@go-to-k/cdkd 0.308.1 → 0.310.0

package/dist/{deploy-engine-CDjAtIrn.js → deploy-engine-DZO2SOQJ.js}

@@ -2,7 +2,7 @@ import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js"
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
 import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-BWqrjGBS.js";
+import { t as getCdkdVersion } from "./version-QOtLxcEo.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4986,7 +4986,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	10,
 	11,
 	12,
-	13
+	13,
+	14
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -6046,7 +6047,7 @@ var S3StateBackend = class S3StateBackend {
 		const body = {
 			...state,
 			...stackInstanceIdCarriedFrom(state),
-			version: 13,
+			version: 14,
 			stackName,
 			region
 		};
@@ -7845,7 +7846,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$9(value) {
+function isPlainObject$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -8101,7 +8102,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$9(args)) return void 0;
+		if (!isPlainObject$11(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -8147,7 +8148,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$9(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$11(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -8441,12 +8442,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$9(resolvedProperties) || !isPlainObject$9(sourceProperties)) return;
+	if (!isPlainObject$11(resolvedProperties) || !isPlainObject$11(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$9(resolvedParameters) || !isPlainObject$9(sourceParameters)) return;
+	if (!isPlainObject$11(resolvedParameters) || !isPlainObject$11(sourceParameters)) return;
 	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -8495,7 +8496,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$9(sourceLeaf)) return void 0;
+		if (!isPlainObject$11(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -8832,7 +8833,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 		}
 		return { value: out };
 	}
-	if (!isPlainObject$9(node)) return void 0;
+	if (!isPlainObject$11(node)) return void 0;
 	const keys = Object.keys(node);
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
@@ -8873,7 +8874,7 @@ function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 }
 function evaluatePureSub(args, bind, pseudo, evaluate) {
 	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
-	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$9(variables)) return;
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$11(variables)) return;
 	const bound = /* @__PURE__ */ new Map();
 	for (const [name, variable] of Object.entries(variables)) {
 		const evaluated = evaluate(variable);
@@ -8906,7 +8907,7 @@ function bindReadName(name, bind, pseudo) {
 function collectRereadConditions(node, names, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
-	if (!isPlainObject$9(node)) return true;
+	if (!isPlainObject$11(node)) return true;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
@@ -8917,7 +8918,7 @@ function collectRereadConditions(node, names, depth = 0) {
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
-	if (!isPlainObject$9(node)) return false;
+	if (!isPlainObject$11(node)) return false;
 	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
 }
 function rendersReadTo(spelling, parentSecrets, value) {
@@ -8960,7 +8961,7 @@ function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return true;
 	if (typeof node === "string") return node.includes("{{resolve:");
 	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
-	if (!isPlainObject$9(node)) return false;
+	if (!isPlainObject$11(node)) return false;
 	if (Object.hasOwn(node, "Fn::If")) {
 		const args = node["Fn::If"];
 		if (Object.keys(node).length !== 1) return true;
@@ -9073,7 +9074,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$9(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$11(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -9105,7 +9106,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$9(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$11(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -9268,7 +9269,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$9(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$11(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -9296,7 +9297,7 @@ const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 ]);
 function arrayElementDrop(element, depth = 0) {
 	if (depth > 16) return "unknown";
-	if (!isPlainObject$9(element)) return "never";
+	if (!isPlainObject$11(element)) return "never";
 	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
 	const keys = Object.keys(element);
 	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
@@ -9332,7 +9333,7 @@ function keptLiteralsCorroborate(kept, bag, secrets) {
 	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
 }
 function isIntrinsicNode(value) {
-	if (!isPlainObject$9(value)) return false;
+	if (!isPlainObject$11(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
 }
@@ -9345,7 +9346,7 @@ function keptElementCorroborates(source, bag, secrets, depth = 0) {
 	if (source === null || typeof source !== "object") return source === bag;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
-	if (!isPlainObject$9(source) || !isPlainObject$9(bag)) return false;
+	if (!isPlainObject$11(source) || !isPlainObject$11(bag)) return false;
 	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
 	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
 }
@@ -9355,12 +9356,12 @@ function corroboratesWhateverResolves(source, depth = 0) {
 	if (source === null || typeof source !== "object") return true;
 	if (isIntrinsicNode(source)) return true;
 	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
-	if (!isPlainObject$9(source)) return false;
+	if (!isPlainObject$11(source)) return false;
 	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
 	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
 }
 function arrayPairsWhateverDrops(source) {
-	if (!source.some((element) => isPlainObject$9(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	if (!source.some((element) => isPlainObject$11(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
 	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -9377,13 +9378,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$9(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$11(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 		const reread = positionByParameterReread(bag, source, secrets);
 		if (reread !== void 0) return reread;
 	}
-	if (typeof bag === "string" && isPlainObject$9(source)) {
+	if (typeof bag === "string" && isPlainObject$11(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -9393,7 +9394,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$9(source)) {
+	if (Array.isArray(bag) && isPlainObject$11(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -9428,7 +9429,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
-	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
+	if (isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) {
 			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
@@ -9450,7 +9451,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$9(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$11(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -9487,7 +9488,7 @@ function nameScalarSecrets(value, secrets) {
 			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
 		}
 		if (Array.isArray(node)) return node.map(walk);
-		if (isPlainObject$9(node) && hasPlainPrototype(node)) {
+		if (isPlainObject$11(node) && hasPlainPrototype(node)) {
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
 			return out;
@@ -9504,13 +9505,13 @@ function substitutionIsSecret(value) {
 function sentinelDefinitionOf(source) {
 	const subs = source["DefinitionSubstitutions"];
 	const values = /* @__PURE__ */ new Map();
-	if (isPlainObject$9(subs)) {
+	if (isPlainObject$11(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
 	}
 	for (const key of ["DefinitionString", "Definition"]) {
 		if (!Object.hasOwn(source, key)) continue;
 		const raw = source[key];
-		const body = typeof raw === "string" ? raw : isPlainObject$9(raw) ? JSON.stringify(raw) : void 0;
+		const body = typeof raw === "string" ? raw : isPlainObject$11(raw) ? JSON.stringify(raw) : void 0;
 		if (body === void 0) continue;
 		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
 		const names = [];
@@ -9581,7 +9582,7 @@ function sentinelDefinitionOf(source) {
 				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
 				return;
 			}
-			if (isPlainObject$9(node)) {
+			if (isPlainObject$11(node)) {
 				const own = new Set(Object.keys(node).map(written));
 				for (const [k, v] of Object.entries(node)) {
 					if (!marked(k)) keys.add(k);
@@ -9609,7 +9610,7 @@ function alignedSecretLeaf(root, leaf) {
 			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
 			cursor = cursor[segment];
 		} else {
-			if (!isPlainObject$9(cursor)) return void 0;
+			if (!isPlainObject$11(cursor)) return void 0;
 			const own = Object.keys(cursor);
 			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
 			if (!Object.hasOwn(cursor, segment)) return void 0;
@@ -9620,7 +9621,7 @@ function alignedSecretLeaf(root, leaf) {
 }
 function collectObjectKeys(value, into) {
 	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
-	else if (isPlainObject$9(value)) for (const [k, v] of Object.entries(value)) {
+	else if (isPlainObject$11(value)) for (const [k, v] of Object.entries(value)) {
 		into.add(k);
 		collectObjectKeys(v, into);
 	}
@@ -9633,7 +9634,7 @@ function spelledKeysOf(properties) {
 }
 function someKeyIsUnspelled(value, spelled) {
 	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
-	if (isPlainObject$9(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	if (isPlainObject$11(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
 	return false;
 }
 function nameDefinitionSecrets(value, source, secrets) {
@@ -9728,8 +9729,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$9(a)) {
-		if (!isPlainObject$9(b)) return false;
+	if (isPlainObject$11(a)) {
+		if (!isPlainObject$11(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -9746,7 +9747,7 @@ function renderedDefinitionLiterals(source) {
 	const keyKeep = /* @__PURE__ */ new Set();
 	const subs = source["DefinitionSubstitutions"];
 	const scalars = [];
-	if (isPlainObject$9(subs)) {
+	if (isPlainObject$11(subs)) {
 		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
 			scalars.push([name, String(value)]);
 			if (typeof value === "string") keep.add(value);
@@ -9758,7 +9759,7 @@ function renderedDefinitionLiterals(source) {
 		if (!Object.hasOwn(source, key)) continue;
 		const body = source[key];
 		if (typeof body === "string") bodies.push(body);
-		else if (isPlainObject$9(body)) bodies.push(JSON.stringify(body));
+		else if (isPlainObject$11(body)) bodies.push(JSON.stringify(body));
 	}
 	for (const body of bodies) {
 		let rendered = body;
@@ -9809,7 +9810,7 @@ function collectScalarLeaves(value, into) {
 		return;
 	}
 	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
-	else if (isPlainObject$9(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+	else if (isPlainObject$11(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
 }
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
 	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9827,7 +9828,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, s
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
-	if (isPlainObject$9(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$11(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
@@ -9854,7 +9855,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
-	if (failClosed === true && isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+	if (failClosed === true && isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
 		const keep = renderedDefinitionLiterals(source);
 		const out = Object.create(null);
 		const rest = Object.create(null);
@@ -9888,7 +9889,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return out;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(source)) {
