@go-to-k/cdkd 0.308.0 → 0.309.0

package/dist/{deploy-engine-DSpxEUjC.js → deploy-engine-tQ0aqZMo.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-DzajQDkv.js";
+import { t as getCdkdVersion } from "./version-9LVuCtBU.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4986,7 +4986,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	10,
 	11,
 	12,
-	13
+	13,
+	14
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -6046,7 +6047,7 @@ var S3StateBackend = class S3StateBackend {
 		const body = {
 			...state,
 			...stackInstanceIdCarriedFrom(state),
-			version: 13,
+			version: 14,
 			stackName,
 			region
 		};
@@ -7845,7 +7846,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$9(value) {
+function isPlainObject$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -8101,7 +8102,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$9(args)) return void 0;
+		if (!isPlainObject$11(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -8147,7 +8148,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$9(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$11(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -8441,12 +8442,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$9(resolvedProperties) || !isPlainObject$9(sourceProperties)) return;
+	if (!isPlainObject$11(resolvedProperties) || !isPlainObject$11(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$9(resolvedParameters) || !isPlainObject$9(sourceParameters)) return;
+	if (!isPlainObject$11(resolvedParameters) || !isPlainObject$11(sourceParameters)) return;
 	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -8495,7 +8496,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$9(sourceLeaf)) return void 0;
+		if (!isPlainObject$11(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -8832,7 +8833,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 		}
 		return { value: out };
 	}
-	if (!isPlainObject$9(node)) return void 0;
+	if (!isPlainObject$11(node)) return void 0;
 	const keys = Object.keys(node);
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
@@ -8873,7 +8874,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 }
 function evaluatePureSub(args, bind, pseudo, evaluate) {
 	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
-	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$9(variables)) return;
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$11(variables)) return;
 	const bound = /* @__PURE__ */ new Map();
 	for (const [name, variable] of Object.entries(variables)) {
 		const evaluated = evaluate(variable);
@@ -8906,7 +8907,7 @@ function bindReadName(name, bind, pseudo) {
 function collectRereadConditions(node, names, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
-	if (!isPlainObject$9(node)) return true;
+	if (!isPlainObject$11(node)) return true;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
@@ -8917,7 +8918,7 @@ function collectRereadConditions(node, names, depth = 0) {
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
-	if (!isPlainObject$9(node)) return false;
+	if (!isPlainObject$11(node)) return false;
 	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
 }
 function rendersReadTo(spelling, parentSecrets, value) {
@@ -8960,7 +8961,7 @@ function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return true;
 	if (typeof node === "string") return node.includes("{{resolve:");
 	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
-	if (!isPlainObject$9(node)) return false;
+	if (!isPlainObject$11(node)) return false;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (Object.keys(node).length !== 1) return true;
@@ -9073,7 +9074,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$9(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$11(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -9105,7 +9106,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$9(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$11(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -9268,7 +9269,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$9(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$11(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -9296,7 +9297,7 @@ const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 ]);
 function arrayElementDrop(element, depth = 0) {
 	if (depth > 16) return "unknown";
-	if (!isPlainObject$9(element)) return "never";
+	if (!isPlainObject$11(element)) return "never";
 	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
 	const keys = Object.keys(element);
 	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
@@ -9332,7 +9333,7 @@ function keptLiteralsCorroborate(kept, bag, secrets) {
 	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
 }
 function isIntrinsicNode(value) {
-	if (!isPlainObject$9(value)) return false;
+	if (!isPlainObject$11(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
 }
@@ -9345,7 +9346,7 @@ function keptElementCorroborates(source, bag, secrets, depth = 0) {
 	if (source === null || typeof source !== "object") return source === bag;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
-	if (!isPlainObject$9(source) || !isPlainObject$9(bag)) return false;
+	if (!isPlainObject$11(source) || !isPlainObject$11(bag)) return false;
 	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
 	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
 }
@@ -9355,12 +9356,12 @@ function corroboratesWhateverResolves(source, depth = 0) {
 	if (source === null || typeof source !== "object") return true;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
-	if (!isPlainObject$9(source)) return false;
+	if (!isPlainObject$11(source)) return false;
 	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
 	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
 }
 function arrayPairsWhateverDrops(source) {
-	if (!source.some((element) => isPlainObject$9(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	if (!source.some((element) => isPlainObject$11(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
 	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -9377,13 +9378,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$9(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$11(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 		const reread = positionByParameterReread(bag, source, secrets);
 		if (reread !== void 0) return reread;
 	}
-	if (typeof bag === "string" && isPlainObject$9(source)) {
+	if (typeof bag === "string" && isPlainObject$11(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -9393,7 +9394,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$9(source)) {
+	if (Array.isArray(bag) && isPlainObject$11(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -9428,7 +9429,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
-	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
+	if (isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) {
 			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
@@ -9450,7 +9451,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$9(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$11(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -9487,7 +9488,7 @@ function nameScalarSecrets(value, secrets) {
 			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
 		}
 		if (Array.isArray(node)) return node.map(walk);
-		if (isPlainObject$9(node) && hasPlainPrototype(node)) {
+		if (isPlainObject$11(node) && hasPlainPrototype(node)) {
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
 			return out;
@@ -9504,13 +9505,13 @@ function substitutionIsSecret(value) {
 function sentinelDefinitionOf(source) {
 	const subs = source["DefinitionSubstitutions"];
 	const values = /* @__PURE__ */ new Map();
-	if (isPlainObject$9(subs)) {
+	if (isPlainObject$11(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
 	}
 	for (const key of ["DefinitionString", "Definition"]) {
 		if (!Object.hasOwn(source, key)) continue;
 		const raw = source[key];
-		const body = typeof raw === "string" ? raw : isPlainObject$9(raw) ? JSON.stringify(raw) : void 0;
+		const body = typeof raw === "string" ? raw : isPlainObject$11(raw) ? JSON.stringify(raw) : void 0;
 		if (body === void 0) continue;
 		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
 		const names = [];
@@ -9581,7 +9582,7 @@ function sentinelDefinitionOf(source) {
 				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
 				return;
 			}
-			if (isPlainObject$9(node)) {
+			if (isPlainObject$11(node)) {
 				const own = new Set(Object.keys(node).map(written));
 				for (const [k, v] of Object.entries(node)) {
 					if (!marked(k)) keys.add(k);
@@ -9609,7 +9610,7 @@ function alignedSecretLeaf(root, leaf) {
 			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
 			cursor = cursor[segment];
 		} else {
-			if (!isPlainObject$9(cursor)) return void 0;
+			if (!isPlainObject$11(cursor)) return void 0;
 			const own = Object.keys(cursor);
 			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
 			if (!Object.hasOwn(cursor, segment)) return void 0;
@@ -9620,7 +9621,7 @@ function alignedSecretLeaf(root, leaf) {
 }
 function collectObjectKeys(value, into) {
 	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
-	else if (isPlainObject$9(value)) for (const [k, v] of Object.entries(value)) {
+	else if (isPlainObject$11(value)) for (const [k, v] of Object.entries(value)) {
 		into.add(k);
 		collectObjectKeys(v, into);
 	}
@@ -9633,7 +9634,7 @@ function spelledKeysOf(properties) {
 }
 function someKeyIsUnspelled(value, spelled) {
 	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
-	if (isPlainObject$9(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	if (isPlainObject$11(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
 	return false;
 }
 function nameDefinitionSecrets(value, source, secrets) {
@@ -9728,8 +9729,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$9(a)) {
-		if (!isPlainObject$9(b)) return false;
+	if (isPlainObject$11(a)) {
+		if (!isPlainObject$11(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -9746,7 +9747,7 @@ function renderedDefinitionLiterals(source) {
 	const keyKeep = /* @__PURE__ */ new Set();
 	const subs = source["DefinitionSubstitutions"];
 	const scalars = [];
-	if (isPlainObject$9(subs)) {
+	if (isPlainObject$11(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
 			scalars.push([name, String(value)]);
 			if (typeof value === "string") keep.add(value);
@@ -9758,7 +9759,7 @@ function renderedDefinitionLiterals(source) {
 		if (!Object.hasOwn(source, key)) continue;
 		const body = source[key];
 		if (typeof body === "string") bodies.push(body);
-		else if (isPlainObject$9(body)) bodies.push(JSON.stringify(body));
+		else if (isPlainObject$11(body)) bodies.push(JSON.stringify(body));
 	}
 	for (const body of bodies) {
 		let rendered = body;
@@ -9809,7 +9810,7 @@ function collectScalarLeaves(value, into) {
 		return;
 	}
 	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
-	else if (isPlainObject$9(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+	else if (isPlainObject$11(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
 }
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
 	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9827,7 +9828,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, s
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
-	if (isPlainObject$9(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$11(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
@@ -9854,7 +9855,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
-	if (failClosed === true && isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+	if (failClosed === true && isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
 		const keep = renderedDefinitionLiterals(source);
 		const out = Object.create(null);
 		const rest = Object.create(null);
@@ -9888,7 +9889,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return out;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
+	if (isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -9915,14 +9916,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$9(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$11(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$9(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$11(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -9932,8 +9933,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$9(source)) {
-		if (!isPlainObject$9(bag)) return false;
+	if (isPlainObject$11(source)) {
+		if (!isPlainObject$11(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -10024,13 +10025,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$9(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$11(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(refused) && isPlainObject$9(scanned)) {
+	if (isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(refused) && isPlainObject$11(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -11520,7 +11521,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$9(variables) ? variables : void 0;
+				const vars = isPlainObject$11(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -11554,7 +11555,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$9(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$11(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -11570,7 +11571,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$9(value)) {
+				if (!isPlainObject$11(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -11619,7 +11620,7 @@ function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, con
 	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
 		parameters: noEchoParameters,
 		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$4(coordinate), {
+	}, (coordinate, node) => nodes.set(canonicalJson$5(coordinate), {
 		coordinate,
 		node
 	}));
@@ -11631,7 +11632,7 @@ function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames
 	if (properties === null || typeof properties !== "object") return bag;
 	const coordinates = /* @__PURE__ */ new Map();
 	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
-	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$4(coordinate), coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$5(coordinate), coordinate);
 	const recordLeaf = (leaf) => {
 		if (typeof leaf === "string") {
 			if (leaf === "***" || leaf.includes("{{resolve:")) return;
@@ -11655,7 +11656,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$9(value)) {
+	if (isPlainObject$11(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -11678,7 +11679,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$9(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$11(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -11694,7 +11695,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$9(node)) return { ...node };
+	if (isPlainObject$11(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -11761,20 +11762,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$9(element)) return path;
+			if (key === void 0 || !isPlainObject$11(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$9(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$11(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$9(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$11(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$9(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$11(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -11803,7 +11804,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$9(v) ? !isPlainObject$9(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$11(v) ? !isPlainObject$11(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -11832,8 +11833,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$9(v) && isPlainObject$9(s)) {
-			const tt = isPlainObject$9(t) ? t : {};
+		if (isPlainObject$11(v) && isPlainObject$11(s)) {
+			const tt = isPlainObject$11(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -11856,13 +11857,13 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$9(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$11(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
-	return canonicalJson$4(a) === canonicalJson$4(b);
+	return canonicalJson$5(a) === canonicalJson$5(b);
 }
-function canonicalJson$4(value) {
+function canonicalJson$5(value) {
 	return JSON.stringify(value, (_key, node) => {
 		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
 		const sorted = Object.create(null);
@@ -11900,7 +11901,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$9(node)) {
+				if (isPlainObject$11(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11943,8 +11944,8 @@ function noEchoOutputsComparison(templateValues, sources) {
 	return (current, desired) => {
 		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
 		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
-		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$4(desired[key])));
-		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$4(desired[key]))) maskedKeys.add(key);
+		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$5(desired[key])));
+		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$5(desired[key]))) maskedKeys.add(key);
 		if (maskedKeys.size === 0) return {
 			current,
 			desired,
@@ -11958,7 +11959,7 @@ function noEchoOutputsComparison(templateValues, sources) {
 			const stored = current[key];
 			if (containsMask(stored)) continue;
 			normalized = { ...normalized ?? {} };
-			normalized[key] = canonicalJson$4(stored) === canonicalJson$4(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+			normalized[key] = canonicalJson$5(stored) === canonicalJson$5(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
 		}
 		return {
 			current: normalized,
@@ -12557,6 +12558,43 @@ function lambdaFunctionNameForMask(value) {
 
 //#endregion
 //#region src/analyzer/replacement-rules.ts
+function vpcInstanceTenancyChangeReplaces(oldValue, newValue) {
+	const tenancyOf = (v) => v == null ? "default" : String(v);
+	return tenancyOf(newValue) !== "default" && tenancyOf(newValue) !== tenancyOf(oldValue);
+}
+function instanceSecurityGroupIdsChangeReplaces(oldValue, newValue, siblings) {
+	if (siblings === void 0) return false;
+	if (Array.isArray(oldValue) && Array.isArray(newValue)) {
+		const before = new Set(oldValue.map(String));
+		const after = new Set(newValue.map(String));
+		if (before.size === after.size && [...before].every((g) => after.has(g))) return false;
+	}
+	return siblings.newProperties["SubnetId"] == null;
+}
+function instanceBlockDeviceMappingsChangeReplaces(oldValue, newValue) {
+	return !blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue);
+}
+function blockDeviceMappingsDifferOnlyInDeleteOnTermination(oldValue, newValue) {
+	if (!Array.isArray(oldValue) || !Array.isArray(newValue)) return false;
+	if (oldValue.length !== newValue.length) return false;
+	const strip = (m) => {
+		if (m === null || typeof m !== "object" || Array.isArray(m)) return m;
+		const out = { ...m };
+		const ebs = out["Ebs"];
+		if (ebs !== null && typeof ebs === "object" && !Array.isArray(ebs)) {
+			const rest = { ...ebs };
+			delete rest["DeleteOnTermination"];
+			out["Ebs"] = rest;
+		}
+		return out;
+	};
+	return oldValue.every((m, i) => isDeepStrictEqual(scalarsAsStrings(strip(m)), scalarsAsStrings(strip(newValue[i]))));
+}
+function scalarsAsStrings(value) {
+	if (Array.isArray(value)) return value.map(scalarsAsStrings);
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, scalarsAsStrings(v)]));
+	return typeof value === "number" || typeof value === "boolean" ? String(value) : value;
+}
 function durableConfigPresenceToggled(oldValue, newValue) {
 	return oldValue == null !== (newValue == null);
 }
@@ -12585,6 +12623,10 @@ function attributeTypeChangedForSharedAttribute(oldValue, newValue) {
 	}
 	return false;
 }
+function globalTableLocalSecondaryIndexesRemoved(oldValue, newValue) {
+	const declares = (value) => Array.isArray(value) && value.length > 0;
+	return declares(oldValue) && (newValue === void 0 || newValue === null || Array.isArray(newValue) && newValue.length === 0);
+}
 function budgetNameChanged(oldValue, newValue) {
 	const nameOf = (value) => {
 		if (value === null || typeof value !== "object") return void 0;
@@ -12643,17 +12685,50 @@ function emrInstancesReplacingPart(value) {
 	strip("TaskInstanceFleets", EMR_FLEET_IN_PLACE_MEMBERS);
 	return instances;
 }
+function elastiCachePreferredAvailabilityZonesMovedToDisjoint(oldValue, newValue) {
+	if (!Array.isArray(oldValue) || !Array.isArray(newValue)) return false;
+	if (oldValue.length === 0 || newValue.length === 0) return false;
+	if (![...oldValue, ...newValue].every((z) => typeof z === "string")) return false;
+	return !newValue.some((z) => oldValue.includes(z));
+}
 function emrClusterInstancesReplaced(oldValue, newValue) {
 	if (oldValue === void 0 && newValue === void 0) return true;
 	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
 }
+const AURORA = "aurora";
+const AURORA_MYSQL = "aurora-mysql";
+const DEPRECATED_ORACLE_SE_ENGINES = /* @__PURE__ */ new Set(["oracle-se", "oracle-se1"]);
+const ORACLE_SE2 = "oracle-se2";
+const ORACLE_CDB_CONVERSIONS = /* @__PURE__ */ new Map([["oracle-ee", "oracle-ee-cdb"], ["oracle-se2", "oracle-se2-cdb"]]);
+const ORACLE_CDB_ENGINES = new Set(ORACLE_CDB_CONVERSIONS.values());
+function enginePair(oldValue, newValue) {
+	return typeof oldValue === "string" && typeof newValue === "string" ? [oldValue, newValue] : void 0;
+}
+function dbClusterEngineChangeReplaces(oldValue, newValue) {
+	const pair = enginePair(oldValue, newValue);
+	if (pair === void 0) return false;
+	const [before, after] = pair;
+	return !(before === after || before === AURORA && after === AURORA_MYSQL);
+}
+function dbInstanceEngineChangeIsInPlace(oldValue, newValue) {
+	const pair = enginePair(oldValue, newValue);
+	if (pair === void 0) return false;
+	const [before, after] = pair;
+	const from = before.toLowerCase();
+	const to = after.toLowerCase();
+	return before === after || before === AURORA && after === AURORA_MYSQL || DEPRECATED_ORACLE_SE_ENGINES.has(from) && to === ORACLE_SE2 || ORACLE_CDB_CONVERSIONS.get(from) === to || from === to && ORACLE_CDB_ENGINES.has(to);
+}
+function dbInstanceEngineChangeReplaces(oldValue, newValue) {
+	if (enginePair(oldValue, newValue) === void 0) return false;
+	return !dbInstanceEngineChangeIsInPlace(oldValue, newValue);
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
 	constructor() {
 		this.initializeRules();
 	}
-	requiresReplacement(resourceType, propertyPath, oldValue, newValue) {
+	requiresReplacement(resourceType, propertyPath, oldValue, newValue, siblings) {
 		const rule = this.rules.get(resourceType);
 		if (!rule) {
 			this.logger.debug(`No replacement rule for ${resourceType}, conservatively assuming replacement may be required for ${propertyPath}`);
@@ -12667,16 +12742,16 @@ var ReplacementRulesRegistry = class {
 		if (rule.conditionalReplacements?.has(propertyPath)) {
 			const condition = rule.conditionalReplacements.get(propertyPath);
 			if (condition) {
-				const requires = condition(oldValue, newValue);
