liveMatchesUnresolvedTokenFrame as xc, DeploymentEventsReader as xi, isNotImplemented as xl, recheckFailedPlan as xn, isReadableResourceEntry as xo, mappingPairs as xr, withheldAccountClause as xs, mergeNoChangeOutputs as xt, runDockerForeground as xu, streamTagsMatchDeclared as y, s3BucketDomainName as ya, recordedNoEchoValuesOf as yc, withCreateTokenLedger as yi, crossPrefixDeniedWarning as yl, planFailedOps as yn, hasReadableResources as yo, isPairableType as yr, unreadableOrphanRecords as ys, isSecretBearingReferenceString as yt, redactedCause as yu, relayedIndexBusyDelete as z, envCredentialsAreAssumedRole as za, maskSecretsInText as zc, wouldReturnToSdkProvider as zi, renderPhaseTimings as zl, retiredAfterRollback as zn, malformedScrubResourceEntriesRefusalMessage as zo, removeSuperseded as zr, coerceCfnBoolean as zs, collectNestedChildUnaddressed as zt, warnDeprecatedNoPrefixCliFlag as zu };
+//# sourceMappingURL=deploy-engine-CDjAtIrn.js.map