+	if (isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -9915,14 +9916,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$9(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$11(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$9(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$11(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -9932,8 +9933,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$9(source)) {
-		if (!isPlainObject$9(bag)) return false;
+	if (isPlainObject$11(source)) {
+		if (!isPlainObject$11(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -10024,13 +10025,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$9(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$11(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$9(bag) && hasPlainPrototype(bag) && isPlainObject$9(refused) && isPlainObject$9(scanned)) {
+	if (isPlainObject$11(bag) && hasPlainPrototype(bag) && isPlainObject$11(refused) && isPlainObject$11(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -11520,7 +11521,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$9(variables) ? variables : void 0;
+				const vars = isPlainObject$11(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -11554,7 +11555,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$9(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$11(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -11570,7 +11571,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$9(value)) {
+				if (!isPlainObject$11(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -11619,7 +11620,7 @@ function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, con
 	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
 		parameters: noEchoParameters,
 		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$4(coordinate), {
+	}, (coordinate, node) => nodes.set(canonicalJson$5(coordinate), {
 		coordinate,
 		node
 	}));
@@ -11631,7 +11632,7 @@ function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames
 	if (properties === null || typeof properties !== "object") return bag;
 	const coordinates = /* @__PURE__ */ new Map();
 	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
-	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$4(coordinate), coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$5(coordinate), coordinate);
 	const recordLeaf = (leaf) => {
 		if (typeof leaf === "string") {
 			if (leaf === "***" || leaf.includes("{{resolve:")) return;
@@ -11655,7 +11656,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$9(value)) {
+	if (isPlainObject$11(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -11678,7 +11679,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$9(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$11(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -11694,7 +11695,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$9(node)) return { ...node };
+	if (isPlainObject$11(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -11761,20 +11762,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$9(element)) return path;
+			if (key === void 0 || !isPlainObject$11(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$9(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$11(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$9(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$11(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$9(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$11(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -11803,7 +11804,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$9(v) ? !isPlainObject$9(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$11(v) ? !isPlainObject$11(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -11832,8 +11833,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$9(v) && isPlainObject$9(s)) {
-			const tt = isPlainObject$9(t) ? t : {};
+		if (isPlainObject$11(v) && isPlainObject$11(s)) {
+			const tt = isPlainObject$11(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -11856,13 +11857,13 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$9(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$11(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
-	return canonicalJson$4(a) === canonicalJson$4(b);
+	return canonicalJson$5(a) === canonicalJson$5(b);
 }
-function canonicalJson$4(value) {
+function canonicalJson$5(value) {
 	return JSON.stringify(value, (_key, node) => {
 		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
 		const sorted = Object.create(null);
@@ -11900,7 +11901,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$9(node)) {
+				if (isPlainObject$11(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11943,8 +11944,8 @@ function noEchoOutputsComparison(templateValues, sources) {
 	return (current, desired) => {
 		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
 		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
-		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$4(desired[key])));
-		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$4(desired[key]))) maskedKeys.add(key);
+		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$5(desired[key])));
+		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$5(desired[key]))) maskedKeys.add(key);
 		if (maskedKeys.size === 0) return {
 			current,
 			desired,
@@ -11958,7 +11959,7 @@ function noEchoOutputsComparison(templateValues, sources) {
 			const stored = current[key];
 			if (containsMask(stored)) continue;
 			normalized = { ...normalized ?? {} };
-			normalized[key] = canonicalJson$4(stored) === canonicalJson$4(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+			normalized[key] = canonicalJson$5(stored) === canonicalJson$5(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
 		}
 		return {
 			current: normalized,
@@ -12622,6 +12623,10 @@ function attributeTypeChangedForSharedAttribute(oldValue, newValue) {
 	}
 	return false;
 }
+function globalTableLocalSecondaryIndexesRemoved(oldValue, newValue) {
+	const declares = (value) => Array.isArray(value) && value.length > 0;
+	return declares(oldValue) && (newValue === void 0 || newValue === null || Array.isArray(newValue) && newValue.length === 0);
+}
 function budgetNameChanged(oldValue, newValue) {
 	const nameOf = (value) => {
 		if (value === null || typeof value !== "object") return void 0;
@@ -12680,10 +12685,43 @@ function emrInstancesReplacingPart(value) {
 	strip("TaskInstanceFleets", EMR_FLEET_IN_PLACE_MEMBERS);
 	return instances;
 }
+function elastiCachePreferredAvailabilityZonesMovedToDisjoint(oldValue, newValue) {
+	if (!Array.isArray(oldValue) || !Array.isArray(newValue)) return false;
+	if (oldValue.length === 0 || newValue.length === 0) return false;
+	if (![...oldValue, ...newValue].every((z) => typeof z === "string")) return false;
+	return !newValue.some((z) => oldValue.includes(z));
+}
 function emrClusterInstancesReplaced(oldValue, newValue) {
 	if (oldValue === void 0 && newValue === void 0) return true;
 	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
 }
+const AURORA = "aurora";
+const AURORA_MYSQL = "aurora-mysql";
+const DEPRECATED_ORACLE_SE_ENGINES = /* @__PURE__ */ new Set(["oracle-se", "oracle-se1"]);
+const ORACLE_SE2 = "oracle-se2";
+const ORACLE_CDB_CONVERSIONS = /* @__PURE__ */ new Map([["oracle-ee", "oracle-ee-cdb"], ["oracle-se2", "oracle-se2-cdb"]]);
+const ORACLE_CDB_ENGINES = new Set(ORACLE_CDB_CONVERSIONS.values());
+function enginePair(oldValue, newValue) {
+	return typeof oldValue === "string" && typeof newValue === "string" ? [oldValue, newValue] : void 0;
+}
+function dbClusterEngineChangeReplaces(oldValue, newValue) {
+	const pair = enginePair(oldValue, newValue);
+	if (pair === void 0) return false;
+	const [before, after] = pair;
+	return !(before === after || before === AURORA && after === AURORA_MYSQL);
+}
+function dbInstanceEngineChangeIsInPlace(oldValue, newValue) {
+	const pair = enginePair(oldValue, newValue);
+	if (pair === void 0) return false;
+	const [before, after] = pair;
+	const from = before.toLowerCase();
+	const to = after.toLowerCase();
+	return before === after || before === AURORA && after === AURORA_MYSQL || DEPRECATED_ORACLE_SE_ENGINES.has(from) && to === ORACLE_SE2 || ORACLE_CDB_CONVERSIONS.get(from) === to || from === to && ORACLE_CDB_ENGINES.has(to);
+}
+function dbInstanceEngineChangeReplaces(oldValue, newValue) {
+	if (enginePair(oldValue, newValue) === void 0) return false;
+	return !dbInstanceEngineChangeIsInPlace(oldValue, newValue);
+}
 var ReplacementRulesRegistry = class {
 	logger = getLogger().child("ReplacementRulesRegistry");
 	rules = /* @__PURE__ */ new Map();
@@ -12782,6 +12820,10 @@ var ReplacementRulesRegistry = class {
 				"DestinationConfig"
 			])
 		});
+		this.rules.set("AWS::DynamoDB::GlobalTable", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["LocalSecondaryIndexes", globalTableLocalSecondaryIndexesRemoved]])
+		});
 		this.rules.set("AWS::DynamoDB::Table", {
 			replacementProperties: /* @__PURE__ */ new Set(["TableName", "KeySchema"]),
 			updateableProperties: /* @__PURE__ */ new Set([
@@ -13001,6 +13043,14 @@ var ReplacementRulesRegistry = class {
 			]),
 			conditionalReplacements: /* @__PURE__ */ new Map([["InstanceTenancy", vpcInstanceTenancyChangeReplaces]])
 		});
+		this.rules.set("AWS::RDS::DBCluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Engine", dbClusterEngineChangeReplaces]])
+		});
+		this.rules.set("AWS::RDS::DBInstance", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Engine", dbInstanceEngineChangeReplaces]])
+		});
 		this.rules.set("AWS::EC2::Subnet", {
 			replacementProperties: /* @__PURE__ */ new Set([
 				"VpcId",
@@ -13057,6 +13107,10 @@ var ReplacementRulesRegistry = class {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["LaunchType", ecsServiceLaunchTypeSetOrChanged]])
 		});
+		this.rules.set("AWS::ElastiCache::CacheCluster", {
+			replacementProperties: /* @__PURE__ */ new Set(),
+			conditionalReplacements: /* @__PURE__ */ new Map([["PreferredAvailabilityZones", elastiCachePreferredAvailabilityZonesMovedToDisjoint]])
+		});
 		this.rules.set("AWS::EMR::Cluster", {
 			replacementProperties: /* @__PURE__ */ new Set(),
 			conditionalReplacements: /* @__PURE__ */ new Map([["Instances", emrClusterInstancesReplaced]])
@@ -14940,7 +14994,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -14980,7 +15034,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$8(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$10(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -14992,7 +15046,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -15005,7 +15059,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -15019,7 +15073,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$8(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -15033,10 +15087,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$10(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$8(value) {
+function isPlainObject$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -15063,7 +15117,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$8(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$10(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -16345,6 +16399,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::CloudTrail::Trail", {
 		handled: /* @__PURE__ */ new Set([
+			"AdvancedEventSelectors",
+			"AggregationConfigurations",
 			"CloudWatchLogsLogGroupArn",
 			"CloudWatchLogsRoleArn",
 			"EnableLogFileValidation",
@@ -16361,7 +16417,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags",
 			"TrailName"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["AdvancedEventSelectors", "not yet implemented by cdkd"], ["AggregationConfigurations", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "SnsTopicArn"]),
 		ccRouteUnavailable: false
@@ -20069,12 +20125,12 @@ function declaresNoEcho(definition) {
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
-function canonicalJson$3(value) {
+function canonicalJson$4(value) {
 	if (value === void 0) return "null";