+				const requires = condition(oldValue, newValue, siblings);
 				this.logger.debug(`Conditional replacement for ${propertyPath} of ${resourceType}: ${requires}`);
 				return requires;
 			}
 		}
 		return false;
 	}
-	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
+	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings) {
 		const condition = this.rules.get(resourceType)?.conditionalReplacements?.get(propertyPath);
-		return condition === void 0 ? void 0 : condition(oldValue, newValue);
+		return condition === void 0 ? void 0 : condition(oldValue, newValue, siblings);
 	}
 	isClassified(resourceType, propertyPath) {
 		const rule = this.rules.get(resourceType);
@@ -12745,6 +12820,10 @@ var ReplacementRulesRegistry = class {
 				"DestinationConfig"
 			])
 		});
+		this.rules.set("AWS::DynamoDB::GlobalTable", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["LocalSecondaryIndexes", globalTableLocalSecondaryIndexesRemoved]])
+		});
 		this.rules.set("AWS::DynamoDB::Table", {
 			replacementProperties: /* @__PURE__ */ new Set(["TableName", "KeySchema"]),
 			updateableProperties: /* @__PURE__ */ new Set([
@@ -12955,6 +13034,23 @@ var ReplacementRulesRegistry = class {
 			"TargetRole"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
+		this.rules.set("AWS::EC2::VPC", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"CidrBlock",
+				"Ipv4IpamPoolId",
+				"Ipv4NetmaskLength",
+				"VpcEncryptionControl"
+			]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["InstanceTenancy", vpcInstanceTenancyChangeReplaces]])
+		});
+		this.rules.set("AWS::RDS::DBCluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Engine", dbClusterEngineChangeReplaces]])
+		});
+		this.rules.set("AWS::RDS::DBInstance", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Engine", dbInstanceEngineChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::Subnet", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"VpcId",
@@ -12963,14 +13059,17 @@ var ReplacementRulesRegistry = class {
 			]),
 			updateableProperties: /* @__PURE__ */ new Set(["MapPublicIpOnLaunch", "Tags"])
 		});
-		this.rules.set("AWS::EC2::Instance", { replacementProperties: /* @__PURE__ */ new Set([
-			"EbsOptimized",
-			"AvailabilityZone",
-			"ImageId",
-			"SubnetId",
-			"KeyName",
-			"NetworkInterfaces"
-		]) });
+		this.rules.set("AWS::EC2::Instance", {
+			replacementProperties: /* @__PURE__ */ new Set([
+				"EbsOptimized",
+				"AvailabilityZone",
+				"ImageId",
+				"SubnetId",
+				"KeyName",
+				"NetworkInterfaces"
+			]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["SecurityGroupIds", instanceSecurityGroupIdsChangeReplaces], ["BlockDeviceMappings", instanceBlockDeviceMappingsChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::NatGateway", {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", natZoneAddressesAddedToAutomaticGateway]])
@@ -13008,6 +13107,10 @@ var ReplacementRulesRegistry = class {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["LaunchType", ecsServiceLaunchTypeSetOrChanged]])
 		});
+		this.rules.set("AWS::ElastiCache::CacheCluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["PreferredAvailabilityZones", elastiCachePreferredAvailabilityZonesMovedToDisjoint]])
+		});
 		this.rules.set("AWS::EMR::Cluster", {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["Instances", emrClusterInstancesReplaced]])
@@ -14891,7 +14994,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -14931,7 +15034,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$8(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$10(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -14943,7 +15046,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -14956,7 +15059,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -14970,7 +15073,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -14984,10 +15087,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$10(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$8(value) {
+function isPlainObject$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -15014,7 +15117,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$10(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -15304,8 +15407,8 @@ async function findReplacedReadersOfRecreateTargets(input) {
 		}
 		return pending;
 	};
-	const isCreateOnly = async (type, key, plainReference) => {
-		if (rules.requiresReplacement(type, key, void 0, void 0)) return true;
+	const isCreateOnly = async (type, key, plainReference, siblings) => {
+		if (rules.requiresReplacement(type, key, void 0, void 0, siblings)) return true;
 		if (rules.isClassified(type, key)) return false;
 		const keys = await wholeCreateOnlyKeys(type);
 		return plainReference ? keys.whole.has(key) : keys.confirmable.has(key);
@@ -15324,7 +15427,11 @@ async function findReplacedReadersOfRecreateTargets(input) {
 			for (const key of keys) {
 				if (stableTargets.has(replacedId) && idOnly.get(replacedId)?.get(readerId)?.has(key)) continue;
 				const plain = isPlainReferenceTo(resource.Properties?.[key], replacedId, resources[replacedId]?.Type);
-				if (await isCreateOnly(resource.Type, key, plain)) properties.push(key);
+				const siblings = {
+					oldProperties: record.properties ?? {},
+					newProperties: resource.Properties ?? {}
+				};
+				if (await isCreateOnly(resource.Type, key, plain, siblings)) properties.push(key);
 			}
 			if (properties.length === 0) continue;
 			replaced.add(readerId);
@@ -20016,12 +20123,12 @@ function declaresNoEcho(definition) {
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
-function canonicalJson$3(value) {
+function canonicalJson$4(value) {
 	if (value === void 0) return "null";
-	if (Array.isArray(value)) return `[${value.map(canonicalJson$3).join(",")}]`;
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$4).join(",")}]`;
 	if (value !== null && typeof value === "object") {
 		const record = value;
-		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$3(record[key])}`).join(",")}}`;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$4(record[key])}`).join(",")}}`;
 	}
 	return JSON.stringify(value) ?? "null";
 }
@@ -20042,7 +20149,7 @@ function splitInputFingerprint(entry) {
 	};
 }
 function templateCarriesNeedle(templateValue, secrets) {
-	const text = canonicalJson$3(templateValue);
+	const text = canonicalJson$4(templateValue);
 	for (const needle of printingCorpusOf(secrets).keys()) {
 		if (needle.length < 4) continue;
 		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
@@ -20050,14 +20157,14 @@ function templateCarriesNeedle(templateValue, secrets) {
 	return false;
 }
 function maskedPropertyFingerprint(templateValue) {
-	const digest = createHash("sha256").update(canonicalJson$3({
+	const digest = createHash("sha256").update(canonicalJson$4({
 		layout: FINGERPRINT_LAYOUT$1,
 		value: templateValue
 	})).digest("hex");
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$7(value) {
+function isPlainObject$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -20065,7 +20172,7 @@ const NESTED_STACK_TYPE$4 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
-	const text = canonicalJson$3(value);
+	const text = canonicalJson$4(value);
 	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
 	for (const corpus of corpora) {
 		if (corpus === void 0) continue;
@@ -20077,7 +20184,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$7(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$9(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -20088,7 +20195,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$7(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$9(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -20139,7 +20246,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$7(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$9(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -20164,7 +20271,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$7(value)) return false;
+		if (!isPlainObject$9(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -20176,7 +20283,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -20190,7 +20297,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$7(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$9(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -20206,7 +20313,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$7(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$9(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -20221,7 +20328,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$7(value)) return;
+		if (!isPlainObject$9(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -20254,7 +20361,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -20283,8 +20390,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$7(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$7(map)) return "unknown";
+	const map = isPlainObject$9(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$9(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -20352,7 +20459,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$7(value)) return {
+	if (!isPlainObject$9(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -20415,7 +20522,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -20468,8 +20575,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$7(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$7(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$9(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$9(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -20493,34 +20600,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$7(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$9(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$7(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$9(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$7(properties)) return "unknown";
+	if (!isPlainObject$9(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$7(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$9(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$7(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$9(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$7(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$9(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$7(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$9(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -20537,7 +20644,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$7(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$9(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -20550,8 +20657,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$7(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$7(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$9(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$9(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -20623,7 +20730,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$7(value)) return "clean";
+	if (!isPlainObject$9(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -20638,7 +20745,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -20702,7 +20809,7 @@ async function maskedInputFingerprint(templateValue, sources) {
 		if (error instanceof UnknownInput) return void 0;
 		throw error;
 	}
-	const digest = createHash("sha256").update(canonicalJson$3({
+	const digest = createHash("sha256").update(canonicalJson$4({
 		layout: INPUT_FINGERPRINT_LAYOUT,
 		value: form
 	})).digest("hex");
@@ -20716,7 +20823,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$7(parameters)) return classes;
+	if (!isPlainObject$9(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -20757,13 +20864,13 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$7(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$9(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
 		const value = resolvedProps[key];
 		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
-		const text = canonicalJson$3(value);
+		const text = canonicalJson$4(value);
 		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
 	});
 }
@@ -20788,7 +20895,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$7(field)) return read;
+	if (!isPlainObject$9(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -20796,7 +20903,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$7(field)) return read;
+	if (!isPlainObject$9(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -20843,7 +20950,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$7(field) ? Object.entries(field) : [];
+	const next = isPlainObject$9(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -20876,10 +20983,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$7(previous)) return scrubbed;
+		if (!isPlainObject$9(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$7(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$9(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -22220,11 +22327,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$6(value) {
+function isPlainObject$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$6(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$8(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -22242,11 +22349,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$8(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$6(field)) return void 0;
+	if (!isPlainObject$8(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -22255,9 +22362,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$8(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$6(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$8(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -22279,7 +22386,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$6(field)) return record;
+	if (!isPlainObject$8(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -22291,12 +22398,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$6(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$8(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$6(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$8(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$6(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$8(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -22314,7 +22421,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$6(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$8(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -22357,7 +22464,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$6(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$8(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -25877,19 +25984,49 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	}
 };
 
+//#endregion
+//#region src/state/unsettled-properties.ts
+function unsettledPropertiesOf(record) {
+	if (record === null || typeof record !== "object") return /* @__PURE__ */ new Set();
+	const value = record.unsettledProperties;
+	if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+	return new Set(value.filter((entry) => typeof entry === "string" && entry !== ""));
+}
+function withUnsettledProperties(record, names) {
+	const merged = new Set(unsettledPropertiesOf(record));
+	const before = merged.size;
+	for (const name of names) if (typeof name === "string" && name !== "") merged.add(name);
+	if (merged.size === before && Array.isArray(record.unsettledProperties)) return record;
+	if (merged.size === 0) return withoutUnsettledProperties(record);
+	return {
+		...record,
+		unsettledProperties: [...merged].sort()
+	};
+}
+function withoutUnsettledProperties(record) {
+	if (!Object.hasOwn(record, "unsettledProperties")) return record;
+	const { unsettledProperties: _cleared, ...rest } = record;
+	return rest;
+}
+function unsettledContextOf(...records) {
+	const names = /* @__PURE__ */ new Set();
+	for (const record of records) for (const name of unsettledPropertiesOf(record)) names.add(name);
+	return names.size > 0 ? { unsettledProperties: names } : {};
+}
+
 //#endregion
 //#region src/analyzer/read-provenance-promotion.ts
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readsAcrossStacks(value) {
 	if (Array.isArray(value)) return value.some(readsAcrossStacks);
-	if (!isPlainObject$5(value)) return false;
+	if (!isPlainObject$7(value)) return false;
 	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
 	return Object.values(value).some(readsAcrossStacks);
 }
 function recordedReadVersions(record) {
-	if (!isPlainObject$5(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$7(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = referenceProvenanceOf(record);
 	if (field === void 0) return void 0;
 	let out;
@@ -25900,7 +26037,7 @@ async function readProvenancePromotions(args) {
 	const { currentState, desiredTemplate, sources } = args;
 	const parser = args.parser ?? new TemplateParser();
 	const records = currentState.resources;
-	const parameters = isPlainObject$5(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const parameters = isPlainObject$7(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
 	const out = [];
 	for (const { logicalId, changeType } of args.rows) {
 		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
@@ -25908,7 +26045,7 @@ async function readProvenancePromotions(args) {
 		const readVersions = recordedReadVersions(record);
 		if (readVersions === void 0) continue;
 		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
-		const properties = isPlainObject$5(resource?.Properties) ? resource.Properties : {};
+		const properties = isPlainObject$7(resource?.Properties) ? resource.Properties : {};
 		const reads = [];
 		for (const [key, value] of Object.entries(properties)) {
 			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
@@ -25951,7 +26088,7 @@ async function readProvenancePromotions(args) {
 			if (recorded.some((version) => !domain.has(version))) moved.push(token);
 		}
 		if (moved.length === 0) continue;
-		const recordProperties = isPlainObject$5(record?.properties) ? record.properties : {};
+		const recordProperties = isPlainObject$7(record?.properties) ? record.properties : {};
 		const keys = [];
 		for (const r of reads) {
 			if (!Object.hasOwn(recordProperties, r.key)) continue;
@@ -25991,7 +26128,10 @@ const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Fn::Or",
 	"Fn::Not"
 ]);
-const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
+const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({
+	"AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]),
+	"AWS::EC2::Instance": /* @__PURE__ */ new Set(["PublicIp", "PublicDnsName"])
+});
 const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
 const REF_READ = "<Ref>";
 function containsIntrinsic(value, seen = /* @__PURE__ */ new Set()) {
@@ -26009,12 +26149,19 @@ function replacementSidesForLog(oldValue, newValue, mask) {
 	if (newText !== maskedJsonForLog(newValue, (text) => text)) return ["***", newText];
 	return [maskedJsonForLog(oldValue, mask), newText];
 }
+function siblingsOf(change) {
+	if (change.currentProperties === void 0 || change.desiredProperties === void 0) return;
+	return {
+		oldProperties: change.currentProperties,
+		newProperties: change.desiredProperties
+	};
+}
 var DiffCalculator = class DiffCalculator {
 	logger = getLogger().child("DiffCalculator");
 	replacementRules = new ReplacementRulesRegistry();
 	parser = new TemplateParser();
-	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
-		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
+	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings) {
+		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue, siblings);
 	}
 	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare, readProvenance) {
 		const changes = /* @__PURE__ */ new Map();
@@ -26103,11 +26250,26 @@ var DiffCalculator = class DiffCalculator {
 						path: key,
 						oldValue,
 						newValue,
-						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
+						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue, {
+							oldProperties: currentCompared,
+							newProperties: desiredCompared
+						}),
 						maskedExpressionChanged: true
 					});
 					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
 				}
+				const listed = new Set(propertyChanges.map((pc) => pc.path));
+				for (const key of unsettledPropertiesOf(currentResource)) {
+					if (listed.has(key)) continue;
+					propertyChanges.push({
+						path: key,
+						oldValue: currentCompared[key],
+						newValue: desiredCompared[key],
+						requiresReplacement: false,
+						unsettled: true
+					});
+					this.logger.debug(safeMsg`${logicalId}: ${key} is unsettled after a failed update and is sent again`);
+				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -26150,7 +26312,7 @@ var DiffCalculator = class DiffCalculator {
 		const syntheticCreateOnlyPaths = await this.loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements);
 		for (const { change, pc, upstreams } of provenanceChanges) {
 			const templateValue = desiredTemplate.Resources[change.logicalId]?.Properties?.[pc.path];
-			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)));
+			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)), siblingsOf(change));
 		}
 		do
 			this.promoteReplacementDependents(changes, desiredTemplate, syntheticCreateOnlyPaths, forcedReplacements);
@@ -26268,8 +26430,8 @@ var DiffCalculator = class DiffCalculator {
 		}));
 		return loaded;
 	}
-	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference) {
-		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0)) return true;
+	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference, siblings) {
+		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0, siblings)) return true;
 		if (this.replacementRules.isClassified(resourceType, propKey)) return false;
 		const createOnly = syntheticCreateOnlyPaths.get(resourceType);
 		if (createOnly === void 0 || !createOnly.whole.has(propKey)) return false;
@@ -26318,7 +26480,7 @@ var DiffCalculator = class DiffCalculator {
 						oldValue,
 						newValue,
 						replacementPropagated: true,
-						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
+						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type), siblingsOf(change)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
 					});
 				}
 				if (syntheticChanges.length === 0) continue;
@@ -26393,7 +26555,7 @@ var DiffCalculator = class DiffCalculator {
 					path: propKey,
 					oldValue: change.currentProperties?.[propKey],
 					newValue: change.desiredProperties?.[propKey],
-					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false),
+					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false, siblingsOf(change)),
 					inPlacePropagated: true,
 					...noEchoPromoted && { noEchoPromoted: true }
 				});
@@ -26509,7 +26671,10 @@ var DiffCalculator = class DiffCalculator {
 			const oldValue = currentProperties[key];
 			const newValue = desiredProperties[key];
 			if (!this.valuesEqual(oldValue, newValue)) {
-				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
+				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue, {
+					oldProperties: currentProperties,
+					newProperties: desiredProperties
+				});
 				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
 					if (createOnlyPaths === void 0) createOnlyPaths = await getCreateOnlyPropertyPaths(resourceType);
 					if (createOnlyChangeRequiresReplacement(createOnlyPaths, key, oldValue, newValue, (a, b) => this.valuesEqual(a, b))) {
@@ -26532,9 +26697,9 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
-	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue) {
-		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue)) return true;
-		if (this.replacementRules.isClassified(resourceType, key) && this.replacementRules.conditionalReplacementVerdict(resourceType, key, oldValue, newValue) === void 0) return false;
+	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue, siblings) {
+		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue, siblings)) return true;
+		if (this.replacementRules.isClassified(resourceType, key) && this.replacementRules.conditionalReplacementVerdict(resourceType, key, oldValue, newValue, siblings) === void 0) return false;
 		return (await getCreateOnlyPropertyPaths(resourceType)).some((path) => path.length === 1 && path[0] === key);
 	}
 	static INTRINSIC_KEYS = INTRINSIC_KEYS;
@@ -27524,8 +27689,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$4(previous)) {
-		if (!isPlainObject$4(desired)) return "differs";
+	if (isPlainObject$6(previous)) {
+		if (!isPlainObject$6(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -27551,7 +27716,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -27954,6 +28119,8 @@ const SLOW_CC_OPERATION_TIMEOUTS = {
 		create: 60 * MINUTE_MS,
 		delete: 60 * MINUTE_MS
 	},
+	"AWS::DynamoDB::Table": { update: 75 * MINUTE_MS },
+	"AWS::DynamoDB::GlobalTable": { update: 75 * MINUTE_MS },
 	"AWS::EKS::Cluster": {
 		create: 30 * MINUTE_MS,
 		delete: 30 * MINUTE_MS
@@ -28502,7 +28669,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CsRMe_zh.js");
+			const { ASGProvider } = await import("./asg-provider-DQoKGfKH.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28611,7 +28778,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BPs9JSk_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-p59T8CFv.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Qpf09VQv.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DmVmx69p.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29767,11 +29934,11 @@ function applyNoEchoDeleteValues(properties, recordedLeaves, values) {
 		payload: properties,
 		unresolved: []
 	};
-	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$4(leaf.coordinate), leaf]));
+	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$5(leaf.coordinate), leaf]));
 	const entries = [];
 	const unresolved = [];
 	for (const coordinate of masked) {
-		const leaf = byKey.get(canonicalJson$4(coordinate));
+		const leaf = byKey.get(canonicalJson$5(coordinate));
 		if (leaf === void 0) unresolved.push(coordinate);
 		else entries.push({
 			coordinate,
@@ -29822,7 +29989,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	const fingerprinter = options.inputSources === void 0 ? void 0 : inputFingerprinter(templateProps, options.inputSources);
 	const leaves = [];
 	for (const coordinate of masked) {
-		if (!nodes.has(canonicalJson$4(coordinate))) continue;
+		if (!nodes.has(canonicalJson$5(coordinate))) continue;
 		if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 		const value = valueAtCoordinate(resolvedProperties, coordinate);
 		if (value === void 0 || carriesSecretMask(value)) continue;
@@ -30001,7 +30168,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const bag = await this.noEchoNeedles();
 		const leaves = [];
 		for (const coordinate of masked) {
-			const key = canonicalJson$4(coordinate);
+			const key = canonicalJson$5(coordinate);
 			if (!nodes.has(key)) continue;
 			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
@@ -37092,7 +37259,7 @@ const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
 			const sorted = Object.create(null);
@@ -37122,7 +37289,7 @@ function skippedOutputDigest(template, outputKey) {
 		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
 	}
 	const entry = template.Outputs?.[outputKey];
-	return createHash("sha256").update(canonicalJson$2({
+	return createHash("sha256").update(canonicalJson$3({
 		output: entry,
 		template: sections
 	})).digest("hex");
@@ -38484,9 +38651,9 @@ function sameIdReversalDone(op, current) {
 	const now = current.properties ?? {};
 	if (forward === void 0) return "undecidable";
 	const own = (bag, key) => Object.hasOwn(bag, key) ? bag[key] : void 0;
-	const changed = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(forward)])].filter((key) => !deepEqual$1(own(before, key), own(forward, key)));
-	if (changed.length === 0) return holdsRedactedLeaf(before) ? "undecidable" : deepEqual$1(now, before);
-	return changed.every((key) => deepEqual$1(own(now, key), own(before, key)));
+	const changed = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(forward)])].filter((key) => !deepEqual$2(own(before, key), own(forward, key)));
+	if (changed.length === 0) return holdsRedactedLeaf(before) ? "undecidable" : deepEqual$2(now, before);
+	return changed.every((key) => deepEqual$2(own(now, key), own(before, key)));
 }
 function holdsRedactedLeaf(value) {
 	if (typeof value === "string") return value.includes("***");
@@ -38496,14 +38663,14 @@ function holdsRedactedLeaf(value) {
 function sameIdReversalUndecidable(op, current) {
 	return sameIdRecreated(op) && current !== void 0 && sameIdReversalDone(op, current) === "undecidable";
 }
-function deepEqual$1(a, b) {
+function deepEqual$2(a, b) {
 	if (a === b) return true;
 	if (a == null || b == null) return a === b;
 	if (typeof a !== typeof b) return false;
 	if (typeof a !== "object") return false;
 	if (Array.isArray(a) || Array.isArray(b)) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => deepEqual$1(v, b[i]));
+		return a.every((v, i) => deepEqual$2(v, b[i]));
 	}
 	const ao = a;
 	const bo = b;
@@ -38511,7 +38678,7 @@ function deepEqual$1(a, b) {
 	if (ak.length !== Object.keys(bo).length) return false;
 	for (const k of ak) {
 		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-		if (!deepEqual$1(ao[k], bo[k])) return false;
+		if (!deepEqual$2(ao[k], bo[k])) return false;
 	}
 	return true;
 }
@@ -38550,13 +38717,13 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 			return "reverse-replacement-readopt";
 		}
 		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) {
-			if (sameTypeAsOld && deepEqual$1(current.properties, op.previousState.properties)) return "skip-already-done";
+			if (sameTypeAsOld && deepEqual$2(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
 		}
 		if (!resolveReplacementOldType(op).ok) return "refuse-replacement-routing";
 		return op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
-	if (op.previousState && deepEqual$1(current.properties, op.previousState.properties)) return "skip-already-done";
+	if (op.previousState && deepEqual$2(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
 }
 function classifyFailedOp(op, stateResources, siblings = []) {
@@ -38906,7 +39073,7 @@ function replaceAtCoordinate(bag, coordinate, value) {
 	});
 	return root;
 }
-async function readLive(live, baseline, marked, logicalId, ctx) {
+async function readLive$1(live, baseline, marked, logicalId, ctx) {
 	let readCurrentState;
 	try {
 		const { provider } = ctx.providerRegistry.getProviderFor({
@@ -38947,7 +39114,7 @@ async function substituteMarkedNoEchoLeaves(input) {
 		...identity,
 		inert: pending
 	};
-	const read = await readLive(live, baseline, pending, logicalId, ctx);
+	const read = await readLive$1(live, baseline, pending, logicalId, ctx);
 	if ("failure" in read) throw unreadableNoEchoLeafRefusal(logicalId, pending, read.failure);
 	const values = [];
 	const unreadable = [];
@@ -38995,7 +39162,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	const marked = noEchoLeavesOf(baseline) ?? [];
 	const names = declaredNoEchoAttributeNames(baseline);
 	if (marked.length === 0 && names.length === 0 && substituted.length === 0) return record;
-	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$4(leaf.value) === canonicalJson$4(value));
+	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$5(leaf.value) === canonicalJson$5(value));
 	let attributes = record.attributes;
 	if (attributes !== void 0 && attributes !== null && typeof attributes === "object") for (const [name, value] of Object.entries(attributes)) {
 		if (!names.includes(name) && !echoes(name, value)) continue;
@@ -39006,7 +39173,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 		const list = coordinate.findIndex((segment) => typeof segment === "number");
 		if (list < 0) return false;
 		const path = coordinate.slice(0, list);
-		return canonicalJson$4(valueAtCoordinate(byIndex, path)) !== canonicalJson$4(valueAtCoordinate(baseline.properties, path));
+		return canonicalJson$5(valueAtCoordinate(byIndex, path)) !== canonicalJson$5(valueAtCoordinate(baseline.properties, path));
 	});
 	const properties = reshaped.length === 0 ? byIndex : maskReadbackAtCoordinates(byIndex, baseline.properties, reshaped);
 	const widened = reshaped.map((coordinate) => readbackPathFor(byIndex, baseline.properties, coordinate)).filter((path, i) => path !== void 0 && path.length < reshaped[i].length);
@@ -39120,6 +39287,355 @@ function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are five ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. (5) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: restore the property with a 'cdkd deploy' that changes this resource, which sends it the value again. Every rollback to such a baseline refuses while the two values still overlap there, so to end this, change the property (or rotate one of the secrets) so that they no longer overlap. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
+//#endregion
+//#region src/analyzer/drift-normalize.ts
+function canonicalizeTagListsDeep(v) {
+	if (Array.isArray(v)) {
+		const mapped = v.map(canonicalizeTagListsDeep);
+		if (mapped.length > 0 && mapped.every((t) => t && typeof t === "object" && typeof t.Key === "string")) return [...mapped].sort((a, b) => {
+			const ka = a.Key;
+			const kb = b.Key;
+			if (ka !== kb) return ka < kb ? -1 : 1;
+			return JSON.stringify(a) < JSON.stringify(b) ? -1 : 1;
+		});
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		if (!hasPlainPrototype$1(v)) return v;
+		const out = nullPrototypeRecord();
+		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeTagListsDeep(val);
+		return out;
+	}
+	return v;
+}
+const ID_RE = /^[a-z][a-z0-9]*-[0-9a-f]{6,}$/;
+const isIdLike = (s) => typeof s === "string" && (s.startsWith("arn:") || ID_RE.test(s));
+function canonicalizeIdArraysDeep(v) {
+	if (Array.isArray(v)) {
+		const mapped = v.map(canonicalizeIdArraysDeep);
+		if (mapped.length > 1 && mapped.every(isIdLike)) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		if (!hasPlainPrototype$1(v)) return v;
+		const out = nullPrototypeRecord();
+		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeIdArraysDeep(val);
+		return out;
+	}
+	return v;
+}
+const LEAF_ONLY_PATH_SUFFIX = "[]";
+function matchesPathPrefix(path, entries) {
+	for (const entry of entries) {
+		if (entry.endsWith("[]")) {
+			const leaf = entry.slice(0, -2);
+			if (leaf !== "" && path === leaf) return true;
+			continue;
+		}
+		if (path === entry) return true;
+		if (path.startsWith(`${entry}.`)) return true;
+	}
+	return false;
+}
+function canonicalizeUnorderedArraysAtPaths(v, paths) {
+	if (paths.length === 0) return v;
+	return walkUnordered(v, "", paths);
+}
+function canonicalJson$2(v) {
+	if (Array.isArray(v)) return `[${v.map(canonicalJson$2).join(",")}]`;
+	if (v && typeof v === "object") {
+		const bag = v;
+		return `{${Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson$2(bag[k])}`).join(",")}}`;
+	}
+	return JSON.stringify(v) ?? "null";
+}
+const isPlainObjectElement = (el) => el !== null && typeof el === "object" && !Array.isArray(el);
+function walkUnordered(v, path, paths) {
+	if (Array.isArray(v)) {
+		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
+		if (mapped.length > 1 && matchesPathPrefix(path, paths)) {
+			if (mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+			if (mapped.every(isPlainObjectElement)) {
+				const keyed = mapped.map((el) => ({
+					el,
+					key: canonicalJson$2(el)
+				}));
+				keyed.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+				return keyed.map((k) => k.el);
+			}
+		}
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		if (!hasPlainPrototype$1(v)) return v;
+		const out = nullPrototypeRecord();
+		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
+		return out;
+	}
+	return v;
+}
+
+//#endregion
+//#region src/analyzer/drift-calculator.ts
+function calculateResourceDrift(stateProperties, awsProperties, options) {
+	const drifts = [];
+	const ignore = options?.ignorePaths ?? [];
+	const union = options?.unionWalkObjects ?? false;
+	const unordered = options?.unorderedPaths ?? [];
+	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
+	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
+	for (const key of Object.keys(stateProperties)) {
+		if (isIgnoredPath(key, ignore)) continue;
+		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
+	}
+	return drifts;
+}
+function undeclaredEmptyObservedKeys(observed, declared) {
+	const keys = [];
+	for (const key of Object.keys(observed)) {
+		if (Object.hasOwn(declared, key)) continue;
+		const value = observed[key];
+		if (value === null || value === void 0 || Array.isArray(value) && value.length === 0 || isPlainObject$5(value) && Object.keys(value).length === 0) keys.push(key);
+	}
+	return keys;
+}
+function isIgnoredPath(path, ignorePaths) {
+	return matchesPathPrefix(path, ignorePaths);
+}
+function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
+	const stateForm = jsonForm(stateValue);
+	const awsForm = jsonForm(awsValue);
+	if (deepEqual$1(stateForm, awsForm)) return;
+	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
+	if (isPlainObject$5(stateForm) && isPlainObject$5(awsForm) && !Array.isArray(stateForm) && !Array.isArray(awsForm)) {
+		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateForm), ...Object.keys(awsForm)]) : Object.keys(stateForm);
+		for (const key of keys) {
+			const childPath = `${path}.${key}`;
+			if (isIgnoredPath(childPath, ignorePaths)) continue;
+			diffAt(childPath, stateForm[key], awsForm[key], out, ignorePaths, unionWalkObjects);
+		}
+		return;
+	}
+	out.push({
+		path,
+		stateValue,
+		awsValue
+	});
+}
+function jsonForm(value) {
+	if (value === null || typeof value !== "object" || hasPlainPrototype$1(value)) return value;
+	const toJSON = value.toJSON;
+	return typeof toJSON === "function" ? toJSON.call(value) : value;
+}
+function deepEqual$1(a, b) {
+	a = jsonForm(a);
+	b = jsonForm(b);
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b)) return false;
+		if (a.length !== b.length) return false;
+		return a.every((v, i) => deepEqual$1(v, b[i]));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	const bKeys = Object.keys(bObj);
+	if (aKeys.length !== bKeys.length) return false;
+	for (const key of aKeys) {
+		if (!Object.prototype.hasOwnProperty.call(bObj, key)) return false;
+		if (!deepEqual$1(aObj[key], bObj[key])) return false;
+	}
+	return true;
+}
+function equalModuloMask(state, aws, mask) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (a === mask && b !== null && b !== void 0) return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMask(v, b[i], mask));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
+}
+function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinMarked = isMarked) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (isMarked(coordinate) && b !== void 0 && b !== null) {
+		if (a === mask) return true;
+		if (isWithinMarked(coordinate) ? isWhollyMask$1(a, mask) : sameJson(a, wholeMaskOf(b, mask))) return holdsMask(a, mask);
+	}
+	if (a === mask && (typeof b === "string" || typeof b === "number" || typeof b === "boolean")) return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked, isWithinMarked));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked, isWithinMarked));
+}
+function wholeMaskOf(value, mask) {
+	if (value === null || value === void 0) return value;
+	if (Array.isArray(value)) return value.map((v) => wholeMaskOf(v, mask));
+	if (isPlainObject$5(value)) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
+	return mask;
+}
+function isWhollyMask$1(value, mask) {
+	const walk = (node) => {
+		if (node === mask || node === null) return true;
+		if (Array.isArray(node)) return node.every(walk);
+		if (isPlainObject$5(node)) return Object.values(node).every(walk);
+		return false;
+	};
+	return walk(value) && holdsMask(value, mask);
+}
+function holdsMask(value, mask) {
+	if (value === mask) return true;
+	if (Array.isArray(value)) return value.some((v) => holdsMask(v, mask));
+	if (isPlainObject$5(value)) return Object.values(value).some((v) => holdsMask(v, mask));
+	return false;
+}
+function sameJson(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => sameJson(v, b[i]));
+	}
+	const aObj = a;
+	const bObj = b;
+	const keys = Object.keys(aObj);
+	return keys.length === Object.keys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
+}
+function isPlainObject$5(value) {
+	return typeof value === "object" && value !== null;
+}
+
+//#endregion
+//#region src/deployment/unsettled-convergence.ts
+const MERGE_SEMANTICS_KEYS = /* @__PURE__ */ new Set(["Tags"]);
+async function readLive(args, names) {
+	const { provider, physicalId, logicalId, resourceType, recordedProperties } = args;
+	let live;
+	if (provider.readUnsettled !== void 0) live = await provider.readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, args.desired);
+	else if (provider.readCurrentState !== void 0) live = await provider.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
+	else return;
+	if (typeof live !== "object" || live === null || Array.isArray(live)) return "unreadable";
+	return live;
+}
+function refusal(args, names, why) {
+	const list = [...names].sort().join(", ");
+	return new ProvisioningError(`${args.logicalId} (${args.resourceType}): an earlier failed update left ${list} unsettled, and ${why} — nothing was updated. Re-run the deploy once the resource has settled` + (args.provider.readCurrentState !== void 0 ? ", or, to keep what AWS holds instead, run 'cdkd drift --accept' once it has." : "."), args.resourceType, args.logicalId, args.physicalId);
+}
+async function settleUnsettledPrevious(args) {
+	const { names, previous, provider } = args;
+	if (names.size === 0) return previous;
+	if (provider.unsettledInTransition !== void 0) {
+		const moving = await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties);
+		if (moving.size > 0) throw refusal(args, moving, "AWS is still changing it or cdkd could not confirm it settled");
+	}
+	const substituted = new Set([...names].filter((name) => !MERGE_SEMANTICS_KEYS.has(name)));
+	if (substituted.size === 0) return previous;
+	let live;
+	try {
+		live = await readLive(args, substituted);
+	} catch (error) {
+		if (error instanceof ProvisioningError) throw error;
+		const wrapped = refusal(args, substituted, "the resource could not be read to converge it");
+		if (error instanceof Error) wrapped.cause = error;
+		throw wrapped;
+	}
+	if (live === void 0) return previous;
+	if (live === "unreadable") throw refusal(args, substituted, "the resource could not be read to converge it");
+	const out = { ...previous };
+	for (const name of substituted) if (Object.hasOwn(live, name) && live[name] !== void 0) out[name] = live[name];
+	else delete out[name];
+	return out;
+}
+function tagsHeld(desired, live) {
+	const asMap = (value) => {
+		if (value === void 0 || value === null) return /* @__PURE__ */ new Map();
+		if (Array.isArray(value)) {
+			const map = /* @__PURE__ */ new Map();
+			for (const entry of value) {
+				if (typeof entry !== "object" || entry === null) return void 0;
+				const { Key, Value } = entry;
+				if (typeof Key !== "string") return void 0;
+				map.set(Key, Value);
+			}
+			return map;
+		}
+		if (typeof value === "object") return new Map(Object.entries(value));
+	};
+	const want = asMap(desired);
+	const have = asMap(live);
+	if (want === void 0 || have === void 0) return false;
+	for (const [key, value] of want) if (!have.has(key) || JSON.stringify(have.get(key)) !== JSON.stringify(value)) return false;
+	return true;
+}
+async function unsettledAfterUpdate(args) {
+	const { names, desired, provider } = args;
+	if (names.size === 0) return [];
+	try {
+		const moving = provider.unsettledInTransition === void 0 ? /* @__PURE__ */ new Set() : await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties);
+		const live = await readLive(args, names);
+		if (live === void 0) return [...moving].sort();
+		if (live === "unreadable") return [...names].sort();
+		const ignorePaths = provider.getDriftUnknownPaths?.(args.resourceType) ?? [];
+		const unorderedPaths = provider.getDriftUnorderedPaths?.(args.resourceType) ?? [];
+		const kept = [];
+		for (const name of names) {
+			if (moving.has(name)) {
+				kept.push(name);
+				continue;
+			}
+			if (MERGE_SEMANTICS_KEYS.has(name)) {
+				if (!tagsHeld(desired[name], live[name])) kept.push(name);
+				continue;
+			}
+			if (!Object.hasOwn(live, name) || desired[name] === void 0) continue;
+			if (calculateResourceDrift({ [name]: desired[name] }, { [name]: live[name] }, {
+				ignorePaths,
+				unorderedPaths
+			}).length > 0) kept.push(name);
+		}
+		return kept.sort();
+	} catch {
+		return [...names].sort();
+	}
+}
+async function withUnprovenUnsettled(record, args, warn) {
+	const kept = await unsettledAfterUpdate(args);
+	if (kept.length === 0) return record;
+	warn(safeMsg`${args.logicalId} (${args.resourceType}): the update succeeded, but AWS does not yet show the requested ${kept.join(", ")}; cdkd keeps ${kept.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
+	return withUnsettledProperties(record, kept);
+}
+function splitUnhandledRemovals(unhandled, recordedPrevious, unsettled) {
+	const addedByFailedUpdate = unhandled.filter((name) => unsettled.has(name) && !Object.hasOwn(recordedPrevious, name));
+	return {
+		removedFromTemplate: unhandled.filter((name) => !addedByFailedUpdate.includes(name)),
+		addedByFailedUpdate
+	};
+}
+function addedByFailedUpdateWarning(logicalId, resourceType, names) {
+	const one = names.length === 1;
+	return safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} set on the resource but in no template: an earlier failed update applied ${one ? "it" : "them"}. cdkd has no default to reset ${one ? "it" : "them"} to, so the value stays; remove it by hand if it should not be there.`;
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-retry.ts
 const RECREATE_RETRY_SCHEDULE = {
@@ -39128,7 +39644,17 @@ const RECREATE_RETRY_SCHEDULE = {
 	maxDelayMs: 1e4
 };
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets, mask) {