-	if (Array.isArray(value)) return `[${value.map(canonicalJson$3).join(",")}]`;
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$4).join(",")}]`;
 	if (value !== null && typeof value === "object") {
 		const record = value;
-		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$3(record[key])}`).join(",")}}`;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$4(record[key])}`).join(",")}}`;
 	}
 	return JSON.stringify(value) ?? "null";
 }
@@ -20095,7 +20151,7 @@ function splitInputFingerprint(entry) {
 	};
 }
 function templateCarriesNeedle(templateValue, secrets) {
-	const text = canonicalJson$3(templateValue);
+	const text = canonicalJson$4(templateValue);
 	for (const needle of printingCorpusOf(secrets).keys()) {
 		if (needle.length < 4) continue;
 		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
@@ -20103,14 +20159,14 @@ function templateCarriesNeedle(templateValue, secrets) {
 	return false;
 }
 function maskedPropertyFingerprint(templateValue) {
-	const digest = createHash("sha256").update(canonicalJson$3({
+	const digest = createHash("sha256").update(canonicalJson$4({
 		layout: FINGERPRINT_LAYOUT$1,
 		value: templateValue
 	})).digest("hex");
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$7(value) {
+function isPlainObject$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -20118,7 +20174,7 @@ const NESTED_STACK_TYPE$4 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
-	const text = canonicalJson$3(value);
+	const text = canonicalJson$4(value);
 	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
 	for (const corpus of corpora) {
 		if (corpus === void 0) continue;
@@ -20130,7 +20186,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$7(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$9(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -20141,7 +20197,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$7(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$9(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -20192,7 +20248,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$7(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$9(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -20217,7 +20273,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$7(value)) return false;
+		if (!isPlainObject$9(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -20229,7 +20285,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -20243,7 +20299,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$7(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$9(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -20259,7 +20315,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$7(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$9(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -20274,7 +20330,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$7(value)) return;
+		if (!isPlainObject$9(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -20307,7 +20363,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -20336,8 +20392,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$7(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$7(map)) return "unknown";
+	const map = isPlainObject$9(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$9(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -20405,7 +20461,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$7(value)) return {
+	if (!isPlainObject$9(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -20468,7 +20524,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -20521,8 +20577,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$7(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$7(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$9(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$9(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -20546,34 +20602,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$7(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$9(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$7(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$9(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$7(properties)) return "unknown";
+	if (!isPlainObject$9(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$7(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$9(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$7(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$9(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$7(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$9(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$7(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$9(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -20590,7 +20646,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$7(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$9(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -20603,8 +20659,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$7(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$7(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$9(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$9(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -20676,7 +20732,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$7(value)) return "clean";
+	if (!isPlainObject$9(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -20691,7 +20747,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$7(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$9(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -20755,7 +20811,7 @@ async function maskedInputFingerprint(templateValue, sources) {
 		if (error instanceof UnknownInput) return void 0;
 		throw error;
 	}
-	const digest = createHash("sha256").update(canonicalJson$3({
+	const digest = createHash("sha256").update(canonicalJson$4({
 		layout: INPUT_FINGERPRINT_LAYOUT,
 		value: form
 	})).digest("hex");
@@ -20769,7 +20825,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$7(parameters)) return classes;
+	if (!isPlainObject$9(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -20810,13 +20866,13 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$7(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$9(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
 		const value = resolvedProps[key];
 		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
-		const text = canonicalJson$3(value);
+		const text = canonicalJson$4(value);
 		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
 	});
 }
@@ -20841,7 +20897,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$7(field)) return read;
+	if (!isPlainObject$9(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -20849,7 +20905,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$7(field)) return read;
+	if (!isPlainObject$9(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -20896,7 +20952,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$7(field) ? Object.entries(field) : [];
+	const next = isPlainObject$9(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -20929,10 +20985,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$7(previous)) return scrubbed;
+		if (!isPlainObject$9(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$7(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$9(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -22273,11 +22329,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$6(value) {
+function isPlainObject$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$6(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$8(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -22295,11 +22351,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$8(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$6(field)) return void 0;
+	if (!isPlainObject$8(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -22308,9 +22364,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$6(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$8(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$6(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$8(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -22332,7 +22388,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$6(field)) return record;
+	if (!isPlainObject$8(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -22344,12 +22400,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$6(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$8(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$6(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$8(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$6(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$8(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -22367,7 +22423,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$6(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$8(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -22410,7 +22466,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$6(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$8(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -25930,19 +25986,49 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	}
 };
 
+//#endregion
+//#region src/state/unsettled-properties.ts
+function unsettledPropertiesOf(record) {
+	if (record === null || typeof record !== "object") return /* @__PURE__ */ new Set();
+	const value = record.unsettledProperties;
+	if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+	return new Set(value.filter((entry) => typeof entry === "string" && entry !== ""));
+}
+function withUnsettledProperties(record, names) {
+	const merged = new Set(unsettledPropertiesOf(record));
+	const before = merged.size;
+	for (const name of names) if (typeof name === "string" && name !== "") merged.add(name);
+	if (merged.size === before && Array.isArray(record.unsettledProperties)) return record;
+	if (merged.size === 0) return withoutUnsettledProperties(record);
+	return {
+		...record,
+		unsettledProperties: [...merged].sort()
+	};
+}
+function withoutUnsettledProperties(record) {
+	if (!Object.hasOwn(record, "unsettledProperties")) return record;
+	const { unsettledProperties: _cleared, ...rest } = record;
+	return rest;
+}
+function unsettledContextOf(...records) {
+	const names = /* @__PURE__ */ new Set();
+	for (const record of records) for (const name of unsettledPropertiesOf(record)) names.add(name);
+	return names.size > 0 ? { unsettledProperties: names } : {};
+}
+
 //#endregion
 //#region src/analyzer/read-provenance-promotion.ts
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readsAcrossStacks(value) {
 	if (Array.isArray(value)) return value.some(readsAcrossStacks);
-	if (!isPlainObject$5(value)) return false;
+	if (!isPlainObject$7(value)) return false;
 	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
 	return Object.values(value).some(readsAcrossStacks);
 }
 function recordedReadVersions(record) {
-	if (!isPlainObject$5(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$7(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = referenceProvenanceOf(record);
 	if (field === void 0) return void 0;
 	let out;
@@ -25953,7 +26039,7 @@ async function readProvenancePromotions(args) {
 	const { currentState, desiredTemplate, sources } = args;
 	const parser = args.parser ?? new TemplateParser();
 	const records = currentState.resources;
-	const parameters = isPlainObject$5(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const parameters = isPlainObject$7(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
 	const out = [];
 	for (const { logicalId, changeType } of args.rows) {
 		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
@@ -25961,7 +26047,7 @@ async function readProvenancePromotions(args) {
 		const readVersions = recordedReadVersions(record);
 		if (readVersions === void 0) continue;
 		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
-		const properties = isPlainObject$5(resource?.Properties) ? resource.Properties : {};
+		const properties = isPlainObject$7(resource?.Properties) ? resource.Properties : {};
 		const reads = [];
 		for (const [key, value] of Object.entries(properties)) {
 			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