-	const [, , resourceType, desired, previous, context] = args;
+	const [, , resourceType, desired, recordedPrevious, context] = args;
+	const previous = await settleUnsettledPrevious({
+		provider,
+		logicalId: args[0],
+		physicalId: args[1],
+		resourceType,
+		recordedProperties: recordedPrevious,
+		names: context?.unsettledProperties ?? /* @__PURE__ */ new Set(),
+		previous: recordedPrevious,
+		desired
+	});
 	const removal = prepareRemovalForUpdate(provider, resourceType, desired, previous);
 	const revertArgs = [
 		args[0],
@@ -39142,7 +39668,9 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 		}
 	];
 	const recorded = (result) => {
-		if (removal.unhandled.length > 0) logger.warn(mask(removalWarning(logicalId, resourceType, removal.unhandled, "rollback")));
+		const unhandledByCause = splitUnhandledRemovals(removal.unhandled, recordedPrevious, context?.unsettledProperties ?? /* @__PURE__ */ new Set());
+		if (unhandledByCause.removedFromTemplate.length > 0) logger.warn(mask(removalWarning(logicalId, resourceType, unhandledByCause.removedFromTemplate, "rollback")));
+		if (unhandledByCause.addedByFailedUpdate.length > 0) logger.warn(mask(addedByFailedUpdateWarning(logicalId, resourceType, unhandledByCause.addedByFailedUpdate)));
 		return result === void 0 ? void 0 : withoutInjectedRemovals(result, removal.injected);
 	};
 	if (provider.disableOuterRetry) return recorded(await withCurrentResourceSecrets(secrets, () => provider.update(...revertArgs)));
@@ -39175,6 +39703,9 @@ async function createWithRollbackRetry(provider, create, logicalId, logger, isIn
 	});
 }
 function recordAfterRollbackUpdate(restored, result) {
+	return withoutUnsettledProperties(recordAfterRollbackUpdateUnsettled(restored, result));
+}
+function recordAfterRollbackUpdateUnsettled(restored, result) {
 	if (result === void 0) return restored;
 	const returned = result.attributes;
 	const replacedId = result.wasReplaced && typeof result.physicalId === "string" && result.physicalId !== "" ? result.physicalId : void 0;
@@ -39466,12 +39997,22 @@ async function replayRevert(s) {
 			expectedRegion: ctx.region,
 			replayingState: true,
 			recordedAttributes: current.attributes,
-			...revertClaimed && { inlinePolicyClaimed: revertClaimed }
+			...revertClaimed && { inlinePolicyClaimed: revertClaimed },
+			...unsettledContextOf(current, previousState)
 		}
 	], op.logicalId, logger, isInterrupted, secrets, mask));
 	if (revertResult) recordNoEchoAttributeValues(revertResult, secrets, desiredProps);
 	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties, previousState.attributes), previousState, noEcho.substituted);
-	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
+	stateResources[op.logicalId] = await withUnprovenUnsettled(stateResources[op.logicalId], {
+		provider,
+		logicalId: op.logicalId,
+		physicalId: current.physicalId,
+		resourceType: op.resourceType,
+		recordedProperties: current.properties ?? {},
+		names: unsettledContextOf(current, previousState).unsettledProperties ?? /* @__PURE__ */ new Set(),
+		desired: desiredProps ?? {}
+	}, (message) => logger.warn(mask(message)));
+	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
 	if (rollbackPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`));
 	else logger.info(`  Rollback: ${safe(op.logicalId)} restored successfully`);
@@ -40413,12 +40954,22 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 							expectedRegion: ctx.region,
 							replayingState: true,
 							recordedAttributes: current.attributes,
-							...revertFailedClaimed && { inlinePolicyClaimed: revertFailedClaimed }
+							...revertFailedClaimed && { inlinePolicyClaimed: revertFailedClaimed },
+							...unsettledContextOf(current, prev)
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
 					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(withNameGenerationReached(recordAfterRollbackUpdate(prev, revertFailedResult), op.logicalId, op.nameGeneration), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
-					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
+					stateResources[op.logicalId] = await withUnprovenUnsettled(stateResources[op.logicalId], {
+						provider,
+						logicalId: op.logicalId,
+						physicalId: current.physicalId,
+						resourceType: op.resourceType,
+						recordedProperties: current.properties ?? {},
+						names: unsettledContextOf(current, prev).unsettledProperties ?? /* @__PURE__ */ new Set(),
+						desired: desiredProps ?? {}
+					}, (message) => logger.warn(mask(message)));
+					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
 					else logger.info(`  Rollback: ${safe(op.logicalId)} reverted successfully`);
@@ -42332,7 +42883,7 @@ async function revertNestedChildFromJournal(args) {
 			...carried,
 			...stackInstanceIdCarriedFrom(base),
 			...supersededAfterRollback(base, supersededHost),
-			version: 13,
+			version: 14,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
@@ -44475,7 +45026,7 @@ function stdoutSupportsColor(env = process.env, argv = process.argv, isTTY = pro
 //#endregion
 //#region src/analyzer/security-diff.ts
 function isSyntheticChange(pc) {
-	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true || pc.unsettled === true;
 }
 function withChanges(base, changes, side) {
 	const props = { ...base ?? {} };
@@ -44855,18 +45406,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalJson$1(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
-	if (isPlainObject$3(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
+	if (isPlainObject$4(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject$3(value)) return false;
+	if (!isPlainObject$4(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44889,8 +45440,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject$3(definitions)) return void 0;
-	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$4(definitions)) return void 0;
+	const declared = isPlainObject$4(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44912,7 +45463,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$4(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -44943,7 +45494,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject$3(value)) return;
+	if (!isPlainObject$4(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -44957,9 +45508,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject$3(section)) continue;
+		if (!isPlainObject$4(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject$3(entry)) continue;
+			if (!isPlainObject$4(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -44991,10 +45542,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject$3(field)) return read;
+	if (!isPlainObject$4(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject$3(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$4(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -45040,11 +45591,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$4(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject$3(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$4(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45379,7 +45930,7 @@ function deferredServiceTokenWarning(row) {
 
 //#endregion
 //#region src/deployment/read-provenance-sources.ts
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function crossStackNodes(value, into = []) {
@@ -45387,7 +45938,7 @@ function crossStackNodes(value, into = []) {
 		for (const item of value) crossStackNodes(item, into);
 		return into;
 	}
-	if (!isPlainObject$2(value)) return into;
+	if (!isPlainObject$3(value)) return into;
 	const keys = Object.keys(value);
 	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
 	for (const item of Object.values(value)) crossStackNodes(item, into);
@@ -45411,11 +45962,11 @@ function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
 function inheritedProvenanceForChildDiff(args) {
 	const { row, rowRecord, parentRecords, parentTemplate } = args;
 	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
-	const recordedParameters = isPlainObject$2(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const recordedParameters = isPlainObject$3(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
 	const tokens = referenceTokensIn(recordedParameters);
 	if (tokens.size === 0) return void 0;
 	const own = referenceProvenanceOf(rowRecord);
-	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$2(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$3(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
 	const out = /* @__PURE__ */ new Map();
 	for (const token of tokens) {
 		const versions = /* @__PURE__ */ new Set();
@@ -46280,6 +46831,38 @@ function planTimeToLive(spec, previousSpec, mode) {
 function isTtlAlreadyDisabled(awsDetail) {
 	return /TimeToLive is already disabled/i.test(awsDetail);
 }
+function isTtlRateLimited(awsDetail) {
+	return /Time to live has been modified multiple times/i.test(awsDetail);
+}
+const TTL_RATE_LIMIT_RETRY_MS = 6e4;
+const TTL_RATE_LIMIT_SLICE_MS = 1e3;
+async function sendTtlWaitingOutRateLimit(send, options) {
+	const retryMs = options.retryMs ?? 6e4;
+	const watch = startInterruptWatch(options.what);
+	let announced = false;
+	try {
+		for (;;) try {
+			await send();
+			return;
+		} catch (error) {
+			if (!isTtlRateLimited(describeAwsFailure(error).detail)) throw error;
+			if (enclosingDeadlineRemainingMs() <= 0) throw error;
+			if (!announced) {
+				options.announce();
+				announced = true;
+			}
+			const until = Date.now() + Math.min(retryMs, enclosingDeadlineRemainingMs());
+			while (Date.now() < until) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await new Promise((resolve) => setTimeout(resolve, Math.min(TTL_RATE_LIMIT_SLICE_MS, until - Date.now())));
+			}
+			if (watch.isInterrupted()) throw watch.onInterrupted();
+			if (enclosingDeadlineRemainingMs() <= 0) throw error;
+		}
+	} finally {
+		watch.dispose();
+	}
+}
 
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
@@ -46617,7 +47200,10 @@ const CI_PATH = `Replicas[].${CONTRIBUTOR_INSIGHTS_KEY}`;
 const KINESIS_PATH = `Replicas[].${KINESIS_KEY}`;
 const TABLE_POLICY_PATH = `Replicas[].${TABLE_POLICY_KEY}`;
 const STREAM_POLICY_PATH = `Replicas[].${REPLICA_STREAM_KEY}.ResourcePolicy`;
-function isPlainObject$1(value) {
+const INDEX_CI_PATH = `Replicas[].${INDEX_CONTRIBUTOR_INSIGHTS_PATH}`;
+const STREAM_TAGS_PATH = `Replicas[].${REPLICA_STREAM_KEY}.Tags`;
+const REPLICA_INDEXES_KEY = "GlobalSecondaryIndexes";
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readPitrSpec(value) {
@@ -46664,7 +47250,7 @@ function readKinesisSpec(value) {
 }
 function readPolicyBlock(value, path) {
 	if (value === void 0 || value === null) return { kind: "absent" };
-	if (!isPlainObject$1(value)) return {
+	if (!isPlainObject$2(value)) return {
 		kind: "unusable",
 		reason: `${path} must be an object with a PolicyDocument`
 	};
@@ -46676,7 +47262,7 @@ function readPolicyBlock(value, path) {
 		kind: "usable",
 		document
 	};
-	if (!isPlainObject$1(document)) return {
+	if (!isPlainObject$2(document)) return {
 		kind: "unusable",
 		reason: `${path}.PolicyDocument must be a policy object or a JSON string`
 	};
@@ -46696,20 +47282,49 @@ function readTablePolicy(replica) {
 function readStreamPolicy$1(replica) {
 	const stream = replica?.[REPLICA_STREAM_KEY];
 	if (stream === void 0 || stream === null) return { kind: "absent" };
-	if (!isPlainObject$1(stream)) return {
+	if (!isPlainObject$2(stream)) return {
 		kind: "unusable",
 		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
 	};
 	return readPolicyBlock(stream["ResourcePolicy"], STREAM_POLICY_PATH);
 }
+function readStreamTags$1(replica) {
+	const stream = replica?.[REPLICA_STREAM_KEY];
+	if (stream === void 0 || stream === null) return {
+		kind: "tags",
+		tags: []
+	};
+	if (!isPlainObject$2(stream)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
+	};
+	const read = readTagList(stream["Tags"], "desired");
+	return read.kind === "tags" ? {
+		kind: "tags",
+		tags: read.tags
+	} : {
+		kind: "unusable",
+		reason: `${STREAM_TAGS_PATH} must be a list of tags with a non-empty string Key and a scalar Value`
+	};
+}
+function replicaIndexInsightsRefusals(replica) {
+	const indexes = replica?.[REPLICA_INDEXES_KEY];
+	if (!Array.isArray(indexes)) return [];
+	return indexes.flatMap((entry, position) => {
+		if (!isPlainObject$2(entry)) return [];
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `Replicas[].${REPLICA_INDEXES_KEY}[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		return read.kind === "unusable" ? [read.reason] : [];
+	});
+}
 function replicaSettingRefusals(replica) {
-	return [
+	return [...[
 		readPitrSpec(replica?.[PITR_KEY]),
 		readContributorInsightsSpec(replica?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH),
 		readKinesisSpec(replica?.[KINESIS_KEY]),
 		readTablePolicy(replica),
-		readStreamPolicy$1(replica)
-	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []);
+		readStreamPolicy$1(replica),
+		readStreamTags$1(replica)
+	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []), ...replicaIndexInsightsRefusals(replica)];
 }
 function settingOf(op) {
 	switch (op.kind) {
@@ -46722,6 +47337,9 @@ function settingOf(op) {
 		case "putTablePolicy": return "tablePolicy";
 		case "deleteStreamPolicy":
 		case "putStreamPolicy": return "streamPolicy";
+		case "indexContributorInsights": return "indexContributorInsights";
+		case "untagStream":
+		case "tagStream": return "streamTags";
 	}
 }
 const SETTING_MEMBER = {
@@ -46729,7 +47347,9 @@ const SETTING_MEMBER = {
 	contributorInsights: CONTRIBUTOR_INSIGHTS_KEY,
 	kinesis: KINESIS_KEY,
 	tablePolicy: TABLE_POLICY_KEY,
-	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`
+	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`,
+	indexContributorInsights: INDEX_CONTRIBUTOR_INSIGHTS_PATH,
+	streamTags: `${REPLICA_STREAM_KEY}.Tags`
 };
 function samePolicyDocument$1(left, right) {
 	if (left === right) return true;
@@ -46826,6 +47446,51 @@ function planReplicaSettingOps(desired, previous, options, onUnusable) {
 		kind: "putStreamPolicy",
 		document
 	}), { kind: "deleteStreamPolicy" }, "streamPolicy");
+	if (options.tableIndexNames !== void 0) ops.push(...planReplicaIndexInsightsOps(desired, previous, {
+		fresh: options.fresh,
+		tableIndexNames: options.tableIndexNames,
+		removes
+	}, onUnusable));
+	const wantTags = readStreamTags$1(desired);
+	if (wantTags.kind === "unusable") onUnusable(wantTags.reason);
+	else {
+		const hadTags = options.streamReplaced === true ? {
+			kind: "tags",
+			tags: []
+		} : readStreamTags$1(prev);
+		const plan = planTagDiff(hadTags.kind === "tags" ? hadTags.tags : [], wantTags.tags);
+		if (plan.remove.length > 0 && removes("streamTags")) ops.push({
+			kind: "untagStream",
+			keys: plan.remove
+		});
+		if (plan.set.size > 0) ops.push({
+			kind: "tagStream",
+			tags: [...plan.set].map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+	}
+	return ops;
+}
+function planReplicaIndexInsightsOps(desired, previous, options, onUnusable) {
+	const prev = options.fresh ? void 0 : previous;
+	const ops = [];
+	const desiredIndexes = indexEntriesByName(desired?.[REPLICA_INDEXES_KEY]);
+	const prevIndexes = indexEntriesByName(prev?.[REPLICA_INDEXES_KEY]);
+	for (const indexName of /* @__PURE__ */ new Set([...desiredIndexes.keys(), ...prevIndexes.keys()])) {
+		if (!options.tableIndexNames.has(indexName)) continue;
+		const want = readContributorInsightsSpec(desiredIndexes.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], INDEX_CI_PATH);
+		const op = planContributorInsightsOp(want, readContributorInsightsSpec(prevIndexes.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], INDEX_CI_PATH), onUnusable);
+		if (op === void 0) continue;
+		if (options.fresh && op.action === "DISABLE") continue;
+		if (want.kind === "absent" && !options.removes("indexContributorInsights")) continue;
+		ops.push({
+			kind: "indexContributorInsights",
+			indexName,
+			...op
+		});
+	}
 	return ops;
 }
 function planReplicaSettingCorrections(desired, live, only) {
@@ -46872,8 +47537,43 @@ function planReplicaSettingCorrections(desired, live, only) {
 		kind: "putStreamPolicy",
 		document: streamPolicy.document
 	});
+	if (only.has("indexContributorInsights") && live.indexContributorInsightsEnabled !== void 0) for (const [indexName, entry] of declaredIndexInsights(desired)) {
+		const enabled = live.indexContributorInsightsEnabled.get(indexName);
+		if (enabled === void 0 || enabled === entry.enabled) continue;
+		ops.push(!entry.enabled ? {
+			kind: "indexContributorInsights",
+			indexName,
+			action: "DISABLE"
+		} : entry.mode === void 0 ? {
+			kind: "indexContributorInsights",
+			indexName,
+			action: "ENABLE"
+		} : {
+			kind: "indexContributorInsights",
+			indexName,
+			action: "ENABLE",
+			mode: entry.mode
+		});
+	}
+	const streamTags = readStreamTags$1(desired);
+	if (only.has("streamTags") && streamTags.kind === "tags" && live.streamTags !== void 0) {
+		const liveTags = live.streamTags;
+		const missing = streamTags.tags.filter((t) => liveTags.get(t.Key) !== t.Value);
+		if (missing.length > 0) ops.push({
+			kind: "tagStream",
+			tags: missing
+		});
+	}
 	return ops;
 }
+function declaredIndexInsights(desired) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [indexName, entry] of indexEntriesByName(desired?.[REPLICA_INDEXES_KEY])) {
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], INDEX_CI_PATH);
+		if (read.kind === "usable") out.set(indexName, read);
+	}
+	return out;
+}
 function declaredReplicaSettings(desired) {
 	const declared = /* @__PURE__ */ new Set();
 	if (readPitrSpec(desired?.["PointInTimeRecoverySpecification"]).kind === "usable") declared.add("pitr");
@@ -46881,6 +47581,9 @@ function declaredReplicaSettings(desired) {
 	if (readKinesisSpec(desired?.["KinesisStreamSpecification"]).kind === "usable") declared.add("kinesis");
 	if (readTablePolicy(desired).kind === "usable") declared.add("tablePolicy");
 	if (readStreamPolicy$1(desired).kind === "usable") declared.add("streamPolicy");
+	if (declaredIndexInsights(desired).size > 0) declared.add("indexContributorInsights");
+	const tags = readStreamTags$1(desired);
+	if (tags.kind === "tags" && tags.tags.length > 0) declared.add("streamTags");
 	return declared;
 }
 function enabledForReadStatus(status) {
@@ -46927,7 +47630,7 @@ const READBACK_5381_NESTED = [[
 function isPre5381ReplicaBaseline(baseline) {
 	if ("TableClass" in baseline || "DeletionProtectionEnabled" in baseline) return true;
 	const replicas = baseline["Replicas"];
-	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$1(r) && "KMSMasterKeyId" in r);
+	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$2(r) && "KMSMasterKeyId" in r);
 }
 function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFromReadback = false) {
 	if (!isPre5381ReplicaBaseline(baseline)) return baseline;
@@ -46941,7 +47644,7 @@ function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFro
 	if (!Array.isArray(replicas)) return result;
 	const awsReplicas = Array.isArray(aws["Replicas"]) ? aws["Replicas"] : [];
 	result["Replicas"] = replicas.map((element) => {
-		if (!isPlainObject$1(element)) return element;
+		if (!isPlainObject$2(element)) return element;
 		const region = element["Region"];
 		const entry = { ...element };
 		if (region === localRegion && localRegion !== "") {
@@ -46952,13 +47655,13 @@ function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFro
 			delete entry["KMSMasterKeyId"];
 			if (!("SSESpecification" in entry)) entry["SSESpecification"] = { KMSMasterKeyId: key };
 		}
-		const live = awsReplicas.find((r) => isPlainObject$1(r) && r["Region"] === region);
+		const live = awsReplicas.find((r) => isPlainObject$2(r) && r["Region"] === region);
 		if (live !== void 0) {
 			for (const member of READBACK_5381_MEMBERS) if (!(member in entry) && member in live) entry[member] = structuredClone(live[member]);
 			for (const [block, member, flag] of READBACK_5381_NESTED) {
 				const mine = entry[block];
 				const theirs = live[block];
-				if (isPlainObject$1(mine) && isPlainObject$1(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
+				if (isPlainObject$2(mine) && isPlainObject$2(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
 					...mine,
 					[member]: theirs[member]
 				};
@@ -46971,18 +47674,19 @@ function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFro
 const UNREAD_REPLICA_MEMBERS = [
 	"TableClass",
 	"DeletionProtectionEnabled",
-	"SSESpecification"
+	"SSESpecification",
+	"GlobalTableSettingsReplicationMode"
 ];
 function keepUnreadReplicaMembers(desired, previous) {
 	const replicas = desired["Replicas"];
 	const prevReplicas = previous["Replicas"];
 	if (!Array.isArray(replicas) || !Array.isArray(prevReplicas)) return desired;
 	const sse = desired["SSESpecification"];
-	const sseOn = isPlainObject$1(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
+	const sseOn = isPlainObject$2(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
 	let changed = false;
 	const completed = replicas.map((element) => {
-		if (!isPlainObject$1(element)) return element;
-		const live = prevReplicas.find((r) => isPlainObject$1(r) && r["Region"] === element["Region"]);
+		if (!isPlainObject$2(element)) return element;
+		const live = prevReplicas.find((r) => isPlainObject$2(r) && r["Region"] === element["Region"]);
 		if (live === void 0) return element;
 		const entry = { ...element };
 		let touched = false;
@@ -46996,7 +47700,7 @@ function keepUnreadReplicaMembers(desired, previous) {
 		const pitr = entry[PITR_KEY];
 		const wantPitr = readPitrSpec(pitr);
 		const livePitr = readPitrSpec(live[PITR_KEY]);
-		if (isPlainObject$1(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
+		if (isPlainObject$2(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
 			entry[PITR_KEY] = {
 				...pitr,
 				RecoveryPeriodInDays: livePitr.recoveryPeriodInDays
@@ -47020,7 +47724,7 @@ const STREAM_POLICY_KEY = "ResourcePolicy";
 const STREAM_TAGS_KEY = "Tags";
 const POLICY_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_POLICY_KEY}`;
 const TAGS_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_TAGS_KEY}`;
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function refusalOf(guard) {
@@ -47032,7 +47736,7 @@ function refusalOf(guard) {
 	}
 }
 function blockMembers(block) {
-	return isPlainObject(block) ? block : {};
+	return isPlainObject$1(block) ? block : {};
 }
 function readStreamPolicy(block) {
 	const value = blockMembers(block)[STREAM_POLICY_KEY];
@@ -47207,7 +47911,7 @@ function streamTagsMatchDeclared(liveTags, desiredBlock) {
 }
 function canonicalJson(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
 	return JSON.stringify(value) ?? "null";
 }
 
@@ -47223,6 +47927,93 @@ const DRIFT_STRIPPED_INDEX_MEMBERS = [{
 function maskLeafValue(value, maskSecrets) {
 	return maskDeep(value, maskSecrets);
 }
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const IDENTITY_KEYS = [
+	"Region",
+	"IndexName",
+	"AttributeName"
+];
+function identityKeyOf(...lists) {
+	const entries = lists.flat();
+	if (entries.length === 0) return void 0;
+	const key = IDENTITY_KEYS.find((candidate) => entries.every((entry) => isPlainObject(entry) && typeof entry[candidate] === "string"));
+	if (key !== void 0) return { key };
+	return entries.some((entry) => isPlainObject(entry) && IDENTITY_KEYS.some((candidate) => typeof entry[candidate] === "string")) ? "ambiguous" : void 0;
+}
+const POSITIONAL_LIST_KEYS = /* @__PURE__ */ new Set(["KeySchema"]);
+function projectNamed(live, own, wanted, path, unnamed) {
+	if (isPlainObject(live) && (isPlainObject(own) || isPlainObject(wanted))) {
+		const ownBag = isPlainObject(own) ? own : void 0;
+		const wantedBag = isPlainObject(wanted) ? wanted : void 0;
+		const out = {};
+		for (const key of IDENTITY_KEYS) if (Object.hasOwn(live, key)) out[key] = live[key];
+		const named = /* @__PURE__ */ new Set([...Object.keys(ownBag ?? {}), ...Object.keys(wantedBag ?? {})]);
+		for (const key of named) {
+			if (IDENTITY_KEYS.includes(key)) continue;
+			if (key === "Tags") {
+				if (ownBag !== void 0 && Object.hasOwn(ownBag, "Tags")) out["Tags"] = ownBag["Tags"];
+				continue;
+			}
+			if (!Object.hasOwn(live, key) || live[key] === void 0) continue;
+			out[key] = POSITIONAL_LIST_KEYS.has(key) ? live[key] : projectNamed(live[key], ownBag?.[key], wantedBag?.[key], `${path}.${key}`, unnamed);
+		}
+		return out;
+	}
+	if (Array.isArray(live)) {
+		const ownList = Array.isArray(own) ? own : [];
+		const wantedList = Array.isArray(wanted) ? wanted : [];
+		const identity = identityKeyOf(live, ownList, wantedList);
+		if (identity === void 0) return live;
+		if (identity === "ambiguous") {
+			unnamed.push({
+				identity: "unkeyed entries",
+				value: "some",
+				path,
+				ambiguous: true
+			});
+			return own;
+		}
+		const id = identity.key;
+		const byId = (list) => new Map(list.map((entry) => [entry[id], entry]));
+		const ownById = byId(ownList);
+		const wantedById = byId(wantedList);
+		return live.flatMap((entry) => {
+			const value = entry[id];
+			const ownEntry = ownById.get(value);
+			const wantedEntry = wantedById.get(value);
+			if (ownEntry === void 0 && wantedEntry === void 0) {
+				unnamed.push({
+					identity: id,
+					value,
+					path
+				});
+				return [];
+			}
+			return [projectNamed(entry, ownEntry, wantedEntry, `${path}[${value}]`, unnamed)];
+		});
+	}
+	return live;
+}
+const strictReadScope = new AsyncLocalStorage();
+function strictFor(key) {
+	return strictReadScope.getStore()?.has(key) === true;
+}
+function replicaStrictness(status) {
+	const current = strictReadScope.getStore() ?? /* @__PURE__ */ new Set();
+	if (status === void 0 || status === "ACTIVE" || status === "UPDATING") return current;
+	return new Set([...current].filter((key) => key !== "Replicas"));
+}
+const unsettledScope = new AsyncLocalStorage();
+function markUnsettled(...keys) {
+	const scope = unsettledScope.getStore();
+	if (scope === void 0) return;
+	for (const key of keys) scope.mark(key);
+}
+function isUnsettled(key) {
+	return unsettledScope.getStore()?.unsettled.has(key) === true;
+}
 function sentence(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -47314,7 +48105,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
 		log.debug(build(log.mask(failure.detail)).message);
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}`);
+		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}` + relayedEncryptionChangeLimit(failure.detail));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	cleanupFailureText(log, head, error) {
@@ -47445,6 +48236,8 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
+		const createMode = readReplicationMode(properties);
+		if (createMode.kind === "usable") createParams.GlobalTableSettingsReplicationMode = createMode.mode;
 		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 		if (sseEnabledRefusal !== void 0) {
 			const onReplay = replayWarn(log, context).onUnusable;
@@ -47594,6 +48387,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (tableClass !== void 0) create.TableClassOverride = tableClass;
 		const replicaUpdates = [{ Create: create }];
 		for (let attempt = 1;; attempt++) try {
+			markUnsettled("Replicas");
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: tableName,
 				ReplicaUpdates: replicaUpdates
@@ -47619,6 +48413,7 @@ var DynamoDBGlobalTableProvider = class {
 		await this.writeReplicaDeletionProtection(tableName, region, enabled);
 	}
 	async writeReplicaDeletionProtection(tableName, region, enabled) {
+		markUnsettled("Replicas");
 		await this.getRegionalClient(region).send(new UpdateTableCommand({
 			TableName: tableName,
 			DeletionProtectionEnabled: enabled
@@ -47693,6 +48488,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared table class`));
 			try {
+				markUnsettled("Replicas");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: tableName,
 					ReplicaUpdates: [{ Update: {
@@ -47740,6 +48536,7 @@ var DynamoDBGlobalTableProvider = class {
 			request = built;
 		}
 		try {
+			markUnsettled("SSESpecification", "Replicas");
 			await this.dynamoDBClient.send(new UpdateTableCommand(request));
 			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
 		} catch (keyError) {
@@ -47782,6 +48579,7 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async applyReplicaSettings(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, streamReplaced, replaying, keepOnRemoval, previousLocalStreamArn, warn, maskSecrets) {
 		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		const tableIndexNames = previousProperties === void 0 ? new Set(indexEntriesByName(properties["GlobalSecondaryIndexes"]).keys()) : void 0;
 		for (const entry of desired) {
 			const replica = asRecord(entry);
 			const region = replica?.["Region"];
@@ -47791,13 +48589,15 @@ var DynamoDBGlobalTableProvider = class {
 			const ops = planReplicaSettingOps(replica, previous, {
 				fresh,
 				streamReplaced,
-				keepOnRemoval
+				keepOnRemoval,
+				...tableIndexNames !== void 0 && { tableIndexNames }
 			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
 			if (!fresh && keepOnRemoval.has("pitr") && replica?.["PointInTimeRecoverySpecification"] == null && (() => {
 				const prior = readPitrSpec(previous?.["PointInTimeRecoverySpecification"]);
 				return prior.kind === "usable" && prior.enabled;
 			})()) warn(`The ${region} replica of ${tableName}: point-in-time recovery was not turned off, although the properties being applied (a rollback's recorded state, or a drift --revert read-back) declare none — turning it off would delete every recovery point. Turn it off by hand if that is intended.`);
 			const unchanged = fresh ? /* @__PURE__ */ new Set() : declaredReplicaSettings(replica);
+			unchanged.delete("indexContributorInsights");
 			for (const op of ops) unchanged.delete(settingOf(op));
 			if (ops.length === 0 && unchanged.size === 0) continue;
 			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
@@ -47824,7 +48624,7 @@ var DynamoDBGlobalTableProvider = class {
 			const streamPolicyChanged = priorStreamPolicy.kind !== "absent" && desiredStreamPolicy.kind !== "unusable" && !(desiredStreamPolicy.kind === "absent" && keepOnRemoval.has("streamPolicy")) && !(priorStreamPolicy.kind === "usable" && desiredStreamPolicy.kind === "usable" && samePolicyDocument$1(priorStreamPolicy.document, desiredStreamPolicy.document));
 			if (region === currentRegion && streamReplaced && previousLocalStreamArn !== void 0 && streamPolicyChanged && (await describe()).streamArn !== previousLocalStreamArn) await this.deleteOldStreamPolicy(client, previousLocalStreamArn, tableName, warn, maskSecrets);
 			if (unchanged.size === 0) continue;
-			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets);
+			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets, replica);
 			for (const op of planReplicaSettingCorrections(replica, live, unchanged)) {
 				const member = SETTING_MEMBER[settingOf(op)];
 				this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared ${member}`));
@@ -47838,7 +48638,60 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		}
 	}
-	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets) {
+	async sendReplicationMode(tableName, logicalId, mode, maskSecrets, fromTemplate = true) {
+		this.logger.debug(maskSecrets(`Setting GlobalTableSettingsReplicationMode of ${tableName} to ${mode}`));
+		await this.sendLocalSettingUpdate({
+			TableName: tableName,
+			GlobalTableSettingsReplicationMode: mode
+		}, fromTemplate, "GlobalTableSettingsReplicationMode", tableName, logicalId, maskSecrets);
+	}
+	async applyReplicaIndexInsights(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, keepOnRemoval, replaying, warn, maskSecrets) {
+		const tableIndexNames = new Set(indexEntriesByName(properties["GlobalSecondaryIndexes"]).keys());
+		if (tableIndexNames.size === 0) return;
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const fresh = freshRegions.has(region);
+			const ops = planReplicaIndexInsightsOps(replica, localReplicaEntry(previousProperties, region), {
+				fresh,
+				tableIndexNames,
+				removes: (setting) => !keepOnRemoval.has(setting)
+			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
+			const addressed = new Set(ops.flatMap((op) => op.kind === "indexContributorInsights" ? [op.indexName] : []));
+			const declared = declaredIndexInsights(replica);
+			const unchanged = fresh ? [] : [...declared.keys()].filter((name) => tableIndexNames.has(name) && !addressed.has(name));
+			if (ops.length === 0 && unchanged.length === 0) continue;
+			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, { ...region !== currentRegion && { region } });
+			await waitForIndexesSettled({
+				tableName,
+				logicalId,
+				logger: maskedLogger(this.logger, maskSecrets, tableName),
+				describeTable: () => client.send(new DescribeTableCommand({ TableName: tableName })),
+				maxAttempts: 900,
+				proceedNote: `setting the index's Contributor Insights may be refused.`
+			});
+			const describe = () => Promise.resolve({});
+			for (const op of ops) await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			if (unchanged.length === 0) continue;
+			const replicaIndexes = indexEntriesByName(replica?.["GlobalSecondaryIndexes"]);
+			const onlyUnchanged = {
+				...replica,
+				GlobalSecondaryIndexes: unchanged.map((name) => replicaIndexes.get(name))
+			};
+			const only = /* @__PURE__ */ new Set(["indexContributorInsights"]);
+			const live = await this.readLiveReplicaSettings(client, tableName, region, only, describe, maskSecrets, onlyUnchanged);
+			for (const op of planReplicaSettingCorrections(onlyUnchanged, live, only)) try {
+				await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			} catch (convergeError) {
+				if (isInterruptedWaitError(convergeError)) throw convergeError;
+				this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold the declared ${SETTING_MEMBER.indexContributorInsights} of an index, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+			}
+		}
+	}
+	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets, declared) {
 		const live = {};
 		const attempt = async (what, read) => {
 			try {
@@ -47881,10 +48734,37 @@ var DynamoDBGlobalTableProvider = class {
 			const answer = await hasPolicy((await describe()).streamArn);
 			if (answer !== void 0) live.hasStreamPolicy = answer;
 		});
+		if (wanted.has("indexContributorInsights")) {
+			const perIndex = /* @__PURE__ */ new Map();
+			for (const indexName of declaredIndexInsights(declared).keys()) await attempt(`Contributor Insights of an index`, async () => {
+				const status = (await client.send(new DescribeContributorInsightsCommand({
+					TableName: tableName,
+					IndexName: indexName
+				}))).ContributorInsightsStatus;
+				if (status === "ENABLED" || status === "DISABLED") perIndex.set(indexName, status === "ENABLED");
+			});
+			live.indexContributorInsightsEnabled = perIndex;
+		}
+		if (wanted.has("streamTags")) await attempt("the stream tags", async () => {
+			const arn = (await describe()).streamArn;
+			if (arn === void 0) return;
+			const tags = /* @__PURE__ */ new Map();
+			let nextToken;
+			do {
+				const out = await client.send(new ListTagsOfResourceCommand({
+					ResourceArn: arn,
+					NextToken: nextToken
+				}));
+				for (const t of out.Tags ?? []) if (t.Key !== void 0) tags.set(t.Key, t.Value ?? "");
+				nextToken = out.NextToken;
+			} while (nextToken !== void 0);
+			live.streamTags = tags;
+		});
 		return live;
 	}
 	async deleteOldStreamPolicy(client, streamArn, tableName, warn, maskSecrets) {
 		try {
+			markUnsettled("Replicas");
 			await this.retrySettlingRefusal(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the policy of the retired stream of ${tableName}`, maskSecrets);
 		} catch (error) {
 			if (isInterruptedWaitError(error)) throw error;
@@ -47900,6 +48780,30 @@ var DynamoDBGlobalTableProvider = class {
 			throw refusal;
 		}
 	}
+	kinesisDisableSettleDelaysMs = Array(30).fill(2e3);
+	async waitForKinesisDisableSettled(client, tableName, streamArn, scope, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`Kinesis streaming disable on ${scope}`));
+		let last = "none read";
+		try {
+			for (const delayMs of [0, ...this.kinesisDisableSettleDelaysMs]) {
+				if (enclosingDeadlineRemainingMs() <= 0) break;
+				if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(delayMs, enclosingDeadlineRemainingMs()))));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				let unsettled;
+				try {
+					unsettled = ((await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }))).KinesisDataStreamDestinations ?? []).find((d) => d.StreamArn === streamArn && KINESIS_DISABLE_UNSETTLED.has(d.DestinationStatus ?? ""))?.DestinationStatus;
+				} catch (error) {
+					this.logger.debug(maskSecrets(`Could not confirm the Kinesis streaming disable on ${scope}: ` + describeAwsFailure(error).detail));
+					return;
+				}
+				if (unsettled === void 0) return;
+				last = unsettled;
+			}
+			this.logger.warn(maskSecrets(`The Kinesis streaming destination on ${scope} had not settled (last status: ${last}); 'cdkd drift' may report it on this replica until it does`));
+		} finally {
+			watch.dispose();
+		}
+	}
 	async activeKinesisStreamArns(client, tableName) {
 		const out = await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }));
 		return new Set((out.KinesisDataStreamDestinations ?? []).filter((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING").flatMap((d) => d.StreamArn !== void 0 ? [d.StreamArn] : []));
@@ -47911,7 +48815,10 @@ var DynamoDBGlobalTableProvider = class {
 			if (arn === void 0 || arn === "") throw new ProvisioningError(maskSecrets(`Cannot apply ${SETTING_MEMBER[settingOf(op)]} to ${scope}: DescribeTable returned no ${which === "tableArn" ? "TableArn" : "LatestStreamArn (the table has no stream)"}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 			return arn;
 		};
-		const send = (call) => this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		const send = (call) => {
+			markUnsettled("Replicas");
+			return this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		};
 		switch (op.kind) {
 			case "pitr":
 				await send(() => client.send(new UpdateContinuousBackupsCommand({
@@ -47950,6 +48857,7 @@ var DynamoDBGlobalTableProvider = class {
 				} catch (error) {
 					if (await this.kinesisStreaming(client, tableName, op.streamArn, error)) throw error;
 				}
+				await this.waitForKinesisDisableSettled(client, tableName, op.streamArn, scope, maskSecrets);
 				break;
 			case "kinesisPrecision":
 				await send(() => client.send(new UpdateKinesisStreamingDestinationCommand({
@@ -47978,6 +48886,31 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				break;
 			}
+			case "indexContributorInsights":
+				await send(() => client.send(new UpdateContributorInsightsCommand({
+					TableName: tableName,
+					IndexName: op.indexName,
+					ContributorInsightsAction: op.action,
+					...op.mode !== void 0 && { ContributorInsightsMode: op.mode }
+				})));
+				break;
+			case "untagStream": {
+				if ((await describe()).streamArn === void 0) break;
+				const arn = await arnFor("streamArn");
+				await send(() => client.send(new UntagResourceCommand$2({
+					ResourceArn: arn,
+					TagKeys: op.keys
+				})));
+				break;
+			}
+			case "tagStream": {
+				const arn = await arnFor("streamArn");
+				await send(() => client.send(new TagResourceCommand$2({
+					ResourceArn: arn,
+					Tags: op.tags
+				})));
+				break;
+			}
 		}
 		this.logger.debug(maskSecrets(`Applied ${op.kind} to ${scope}`));
 	}
@@ -48003,12 +48936,13 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
 		try {
+			markUnsettled(input.SSESpecification !== void 0 ? "SSESpecification" : "Replicas");
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
 			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
 		} catch (error) {
 			if (fromTemplate || isInterruptedWaitError(error)) throw error;
 			this.logger.debug(maskSecrets(`Could not bring the ${what} of ${tableName} to the declared one: ` + describeAwsFailure(error).detail));
-			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}). The next deploy that updates this table tries again.`));
+			this.logger.warn(maskSecrets(`${tableName} does not hold its declared ${what}, and setting it failed (${describeAwsFailure(error).summary}).` + relayedEncryptionChangeLimit(describeAwsFailure(error).detail) + ` The next deploy that updates this table tries again.`));
 		}
 	}
 	async waitForGlobalTableSettled(tableName, logicalId, maskSecrets, opts = {}) {
@@ -48109,6 +49043,12 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		return unsettledScope.run({
+			mark: (key) => context?.markUnsettled?.(key),
+			unsettled: context?.unsettledProperties ?? /* @__PURE__ */ new Set()
+		}, () => this.updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context));
+	}
+	async updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		if (context?.desiredFromAwsReadback === true) properties = keepUnreadReplicaMembers(properties, previousProperties);
 		const log = this.operationSinks(context, [[properties["TableName"], physicalId], [previousProperties["TableName"], physicalId]]);
 		const maskSecrets = log.mask;
@@ -48155,7 +49095,7 @@ var DynamoDBGlobalTableProvider = class {
 			physicalName: physicalId
 		})) throw new ProvisioningError(log.mask(`TableName is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
 		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(log.mask(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
-		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(log.mask(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
+		if (!deepEqual(lsiListOrEmpty(properties["LocalSecondaryIndexes"]), lsiListOrEmpty(previousProperties["LocalSecondaryIndexes"]))) throw new ProvisioningError(log.mask(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
 		const oldAttrs = previousProperties["AttributeDefinitions"] ?? [];
 		const newAttrs = properties["AttributeDefinitions"] ?? [];
 		const desiredKeyAttrNames = collectDesiredKeyAttributeNames(properties);
@@ -48335,6 +49275,9 @@ var DynamoDBGlobalTableProvider = class {
 				flatChanged = true;
 			}
 			if (flatChanged) {
+				if (flatUpdate.DeletionProtectionEnabled !== void 0) markUnsettled("Replicas");
+				if (flatUpdate.StreamSpecification !== void 0) markUnsettled("StreamSpecification");
+				if (flatUpdate.OnDemandThroughput !== void 0) markUnsettled("WriteOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
@@ -48390,10 +49333,13 @@ var DynamoDBGlobalTableProvider = class {
 					}
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
+				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings");
+				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			if (deferCeilingsPastFlip) {
+				markUnsettled("WriteOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					OnDemandThroughput: onDemandPayload
@@ -48411,6 +49357,8 @@ var DynamoDBGlobalTableProvider = class {
 					region: currentRegion
 				}));
 			}
+			const modeUpdate = replicationModeUpdate(properties, previousProperties);
+			if (modeUpdate === "DISABLED" && readReplicationMode(properties).kind === "absent") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
 			const replicaDiff = diffReplicas(previousProperties["Replicas"] ?? [], properties["Replicas"] ?? []);
 			for (const replica of replicaDiff.removed) {
 				const region = replica["Region"];
@@ -48424,6 +49372,7 @@ var DynamoDBGlobalTableProvider = class {
 						region
 					}));
 				}
+				markUnsettled("Replicas");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					ReplicaUpdates: [{ Delete: { RegionName: region } }]
@@ -48483,6 +49432,7 @@ var DynamoDBGlobalTableProvider = class {
 					debug(`Cross-region replica ${region} of ${maskSecrets(physicalId)}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
+				markUnsettled("Replicas");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					ReplicaUpdates: [{ Update: updateAction }]
@@ -48490,16 +49440,24 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
 			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
+			if (modeUpdate !== void 0 && readReplicationMode(properties).kind === "usable") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
+			else {
+				const correction = replicationModeCorrection(properties, previousProperties, describeResp.Table?.GlobalTableSettingsReplicationMode);
+				if (correction !== void 0) await this.sendReplicationMode(physicalId, logicalId, correction, maskSecrets, false);
+			}
 			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, context?.desiredFromAwsReadback === true, warn, maskSecrets);
 			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
 			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
-			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, new Set(context?.desiredFromAwsReadback === true ? [
+			const replicaKeepOnRemoval = new Set(context?.desiredFromAwsReadback === true ? [
 				"pitr",
 				"contributorInsights",
 				"kinesis",
 				"tablePolicy",
-				"streamPolicy"
-			] : context?.replayingState === true ? ["pitr"] : []), describeResp.Table?.LatestStreamArn, warn, maskSecrets);
+				"streamPolicy",
+				"indexContributorInsights",
+				"streamTags"
+			] : context?.replayingState === true ? ["pitr"] : []);
+			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, replicaKeepOnRemoval, describeResp.Table?.LatestStreamArn, warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -48522,6 +49480,7 @@ var DynamoDBGlobalTableProvider = class {
 			for (const gsi of gsiDiff.removed) {
 				if (!gsi.IndexName) continue;
 				const gsiUpdate = { Delete: { IndexName: gsi.IndexName } };
+				markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -48539,6 +49498,7 @@ var DynamoDBGlobalTableProvider = class {
 					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput },
 					...addedWarmToSend && { WarmThroughput: addedWarmToSend }
 				} };
+				markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					AttributeDefinitions: newAttrs,