@@ -26004,7 +26090,7 @@ async function readProvenancePromotions(args) {
 			if (recorded.some((version) => !domain.has(version))) moved.push(token);
 		}
 		if (moved.length === 0) continue;
-		const recordProperties = isPlainObject$5(record?.properties) ? record.properties : {};
+		const recordProperties = isPlainObject$7(record?.properties) ? record.properties : {};
 		const keys = [];
 		for (const r of reads) {
 			if (!Object.hasOwn(recordProperties, r.key)) continue;
@@ -26174,6 +26260,18 @@ var DiffCalculator = class DiffCalculator {
 					});
 					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
 				}
+				const listed = new Set(propertyChanges.map((pc) => pc.path));
+				for (const key of unsettledPropertiesOf(currentResource)) {
+					if (listed.has(key)) continue;
+					propertyChanges.push({
+						path: key,
+						oldValue: currentCompared[key],
+						newValue: desiredCompared[key],
+						requiresReplacement: false,
+						unsettled: true
+					});
+					this.logger.debug(safeMsg`${logicalId}: ${key} is unsettled after a failed update and is sent again`);
+				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -27593,8 +27691,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$4(previous)) {
-		if (!isPlainObject$4(desired)) return "differs";
+	if (isPlainObject$6(previous)) {
+		if (!isPlainObject$6(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -27620,7 +27718,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -28573,7 +28671,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B7pAjRIc.js");
+			const { ASGProvider } = await import("./asg-provider-I1bFHVsO.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28682,7 +28780,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CZhBLQgJ.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Y3Ii8oYI.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BqwTQeS-.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-8kjFmR1l.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29838,11 +29936,11 @@ function applyNoEchoDeleteValues(properties, recordedLeaves, values) {
 		payload: properties,
 		unresolved: []
 	};
-	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$4(leaf.coordinate), leaf]));
+	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$5(leaf.coordinate), leaf]));
 	const entries = [];
 	const unresolved = [];
 	for (const coordinate of masked) {
-		const leaf = byKey.get(canonicalJson$4(coordinate));
+		const leaf = byKey.get(canonicalJson$5(coordinate));
 		if (leaf === void 0) unresolved.push(coordinate);
 		else entries.push({
 			coordinate,
@@ -29893,7 +29991,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	const fingerprinter = options.inputSources === void 0 ? void 0 : inputFingerprinter(templateProps, options.inputSources);
 	const leaves = [];
 	for (const coordinate of masked) {
-		if (!nodes.has(canonicalJson$4(coordinate))) continue;
+		if (!nodes.has(canonicalJson$5(coordinate))) continue;
 		if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 		const value = valueAtCoordinate(resolvedProperties, coordinate);
 		if (value === void 0 || carriesSecretMask(value)) continue;
@@ -30072,7 +30170,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const bag = await this.noEchoNeedles();
 		const leaves = [];
 		for (const coordinate of masked) {
-			const key = canonicalJson$4(coordinate);
+			const key = canonicalJson$5(coordinate);
 			if (!nodes.has(key)) continue;
 			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
@@ -37163,7 +37261,7 @@ const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
-function canonicalJson$2(value) {
+function canonicalJson$3(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
 			const sorted = Object.create(null);
@@ -37193,7 +37291,7 @@ function skippedOutputDigest(template, outputKey) {
 		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
 	}
 	const entry = template.Outputs?.[outputKey];
-	return createHash("sha256").update(canonicalJson$2({
+	return createHash("sha256").update(canonicalJson$3({
 		output: entry,
 		template: sections
 	})).digest("hex");
@@ -38555,9 +38653,9 @@ function sameIdReversalDone(op, current) {
 	const now = current.properties ?? {};
 	if (forward === void 0) return "undecidable";
 	const own = (bag, key) => Object.hasOwn(bag, key) ? bag[key] : void 0;
-	const changed = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(forward)])].filter((key) => !deepEqual$1(own(before, key), own(forward, key)));
-	if (changed.length === 0) return holdsRedactedLeaf(before) ? "undecidable" : deepEqual$1(now, before);
-	return changed.every((key) => deepEqual$1(own(now, key), own(before, key)));
+	const changed = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(forward)])].filter((key) => !deepEqual$2(own(before, key), own(forward, key)));
+	if (changed.length === 0) return holdsRedactedLeaf(before) ? "undecidable" : deepEqual$2(now, before);
+	return changed.every((key) => deepEqual$2(own(now, key), own(before, key)));
 }
 function holdsRedactedLeaf(value) {
 	if (typeof value === "string") return value.includes("***");
@@ -38567,14 +38665,14 @@ function holdsRedactedLeaf(value) {
 function sameIdReversalUndecidable(op, current) {
 	return sameIdRecreated(op) && current !== void 0 && sameIdReversalDone(op, current) === "undecidable";
 }
-function deepEqual$1(a, b) {
+function deepEqual$2(a, b) {
 	if (a === b) return true;
 	if (a == null || b == null) return a === b;
 	if (typeof a !== typeof b) return false;
 	if (typeof a !== "object") return false;
 	if (Array.isArray(a) || Array.isArray(b)) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => deepEqual$1(v, b[i]));
+		return a.every((v, i) => deepEqual$2(v, b[i]));
 	}
 	const ao = a;
 	const bo = b;
@@ -38582,7 +38680,7 @@ function deepEqual$1(a, b) {
 	if (ak.length !== Object.keys(bo).length) return false;
 	for (const k of ak) {
 		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-		if (!deepEqual$1(ao[k], bo[k])) return false;
+		if (!deepEqual$2(ao[k], bo[k])) return false;
 	}
 	return true;
 }
@@ -38621,13 +38719,13 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 			return "reverse-replacement-readopt";
 		}
 		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) {
-			if (sameTypeAsOld && deepEqual$1(current.properties, op.previousState.properties)) return "skip-already-done";
+			if (sameTypeAsOld && deepEqual$2(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
 		}
 		if (!resolveReplacementOldType(op).ok) return "refuse-replacement-routing";
 		return op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
-	if (op.previousState && deepEqual$1(current.properties, op.previousState.properties)) return "skip-already-done";
+	if (op.previousState && deepEqual$2(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
 }
 function classifyFailedOp(op, stateResources, siblings = []) {
@@ -38977,7 +39075,7 @@ function replaceAtCoordinate(bag, coordinate, value) {
 	});
 	return root;
 }
-async function readLive(live, baseline, marked, logicalId, ctx) {
+async function readLive$1(live, baseline, marked, logicalId, ctx) {
 	let readCurrentState;
 	try {
 		const { provider } = ctx.providerRegistry.getProviderFor({
@@ -39018,7 +39116,7 @@ async function substituteMarkedNoEchoLeaves(input) {
 		...identity,
 		inert: pending
 	};
-	const read = await readLive(live, baseline, pending, logicalId, ctx);
+	const read = await readLive$1(live, baseline, pending, logicalId, ctx);
 	if ("failure" in read) throw unreadableNoEchoLeafRefusal(logicalId, pending, read.failure);
 	const values = [];
 	const unreadable = [];
@@ -39066,7 +39164,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	const marked = noEchoLeavesOf(baseline) ?? [];
 	const names = declaredNoEchoAttributeNames(baseline);
 	if (marked.length === 0 && names.length === 0 && substituted.length === 0) return record;
-	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$4(leaf.value) === canonicalJson$4(value));
+	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$5(leaf.value) === canonicalJson$5(value));
 	let attributes = record.attributes;
 	if (attributes !== void 0 && attributes !== null && typeof attributes === "object") for (const [name, value] of Object.entries(attributes)) {
 		if (!names.includes(name) && !echoes(name, value)) continue;
@@ -39077,7 +39175,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 		const list = coordinate.findIndex((segment) => typeof segment === "number");
 		if (list < 0) return false;
 		const path = coordinate.slice(0, list);
-		return canonicalJson$4(valueAtCoordinate(byIndex, path)) !== canonicalJson$4(valueAtCoordinate(baseline.properties, path));
+		return canonicalJson$5(valueAtCoordinate(byIndex, path)) !== canonicalJson$5(valueAtCoordinate(baseline.properties, path));
 	});
 	const properties = reshaped.length === 0 ? byIndex : maskReadbackAtCoordinates(byIndex, baseline.properties, reshaped);
 	const widened = reshaped.map((coordinate) => readbackPathFor(byIndex, baseline.properties, coordinate)).filter((path, i) => path !== void 0 && path.length < reshaped[i].length);
@@ -39191,6 +39289,355 @@ function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are five ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. (5) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: restore the property with a 'cdkd deploy' that changes this resource, which sends it the value again. Every rollback to such a baseline refuses while the two values still overlap there, so to end this, change the property (or rotate one of the secrets) so that they no longer overlap. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
+//#endregion
+//#region src/analyzer/drift-normalize.ts
+function canonicalizeTagListsDeep(v) {
+	if (Array.isArray(v)) {
+		const mapped = v.map(canonicalizeTagListsDeep);
+		if (mapped.length > 0 && mapped.every((t) => t && typeof t === "object" && typeof t.Key === "string")) return [...mapped].sort((a, b) => {
+			const ka = a.Key;
+			const kb = b.Key;
+			if (ka !== kb) return ka < kb ? -1 : 1;
+			return JSON.stringify(a) < JSON.stringify(b) ? -1 : 1;
+		});
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		if (!hasPlainPrototype$1(v)) return v;
+		const out = nullPrototypeRecord();
+		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeTagListsDeep(val);
+		return out;
+	}
+	return v;
+}
+const ID_RE = /^[a-z][a-z0-9]*-[0-9a-f]{6,}$/;
+const isIdLike = (s) => typeof s === "string" && (s.startsWith("arn:") || ID_RE.test(s));
+function canonicalizeIdArraysDeep(v) {
+	if (Array.isArray(v)) {
+		const mapped = v.map(canonicalizeIdArraysDeep);
+		if (mapped.length > 1 && mapped.every(isIdLike)) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		if (!hasPlainPrototype$1(v)) return v;
+		const out = nullPrototypeRecord();
+		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeIdArraysDeep(val);
+		return out;
+	}
+	return v;
+}
+const LEAF_ONLY_PATH_SUFFIX = "[]";
+function matchesPathPrefix(path, entries) {
+	for (const entry of entries) {
+		if (entry.endsWith("[]")) {
+			const leaf = entry.slice(0, -2);
+			if (leaf !== "" && path === leaf) return true;
+			continue;
+		}
+		if (path === entry) return true;
+		if (path.startsWith(`${entry}.`)) return true;
+	}
+	return false;
+}
+function canonicalizeUnorderedArraysAtPaths(v, paths) {
+	if (paths.length === 0) return v;
+	return walkUnordered(v, "", paths);
+}
+function canonicalJson$2(v) {
+	if (Array.isArray(v)) return `[${v.map(canonicalJson$2).join(",")}]`;
+	if (v && typeof v === "object") {
+		const bag = v;
+		return `{${Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson$2(bag[k])}`).join(",")}}`;
+	}
+	return JSON.stringify(v) ?? "null";
+}
+const isPlainObjectElement = (el) => el !== null && typeof el === "object" && !Array.isArray(el);
+function walkUnordered(v, path, paths) {
+	if (Array.isArray(v)) {
+		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
+		if (mapped.length > 1 && matchesPathPrefix(path, paths)) {
+			if (mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+			if (mapped.every(isPlainObjectElement)) {
+				const keyed = mapped.map((el) => ({
+					el,
+					key: canonicalJson$2(el)