@@ -48579,6 +49539,7 @@ var DynamoDBGlobalTableProvider = class {
 					continue;
 				}
 				const gsiUpdate = { Update: update };
+				markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -48592,17 +49553,21 @@ var DynamoDBGlobalTableProvider = class {
 				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId, { maskSecrets });
 				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied, maskSecrets);
 			}
+			await this.applyReplicaIndexInsights(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, replicaKeepOnRemoval, context?.replayingState === true || context?.desiredFromAwsReadback === true, warn, maskSecrets);
 			if (!deepEqual(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
 					try {
-						await this.dynamoDBClient.send(cmd);
+						await sendTtlWaitingOutRateLimit(() => this.dynamoDBClient.send(cmd), {
+							what: maskSecrets(`DynamoDB TimeToLive rate-limit wait on ${physicalId}`),
+							announce: () => this.logger.info(maskSecrets(`DynamoDB global table ${logicalId}: TimeToLive was changed recently, and AWS refuses another change until its rate-limit interval passes (up to about an hour). Retrying every minute, like CloudFormation, within the resource timeout.`))
+						});
 					} catch (ttlErr) {
 						const msg = describeAwsFailure(ttlErr).detail;
 						if (cmd.input.TimeToLiveSpecification?.Enabled === false && isTtlAlreadyDisabled(msg)) {
 							this.logger.debug(maskSecrets(`TimeToLive already disabled on ${physicalId}`));
 							return;
 						}
-						if (msg.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table (the interval can last up to about an hour); wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						if (isTtlRateLimited(msg)) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${sentence(text)} AWS rate-limits TTL changes per table, and kept refusing until the resource timeout ran out; redeploy once the interval has passed (up to about an hour), or raise --resource-timeout.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
@@ -48623,13 +49588,16 @@ var DynamoDBGlobalTableProvider = class {
 						attributeName: live.AttributeName
 					};
 				}
-				if (ttlTarget) await sendTtl(new UpdateTimeToLiveCommand({
-					TableName: physicalId,
-					TimeToLiveSpecification: {
-						Enabled: ttlTarget.enabled,
-						AttributeName: ttlTarget.attributeName
-					}
-				}));
+				if (ttlTarget) {
+					markUnsettled("TimeToLiveSpecification");
+					await sendTtl(new UpdateTimeToLiveCommand({
+						TableName: physicalId,
+						TimeToLiveSpecification: {
+							Enabled: ttlTarget.enabled,
+							AttributeName: ttlTarget.attributeName
+						}
+					}));
+				}
 			}
 			const finalDescribe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const impliedStream = replicationImpliedStreamSpecification(properties);
@@ -48660,7 +49628,7 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async applyCrossRegionReplicaTagsDiff(tableArn, region, oldTags, newTags, resourceType, logicalId, physicalIdForLogs, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		if (deepEqual(oldTags, newTags)) return;
+		if (deepEqual(oldTags, newTags) && !isUnsettled("Replicas")) return;
 		if (!tableArn) {
 			warn(`Local DescribeTable returned no TableArn — cannot propagate Tags to cross-region replica ${region} of ${physicalIdForLogs}`);
 			return;
@@ -48681,11 +49649,12 @@ var DynamoDBGlobalTableProvider = class {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, id);
 		if (tagWarning !== void 0) this.logger.warn(maskSecrets(tagWarning));
-		const tagsToAdd = [...plan.set].map(([k, v]) => ({
+		const tagsToAdd = [...isUnsettled("Replicas") ? planTagDiff(void 0, newTagsRaw).set : plan.set].map(([k, v]) => ({
 			Key: k,
 			Value: v
 		}));
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || tagsToAdd.length > 0) markUnsettled("Replicas");
 		if (tagsToRemove.length > 0) {
 			await client.send(new UntagResourceCommand$2({
 				ResourceArn: tableArn,
@@ -48702,6 +49671,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text, progress) {
+		const autoScalingKey = indexName !== void 0 ? "GlobalSecondaryIndexes" : dimension.includes("Write") ? "WriteProvisionedThroughputSettings" : "Replicas";
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const asMaxRetries = autoScalingRetriesWithinDeleteBudget(budget, 8);
 		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
@@ -48721,6 +49691,7 @@ var DynamoDBGlobalTableProvider = class {
 					return;
 				}
 				try {
+					markUnsettled(autoScalingKey);
 					await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
 						ServiceNamespace: "dynamodb",
 						ResourceId: resourceId,
@@ -48761,6 +49732,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 				try {
+					markUnsettled(autoScalingKey);
 					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
 						PolicyName: policyName,
 						ServiceNamespace: "dynamodb",
@@ -48789,6 +49761,7 @@ var DynamoDBGlobalTableProvider = class {
 				return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
 			};
 			try {
+				markUnsettled(autoScalingKey);
 				await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
 					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
@@ -48808,6 +49781,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: ${pasteableAwsCommand(maskSecrets)`aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`.render()}`);
 			}
 			try {
+				markUnsettled(autoScalingKey);
 				await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
@@ -49112,6 +50086,44 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+		const live = await strictReadScope.run(names, () => this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties));
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		if (out["BillingMode"] === "PAY_PER_REQUEST") delete out["WriteProvisionedThroughputSettings"];
+		const unnamed = [];
+		for (const name of names) {
+			if (!Object.hasOwn(out, name)) continue;
+			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed);
+		}
+		for (const entry of unnamed.filter((e) => e.ambiguous === true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS has entries cdkd cannot key by an identity, so convergence keeps the recorded ${entry.path} rather than risk removing an entry neither the record nor the template declares. Check it with 'cdkd drift'.`);
+		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete).`);
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		const MOVING = /* @__PURE__ */ new Set([
+			"CREATING",
+			"UPDATING",
+			"DELETING"
+		]);
+		try {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			const moving = /* @__PURE__ */ new Set();
+			if (table?.TableStatus !== void 0 && MOVING.has(table.TableStatus)) {
+				for (const name of names) if (name !== "TimeToLiveSpecification") moving.add(name);
+			}
+			if (names.has("Replicas") && (table?.Replicas ?? []).some((replica) => replica.ReplicaStatus !== void 0 && MOVING.has(replica.ReplicaStatus))) moving.add("Replicas");
+			if (names.has("GlobalSecondaryIndexes") && (table?.GlobalSecondaryIndexes ?? []).some((index) => index.IndexStatus !== void 0 && MOVING.has(index.IndexStatus))) moving.add("GlobalSecondaryIndexes");
+			const sse = table?.SSEDescription?.Status;
+			if (names.has("SSESpecification") && (sse === "ENABLING" || sse === "DISABLING" || sse === "UPDATING")) moving.add("SSESpecification");
+			if (names.has("TimeToLiveSpecification")) {
+				if ((await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription?.TimeToLiveStatus === "ENABLING") moving.add("TimeToLiveSpecification");
+			}
+			return moving;
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		const afterOwnWrite = context?.afterOwnWrite === true;
 		try {
@@ -49136,7 +50148,7 @@ var DynamoDBGlobalTableProvider = class {
 			const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 			const tableNameForSubs = table.TableName ?? physicalId;
 			const sdkReplicas = table.Replicas && table.Replicas.length > 0 ? currentRegion && !table.Replicas.some((r) => r.RegionName === currentRegion) ? [...table.Replicas, { RegionName: currentRegion }] : table.Replicas : [{ RegionName: currentRegion }];
-			const replicas = await Promise.all(sdkReplicas.map(async (r) => {
+			const replicas = await Promise.all(sdkReplicas.map(async (r) => strictReadScope.run(replicaStrictness(r.ReplicaStatus), async () => {
 				const entry = { Region: r.RegionName };
 				if (!r.RegionName) return entry;
 				const isLocal = r.RegionName === currentRegion;
@@ -49159,6 +50171,7 @@ var DynamoDBGlobalTableProvider = class {
 					protection = regional.Table?.DeletionProtectionEnabled;
 					streamArn = regional.Table?.LatestStreamArn;
 				} catch (err) {
+					if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 					if (err instanceof ResourceNotFoundException$1) this.logger.debug(safeMsg`Cross-region replica ${regionLabel} returned RNF on DescribeTable; omitting its protection and stream policy`);
 					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
 				}
@@ -49168,6 +50181,7 @@ var DynamoDBGlobalTableProvider = class {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
 					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 				} catch (tagErr) {
+					if (strictFor("Replicas") && !(tagErr instanceof ResourceNotFoundException$1)) throw tagErr;
 					if (tagErr instanceof ResourceNotFoundException$1) {
 						if (isLocal) throw tagErr;
 						this.logger.debug(`Cross-region replica ${regionLabel} returned RNF on ListTagsOfResource; omitting Tags`);
@@ -49184,7 +50198,7 @@ var DynamoDBGlobalTableProvider = class {
 					if (readAutoScaling) entry["ReadProvisionedThroughputSettings"] = { ReadCapacityAutoScalingSettings: readAutoScaling };
 				}
 				return entry;
-			}));
+			})));
 			result["Replicas"] = replicas;
 			const localReplica = replicas.find((r) => r["Region"] === currentRegion);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
@@ -49240,6 +50254,7 @@ var DynamoDBGlobalTableProvider = class {
 				};
 				else if (ttlStatus === "DISABLED") {}
 			} catch (ttlErr) {
+				if (strictFor("TimeToLiveSpecification")) throw ttlErr;
 				this.logger.debug(`Could not read TimeToLive for ${tableNameForSubs}: ${describeAwsFailure(ttlErr).detail}`);
 			}
 			return result;
@@ -49255,6 +50270,7 @@ var DynamoDBGlobalTableProvider = class {
 			const block = reverseMapReplicaContributorInsights(ci.ContributorInsightsStatus, ci.ContributorInsightsMode, declaredReplica?.["ContributorInsightsSpecification"]);
 			if (block !== void 0) out["ContributorInsightsSpecification"] = block;
 		} catch (err) {
+			if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
@@ -49262,6 +50278,7 @@ var DynamoDBGlobalTableProvider = class {
 			const block = reverseMapReplicaPitr(description?.PointInTimeRecoveryStatus, description?.RecoveryPeriodInDays, declaredReplica?.["PointInTimeRecoverySpecification"]);
 			if (block !== void 0) out["PointInTimeRecoverySpecification"] = block;
 		} catch (err) {
+			if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
@@ -49272,6 +50289,7 @@ var DynamoDBGlobalTableProvider = class {
 				out["KinesisStreamSpecification"] = ksOut;
 			}
 		} catch (err) {
+			if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 			this.logger.debug(`Could not read KinesisStreamingDestination for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		return out;
@@ -49309,6 +50327,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				return reverseMapStreamPolicy(live, container);
 			} catch (err) {
+				if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 				this.logger.debug(safeMsg`Could not read the ${what} of the ${regionLabel} replica of ${tableName}: ${describeAwsFailure(err).detail}`);
 				if (afterOwnWrite && last !== void 0 && last !== "") return reverseMapStreamPolicy(last, container);
 				if (afterOwnWrite && (isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1)) return declaredMember();
@@ -49357,6 +50376,7 @@ var DynamoDBGlobalTableProvider = class {
 				TargetTrackingScalingPolicyConfiguration: tttConfig
 			};
 		} catch (err) {
+			if (strictFor(indexName !== void 0 ? "GlobalSecondaryIndexes" : scalableDimension.includes("Write") ? "WriteProvisionedThroughputSettings" : "Replicas")) throw err;
 			this.logger.debug(`Could not read application-autoscaling settings for ${resourceId} (${scalableDimension}): ${describeAwsFailure(err).detail}`);
 			return null;
 		}
@@ -49414,6 +50434,12 @@ var DynamoDBGlobalTableProvider = class {
 			aws
 		};
 	}
+	getDriftAbsentMeansDefaultKeys(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return [];
+		const declared = properties["SSESpecification"];
+		if (declared === void 0) return ["SSESpecification"];
+		return coerceCfnBoolean(asRecord(declared)?.["SSEEnabled"]) === false ? ["SSESpecification"] : [];
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
 		if (explicit) try {
@@ -49570,9 +50596,48 @@ const REPLICA_SETTING_MEMBERS = [
 	"ContributorInsightsSpecification",
 	"KinesisStreamSpecification",
 	"ResourcePolicy",
-	"ReplicaStreamSpecification"
+	"ReplicaStreamSpecification",
+	"GlobalSecondaryIndexes"
 ];
+const REPLICATION_MODE_KEY = "GlobalTableSettingsReplicationMode";
+function readReplicationMode(properties) {
+	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	const declared = replicas.map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY]).filter((value) => value !== void 0 && value !== null);
+	if (declared.length === 0) return { kind: "absent" };
+	const [first] = declared;
+	if (typeof first !== "string" || first === "" || declared.some((v) => v !== first)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICATION_MODE_KEY} must be one non-empty string`
+	};
+	if (replicas.length !== 1) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICATION_MODE_KEY} can be declared only on a table with exactly one replica, as CloudFormation refuses it ("GlobalTableSettingsReplicationMode can be specified when exactly one replica is present"); remove it, or keep one replica`
+	};
+	return {
+		kind: "usable",
+		mode: first
+	};
+}
+function replicationModeShape(properties) {
+	return (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY] ?? null);
+}
+function replicationModeUpdate(properties, previousProperties) {
+	const want = readReplicationMode(properties);
+	if (want.kind === "unusable") return void 0;
+	const had = readReplicationMode(previousProperties);
+	const desired = want.kind === "usable" ? want.mode : void 0;
+	if (desired === (had.kind === "usable" ? had.mode : void 0)) return void 0;
+	return desired ?? "DISABLED";
+}
+function replicationModeCorrection(properties, previousProperties, liveMode) {
+	const want = readReplicationMode(properties);
+	if (want.kind !== "usable") return void 0;
+	if (replicationModeUpdate(properties, previousProperties) !== void 0) return void 0;
+	return (liveMode ?? "DISABLED") === want.mode ? void 0 : want.mode;
+}
 function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
+	const mode = readReplicationMode(properties);
+	if (mode.kind === "unusable" && (previousProperties === void 0 || !deepEqual(replicationModeShape(properties), replicationModeShape(previousProperties)))) return mode.reason;
 	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
 		const region = asRecord(entry)?.["Region"];
@@ -49719,6 +50784,15 @@ function collectAutoScalingTargets(properties, localRegion) {
 const REPLICA_COPY_RELEASE_POLLS = 180;
 const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
 const DELETION_PROTECTION_REFLIP_MS = 16e3;
+function relayedEncryptionChangeLimit(withheldText) {
+	return /Encryption mode changes are limited/i.test(withheldText) ? " AWS limits a table to 4 encryption changes in 24 hours, then one every 6 hours; retry the change later (--verbose shows when AWS allows the next one)." : "";
+}
+const KINESIS_DISABLE_UNSETTLED = /* @__PURE__ */ new Set([
+	"ACTIVE",
+	"ENABLING",
+	"UPDATING",
+	"DISABLING"
+]);
 const REPLICA_PROTECTION_SETTLE_POLLS = 60;
 const REPLICA_PROTECTION_SETTLE_POLL_MS = 5e3;
 const SETTLING_RETRY_ATTEMPTS = 8;
@@ -50240,7 +51314,7 @@ function buildLiveRecoveryGsiBaseline(desiredSdkIndexes, liveIndexes, options) {
 }
 function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnostics, maskSecrets = (text) => text) {
 	if (!Array.isArray(replicaIndexes) || replicaIndexes.length === 0) return void 0;
-	return replicaIndexes.map((entry) => {
+	const sendable = replicaIndexes.map((entry) => {
 		const cfn = asRecord(entry);
 		if (!cfn) return entry;
 		const indexName = cfn["IndexName"];
@@ -50249,7 +51323,8 @@ function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnos
 		if (overrides.ProvisionedThroughputOverride) sdk.ProvisionedThroughputOverride = overrides.ProvisionedThroughputOverride;
 		if (overrides.OnDemandThroughputOverride) sdk.OnDemandThroughputOverride = overrides.OnDemandThroughputOverride;
 		return sdk;
-	});
+	}).filter((sdk) => asRecord(sdk) === void 0 || sdk.ProvisionedThroughputOverride !== void 0 || sdk.OnDemandThroughputOverride !== void 0);
+	return sendable.length > 0 ? sendable : void 0;
 }
 function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context, maskSecrets = (text) => text) {
 	const explicitProvisioned = asRecord(cfn["ProvisionedThroughputOverride"]);
@@ -50367,6 +51442,10 @@ function deepEqual(a, b) {
 		return false;
 	}
 }
+function lsiListOrEmpty(value) {
+	if (value === void 0 || value === null) return [];
+	return value;
+}
 
 //#endregion
 //#region src/provisioning/protection-flags.ts
@@ -50796,31 +51875,63 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	const previousForUpdate = reattached?.previous ?? previousWithSecretsDropped;
 	const changedForProvider = new Set(changedProperties);
 	for (const key of /* @__PURE__ */ new Set([...Object.keys(previousWithNoEchoHeld), ...Object.keys(previousForUpdate)])) if (keyOrderFreeJson(previousForUpdate[key]) !== keyOrderFreeJson(previousWithNoEchoHeld[key])) changedForProvider.add(key);
+	const unsettled = unsettledPropertiesOf(currentResource);
 	if (changedForProvider.size === 0) for (const key of /* @__PURE__ */ new Set([...Object.keys(updateProps), ...Object.keys(previousForUpdate)])) changedForProvider.add(key);
 	if (reattached !== void 0) engine.logger.info(safeMsg`  ${logicalId} (${resourceType}) lost its attachment to ${reattached.parents.join(", ")}, which this deploy re-created under the same name: attaching it again`);
 	if (droppedPrincipalKinds.length > 0) {
 		const kinds = droppedPrincipalKinds.join(" / ");
 		engine.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${kinds} holds a secret reference the template still spells the same way, so cdkd re-applies it to the principals this deploy resolved it to and removes it from none of them. If that secret's value changed since the last deploy, a principal only the OLD value named still has the policy or membership: remove it from that principal by hand.`);
 	}
-	const removal = prepareRemovalForUpdate(updateProvider, resourceType, updateProps, previousForUpdate);
+	const unsettledIdentity = {
+		provider: updateProvider,
+		logicalId,
+		physicalId: currentResource.physicalId,
+		resourceType,
+		recordedProperties: currentResource.properties ?? {}
+	};
+	const previousSettled = await settleUnsettledPrevious({
+		...unsettledIdentity,
+		names: unsettled,
+		previous: previousForUpdate,
+		desired: updateProps
+	});
+	if (unsettled.has("Tags")) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): an earlier failed update left Tags unsettled. cdkd re-applies the template's tags and removes only the recorded ones the template dropped; a tag that failed update added and no template declares is left on the resource. Remove it by hand if it should not be there.`);
+	const removal = prepareRemovalForUpdate(updateProvider, resourceType, updateProps, previousSettled);
 	let result;
 	let resultProvisionedBy = updateDecision.provisionedBy;
 	let captureProvider = updateProvider;
 	let replacedAtGeneration;
 	const inlinePolicyClaimed = engine.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
 	try {
-		result = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, removal.properties, previousForUpdate, {
+		result = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, removal.properties, previousSettled, {
 			maskSecrets: createSecretMasker(updateSecrets),
 			expectedRegion: engine.stackRegion,
 			recordedAttributes: currentResource.attributes,
 			...inlinePolicyClaimed && { inlinePolicyClaimed },
 			...removal.context,
-			changedProperties: changedForProvider
+			changedProperties: changedForProvider,
+			markUnsettled: (propertyName) => {
+				if (typeof propertyName !== "string" || propertyName === "") return;
+				if (!Object.hasOwn(resolvedProps, propertyName) && !Object.hasOwn(currentResource.properties ?? {}, propertyName)) {
+					engine.logger.debug(safeMsg`${logicalId}: ignored an unsettled mark for ${propertyName}, which is not one of its properties`);
+					return;
+				}
+				let marks = engine.unsettledMarks.get(logicalId);
+				if (marks === void 0) {
+					marks = /* @__PURE__ */ new Set();
+					engine.unsettledMarks.set(logicalId, marks);
+				}
+				marks.add(propertyName);
+			},
+			...unsettled.size > 0 && { unsettledProperties: unsettled }
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) engine.replacementRun.updatesThatSentNothing.add(logicalId);
+		engine.unsettledMarks.delete(logicalId);
 		if (result.wasReplaced === true && result.outcome === "partial") engine.replacementRun.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
 		result = withoutInjectedRemovals(result, removal.injected);
-		if (removal.unhandled.length > 0) engine.logger.warn(removalWarning(logicalId, resourceType, removal.unhandled));
+		const unhandledByCause = splitUnhandledRemovals(removal.unhandled, previousForUpdate, unsettled);
+		if (unhandledByCause.removedFromTemplate.length > 0) engine.logger.warn(removalWarning(logicalId, resourceType, unhandledByCause.removedFromTemplate));
+		if (unhandledByCause.addedByFailedUpdate.length > 0) engine.logger.warn(addedByFailedUpdateWarning(logicalId, resourceType, unhandledByCause.addedByFailedUpdate));
 	} catch (updateError) {
 		const ccUnsupported = isUpdateUnsupportedError(updateError, logicalId);
 		const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && engine.options.replace === true;
@@ -51000,6 +52111,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				logicalId,
 				generation: fallbackGeneration
 			}, replaceFallback));
+			engine.unsettledMarks.delete(logicalId);
 			result = fallbackOutcome.result;
 			resultProvisionedBy = fallbackOutcome.provisionedBy;
 			captureProvider = fallbackOutcome.captureProvider;
@@ -51020,6 +52132,12 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 			throw updateError;
 		}
 	}
+	const stillUnsettled = result.wasReplaced ? [] : await unsettledAfterUpdate({
+		...unsettledIdentity,
+		names: unsettled,
+		desired: updateProps
+	});