+				}));
+				keyed.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+				return keyed.map((k) => k.el);
+			}
+		}
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		if (!hasPlainPrototype$1(v)) return v;
+		const out = nullPrototypeRecord();
+		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
+		return out;
+	}
+	return v;
+}
+
+//#endregion
+//#region src/analyzer/drift-calculator.ts
+function calculateResourceDrift(stateProperties, awsProperties, options) {
+	const drifts = [];
+	const ignore = options?.ignorePaths ?? [];
+	const union = options?.unionWalkObjects ?? false;
+	const unordered = options?.unorderedPaths ?? [];
+	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
+	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
+	for (const key of Object.keys(stateProperties)) {
+		if (isIgnoredPath(key, ignore)) continue;
+		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
+	}
+	return drifts;
+}
+function undeclaredEmptyObservedKeys(observed, declared) {
+	const keys = [];
+	for (const key of Object.keys(observed)) {
+		if (Object.hasOwn(declared, key)) continue;
+		const value = observed[key];
+		if (value === null || value === void 0 || Array.isArray(value) && value.length === 0 || isPlainObject$5(value) && Object.keys(value).length === 0) keys.push(key);
+	}
+	return keys;
+}
+function isIgnoredPath(path, ignorePaths) {
+	return matchesPathPrefix(path, ignorePaths);
+}
+function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
+	const stateForm = jsonForm(stateValue);
+	const awsForm = jsonForm(awsValue);
+	if (deepEqual$1(stateForm, awsForm)) return;
+	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
+	if (isPlainObject$5(stateForm) && isPlainObject$5(awsForm) && !Array.isArray(stateForm) && !Array.isArray(awsForm)) {
+		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateForm), ...Object.keys(awsForm)]) : Object.keys(stateForm);
+		for (const key of keys) {
+			const childPath = `${path}.${key}`;
+			if (isIgnoredPath(childPath, ignorePaths)) continue;
+			diffAt(childPath, stateForm[key], awsForm[key], out, ignorePaths, unionWalkObjects);
+		}
+		return;
+	}
+	out.push({
+		path,
+		stateValue,
+		awsValue
+	});
+}
+function jsonForm(value) {
+	if (value === null || typeof value !== "object" || hasPlainPrototype$1(value)) return value;
+	const toJSON = value.toJSON;
+	return typeof toJSON === "function" ? toJSON.call(value) : value;
+}
+function deepEqual$1(a, b) {
+	a = jsonForm(a);
+	b = jsonForm(b);
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b)) return false;
+		if (a.length !== b.length) return false;
+		return a.every((v, i) => deepEqual$1(v, b[i]));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	const bKeys = Object.keys(bObj);
+	if (aKeys.length !== bKeys.length) return false;
+	for (const key of aKeys) {
+		if (!Object.prototype.hasOwnProperty.call(bObj, key)) return false;
+		if (!deepEqual$1(aObj[key], bObj[key])) return false;
+	}
+	return true;
+}
+function equalModuloMask(state, aws, mask) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (a === mask && b !== null && b !== void 0) return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMask(v, b[i], mask));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
+}
+function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinMarked = isMarked) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (isMarked(coordinate) && b !== void 0 && b !== null) {
+		if (a === mask) return true;
+		if (isWithinMarked(coordinate) ? isWhollyMask$1(a, mask) : sameJson(a, wholeMaskOf(b, mask))) return holdsMask(a, mask);
+	}
+	if (a === mask && (typeof b === "string" || typeof b === "number" || typeof b === "boolean")) return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked, isWithinMarked));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked, isWithinMarked));
+}
+function wholeMaskOf(value, mask) {
+	if (value === null || value === void 0) return value;
+	if (Array.isArray(value)) return value.map((v) => wholeMaskOf(v, mask));
+	if (isPlainObject$5(value)) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
+	return mask;
+}
+function isWhollyMask$1(value, mask) {
+	const walk = (node) => {
+		if (node === mask || node === null) return true;
+		if (Array.isArray(node)) return node.every(walk);
+		if (isPlainObject$5(node)) return Object.values(node).every(walk);
+		return false;
+	};
+	return walk(value) && holdsMask(value, mask);
+}
+function holdsMask(value, mask) {
+	if (value === mask) return true;
+	if (Array.isArray(value)) return value.some((v) => holdsMask(v, mask));
+	if (isPlainObject$5(value)) return Object.values(value).some((v) => holdsMask(v, mask));
+	return false;
+}
+function sameJson(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => sameJson(v, b[i]));
+	}
+	const aObj = a;
+	const bObj = b;
+	const keys = Object.keys(aObj);
+	return keys.length === Object.keys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
+}
+function isPlainObject$5(value) {
+	return typeof value === "object" && value !== null;
+}
+
+//#endregion
+//#region src/deployment/unsettled-convergence.ts
+const MERGE_SEMANTICS_KEYS = /* @__PURE__ */ new Set(["Tags"]);
+async function readLive(args, names) {
+	const { provider, physicalId, logicalId, resourceType, recordedProperties } = args;
+	let live;
+	if (provider.readUnsettled !== void 0) live = await provider.readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, args.desired);
+	else if (provider.readCurrentState !== void 0) live = await provider.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
+	else return;
+	if (typeof live !== "object" || live === null || Array.isArray(live)) return "unreadable";
+	return live;
+}
+function refusal(args, names, why) {
+	const list = [...names].sort().join(", ");
+	return new ProvisioningError(`${args.logicalId} (${args.resourceType}): an earlier failed update left ${list} unsettled, and ${why} — nothing was updated. Re-run the deploy once the resource has settled` + (args.provider.readCurrentState !== void 0 ? ", or, to keep what AWS holds instead, run 'cdkd drift --accept' once it has." : "."), args.resourceType, args.logicalId, args.physicalId);
+}
+async function settleUnsettledPrevious(args) {
+	const { names, previous, provider } = args;
+	if (names.size === 0) return previous;
+	if (provider.unsettledInTransition !== void 0) {
+		const moving = await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties);
+		if (moving.size > 0) throw refusal(args, moving, "AWS is still changing it or cdkd could not confirm it settled");
+	}
+	const substituted = new Set([...names].filter((name) => !MERGE_SEMANTICS_KEYS.has(name)));
+	if (substituted.size === 0) return previous;
+	let live;
+	try {
+		live = await readLive(args, substituted);
+	} catch (error) {
+		if (error instanceof ProvisioningError) throw error;
+		const wrapped = refusal(args, substituted, "the resource could not be read to converge it");
+		if (error instanceof Error) wrapped.cause = error;
+		throw wrapped;
+	}
+	if (live === void 0) return previous;
+	if (live === "unreadable") throw refusal(args, substituted, "the resource could not be read to converge it");
+	const out = { ...previous };
+	for (const name of substituted) if (Object.hasOwn(live, name) && live[name] !== void 0) out[name] = live[name];
+	else delete out[name];
+	return out;
+}
+function tagsHeld(desired, live) {
+	const asMap = (value) => {
+		if (value === void 0 || value === null) return /* @__PURE__ */ new Map();
+		if (Array.isArray(value)) {
+			const map = /* @__PURE__ */ new Map();
+			for (const entry of value) {
+				if (typeof entry !== "object" || entry === null) return void 0;
+				const { Key, Value } = entry;
+				if (typeof Key !== "string") return void 0;
+				map.set(Key, Value);
+			}
+			return map;
+		}
+		if (typeof value === "object") return new Map(Object.entries(value));
+	};
+	const want = asMap(desired);
+	const have = asMap(live);
+	if (want === void 0 || have === void 0) return false;
+	for (const [key, value] of want) if (!have.has(key) || JSON.stringify(have.get(key)) !== JSON.stringify(value)) return false;
+	return true;
+}
+async function unsettledAfterUpdate(args) {
+	const { names, desired, provider } = args;
+	if (names.size === 0) return [];
+	try {
+		const moving = provider.unsettledInTransition === void 0 ? /* @__PURE__ */ new Set() : await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties);
+		const live = await readLive(args, names);
+		if (live === void 0) return [...moving].sort();
+		if (live === "unreadable") return [...names].sort();
+		const ignorePaths = provider.getDriftUnknownPaths?.(args.resourceType) ?? [];
+		const unorderedPaths = provider.getDriftUnorderedPaths?.(args.resourceType) ?? [];
+		const kept = [];
+		for (const name of names) {
+			if (moving.has(name)) {
+				kept.push(name);
+				continue;
+			}
+			if (MERGE_SEMANTICS_KEYS.has(name)) {
+				if (!tagsHeld(desired[name], live[name])) kept.push(name);
+				continue;
+			}
+			if (!Object.hasOwn(live, name) || desired[name] === void 0) continue;
+			if (calculateResourceDrift({ [name]: desired[name] }, { [name]: live[name] }, {
+				ignorePaths,
+				unorderedPaths
+			}).length > 0) kept.push(name);
+		}
+		return kept.sort();
+	} catch {
+		return [...names].sort();
+	}
+}
+async function withUnprovenUnsettled(record, args, warn) {
+	const kept = await unsettledAfterUpdate(args);
+	if (kept.length === 0) return record;
+	warn(safeMsg`${args.logicalId} (${args.resourceType}): the update succeeded, but AWS does not yet show the requested ${kept.join(", ")}; cdkd keeps ${kept.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
+	return withUnsettledProperties(record, kept);
+}
+function splitUnhandledRemovals(unhandled, recordedPrevious, unsettled) {
+	const addedByFailedUpdate = unhandled.filter((name) => unsettled.has(name) && !Object.hasOwn(recordedPrevious, name));
+	return {
+		removedFromTemplate: unhandled.filter((name) => !addedByFailedUpdate.includes(name)),
+		addedByFailedUpdate
+	};
+}
+function addedByFailedUpdateWarning(logicalId, resourceType, names) {
+	const one = names.length === 1;
+	return safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} set on the resource but in no template: an earlier failed update applied ${one ? "it" : "them"}. cdkd has no default to reset ${one ? "it" : "them"} to, so the value stays; remove it by hand if it should not be there.`;
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-retry.ts
 const RECREATE_RETRY_SCHEDULE = {
@@ -39199,7 +39646,17 @@ const RECREATE_RETRY_SCHEDULE = {
 	maxDelayMs: 1e4
 };
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets, mask) {
-	const [, , resourceType, desired, previous, context] = args;
+	const [, , resourceType, desired, recordedPrevious, context] = args;
+	const previous = await settleUnsettledPrevious({
+		provider,
+		logicalId: args[0],
+		physicalId: args[1],
+		resourceType,
+		recordedProperties: recordedPrevious,
+		names: context?.unsettledProperties ?? /* @__PURE__ */ new Set(),
+		previous: recordedPrevious,
+		desired
+	});
 	const removal = prepareRemovalForUpdate(provider, resourceType, desired, previous);
 	const revertArgs = [
 		args[0],
@@ -39213,7 +39670,9 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 		}
 	];
 	const recorded = (result) => {
-		if (removal.unhandled.length > 0) logger.warn(mask(removalWarning(logicalId, resourceType, removal.unhandled, "rollback")));
+		const unhandledByCause = splitUnhandledRemovals(removal.unhandled, recordedPrevious, context?.unsettledProperties ?? /* @__PURE__ */ new Set());
+		if (unhandledByCause.removedFromTemplate.length > 0) logger.warn(mask(removalWarning(logicalId, resourceType, unhandledByCause.removedFromTemplate, "rollback")));
+		if (unhandledByCause.addedByFailedUpdate.length > 0) logger.warn(mask(addedByFailedUpdateWarning(logicalId, resourceType, unhandledByCause.addedByFailedUpdate)));
 		return result === void 0 ? void 0 : withoutInjectedRemovals(result, removal.injected);
 	};
 	if (provider.disableOuterRetry) return recorded(await withCurrentResourceSecrets(secrets, () => provider.update(...revertArgs)));