+	if (stillUnsettled.length > 0) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): the update succeeded, but AWS does not yet show the template's ${stillUnsettled.join(", ")}; cdkd keeps ${stillUnsettled.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
 	engine.replacementRun.updateWasReplaced.set(logicalId, result.wasReplaced === true);
 	if (result.wasReplaced !== true && (hasPassProvenance(updateSecrets) || referenceProvenanceOf(currentResource) !== void 0)) {
 		const cached = cachedCreateOnlyPropertyPaths(resourceType);
@@ -51056,6 +52174,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
+		...stillUnsettled.length > 0 && { unsettledProperties: stillUnsettled },
 		...keepsParameterRefusal && {
 			observedBaselineRefused: true,
 			observedBaselineRefusalReason: "unverifiable-parameter"
@@ -51464,6 +52583,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	for (const path of provenanceMoved.paths) rewrittenPaths.add(path);
 	if (provenanceMoved.paths.size > 0) engine.logger.info(safeMsg`${logicalId} is sent: ${[...provenanceMoved.paths].sort().join(", ")} read a secret-derived value at a newer version than ${logicalId} was deployed with (its upstream changed since then)`);
 	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const unsettledNames = unsettledPropertiesOf(currentResource);
 	const movedAsWritten = (key) => movedMasked.has(key) || rewrittenPaths.has(key) || keyOrderFreeJson(desiredForSkipCheckAsWritten[key]) !== keyOrderFreeJson(currentPropsAsWritten[key]);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
@@ -51538,7 +52658,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${engine.options.requireApproval ?? "never"})`;
 	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired) {
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired && unsettledNames.size === 0) {
 		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -51570,7 +52690,10 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 				continue;
 			}
 			const moved = movedAsWritten(pc.path);
-			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
+			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path], {
+				oldProperties: currentPropsAsWritten,
+				newProperties: desiredForSkipCheckAsWritten
+			}) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
 				lowered.push(pc);
@@ -51671,7 +52794,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		}
 	}
 	const confirmedPaths = /* @__PURE__ */ new Set([...noEchoHeldPaths, ...parameterSettledPaths]);
-	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
+	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired && unsettledNames.size === 0 && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
 		engine.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
 		const staleHeld = staleCoordinates.filter((coordinate) => typeof coordinate[0] === "string" && parameterHeldKeys.has(coordinate[0]));
 		if (staleHeld.length > 0) {
@@ -51786,8 +52909,9 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const changedProperties = new Set([.../* @__PURE__ */ new Set([
 		...Object.keys(desiredForSkipCheckAsWritten),
 		...Object.keys(currentPropsAsWritten),
-		...Object.keys(resolvedProps)
-	])].filter((key) => movedAsWritten(key) || !confirmedPaths.has(key) && (pendingParameterLeaves.has(key) || otherFreshAt(key).length > 0)));
+		...Object.keys(resolvedProps),
+		...unsettledNames
+	])].filter((key) => unsettledNames.has(key) || movedAsWritten(key) || !confirmedPaths.has(key) && (pendingParameterLeaves.has(key) || otherFreshAt(key).length > 0)));
 	let previousForProvider = currentPropsAsWritten;
 	for (const coordinate of witness?.confirmed ?? []) {
 		const value = valueAtCoordinate(resolvedProps, coordinate);
@@ -52074,7 +53198,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			const savedFor = savedIds.join(", ");
 			try {
 				const partialState = {
-					version: 13,
+					version: 14,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -52203,6 +53327,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				} catch (provisionError) {
 					engine.interrupted = true;
 					engine.interruptCause ??= "sibling-failure";
+					if (change.changeType === "UPDATE") recordUnsettledMarks(engine, newResources, logicalId);
 					const refused = isRefusedBeforeApplying(provisionError, logicalId);
 					const attemptedGeneration = change.changeType === "UPDATE" && !refused && !isReplacementNameRefusal(provisionError, logicalId) ? engine.replacementRun.attemptedNameGeneration.get(logicalId) : void 0;
 					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
@@ -52369,6 +53494,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			await retryCarriedSupersededResources(engine, currentState, carriedSuperseded, newResources, { waitInUse: releasedSomething });
 		}
 	} catch (error) {
+		recordUnsettledMarks(engine, newResources);
 		warnUnretriedReplacedDeletes(engine.replacementRun, engine.replacementDeps(), engine.interruptCause === "user" ? "interrupted" : "failed");
 		const initialDeploy = currentEtag === void 0;
 		const written = /* @__PURE__ */ new Set([...engine.replacementRun.restoredLostChildren, ...completedOperations.map((op) => op.logicalId)]);
@@ -52425,7 +53551,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		}
 		try {
 			const preRollbackState = {
-				version: 13,
+				version: 14,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -52488,9 +53614,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			rollbackSettledNested = rollbackResult.settledNested;
 			rollbackRemainingFailedOps = rollbackResult.remainingFailedOps;
 		}
+		recordUnsettledMarks(engine, newResources);
 		try {
 			const postRollbackState = {
-				version: 13,
+				version: 14,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -52511,8 +53638,9 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			engine.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 			try {
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
+				recordUnsettledMarks(engine, newResources);
 				const postRollbackState = {
-					version: 13,
+					version: 14,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -52549,7 +53677,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	}
 	return {
 		state: {
-			version: 13,
+			version: 14,
 			region: engine.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
@@ -52568,7 +53696,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 }
 async function persistStateAfterOutputFailure(engine, stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 13,
+		version: 14,
 		region: engine.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -52602,6 +53730,13 @@ function journaledOrphanPolicy(policy) {
 	if (policy === void 0) return void 0;
 	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
 }
+function recordUnsettledMarks(engine, newResources, only) {
+	for (const [logicalId, marks] of engine.unsettledMarks) {
+		if (only !== void 0 && logicalId !== only) continue;
+		if (marks.size === 0 || !Object.hasOwn(newResources, logicalId)) continue;
+		newResources[logicalId] = withUnsettledProperties(newResources[logicalId], marks);
+	}
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/deploy-flow.ts
@@ -52643,7 +53778,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		clock.lap("state load");
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 13,
+			version: 14,
 			region: engine.stackRegion,
 			stackName,
 			resources: {},
@@ -52946,7 +54081,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					await resolveStackInstanceId();
 					try {
 						const refreshedState = {
-							version: 13,
+							version: 14,
 							region: engine.stackRegion,
 							stackName: currentState.stackName,
 							resources: currentState.resources,
@@ -53234,6 +54369,7 @@ var DeployEngine = class {
 	replacementRun = new ReplacementRunState();
 	outputsRun = new OutputsRunState();
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	unsettledMarks = /* @__PURE__ */ new Map();
 	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
@@ -53426,6 +54562,7 @@ var DeployEngine = class {
 		this.noEchoRun = new NoEchoRunState();
 		this.replacementRun = new ReplacementRunState();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
+		this.unsettledMarks = /* @__PURE__ */ new Map();
 		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
@@ -53630,5 +54767,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { inheritedProvenanceForChildDiff as $, isStalePlaceholderArnAttribute as $a, carriesSecretMask as $c, deleteIndeterminateGuards as $i, readBootstrapMarkerBody as $l, exportNameSecretExposure as $n, refuseMalformedResourceEntriesForImport as $o, secretNamePrintingBag as $r, canonicalLambdaFunctionName as $s, readRefactorMarker as $t, parseFailureDebugDetail as $u, beginDeleteWait as A, assertSendableRoleArn as Aa, recordLogOnlyValue as Ac, tagPlanWarning as Ai, isReadableBag as Al, redactedDeleteAddressFields as An, malformedOrphansWarning as Ao, green as Ar, isStatefulRecreateTargetSync as As, dropSettledNestedJournals as At, resolveCaptureObservedState as Au, waitForIndexesSettled as B, producerRegionsFromState as Ba, DYNAMIC_REFERENCE_TOKEN_SCAN as Bc, readsNoEchoDeleteValues as Bi, stringifyValue as Bl, withNameGenerationReached as Bn, refuseDivergentRecordRegionForDestroy as Bo, supersededHolderOf as Br, configIntegerRefusal as Bs, deleteJournaledOrphans as Bt, MIGRATE_TMP_PREFIX as Bu, planContributorInsightsOp as C, refuseUnreadableCdkCrossAccountRefs as Ca, carryLogOnlyValues as Cc, markDeleteStarted as Ci, describeRegionValueKind as Cl, seedsDeleteFirstGuard as Cn, malformedLocalOutputsWarning as Co, destroyStackRecordsView as Cr, withoutSilentDropProperties as Cs, pendingRequestCount as Ct, Synthesizer as Cu, reverseMapTableContributorInsights as D, recordedReferenceRegions as Da, logOnlyValueCount as Dc, readTagList as Di, hasUnverifiableParameterRefusal as Dl, inheritProducerRegions as Dn, malformedOrphanRecordsWarning as Do, bold as Dr, shownType as Ds, NESTED_PENDING_PARENT_REASON as Dt, loadCdkJson as Du, reverseMapIndexContributorInsights as E, recordedOutputReferenceRegions as Ea, literalSplitDelimitersOf as Ec, planTagDiff as Ei, hasReasonlessBaselineRefusal as El, getCurrentProducerRegions as En, malformedOrphanRecordsRefusalMessage as Eo, replacedDeleteFailureVerdict as Er, findReplacedReadersOfRecreateTargets as Es, recordRetainedForReadoption as Et, getLegacyStateBucketName as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, applyCallerIdentityCredentials as Fa, maskSecretsInError as Fc, ccBrokenReason as Fi, PhaseClock as Fl, nameGenerationHighWaterOf as Fn, malformedResourcePropertiesWarning as Fo, holdsSupersededResources as Fr, toCfnInteger as Fs, revertedNestedRowIds as Ft, stateBucketExistenceConfirmed as Fu, S3_AUTO_DELETE_OBJECTS_TAG as G, getAccountInfo as Ga, identityKeyFor as Gc, applyCustomResourceResponseExpiration as Gi, rewriteTemplateAssetReferences as Gl, WITHHELD_NAME_DISPLAY as Gn, refuseMalformedOrphansForDestroy as Go, noEchoExactEchoLeavesOf as Gr, requireConfigObject as Gs, loadJournaledOrphans as Gt, expectedOwnerParam as Gu, planTimeToLive as H, coerceParameterTypedValue as Ha, isUncertifiedBaselineMaskPosition as Hc, getCurrentResourceSecrets as Hi, buildAssetRedirectMap as Hl, namesAnyDeclaredParameter as Hn, refuseMalformedOrphanRecords as Ho, withoutSuperseded as Hr, readConfigString as Hs, dropFailedHint as Ht, uploadCfnTemplate as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, callerEnvCredentials as Ia, maskSecretsInText as Ic, isCustomResource as Ii, renderPhaseTimings as Il, nameScopeOf as In, malformedResourcesWarning as Io, isSupersededResourceRecord as Ir, toFiniteNumber as Is, withNestedRevertRun as It, warnDeprecatedNoPrefixCliFlag as Iu, getPriorAttempts as J, carriesFetchableDynamicReference as Ja, recoverMaskedOutput as Jc, slowCcOperationTimeoutMs as Ji, assertAssetBucketRegion as Jl, secretBearing as Jn, refuseMalformedOutputsForDestroy as Jo, completedReplayEntries as Jr, templateResourceTypes as Js, formatResourceLine as Jt, derivePartitionAndUrlSuffix as Ju, hasCdkAutoDeleteTag as K, isImpossibleEmptyStoredAttribute as Ka, inheritNestedStackParameterAssociations as Kc, customResourceResponseExpirationWarning as Ki, AssetModeResolver as Kl, displayTextOrWithheld as Kn, refuseMalformedOrphansForOrphan as Ko, noEchoParameterNamesOf as Kr, requireConfigString as Ks, makeForeignHolderScan as Kt, PARTITION_TABLE as Ku, deleteTableWithIndexBusyRetry as L, envCredentialsAreAssumedRole as La, scrubResourceRecord as Lc, wouldReturnToSdkProvider as Li, timePhase as Ll, retiredAfterRollback as Ln, malformedScrubResourceEntriesRefusalMessage as Lo, removeSuperseded as Lr, coerceCfnBoolean as Ls, collectNestedChildUnaddressed as Lt, ssmResolvedValueType as Lu, deleteBudgetKey as M, isIamRoleArn as Ma, unionOfSecretBags as Mc, stringifyIfAssigned as Mi, orphansCarriedFrom as Ml, updatePartialMessage as Mn, malformedOutputsWarning as Mo, yellow as Mr, WARM_THROUGHPUT_MEMBERS as Ms, nestedChildStackName as Mt, resolveStateBucketWithDefault as Mu, resolveDynamoDbDeleteBudgetClock as N, sendableAssumeRoleCommand as Na, createSecretMasker as Nc, CC_BROKEN_REASON as Ni, shouldRetainResource as Nl, updatePartialReason as Nn, malformedRenderedContainersWarning as No, addSuperseded as Nr, coerceWarmThroughput as Ns, recordDisplacedSkips as Nt, resolveStateBucketWithDefaultAndSource as Nu, stripIndexContributorInsights as O, applyRoleArnIfSet as Oa, printingCorpusOf as Oc, refuseMalformedDesiredTags as Oi, importableOutputKeys as Ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as On, malformedOrphanRowsKeptWarning as Oo, cyan as Or, MULTI_REGION_RECREATE_BLOCKED_TYPES as Os, displacedOpClause as Ot, resolveApp as Ou, resolveDynamoDbDeleteBudgetMs as P, AWS_CREDENTIAL_ENV_KEYS as Pa, errorCauseChain as Pc, ProviderRegistry as Pi, stackInstanceIdCarriedFrom as Pl, nameGenerationCarriedFrom as Pn, malformedResourceEntriesWarning as Po, deleteSupersededEntry as Pr, isWarmThroughputDecrease as Ps, revertNestedChildFromJournal as Pt, resolveUseCdkBootstrapAssets as Pu, crossStackOutputProvenanceSource as Q, cfnRefValueFromPhysicalId as Qa, splitGetAttStringForm as Qc, UNSPECIFIED_SKIP_REASON as Qi, parseBootstrapMarker as Ql, exportNameNoEchoParameters as Qn, refuseMalformedResourceEntriesForDestroy as Qo, orphanRecordsPrintingBag as Qr, emrClusterInstancesReplaced as Qs, withApiLimit as Qt, describeJsonParseFailure as Qu, maskedLogger as R, classifyRecordedSecretRegion as Ra, withPhysicalNameCopies as Rc, waitForLambdaFunctionActive as Ri, AssetPublisher as Rl, retiredNameGenerationsAfter as Rn, malformedStateRefusalMessage as Ro, supersededAfterRollback as Rr, coerceCfnInteger as Rs, getCurrentNestedStackContext as Rt, CFN_TEMPLATE_BODY_LIMIT as Ru, indexDeclaresContributorInsights as S, producerLookupOver as Sa, snapshotPassProvenance as Sc, isRefusedByName as Si, acceptedCreateOnlyDropsOf as Sl, resolveReplacementOldType as Sn, malformedExportSourceWarning as So, awaitInFlightSibling as Sr, unwrittenCreateOnlyReplacement as Ss, planOrphanAdoption as St, getDockerImageBySourceHash as Su, readContributorInsightsSpec as T, outputReferenceProvenanceOf as Ta, hasMaskableValues as Tc, DBPROXY_TAG_OPTIONS as Ti, hasReadableExportSet as Tl, findNestedStackTypeChanges as Tn, malformedLocalResourcesWarning as To, withStackRecords as Tr, hasNoCloudControlHandlers as Ts, keptForRetainedRecord as Tt, getDefaultStateBucketName as Tu, readTtlSpec as U, isUnboundTemplateParameter as Ua, pathCrossesDottedKey as Uc, withPrintingSecrets as Ui, createAssetRedirectResolver as Ul, reachableDivergentParameters as Un, refuseMalformedOrphanRecordsForDestroy as Uo, noEchoAttributeNamesOf as Ur, replayWarn as Us, isHandledOrphan as Ut, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Uu, isTtlAlreadyDisabled as V, regionLessSecretName as Va, dynamicReferenceTokens as Vc, isCustomResourceType as Vi, WorkGraph as Vl, computeParameterTaint as Vn, refuseMalformedNestedChildOutputs as Vo, supersededResourcesOf as Vr, configStringRefusal as Vs, dropFailedCommands as Vt, findLargeInlineResources as Vu, ECR_AUTO_DELETE_IMAGES_TAG as W, parameterTypeMayLoseSecretIdentity as Wa, spelledKeysOf as Wc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Wi, loadPublishableAssetManifest as Wl, resourcesNamingDeclaredParameter as Wn, refuseMalformedOrphans as Wo, noEchoComparisonForTemplate as Wr, requireConfigArray as Ws, journaledOrphanLines as Wt, decodeListingKey as Wu, IMPLICIT_DELETE_DEPENDENCIES as X, keepsSecretReferenceToken as Xa, recordAttributeIdCopy as Xc, unchangedBehindSecretReference as Xi, getBootstrapMarkerKey as Xl, secretSafeKeyDisplay as Xn, refuseMalformedResourceEntries as Xo, maskEventTextWithBoundBags as Xr, withRetry as Xs, isAccessDeniedError as Xt, StageLoadError as Xu, markRefusedBeforeApplying as Y, isNamelessDynamicReferenceError as Ya, physicalNameCopiesOf as Yc, onlySecretReferencesDiffer as Yi, ensureAssetStorage as Yl, secretBearingStateKeyWarning as Yn, refuseMalformedResourceAttributesForOrphan as Yo, journaledOrphanPrintingBag as Yr, describeTypeWithThrottleRetry as Ys, chunks as Yt, AssemblyReader as Yu, computeImplicitDeleteEdges as Z, AWS_NO_VALUE as Za, recordPhysicalNameCopy as Zc, RollbackInlinePolicyWriters as Zi, isCrossRegionRedirect as Zl, carriedExportAliasExposure as Zn, refuseMalformedResourceEntriesForDeploy as Zo, namingSecretsWithRecordedNoEcho as Zr, ecsServiceLaunchTypeSetOrChanged as Zs, lookupEachName as Zt, processStackMessages as Zu, streamMemberRefusals as _, s3BucketDomainName as _a, valueAtCoordinate as _c, withCreateTokenLedger as _i, isAccessDenied$1 as _l, planFailedOps as _n, hasReadableResources as _o, isPairableType as _r, unreadableOrphanRecords as _s, isSecretBearingReferenceString as _t, redactedDockerCause as _u, isProtectionValueActive as a, disableInstanceApiTermination as aa, isMarkedCoordinate as ac, ownValue as ad, ATOMIC_FINAL_SNAPSHOT_TYPES as ai, recordProvenPublicExpression as al, updateRefactorMarker as an, passedParameterClassesOf as ao, bindingSkippedOutputs as ar, refuseMalformedResourcePropertiesForOrphan as as, isAbsoluteAssetPath as at, describeDockerCapturedOutput as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketWebsiteUrl as ba, redactForState as bc, DeploymentEventsStore as bi, withStackInstanceIdWithheld as bl, recordUnderIdIsNotOwn as bn, malformedDriftResourcePropertiesWarning as bo, parseMappingFile as br, findActionableSilentDrops as bs, makeCanonicalizePropertiesFn as bt, warnFinchArgvExposure as bu, DynamoDBGlobalTableProvider as c, observeThenDisableInstanceApiTermination as ca, maskWholeValue as cc, displayAssemblyPath as cd, ccRoutedFinalSnapshotError as ci, isSingleDynamicReferenceToken as cl, pendingMovesRefusalMessage as cn, STATE_REGION_DIVERGED as co, maskingRetryLogger as cr, refuseMalformedResourcesForExport as cs, templateIdentity as ct, dockerSpawnEnvWithSensitive as cu, declaredStreamPolicyMember as d, DiffCalculator as da, noEchoLeavesOf as dc, injectAwsRegion as dd, isFinalSnapshotError as di, S3StateBackend as dl, replayRollback as dn, UNREADABLE_RESOURCES_MAP_ROW as do, formatDestructiveChange as dr, repairMalformedOrphansForReadOnly as ds, parentSuppliedValues as dt, getDockerCmd as du, deleteLeftInPlace as ea, lambdaFunctionNameForMask as ec, utf8ByteLength as ed, secretNamePrintingBags as ei, provenPublicValue as el, readRefactorMarkerOnce as en, lacksRecordedTableArn as eo, isWholeDynamicReferenceValue as er, refuseMalformedResourceEntriesForImportSave as es, deferredServiceTokenWarning as et, validateAssetBucketName as eu, declaredStreamTagsMember as f, INTRINSIC_KEYS as fa, noEchoOutputsComparison as fc, injectedAwsRegionValue as fd, refusesFinalSnapshot as fi, rebuildClientForBucketRegion as fl, removeProtectionTypeList as fn, accountArgs as fo, findRefactorHints as fr, repairMalformedOutputsForReadOnly as fs, readRecordedConditionVerdicts as ft, isDockerClientEnvKey as fu, streamDeclaresTags as g, s3BucketArn as ga, recordedNoEchoValuesOf as gc, reserveStackCreateToken as gi, crossPrefixDeniedWarning as gl, isReplacementOrphan as gn, hasReadableOutputs as go, withMovedTo as gr, unpreviewableOrphanRecords as gs, diffSecurity as gt, redactedCause as gu, streamDeclaresPolicy as h, isSettledInstanceState as ha, readsNoEchoSource as hc, ledgerForStack as hi, applyCrossPrefixScan as hl, isJournaledOrphan as hn, hasReadableOrphans as ho, rollbackOrphanIds as hr, repairMalformedResourcesForReadOnly as hs, withResourceDeadline as ht, redactDockerArgvValues as hu, PROTECTION_PROPERTY_BY_TYPE as i, markWaitAbandoned as ia, canonicalCoordinates as ic, nullPrototypeRecord as id, storedSecretNameNeedles as ii, recordNoEchoParameterFreshValue as il, sameMove as in, parameterInputsFor as io, isExportAliasCollision as ir, refuseMalformedResourcePropertiesForExport as is, findNestedTemplateTreeDefect as it, resolveDockerContextDirectory as iu, compensateRemovedDeletionProtection as j, explicitRoleArnOrThrow as ja, shareLogOnlyValues as jc, definedAttributes as ji, orphansAfterRollback as jl, redactedDeleteAddressSkip as jn, malformedOutputsRefusalMessage as jo, red as jr, renderStatefulReason as js, getNestedRevertRun as jt, resolveSkipPrefix as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, assertFlagRoleArn as ka, recordLogOnlyParameterValue as kc, tagMapAsList as ki, importableOutputs as kl, isRedactedRecordedValue as kn, malformedOrphansRefusalMessage as ko, gray as kr, isStatefulRecreateTargetForReplace as ks, displacedPhysicalIdShown as kt, resolveAutoAssetStorage as ku, STREAM_POLICY_KEY as l, reDisableInstanceApiTermination as la, maskedLeafCoordinatesOf as lc, renderAssemblyPathEscape as ld, createPreDeleteFinalSnapshot as li, LockManager as ll, refusePendingMovesOut as ln, STATE_RESOURCES_MALFORMED as lo, constructPathOf as lr, refuseMalformedState as ls, conditionFingerprint as lt, finchSecretArgvRefusal as lu, reverseMapStreamPolicy as m, poisonRenderedSpellingsCollidingIn as ma, readbackPathFor as mc, resolveBucketRegion as md, earliestDefined as mi, CrossPrefixScanCache as ml, demoteSupersededOrphans as mn, displayLogicalId as mo, movedToHint as mr, repairMalformedResourcePropertiesForReadOnly as ms, enclosingDeadlineRemainingMs as mt, partitionSensitiveEnv as mu, recordedProtectionEvidence as n, withIndeterminateGuard as na, DagBuilder as nc, hasOwnKey as nd, secretNamedRecordNeedles as ni, recordMaskOnlyValuesIn as nl, refactorMarkerRefusalMessage as nn, parseWebACLArn as no, collectDeclaredOutputNames as nr, refuseMalformedResourcePropertiesForDestroy as ns, serviceTokenBlockingReason as nt, buildDenyExternalAccessPolicy as nu, perType as o, ec2InstanceProtectionSite as oa, maskAtCoordinates as oc, absoluteAssemblyPathEscape as od, PRE_DELETE_SNAPSHOT_TYPES as oi, wholeStringLeavesOf as ol, hasPendingMovesOut as on, declaresNoEcho as oo, DEFAULT_RESOURCE_TIMEOUT_MS as or, refuseMalformedResourcesForDeploy as os, listNestedTemplateRows as ot, describeDockerExecFailure as ou, planStreamMemberOps as p, IntrinsicFunctionResolver as pa, passedNoEchoParametersOf as pc, clearBucketRegionCache as pd, unsupportedFinalSnapshotError as pi, CrossPrefixReadError as pl, recordAfterRollbackUpdate as pn, deployRefusesOrphanRowsReason as po, hintSidesOf as pr, repairMalformedResourceEntriesForReadOnly as ps, enclosingDeadlineExpired as pt, isMalformedEnvKey as pu, isTruthyCfnBoolean as q, carriesDynamicReference as qa, recordNestedStackParameterExpressions as qc, CloudControlProvider as qi, BOOTSTRAP_MARKER_PREFIX as ql, exportAliasCollisionScrubWarning as qn, refuseMalformedOutputs as qo, createReadOnlyAttributeHealerFactory as qr, prefetchCreateOnlyPropertyPaths as qs, sameJournaledOrphans as qt, canonicalizeRegion as qu, recordedProtectionNote as r, isWaitAbandonedError as ra, TemplateParser as rc, hasPlainPrototype$1 as rd, stateSecretNameNeedles as ri, recordNoEchoAttributeValues as rl, refuseRefactorMarker as rn, withSharedDrainBudget as ro, collectPublishedOutputNames as rr, refuseMalformedResourcePropertiesForDrift as rs, childTemplateLoader as rt, buildDockerImage as ru, readProtection as s, isTerminationProtectionPropagationError as sa, maskReadbackAtCoordinates as sc, describeFileReadFailure as sd, buildFinalSnapshotIdentifier as si, WHOLE_DYNAMIC_REFERENCE_PATTERN as sl, pendingMovesOutOf as sn, JSON_LISTING_HOLE_VALUE as so, DEFAULT_RESOURCE_WARN_AFTER_MS as sr, refuseMalformedResourcesForDestroy as ss, renderNestedTemplateTreeDefect as st, describeDockerFailure as su, DeployEngine as t, deleteSkipReason as ta, sameLambdaFunctionAddress as tc, defineOwnKey as td, secretNamedAttributeNamesOf as ti, recordMaskOnlyValue as tl, refactorMarkerMovesOf as tn, refStateLookupFromResource as to, noEchoParameterValueSeed as tr, refuseMalformedResourceEntriesForOrphan as ts, findServiceTokenRefusals as tt, validateContainerRepoName as tu, STREAM_TAGS_KEY as u, reEnableInstanceApiTermination as ua, noEchoCoordinatesOf as uc, resolveAssemblyPath as ud, effectiveDeletionPolicy as ui, isLockInfoExpired as ul, replayFailedOperations as un, UNREADABLE_ORPHANS_CONTAINER_ROW as uo, findDestructiveChanges as ur, repairMalformedOrphanRecordsForReadOnly as us, conditionInputsFrom as ut, formatDockerLoginError as uu, streamPolicyMatchesDeclared as v, s3BucketDualStackDomainName as va, liveMatchesUnresolvedTokenFrame as vc, acquireIdempotencyToken as vi, isNotImplemented as vl, planRollback as vn, isReadableOrphanRecord as vo, looselyEqual as vr, unreadableResourceEntries as vs, keptWholeReasonText as vt, runDockerForeground as vu, planIndexContributorInsightsOps as w, keepHeldTokenProvenance as wa, createUnionSecretMasker as wc, DBPROXY_TAGS_WHAT as wi, exportNamesCarriedFrom as wl, orphanNeedsIdentity as wn, malformedLocalResourceEntriesWarning as wo, getStackRecords as wr, NO_CC_HANDLERS_REASON as ws, resolvePendingCloudControlRequests as wt, synthesisStatusMessage as wu, contributorInsightsRefusals as x, resolveDynamicReferences as xa, recordReferenceProvenanceEntry as xc, extractDeploymentEventError as xi, splitImportedOps as xl, replacementNeverSwapped as xn, malformedExportNamesWarning as xo, proposeRenames as xr, findSilentDropProperties as xs, makeSiblingClaimReader as xt, AssetManifestLoader as xu, streamTagsMatchDeclared as y, s3BucketRegionalDomainName as ya, markSameGenerationBag as yc, DeploymentEventsReader as yi, stackInstanceIdOf as yl, recheckFailedPlan as yn, isReadableResourceEntry as yo, mappingPairs as yr, withheldAccountClause as ys, mergeNoChangeOutputs as yt, runDockerStreaming as yu, relayedIndexBusyDelete as z, classifyReplaySecretRegion as za, withoutPhysicalNameCopies as zc, TemplateNoEchoReresolver as zi, isSensitiveAttributeName as zl, retiredNameGenerationsLeaving as zn, previewableOrphanRecords as zo, supersededHeldByOtherTypeWarning as zr, configBooleanRefusal as zs, withNestedStackContext as zt, CFN_TEMPLATE_URL_LIMIT as zu };
-//# sourceMappingURL=deploy-engine-DSpxEUjC.js.map
+export { computeImplicitDeleteEdges as $, coerceParameterTypedValue as $a, DYNAMIC_REFERENCE_TOKEN_SCAN as $c, applyCustomResourceResponseExpiration as $i, stringifyValue as $l, WITHHELD_NAME_DISPLAY as $n, refuseMalformedOrphanRecords as $o, noEchoExactEchoLeavesOf as $r, readConfigString as $s, lookupEachName as $t, MIGRATE_TMP_PREFIX as $u, beginDeleteWait as A, s3BucketRegionalDomainName as Aa, valueAtCoordinate as Ac, isRefusedByName as Ai, isAccessDenied$1 as Al, resolveReplacementOldType as An, isReadableResourceEntry as Ao, awaitInFlightSibling as Ar, withheldAccountClause as As, displacedOpClause as At, redactedDockerCause as Au, waitForIndexesSettled as B, assertFlagRoleArn as Ba, logOnlyValueCount as Bc, stringifyIfAssigned as Bi, hasUnverifiableParameterRefusal as Bl, updatePartialMessage as Bn, malformedOrphansRefusalMessage as Bo, yellow as Br, isStatefulRecreateTargetForReplace as Bs, getCurrentNestedStackContext as Bt, loadCdkJson as Bu, planContributorInsightsOp as C, withoutUnsettledProperties as Ca, noEchoCoordinatesOf as Cc, resolveAssemblyPath as Cd, ledgerForStack as Ci, isLockInfoExpired as Cl, isJournaledOrphan as Cn, accountArgs as Co, rollbackOrphanIds as Cr, repairMalformedOutputsForReadOnly as Cs, makeSiblingClaimReader as Ct, formatDockerLoginError as Cu, reverseMapTableContributorInsights as D, s3BucketArn as Da, readbackPathFor as Dc, resolveBucketRegion as Dd, DeploymentEventsReader as Di, CrossPrefixScanCache as Dl, recheckFailedPlan as Dn, hasReadableOutputs as Do, mappingPairs as Dr, unpreviewableOrphanRecords as Ds, keptForRetainedRecord as Dt, partitionSensitiveEnv as Du, reverseMapIndexContributorInsights as E, isSettledInstanceState as Ea, passedNoEchoParametersOf as Ec, clearBucketRegionCache as Ed, acquireIdempotencyToken as Ei, CrossPrefixReadError as El, planRollback as En, hasReadableOrphans as Eo, looselyEqual as Er, repairMalformedResourcesForReadOnly as Es, resolvePendingCloudControlRequests as Et, isMalformedEnvKey as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, keepHeldTokenProvenance as Fa, snapshotPassProvenance as Fc, readTagList as Fi, acceptedCreateOnlyDropsOf as Fl, inheritProducerRegions as Fn, malformedLocalResourceEntriesWarning as Fo, bold as Fr, NO_CC_HANDLERS_REASON as Fs, recordDisplacedSkips as Ft, getDockerImageBySourceHash as Fu, sendTtlWaitingOutRateLimit as G, AWS_CREDENTIAL_ENV_KEYS as Ga, unionOfSecretBags as Gc, wouldReturnToSdkProvider as Gi, orphansCarriedFrom as Gl, retiredAfterRollback as Gn, malformedResourceEntriesWarning as Go, removeSuperseded as Gr, isWarmThroughputDecrease as Gs, isHandledOrphan as Gt, resolveStateBucketWithDefault as Gu, isTtlRateLimited as H, explicitRoleArnOrThrow as Ha, recordLogOnlyParameterValue as Hc, ProviderRegistry as Hi, importableOutputs as Hl, nameGenerationCarriedFrom as Hn, malformedOutputsRefusalMessage as Ho, deleteSupersededEntry as Hr, renderStatefulReason as Hs, deleteJournaledOrphans as Ht, resolveAutoAssetStorage as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, outputReferenceProvenanceOf as Ia, carryLogOnlyValues as Ic, refuseMalformedDesiredTags as Ii, describeRegionValueKind as Il, REDACTED_DELETE_ADDRESS_SKIP_REASON as In, malformedLocalResourcesWarning as Io, cyan as Ir, hasNoCloudControlHandlers as Is, revertNestedChildFromJournal as It, Synthesizer as Iu, hasCdkAutoDeleteTag as J, envCredentialsAreAssumedRole as Ja, maskSecretsInError as Jc, readsNoEchoDeleteValues as Ji, PhaseClock as Jl, withNameGenerationReached as Jn, malformedScrubResourceEntriesRefusalMessage as Jo, supersededHolderOf as Jr, coerceCfnBoolean as Js, makeForeignHolderScan as Jt, stateBucketExistenceConfirmed as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, applyCallerIdentityCredentials as Ka, createSecretMasker as Kc, waitForLambdaFunctionActive as Ki, shouldRetainResource as Kl, retiredNameGenerationsAfter as Kn, malformedResourcePropertiesWarning as Ko, supersededAfterRollback as Kr, toCfnInteger as Ks, journaledOrphanLines as Kt, resolveStateBucketWithDefaultAndSource as Ku, deleteTableWithIndexBusyRetry as L, recordedOutputReferenceRegions as La, createUnionSecretMasker as Lc, tagMapAsList as Li, exportNamesCarriedFrom as Ll, isRedactedRecordedValue as Ln, malformedOrphanRecordsRefusalMessage as Lo, gray as Lr, findReplacedReadersOfRecreateTargets as Ls, revertedNestedRowIds as Lt, synthesisStatusMessage as Lu, deleteBudgetKey as M, resolveDynamicReferences as Ma, markSameGenerationBag as Mc, DBPROXY_TAGS_WHAT as Mi, stackInstanceIdOf as Ml, orphanNeedsIdentity as Mn, malformedExportNamesWarning as Mo, getStackRecords as Mr, findSilentDropProperties as Ms, dropSettledNestedJournals as Mt, runDockerStreaming as Mu, resolveDynamoDbDeleteBudgetClock as N, producerLookupOver as Na, redactForState as Nc, DBPROXY_TAG_OPTIONS as Ni, withStackInstanceIdWithheld as Nl, findNestedStackTypeChanges as Nn, malformedExportSourceWarning as No, withStackRecords as Nr, unwrittenCreateOnlyReplacement as Ns, getNestedRevertRun as Nt, warnFinchArgvExposure as Nu, stripIndexContributorInsights as O, s3BucketDomainName as Oa, readsNoEchoSource as Oc, DeploymentEventsStore as Oi, applyCrossPrefixScan as Ol, recordUnderIdIsNotOwn as On, hasReadableResources as Oo, parseMappingFile as Or, unreadableOrphanRecords as Os, recordRetainedForReadoption as Ot, redactDockerArgvValues as Ou, resolveDynamoDbDeleteBudgetMs as P, refuseUnreadableCdkCrossAccountRefs as Pa, recordReferenceProvenanceEntry as Pc, planTagDiff as Pi, splitImportedOps as Pl, getCurrentProducerRegions as Pn, malformedLocalOutputsWarning as Po, replacedDeleteFailureVerdict as Pr, withoutSilentDropProperties as Ps, nestedChildStackName as Pt, AssetManifestLoader as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, regionLessSecretName as Qa, withoutPhysicalNameCopies as Qc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Qi, isSensitiveAttributeName as Ql, resourcesNamingDeclaredParameter as Qn, refuseMalformedNestedChildOutputs as Qo, noEchoComparisonForTemplate as Qr, configStringRefusal as Qs, isAccessDeniedError as Qt, CFN_TEMPLATE_URL_LIMIT as Qu, maskedLogger as R, recordedReferenceRegions as Ra, hasMaskableValues as Rc, tagPlanWarning as Ri, hasReadableExportSet as Rl, redactedDeleteAddressFields as Rn, malformedOrphanRecordsWarning as Ro, green as Rr, shownType as Rs, withNestedRevertRun as Rt, getDefaultStateBucketName as Ru, indexDeclaresContributorInsights as S, withUnsettledProperties as Sa, maskedLeafCoordinatesOf as Sc, renderAssemblyPathEscape as Sd, earliestDefined as Si, LockManager as Sl, demoteSupersededOrphans as Sn, UNREADABLE_RESOURCES_MAP_ROW as So, movedToHint as Sr, repairMalformedOrphansForReadOnly as Ss, makeCanonicalizePropertiesFn as St, finchSecretArgvRefusal as Su, readContributorInsightsSpec as T, poisonRenderedSpellingsCollidingIn as Ta, noEchoOutputsComparison as Tc, injectedAwsRegionValue as Td, withCreateTokenLedger as Ti, rebuildClientForBucketRegion as Tl, planFailedOps as Tn, displayLogicalId as To, isPairableType as Tr, repairMalformedResourcePropertiesForReadOnly as Ts, pendingRequestCount as Tt, isDockerClientEnvKey as Tu, planTimeToLive as U, isIamRoleArn as Ua, recordLogOnlyValue as Uc, ccBrokenReason as Ui, isReadableBag as Ul, nameGenerationHighWaterOf as Un, malformedOutputsWarning as Uo, holdsSupersededResources as Ur, WARM_THROUGHPUT_MEMBERS as Us, dropFailedCommands as Ut, resolveCaptureObservedState as Uu, isTtlAlreadyDisabled as V, assertSendableRoleArn as Va, printingCorpusOf as Vc, CC_BROKEN_REASON as Vi, importableOutputKeys as Vl, updatePartialReason as Vn, malformedOrphansWarning as Vo, addSuperseded as Vr, isStatefulRecreateTargetSync as Vs, withNestedStackContext as Vt, resolveApp as Vu, readTtlSpec as W, sendableAssumeRoleCommand as Wa, shareLogOnlyValues as Wc, isCustomResource as Wi, orphansAfterRollback as Wl, nameScopeOf as Wn, malformedRenderedContainersWarning as Wo, isSupersededResourceRecord as Wr, coerceWarmThroughput as Ws, dropFailedHint as Wt, resolveSkipPrefix as Wu, getPriorAttempts as X, classifyReplaySecretRegion as Xa, scrubResourceRecord as Xc, getCurrentResourceSecrets as Xi, timePhase as Xl, namesAnyDeclaredParameter as Xn, previewableOrphanRecords as Xo, withoutSuperseded as Xr, configBooleanRefusal as Xs, formatResourceLine as Xt, ssmResolvedValueType as Xu, isTruthyCfnBoolean as Y, classifyRecordedSecretRegion as Ya, maskSecretsInText as Yc, isCustomResourceType as Yi, renderPhaseTimings as Yl, computeParameterTaint as Yn, malformedStateRefusalMessage as Yo, supersededResourcesOf as Yr, coerceCfnInteger as Ys, sameJournaledOrphans as Yt, warnDeprecatedNoPrefixCliFlag as Yu, markRefusedBeforeApplying as Z, producerRegionsFromState as Za, withPhysicalNameCopies as Zc, withPrintingSecrets as Zi, AssetPublisher as Zl, reachableDivergentParameters as Zn, refuseDivergentRecordRegionForDestroy as Zo, noEchoAttributeNamesOf as Zr, configIntegerRefusal as Zs, chunks as Zt, CFN_TEMPLATE_BODY_LIMIT as Zu, streamMemberRefusals as _, reDisableInstanceApiTermination as _a, canonicalCoordinates as _c, nullPrototypeRecord as _d, createPreDeleteFinalSnapshot as _i, recordNoEchoParameterFreshValue as _l, withUnprovenUnsettled as _n, declaresNoEcho as _o, constructPathOf as _r, refuseMalformedResourcesForDeploy as _s, withResourceDeadline as _t, resolveDockerContextDirectory as _u, isProtectionValueActive as a, RollbackInlinePolicyWriters as aa, templateResourceTypes as ac, PARTITION_TABLE as ad, namingSecretsWithRecordedNoEcho as ai, inheritNestedStackParameterAssociations as al, refuseRefactorMarker as an, carriesFetchableDynamicReference as ao, carriedExportAliasExposure as ar, refuseMalformedOutputsForDestroy as as, childTemplateLoader as at, AssetModeResolver as au, CONTRIBUTOR_INSIGHTS_KEY as b, INTRINSIC_KEYS as ba, maskReadbackAtCoordinates as bc, describeFileReadFailure as bd, refusesFinalSnapshot as bi, WHOLE_DYNAMIC_REFERENCE_PATTERN as bl, equalModuloMask as bn, STATE_RESOURCES_MALFORMED as bo, findRefactorHints as br, refuseMalformedState as bs, keptWholeReasonText as bt, describeDockerFailure as bu, DynamoDBGlobalTableProvider as c, deleteLeftInPlace as ca, blockDeviceMappingsDifferOnlyInDeleteOnTermination as cc, AssemblyReader as cd, secretNamePrintingBags as ci, physicalNameCopiesOf as cl, hasPendingMovesOut as cn, AWS_NO_VALUE as co, isWholeDynamicReferenceValue as cr, refuseMalformedResourceEntriesForDeploy as cs, listNestedTemplateRows as ct, ensureAssetStorage as cu, declaredStreamPolicyMember as d, isWaitAbandonedError as da, emrClusterInstancesReplaced as dc, describeJsonParseFailure as dd, stateSecretNameNeedles as di, splitGetAttStringForm as dl, refusePendingMovesOut as dn, lacksRecordedTableArn as do, collectPublishedOutputNames as dr, refuseMalformedResourceEntriesForImportSave as ds, conditionFingerprint as dt, parseBootstrapMarker as du, customResourceResponseExpirationWarning as ea, replayWarn as ec, findLargeInlineResources as ed, noEchoParameterNamesOf as ei, dynamicReferenceTokens as el, withApiLimit as en, isUnboundTemplateParameter as eo, displayTextOrWithheld as er, refuseMalformedOrphanRecordsForDestroy as es, crossStackOutputProvenanceSource as et, WorkGraph as eu, declaredStreamTagsMember as f, markWaitAbandoned as fa, canonicalLambdaFunctionName as fc, parseFailureDebugDetail as fd, storedSecretNameNeedles as fi, carriesSecretMask as fl, replayFailedOperations as fn, refStateLookupFromResource as fo, isExportAliasCollision as fr, refuseMalformedResourceEntriesForOrphan as fs, conditionInputsFrom as ft, readBootstrapMarkerBody as fu, streamDeclaresTags as g, observeThenDisableInstanceApiTermination as ga, TemplateParser as gc, hasPlainPrototype$1 as gd, ccRoutedFinalSnapshotError as gi, recordNoEchoAttributeValues as gl, settleUnsettledPrevious as gn, passedParameterClassesOf as go, maskingRetryLogger as gr, refuseMalformedResourcePropertiesForOrphan as gs, enclosingDeadlineRemainingMs as gt, buildDockerImage as gu, streamDeclaresPolicy as h, isTerminationProtectionPropagationError as ha, DagBuilder as hc, hasOwnKey as hd, buildFinalSnapshotIdentifier as hi, recordMaskOnlyValuesIn as hl, recordAfterRollbackUpdate as hn, parameterInputsFor as ho, DEFAULT_RESOURCE_WARN_AFTER_MS as hr, refuseMalformedResourcePropertiesForExport as hs, enclosingDeadlineExpired as ht, buildDenyExternalAccessPolicy as hu, PROTECTION_PROPERTY_BY_TYPE as i, unchangedBehindSecretReference as ia, prefetchCreateOnlyPropertyPaths as ic, expectedOwnerParam as id, maskEventTextWithBoundBags as ii, identityKeyFor as il, refactorMarkerRefusalMessage as in, carriesDynamicReference as io, secretSafeKeyDisplay as ir, refuseMalformedOutputs as is, serviceTokenBlockingReason as it, rewriteTemplateAssetReferences as iu, compensateRemovedDeletionProtection as j, s3BucketWebsiteUrl as ja, liveMatchesUnresolvedTokenFrame as jc, markDeleteStarted as ji, isNotImplemented as jl, seedsDeleteFirstGuard as jn, malformedDriftResourcePropertiesWarning as jo, destroyStackRecordsView as jr, findActionableSilentDrops as js, displacedPhysicalIdShown as jt, runDockerForeground as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, s3BucketDualStackDomainName as ka, recordedNoEchoValuesOf as kc, extractDeploymentEventError as ki, crossPrefixDeniedWarning as kl, replacementNeverSwapped as kn, isReadableOrphanRecord as ko, proposeRenames as kr, unreadableResourceEntries as ks, NESTED_PENDING_PARENT_REASON as kt, redactedCause as ku, STREAM_POLICY_KEY as l, deleteSkipReason as la, dbInstanceEngineChangeIsInPlace as lc, StageLoadError as ld, secretNamedAttributeNamesOf as li, recordAttributeIdCopy as ll, pendingMovesOutOf as ln, cfnRefValueFromPhysicalId as lo, noEchoParameterValueSeed as lr, refuseMalformedResourceEntriesForDestroy as ls, renderNestedTemplateTreeDefect as lt, getBootstrapMarkerKey as lu, reverseMapStreamPolicy as m, ec2InstanceProtectionSite as ma, sameLambdaFunctionAddress as mc, defineOwnKey as md, PRE_DELETE_SNAPSHOT_TYPES as mi, recordMaskOnlyValue as ml, removeProtectionTypeList as mn, withSharedDrainBudget as mo, DEFAULT_RESOURCE_TIMEOUT_MS as mr, refuseMalformedResourcePropertiesForDrift as ms, readRecordedConditionVerdicts as mt, validateContainerRepoName as mu, recordedProtectionEvidence as n, slowCcOperationTimeoutMs as na, requireConfigObject as nc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as nd, completedReplayEntries as ni, pathCrossesDottedKey as nl, readRefactorMarkerOnce as nn, getAccountInfo as no, secretBearing as nr, refuseMalformedOrphansForDestroy as ns, deferredServiceTokenWarning as nt, createAssetRedirectResolver as nu, perType as o, UNSPECIFIED_SKIP_REASON as oa, describeTypeWithThrottleRetry as oc, canonicalizeRegion as od, orphanRecordsPrintingBag as oi, recordNestedStackParameterExpressions as ol, sameMove as on, isNamelessDynamicReferenceError as oo, exportNameNoEchoParameters as or, refuseMalformedResourceAttributesForOrphan as os, findNestedTemplateTreeDefect as ot, BOOTSTRAP_MARKER_PREFIX as ou, planStreamMemberOps as p, disableInstanceApiTermination as pa, lambdaFunctionNameForMask as pc, utf8ByteLength as pd, ATOMIC_FINAL_SNAPSHOT_TYPES as pi, provenPublicValue as pl, replayRollback as pn, parseWebACLArn as po, bindingSkippedOutputs as pr, refuseMalformedResourcePropertiesForDestroy as ps, parentSuppliedValues as pt, validateAssetBucketName as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, callerEnvCredentials as qa, errorCauseChain as qc, TemplateNoEchoReresolver as qi, stackInstanceIdCarriedFrom as ql, retiredNameGenerationsLeaving as qn, malformedResourcesWarning as qo, supersededHeldByOtherTypeWarning as qr, toFiniteNumber as qs, loadJournaledOrphans as qt, resolveUseCdkBootstrapAssets as qu, recordedProtectionNote as r, onlySecretReferencesDiffer as ra, requireConfigString as rc, decodeListingKey as rd, journaledOrphanPrintingBag as ri, spelledKeysOf as rl, refactorMarkerMovesOf as rn, isImpossibleEmptyStoredAttribute as ro, secretBearingStateKeyWarning as rr, refuseMalformedOrphansForOrphan as rs, findServiceTokenRefusals as rt, loadPublishableAssetManifest as ru, readProtection as s, deleteIndeterminateGuards as sa, withRetry as sc, derivePartitionAndUrlSuffix as sd, secretNamePrintingBag as si, recoverMaskedOutput as sl, updateRefactorMarker as sn, keepsSecretReferenceToken as so, exportNameSecretExposure as sr, refuseMalformedResourceEntries as ss, isAbsoluteAssetPath as st, assertAssetBucketRegion as su, DeployEngine as t, CloudControlProvider as ta, requireConfigArray as tc, uploadCfnTemplate as td, createReadOnlyAttributeHealerFactory as ti, isUncertifiedBaselineMaskPosition as tl, readRefactorMarker as tn, parameterTypeMayLoseSecretIdentity as to, exportAliasCollisionScrubWarning as tr, refuseMalformedOrphans as ts, inheritedProvenanceForChildDiff as tt, buildAssetRedirectMap as tu, STREAM_TAGS_KEY as u, withIndeterminateGuard as ua, ecsServiceLaunchTypeSetOrChanged as uc, processStackMessages as ud, secretNamedRecordNeedles as ui, recordPhysicalNameCopy as ul, pendingMovesRefusalMessage as un, isStalePlaceholderArnAttribute as uo, collectDeclaredOutputNames as ur, refuseMalformedResourceEntriesForImport as us, templateIdentity as ut, isCrossRegionRedirect as uu, streamPolicyMatchesDeclared as v, reEnableInstanceApiTermination as va, isMarkedCoordinate as vc, ownValue as vd, effectiveDeletionPolicy as vi, recordProvenPublicExpression as vl, calculateResourceDrift as vn, JSON_LISTING_HOLE_VALUE as vo, findDestructiveChanges as vr, refuseMalformedResourcesForDestroy as vs, diffSecurity as vt, describeDockerCapturedOutput as vu, planIndexContributorInsightsOps as w, IntrinsicFunctionResolver as wa, noEchoLeavesOf as wc, injectAwsRegion as wd, reserveStackCreateToken as wi, S3StateBackend as wl, isReplacementOrphan as wn, deployRefusesOrphanRowsReason as wo, withMovedTo as wr, repairMalformedResourceEntriesForReadOnly as ws, planOrphanAdoption as wt, getDockerCmd as wu, contributorInsightsRefusals as x, unsettledPropertiesOf as xa, maskWholeValue as xc, displayAssemblyPath as xd, unsupportedFinalSnapshotError as xi, isSingleDynamicReferenceToken as xl, undeclaredEmptyObservedKeys as xn, UNREADABLE_ORPHANS_CONTAINER_ROW as xo, hintSidesOf as xr, repairMalformedOrphanRecordsForReadOnly as xs, mergeNoChangeOutputs as xt, dockerSpawnEnvWithSensitive as xu, streamTagsMatchDeclared as y, DiffCalculator as ya, maskAtCoordinates as yc, absoluteAssemblyPathEscape as yd, isFinalSnapshotError as yi, wholeStringLeavesOf as yl, equalModuloMarkedMask as yn, STATE_REGION_DIVERGED as yo, formatDestructiveChange as yr, refuseMalformedResourcesForExport as ys, isSecretBearingReferenceString as yt, describeDockerExecFailure as yu, relayedIndexBusyDelete as z, applyRoleArnIfSet as za, literalSplitDelimitersOf as zc, definedAttributes as zi, hasReasonlessBaselineRefusal as zl, redactedDeleteAddressSkip as zn, malformedOrphanRowsKeptWarning as zo, red as zr, MULTI_REGION_RECREATE_BLOCKED_TYPES as zs, collectNestedChildUnaddressed as zt, getLegacyStateBucketName as zu };
+//# sourceMappingURL=deploy-engine-tQ0aqZMo.js.map