@@ -39246,6 +39705,9 @@ async function createWithRollbackRetry(provider, create, logicalId, logger, isIn
 	});
 }
 function recordAfterRollbackUpdate(restored, result) {
+	return withoutUnsettledProperties(recordAfterRollbackUpdateUnsettled(restored, result));
+}
+function recordAfterRollbackUpdateUnsettled(restored, result) {
 	if (result === void 0) return restored;
 	const returned = result.attributes;
 	const replacedId = result.wasReplaced && typeof result.physicalId === "string" && result.physicalId !== "" ? result.physicalId : void 0;
@@ -39537,12 +39999,22 @@ async function replayRevert(s) {
 			expectedRegion: ctx.region,
 			replayingState: true,
 			recordedAttributes: current.attributes,
-			...revertClaimed && { inlinePolicyClaimed: revertClaimed }
+			...revertClaimed && { inlinePolicyClaimed: revertClaimed },
+			...unsettledContextOf(current, previousState)
 		}
 	], op.logicalId, logger, isInterrupted, secrets, mask));
 	if (revertResult) recordNoEchoAttributeValues(revertResult, secrets, desiredProps);
 	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties, previousState.attributes), previousState, noEcho.substituted);
-	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
+	stateResources[op.logicalId] = await withUnprovenUnsettled(stateResources[op.logicalId], {
+		provider,
+		logicalId: op.logicalId,
+		physicalId: current.physicalId,
+		resourceType: op.resourceType,
+		recordedProperties: current.properties ?? {},
+		names: unsettledContextOf(current, previousState).unsettledProperties ?? /* @__PURE__ */ new Set(),
+		desired: desiredProps ?? {}
+	}, (message) => logger.warn(mask(message)));
+	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
 	if (rollbackPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`));
 	else logger.info(`  Rollback: ${safe(op.logicalId)} restored successfully`);
@@ -40484,12 +40956,22 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 							expectedRegion: ctx.region,
 							replayingState: true,
 							recordedAttributes: current.attributes,
-							...revertFailedClaimed && { inlinePolicyClaimed: revertFailedClaimed }
+							...revertFailedClaimed && { inlinePolicyClaimed: revertFailedClaimed },
+							...unsettledContextOf(current, prev)
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
 					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(withNameGenerationReached(recordAfterRollbackUpdate(prev, revertFailedResult), op.logicalId, op.nameGeneration), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
-					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
+					stateResources[op.logicalId] = await withUnprovenUnsettled(stateResources[op.logicalId], {
+						provider,
+						logicalId: op.logicalId,
+						physicalId: current.physicalId,
+						resourceType: op.resourceType,
+						recordedProperties: current.properties ?? {},
+						names: unsettledContextOf(current, prev).unsettledProperties ?? /* @__PURE__ */ new Set(),
+						desired: desiredProps ?? {}
+					}, (message) => logger.warn(mask(message)));
+					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
 					else logger.info(`  Rollback: ${safe(op.logicalId)} reverted successfully`);
@@ -42403,7 +42885,7 @@ async function revertNestedChildFromJournal(args) {
 			...carried,
 			...stackInstanceIdCarriedFrom(base),
 			...supersededAfterRollback(base, supersededHost),
-			version: 13,
+			version: 14,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
@@ -44546,7 +45028,7 @@ function stdoutSupportsColor(env = process.env, argv = process.argv, isTTY = pro
 //#endregion
 //#region src/analyzer/security-diff.ts
 function isSyntheticChange(pc) {
-	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true || pc.unsettled === true;
 }
 function withChanges(base, changes, side) {
 	const props = { ...base ?? {} };
@@ -44926,18 +45408,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalJson$1(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
-	if (isPlainObject$3(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
+	if (isPlainObject$4(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject$3(value)) return false;
+	if (!isPlainObject$4(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44960,8 +45442,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject$3(definitions)) return void 0;
-	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$4(definitions)) return void 0;
+	const declared = isPlainObject$4(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44983,7 +45465,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$4(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -45014,7 +45496,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject$3(value)) return;
+	if (!isPlainObject$4(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -45028,9 +45510,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject$3(section)) continue;
+		if (!isPlainObject$4(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject$3(entry)) continue;
+			if (!isPlainObject$4(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -45062,10 +45544,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject$3(field)) return read;
+	if (!isPlainObject$4(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject$3(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$4(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -45111,11 +45593,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$4(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject$3(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$4(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45450,7 +45932,7 @@ function deferredServiceTokenWarning(row) {
 
 //#endregion
 //#region src/deployment/read-provenance-sources.ts
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function crossStackNodes(value, into = []) {
@@ -45458,7 +45940,7 @@ function crossStackNodes(value, into = []) {
 		for (const item of value) crossStackNodes(item, into);
 		return into;
 	}
-	if (!isPlainObject$2(value)) return into;
+	if (!isPlainObject$3(value)) return into;
 	const keys = Object.keys(value);
 	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
 	for (const item of Object.values(value)) crossStackNodes(item, into);
@@ -45482,11 +45964,11 @@ function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
 function inheritedProvenanceForChildDiff(args) {
 	const { row, rowRecord, parentRecords, parentTemplate } = args;
 	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
-	const recordedParameters = isPlainObject$2(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const recordedParameters = isPlainObject$3(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
 	const tokens = referenceTokensIn(recordedParameters);
 	if (tokens.size === 0) return void 0;
 	const own = referenceProvenanceOf(rowRecord);
-	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$2(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject$3(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
 	const out = /* @__PURE__ */ new Map();
 	for (const token of tokens) {
 		const versions = /* @__PURE__ */ new Set();
@@ -46720,7 +47202,10 @@ const CI_PATH = `Replicas[].${CONTRIBUTOR_INSIGHTS_KEY}`;
 const KINESIS_PATH = `Replicas[].${KINESIS_KEY}`;
 const TABLE_POLICY_PATH = `Replicas[].${TABLE_POLICY_KEY}`;
 const STREAM_POLICY_PATH = `Replicas[].${REPLICA_STREAM_KEY}.ResourcePolicy`;
-function isPlainObject$1(value) {
+const INDEX_CI_PATH = `Replicas[].${INDEX_CONTRIBUTOR_INSIGHTS_PATH}`;
+const STREAM_TAGS_PATH = `Replicas[].${REPLICA_STREAM_KEY}.Tags`;
+const REPLICA_INDEXES_KEY = "GlobalSecondaryIndexes";
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readPitrSpec(value) {
@@ -46767,7 +47252,7 @@ function readKinesisSpec(value) {
 }
 function readPolicyBlock(value, path) {
 	if (value === void 0 || value === null) return { kind: "absent" };
-	if (!isPlainObject$1(value)) return {
+	if (!isPlainObject$2(value)) return {
 		kind: "unusable",
 		reason: `${path} must be an object with a PolicyDocument`
 	};
@@ -46779,7 +47264,7 @@ function readPolicyBlock(value, path) {
 		kind: "usable",
 		document
 	};
-	if (!isPlainObject$1(document)) return {
+	if (!isPlainObject$2(document)) return {
 		kind: "unusable",
 		reason: `${path}.PolicyDocument must be a policy object or a JSON string`
 	};
@@ -46799,20 +47284,49 @@ function readTablePolicy(replica) {
 function readStreamPolicy$1(replica) {
 	const stream = replica?.[REPLICA_STREAM_KEY];
 	if (stream === void 0 || stream === null) return { kind: "absent" };
-	if (!isPlainObject$1(stream)) return {
+	if (!isPlainObject$2(stream)) return {
 		kind: "unusable",
 		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
 	};
 	return readPolicyBlock(stream["ResourcePolicy"], STREAM_POLICY_PATH);
 }
+function readStreamTags$1(replica) {
+	const stream = replica?.[REPLICA_STREAM_KEY];
+	if (stream === void 0 || stream === null) return {
+		kind: "tags",
+		tags: []
+	};
+	if (!isPlainObject$2(stream)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICA_STREAM_KEY} must be an object`
+	};
+	const read = readTagList(stream["Tags"], "desired");
+	return read.kind === "tags" ? {
+		kind: "tags",
+		tags: read.tags
+	} : {
+		kind: "unusable",
+		reason: `${STREAM_TAGS_PATH} must be a list of tags with a non-empty string Key and a scalar Value`
+	};
+}
+function replicaIndexInsightsRefusals(replica) {
+	const indexes = replica?.[REPLICA_INDEXES_KEY];
+	if (!Array.isArray(indexes)) return [];
+	return indexes.flatMap((entry, position) => {
+		if (!isPlainObject$2(entry)) return [];
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `Replicas[].${REPLICA_INDEXES_KEY}[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		return read.kind === "unusable" ? [read.reason] : [];
+	});
+}
 function replicaSettingRefusals(replica) {
-	return [
+	return [...[
 		readPitrSpec(replica?.[PITR_KEY]),
 		readContributorInsightsSpec(replica?.[CONTRIBUTOR_INSIGHTS_KEY], CI_PATH),
 		readKinesisSpec(replica?.[KINESIS_KEY]),
 		readTablePolicy(replica),
-		readStreamPolicy$1(replica)
-	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []);
+		readStreamPolicy$1(replica),
+		readStreamTags$1(replica)
+	].flatMap((read) => read.kind === "unusable" ? [read.reason] : []), ...replicaIndexInsightsRefusals(replica)];
 }
 function settingOf(op) {
 	switch (op.kind) {
@@ -46825,6 +47339,9 @@ function settingOf(op) {
 		case "putTablePolicy": return "tablePolicy";
 		case "deleteStreamPolicy":
 		case "putStreamPolicy": return "streamPolicy";
+		case "indexContributorInsights": return "indexContributorInsights";
+		case "untagStream":
+		case "tagStream": return "streamTags";
 	}
 }
 const SETTING_MEMBER = {
@@ -46832,7 +47349,9 @@ const SETTING_MEMBER = {
 	contributorInsights: CONTRIBUTOR_INSIGHTS_KEY,
 	kinesis: KINESIS_KEY,
 	tablePolicy: TABLE_POLICY_KEY,
-	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`
+	streamPolicy: `${REPLICA_STREAM_KEY}.ResourcePolicy`,
+	indexContributorInsights: INDEX_CONTRIBUTOR_INSIGHTS_PATH,
+	streamTags: `${REPLICA_STREAM_KEY}.Tags`
 };
 function samePolicyDocument$1(left, right) {
 	if (left === right) return true;
@@ -46929,6 +47448,51 @@ function planReplicaSettingOps(desired, previous, options, onUnusable) {
 		kind: "putStreamPolicy",
 		document
 	}), { kind: "deleteStreamPolicy" }, "streamPolicy");
+	if (options.tableIndexNames !== void 0) ops.push(...planReplicaIndexInsightsOps(desired, previous, {
+		fresh: options.fresh,
+		tableIndexNames: options.tableIndexNames,
+		removes
+	}, onUnusable));
+	const wantTags = readStreamTags$1(desired);
+	if (wantTags.kind === "unusable") onUnusable(wantTags.reason);
+	else {
+		const hadTags = options.streamReplaced === true ? {
+			kind: "tags",
+			tags: []
+		} : readStreamTags$1(prev);
+		const plan = planTagDiff(hadTags.kind === "tags" ? hadTags.tags : [], wantTags.tags);
+		if (plan.remove.length > 0 && removes("streamTags")) ops.push({
+			kind: "untagStream",
+			keys: plan.remove
+		});
+		if (plan.set.size > 0) ops.push({
+			kind: "tagStream",
+			tags: [...plan.set].map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+	}
+	return ops;
+}
+function planReplicaIndexInsightsOps(desired, previous, options, onUnusable) {
+	const prev = options.fresh ? void 0 : previous;
+	const ops = [];
+	const desiredIndexes = indexEntriesByName(desired?.[REPLICA_INDEXES_KEY]);
+	const prevIndexes = indexEntriesByName(prev?.[REPLICA_INDEXES_KEY]);
+	for (const indexName of /* @__PURE__ */ new Set([...desiredIndexes.keys(), ...prevIndexes.keys()])) {
+		if (!options.tableIndexNames.has(indexName)) continue;
+		const want = readContributorInsightsSpec(desiredIndexes.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], INDEX_CI_PATH);
+		const op = planContributorInsightsOp(want, readContributorInsightsSpec(prevIndexes.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], INDEX_CI_PATH), onUnusable);
+		if (op === void 0) continue;
+		if (options.fresh && op.action === "DISABLE") continue;
+		if (want.kind === "absent" && !options.removes("indexContributorInsights")) continue;
+		ops.push({
+			kind: "indexContributorInsights",
+			indexName,
+			...op
+		});
+	}
 	return ops;
 }
 function planReplicaSettingCorrections(desired, live, only) {
@@ -46975,8 +47539,43 @@ function planReplicaSettingCorrections(desired, live, only) {
 		kind: "putStreamPolicy",
 		document: streamPolicy.document
 	});
+	if (only.has("indexContributorInsights") && live.indexContributorInsightsEnabled !== void 0) for (const [indexName, entry] of declaredIndexInsights(desired)) {
+		const enabled = live.indexContributorInsightsEnabled.get(indexName);
+		if (enabled === void 0 || enabled === entry.enabled) continue;
+		ops.push(!entry.enabled ? {
+			kind: "indexContributorInsights",
+			indexName,
+			action: "DISABLE"
+		} : entry.mode === void 0 ? {
+			kind: "indexContributorInsights",
+			indexName,
+			action: "ENABLE"
+		} : {
+			kind: "indexContributorInsights",
+			indexName,
+			action: "ENABLE",
+			mode: entry.mode
+		});
+	}
+	const streamTags = readStreamTags$1(desired);
+	if (only.has("streamTags") && streamTags.kind === "tags" && live.streamTags !== void 0) {
+		const liveTags = live.streamTags;
+		const missing = streamTags.tags.filter((t) => liveTags.get(t.Key) !== t.Value);
+		if (missing.length > 0) ops.push({
+			kind: "tagStream",
+			tags: missing
+		});
+	}
 	return ops;
 }
+function declaredIndexInsights(desired) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [indexName, entry] of indexEntriesByName(desired?.[REPLICA_INDEXES_KEY])) {
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], INDEX_CI_PATH);
+		if (read.kind === "usable") out.set(indexName, read);
+	}
+	return out;
+}
 function declaredReplicaSettings(desired) {
 	const declared = /* @__PURE__ */ new Set();
 	if (readPitrSpec(desired?.["PointInTimeRecoverySpecification"]).kind === "usable") declared.add("pitr");
@@ -46984,6 +47583,9 @@ function declaredReplicaSettings(desired) {
 	if (readKinesisSpec(desired?.["KinesisStreamSpecification"]).kind === "usable") declared.add("kinesis");
 	if (readTablePolicy(desired).kind === "usable") declared.add("tablePolicy");
 	if (readStreamPolicy$1(desired).kind === "usable") declared.add("streamPolicy");
+	if (declaredIndexInsights(desired).size > 0) declared.add("indexContributorInsights");
+	const tags = readStreamTags$1(desired);
+	if (tags.kind === "tags" && tags.tags.length > 0) declared.add("streamTags");
 	return declared;
 }
 function enabledForReadStatus(status) {
@@ -47030,7 +47632,7 @@ const READBACK_5381_NESTED = [[
 function isPre5381ReplicaBaseline(baseline) {
 	if ("TableClass" in baseline || "DeletionProtectionEnabled" in baseline) return true;
 	const replicas = baseline["Replicas"];
-	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$1(r) && "KMSMasterKeyId" in r);
+	return Array.isArray(replicas) && replicas.some((r) => isPlainObject$2(r) && "KMSMasterKeyId" in r);
 }
 function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFromReadback = false) {
 	if (!isPre5381ReplicaBaseline(baseline)) return baseline;
@@ -47044,7 +47646,7 @@ function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFro
 	if (!Array.isArray(replicas)) return result;
 	const awsReplicas = Array.isArray(aws["Replicas"]) ? aws["Replicas"] : [];
 	result["Replicas"] = replicas.map((element) => {
-		if (!isPlainObject$1(element)) return element;
+		if (!isPlainObject$2(element)) return element;
 		const region = element["Region"];
 		const entry = { ...element };
 		if (region === localRegion && localRegion !== "") {
@@ -47055,13 +47657,13 @@ function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFro
 			delete entry["KMSMasterKeyId"];
 			if (!("SSESpecification" in entry)) entry["SSESpecification"] = { KMSMasterKeyId: key };
 		}
-		const live = awsReplicas.find((r) => isPlainObject$1(r) && r["Region"] === region);
+		const live = awsReplicas.find((r) => isPlainObject$2(r) && r["Region"] === region);
 		if (live !== void 0) {
 			for (const member of READBACK_5381_MEMBERS) if (!(member in entry) && member in live) entry[member] = structuredClone(live[member]);
 			for (const [block, member, flag] of READBACK_5381_NESTED) {
 				const mine = entry[block];
 				const theirs = live[block];
-				if (isPlainObject$1(mine) && isPlainObject$1(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
+				if (isPlainObject$2(mine) && isPlainObject$2(theirs) && !(member in mine) && member in theirs && mine[flag] === theirs[flag]) entry[block] = {
 					...mine,
 					[member]: theirs[member]
 				};
@@ -47074,18 +47676,19 @@ function canonicalizePre5381ReplicaBaseline(baseline, aws, localRegion, localFro
 const UNREAD_REPLICA_MEMBERS = [
 	"TableClass",
 	"DeletionProtectionEnabled",
-	"SSESpecification"
+	"SSESpecification",
+	"GlobalTableSettingsReplicationMode"
 ];
 function keepUnreadReplicaMembers(desired, previous) {
 	const replicas = desired["Replicas"];
 	const prevReplicas = previous["Replicas"];
 	if (!Array.isArray(replicas) || !Array.isArray(prevReplicas)) return desired;
 	const sse = desired["SSESpecification"];
-	const sseOn = isPlainObject$1(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
+	const sseOn = isPlainObject$2(sse) && coerceCfnBoolean(sse["SSEEnabled"]) !== false;
 	let changed = false;
 	const completed = replicas.map((element) => {
-		if (!isPlainObject$1(element)) return element;
-		const live = prevReplicas.find((r) => isPlainObject$1(r) && r["Region"] === element["Region"]);
+		if (!isPlainObject$2(element)) return element;
+		const live = prevReplicas.find((r) => isPlainObject$2(r) && r["Region"] === element["Region"]);
 		if (live === void 0) return element;
 		const entry = { ...element };
 		let touched = false;
@@ -47099,7 +47702,7 @@ function keepUnreadReplicaMembers(desired, previous) {
 		const pitr = entry[PITR_KEY];
 		const wantPitr = readPitrSpec(pitr);
 		const livePitr = readPitrSpec(live[PITR_KEY]);
-		if (isPlainObject$1(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
+		if (isPlainObject$2(pitr) && wantPitr.kind === "usable" && wantPitr.enabled && wantPitr.recoveryPeriodInDays === void 0 && livePitr.kind === "usable" && livePitr.enabled && livePitr.recoveryPeriodInDays !== void 0) {
 			entry[PITR_KEY] = {
 				...pitr,
 				RecoveryPeriodInDays: livePitr.recoveryPeriodInDays
@@ -47123,7 +47726,7 @@ const STREAM_POLICY_KEY = "ResourcePolicy";
 const STREAM_TAGS_KEY = "Tags";
 const POLICY_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_POLICY_KEY}`;
 const TAGS_PATH = `${STREAM_SPECIFICATION_KEY$1}.${STREAM_TAGS_KEY}`;
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function refusalOf(guard) {
@@ -47135,7 +47738,7 @@ function refusalOf(guard) {
 	}
 }
 function blockMembers(block) {
-	return isPlainObject(block) ? block : {};
+	return isPlainObject$1(block) ? block : {};
 }
 function readStreamPolicy(block) {
 	const value = blockMembers(block)[STREAM_POLICY_KEY];
@@ -47310,7 +47913,7 @@ function streamTagsMatchDeclared(liveTags, desiredBlock) {
 }
 function canonicalJson(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
 	return JSON.stringify(value) ?? "null";
 }
 
@@ -47326,6 +47929,93 @@ const DRIFT_STRIPPED_INDEX_MEMBERS = [{
 function maskLeafValue(value, maskSecrets) {
 	return maskDeep(value, maskSecrets);
 }
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const IDENTITY_KEYS = [
+	"Region",
+	"IndexName",
+	"AttributeName"
+];
+function identityKeyOf(...lists) {
+	const entries = lists.flat();
+	if (entries.length === 0) return void 0;
+	const key = IDENTITY_KEYS.find((candidate) => entries.every((entry) => isPlainObject(entry) && typeof entry[candidate] === "string"));
+	if (key !== void 0) return { key };
+	return entries.some((entry) => isPlainObject(entry) && IDENTITY_KEYS.some((candidate) => typeof entry[candidate] === "string")) ? "ambiguous" : void 0;
+}
+const POSITIONAL_LIST_KEYS = /* @__PURE__ */ new Set(["KeySchema"]);
+function projectNamed(live, own, wanted, path, unnamed) {
+	if (isPlainObject(live) && (isPlainObject(own) || isPlainObject(wanted))) {
+		const ownBag = isPlainObject(own) ? own : void 0;
+		const wantedBag = isPlainObject(wanted) ? wanted : void 0;
+		const out = {};
+		for (const key of IDENTITY_KEYS) if (Object.hasOwn(live, key)) out[key] = live[key];
+		const named = /* @__PURE__ */ new Set([...Object.keys(ownBag ?? {}), ...Object.keys(wantedBag ?? {})]);
+		for (const key of named) {
+			if (IDENTITY_KEYS.includes(key)) continue;
+			if (key === "Tags") {
+				if (ownBag !== void 0 && Object.hasOwn(ownBag, "Tags")) out["Tags"] = ownBag["Tags"];
+				continue;
+			}
+			if (!Object.hasOwn(live, key) || live[key] === void 0) continue;
+			out[key] = POSITIONAL_LIST_KEYS.has(key) ? live[key] : projectNamed(live[key], ownBag?.[key], wantedBag?.[key], `${path}.${key}`, unnamed);
+		}
+		return out;
+	}
+	if (Array.isArray(live)) {
+		const ownList = Array.isArray(own) ? own : [];
+		const wantedList = Array.isArray(wanted) ? wanted : [];
+		const identity = identityKeyOf(live, ownList, wantedList);
+		if (identity === void 0) return live;
+		if (identity === "ambiguous") {
+			unnamed.push({
+				identity: "unkeyed entries",
+				value: "some",
+				path,
+				ambiguous: true
+			});
+			return own;
+		}
+		const id = identity.key;
+		const byId = (list) => new Map(list.map((entry) => [entry[id], entry]));
+		const ownById = byId(ownList);
+		const wantedById = byId(wantedList);
+		return live.flatMap((entry) => {
+			const value = entry[id];
+			const ownEntry = ownById.get(value);
+			const wantedEntry = wantedById.get(value);
+			if (ownEntry === void 0 && wantedEntry === void 0) {
+				unnamed.push({
+					identity: id,
+					value,
+					path
+				});
+				return [];
+			}
+			return [projectNamed(entry, ownEntry, wantedEntry, `${path}[${value}]`, unnamed)];
+		});
+	}
+	return live;
+}
+const strictReadScope = new AsyncLocalStorage();
+function strictFor(key) {
+	return strictReadScope.getStore()?.has(key) === true;
+}
+function replicaStrictness(status) {
+	const current = strictReadScope.getStore() ?? /* @__PURE__ */ new Set();
+	if (status === void 0 || status === "ACTIVE" || status === "UPDATING") return current;
+	return new Set([...current].filter((key) => key !== "Replicas"));
+}
+const unsettledScope = new AsyncLocalStorage();
+function markUnsettled(...keys) {
+	const scope = unsettledScope.getStore();
+	if (scope === void 0) return;
+	for (const key of keys) scope.mark(key);
+}
+function isUnsettled(key) {
+	return unsettledScope.getStore()?.unsettled.has(key) === true;
+}
 function sentence(text) {
 	return text.endsWith(".") ? text : `${text}.`;
 }
@@ -47548,6 +48238,8 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
+		const createMode = readReplicationMode(properties);
+		if (createMode.kind === "usable") createParams.GlobalTableSettingsReplicationMode = createMode.mode;
 		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 		if (sseEnabledRefusal !== void 0) {
 			const onReplay = replayWarn(log, context).onUnusable;
@@ -47697,6 +48389,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (tableClass !== void 0) create.TableClassOverride = tableClass;
 		const replicaUpdates = [{ Create: create }];
 		for (let attempt = 1;; attempt++) try {
+			markUnsettled("Replicas");
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: tableName,
 				ReplicaUpdates: replicaUpdates
@@ -47722,6 +48415,7 @@ var DynamoDBGlobalTableProvider = class {
 		await this.writeReplicaDeletionProtection(tableName, region, enabled);
 	}
 	async writeReplicaDeletionProtection(tableName, region, enabled) {
+		markUnsettled("Replicas");
 		await this.getRegionalClient(region).send(new UpdateTableCommand({
 			TableName: tableName,
 			DeletionProtectionEnabled: enabled
@@ -47796,6 +48490,7 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared table class`));
 			try {
+				markUnsettled("Replicas");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: tableName,
 					ReplicaUpdates: [{ Update: {
@@ -47843,6 +48538,7 @@ var DynamoDBGlobalTableProvider = class {
 			request = built;
 		}
 		try {
+			markUnsettled("SSESpecification", "Replicas");
 			await this.dynamoDBClient.send(new UpdateTableCommand(request));
 			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
 		} catch (keyError) {
@@ -47885,6 +48581,7 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async applyReplicaSettings(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, streamReplaced, replaying, keepOnRemoval, previousLocalStreamArn, warn, maskSecrets) {
 		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		const tableIndexNames = previousProperties === void 0 ? new Set(indexEntriesByName(properties["GlobalSecondaryIndexes"]).keys()) : void 0;
 		for (const entry of desired) {
 			const replica = asRecord(entry);
 			const region = replica?.["Region"];
@@ -47894,13 +48591,15 @@ var DynamoDBGlobalTableProvider = class {
 			const ops = planReplicaSettingOps(replica, previous, {
 				fresh,
 				streamReplaced,
-				keepOnRemoval
+				keepOnRemoval,
+				...tableIndexNames !== void 0 && { tableIndexNames }
 			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
 			if (!fresh && keepOnRemoval.has("pitr") && replica?.["PointInTimeRecoverySpecification"] == null && (() => {
 				const prior = readPitrSpec(previous?.["PointInTimeRecoverySpecification"]);
 				return prior.kind === "usable" && prior.enabled;
 			})()) warn(`The ${region} replica of ${tableName}: point-in-time recovery was not turned off, although the properties being applied (a rollback's recorded state, or a drift --revert read-back) declare none — turning it off would delete every recovery point. Turn it off by hand if that is intended.`);
 			const unchanged = fresh ? /* @__PURE__ */ new Set() : declaredReplicaSettings(replica);
+			unchanged.delete("indexContributorInsights");
 			for (const op of ops) unchanged.delete(settingOf(op));
 			if (ops.length === 0 && unchanged.size === 0) continue;
 			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
@@ -47927,7 +48626,7 @@ var DynamoDBGlobalTableProvider = class {
 			const streamPolicyChanged = priorStreamPolicy.kind !== "absent" && desiredStreamPolicy.kind !== "unusable" && !(desiredStreamPolicy.kind === "absent" && keepOnRemoval.has("streamPolicy")) && !(priorStreamPolicy.kind === "usable" && desiredStreamPolicy.kind === "usable" && samePolicyDocument$1(priorStreamPolicy.document, desiredStreamPolicy.document));
 			if (region === currentRegion && streamReplaced && previousLocalStreamArn !== void 0 && streamPolicyChanged && (await describe()).streamArn !== previousLocalStreamArn) await this.deleteOldStreamPolicy(client, previousLocalStreamArn, tableName, warn, maskSecrets);
 			if (unchanged.size === 0) continue;
-			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets);
+			const live = await this.readLiveReplicaSettings(client, tableName, region, unchanged, describe, maskSecrets, replica);
 			for (const op of planReplicaSettingCorrections(replica, live, unchanged)) {
 				const member = SETTING_MEMBER[settingOf(op)];
 				this.logger.debug(maskSecrets(`Bringing the ${region} replica of ${tableName} to its declared ${member}`));
@@ -47941,7 +48640,60 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		}
 	}
-	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets) {
+	async sendReplicationMode(tableName, logicalId, mode, maskSecrets, fromTemplate = true) {
+		this.logger.debug(maskSecrets(`Setting GlobalTableSettingsReplicationMode of ${tableName} to ${mode}`));
+		await this.sendLocalSettingUpdate({
+			TableName: tableName,
+			GlobalTableSettingsReplicationMode: mode
+		}, fromTemplate, "GlobalTableSettingsReplicationMode", tableName, logicalId, maskSecrets);
+	}
+	async applyReplicaIndexInsights(tableName, logicalId, currentRegion, properties, previousProperties, freshRegions, keepOnRemoval, replaying, warn, maskSecrets) {
+		const tableIndexNames = new Set(indexEntriesByName(properties["GlobalSecondaryIndexes"]).keys());
+		if (tableIndexNames.size === 0) return;
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const fresh = freshRegions.has(region);
+			const ops = planReplicaIndexInsightsOps(replica, localReplicaEntry(previousProperties, region), {
+				fresh,
+				tableIndexNames,
+				removes: (setting) => !keepOnRemoval.has(setting)
+			}, (reason) => warn(`The ${region} replica of ${tableName}: ${reason}, so that setting was left as it is. ` + (replaying ? `The value came from a recorded state, which a template edit cannot reach.` : `Fix the template value and re-deploy.`)));
+			const addressed = new Set(ops.flatMap((op) => op.kind === "indexContributorInsights" ? [op.indexName] : []));
+			const declared = declaredIndexInsights(replica);
+			const unchanged = fresh ? [] : [...declared.keys()].filter((name) => tableIndexNames.has(name) && !addressed.has(name));
+			if (ops.length === 0 && unchanged.length === 0) continue;
+			const client = region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, { ...region !== currentRegion && { region } });
+			await waitForIndexesSettled({
+				tableName,
+				logicalId,
+				logger: maskedLogger(this.logger, maskSecrets, tableName),
+				describeTable: () => client.send(new DescribeTableCommand({ TableName: tableName })),
+				maxAttempts: 900,
+				proceedNote: `setting the index's Contributor Insights may be refused.`
+			});
+			const describe = () => Promise.resolve({});
+			for (const op of ops) await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			if (unchanged.length === 0) continue;
+			const replicaIndexes = indexEntriesByName(replica?.["GlobalSecondaryIndexes"]);
+			const onlyUnchanged = {
+				...replica,
+				GlobalSecondaryIndexes: unchanged.map((name) => replicaIndexes.get(name))
+			};
+			const only = /* @__PURE__ */ new Set(["indexContributorInsights"]);
+			const live = await this.readLiveReplicaSettings(client, tableName, region, only, describe, maskSecrets, onlyUnchanged);
+			for (const op of planReplicaSettingCorrections(onlyUnchanged, live, only)) try {
+				await this.sendReplicaSettingOp(client, tableName, region, logicalId, op, describe, maskSecrets);
+			} catch (convergeError) {
+				if (isInterruptedWaitError(convergeError)) throw convergeError;
+				this.logger.warn(maskSecrets(`The ${region} replica of ${tableName} does not hold the declared ${SETTING_MEMBER.indexContributorInsights} of an index, and setting it failed (${describeAwsFailure(convergeError).summary}). The next deploy that updates this table tries again.`));
+			}
+		}
+	}
+	async readLiveReplicaSettings(client, tableName, region, wanted, describe, maskSecrets, declared) {
 		const live = {};
 		const attempt = async (what, read) => {
 			try {
@@ -47984,10 +48736,37 @@ var DynamoDBGlobalTableProvider = class {
 			const answer = await hasPolicy((await describe()).streamArn);
 			if (answer !== void 0) live.hasStreamPolicy = answer;
 		});
+		if (wanted.has("indexContributorInsights")) {
+			const perIndex = /* @__PURE__ */ new Map();
+			for (const indexName of declaredIndexInsights(declared).keys()) await attempt(`Contributor Insights of an index`, async () => {
+				const status = (await client.send(new DescribeContributorInsightsCommand({
+					TableName: tableName,
+					IndexName: indexName
+				}))).ContributorInsightsStatus;
+				if (status === "ENABLED" || status === "DISABLED") perIndex.set(indexName, status === "ENABLED");
+			});
+			live.indexContributorInsightsEnabled = perIndex;
+		}
+		if (wanted.has("streamTags")) await attempt("the stream tags", async () => {
+			const arn = (await describe()).streamArn;
+			if (arn === void 0) return;
+			const tags = /* @__PURE__ */ new Map();
+			let nextToken;
+			do {
+				const out = await client.send(new ListTagsOfResourceCommand({
+					ResourceArn: arn,
+					NextToken: nextToken
+				}));
+				for (const t of out.Tags ?? []) if (t.Key !== void 0) tags.set(t.Key, t.Value ?? "");
+				nextToken = out.NextToken;
+			} while (nextToken !== void 0);
+			live.streamTags = tags;
+		});
 		return live;
 	}
 	async deleteOldStreamPolicy(client, streamArn, tableName, warn, maskSecrets) {
 		try {
+			markUnsettled("Replicas");
 			await this.retrySettlingRefusal(() => client.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the policy of the retired stream of ${tableName}`, maskSecrets);
 		} catch (error) {
 			if (isInterruptedWaitError(error)) throw error;
@@ -48038,7 +48817,10 @@ var DynamoDBGlobalTableProvider = class {
 			if (arn === void 0 || arn === "") throw new ProvisioningError(maskSecrets(`Cannot apply ${SETTING_MEMBER[settingOf(op)]} to ${scope}: DescribeTable returned no ${which === "tableArn" ? "TableArn" : "LatestStreamArn (the table has no stream)"}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 			return arn;
 		};
-		const send = (call) => this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		const send = (call) => {
+			markUnsettled("Replicas");
+			return this.retrySettlingRefusal(call, `${op.kind} on ${scope}`, maskSecrets);
+		};
 		switch (op.kind) {
 			case "pitr":
 				await send(() => client.send(new UpdateContinuousBackupsCommand({
@@ -48106,6 +48888,31 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				break;
 			}
+			case "indexContributorInsights":
+				await send(() => client.send(new UpdateContributorInsightsCommand({
+					TableName: tableName,
+					IndexName: op.indexName,
+					ContributorInsightsAction: op.action,
+					...op.mode !== void 0 && { ContributorInsightsMode: op.mode }
+				})));
+				break;
+			case "untagStream": {
+				if ((await describe()).streamArn === void 0) break;
+				const arn = await arnFor("streamArn");
+				await send(() => client.send(new UntagResourceCommand$2({
+					ResourceArn: arn,
+					TagKeys: op.keys
+				})));
+				break;
+			}
+			case "tagStream": {
+				const arn = await arnFor("streamArn");
+				await send(() => client.send(new TagResourceCommand$2({
+					ResourceArn: arn,
+					Tags: op.tags
+				})));
+				break;
+			}
 		}
 		this.logger.debug(maskSecrets(`Applied ${op.kind} to ${scope}`));
 	}
@@ -48131,6 +48938,7 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async sendLocalSettingUpdate(input, fromTemplate, what, tableName, logicalId, maskSecrets) {
 		try {
+			markUnsettled(input.SSESpecification !== void 0 ? "SSESpecification" : "Replicas");
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
 			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
 		} catch (error) {
@@ -48237,6 +49045,12 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		return unsettledScope.run({
+			mark: (key) => context?.markUnsettled?.(key),
+			unsettled: context?.unsettledProperties ?? /* @__PURE__ */ new Set()
+		}, () => this.updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context));
+	}
+	async updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		if (context?.desiredFromAwsReadback === true) properties = keepUnreadReplicaMembers(properties, previousProperties);
 		const log = this.operationSinks(context, [[properties["TableName"], physicalId], [previousProperties["TableName"], physicalId]]);
 		const maskSecrets = log.mask;
@@ -48283,7 +49097,7 @@ var DynamoDBGlobalTableProvider = class {
 			physicalName: physicalId
 		})) throw new ProvisioningError(log.mask(`TableName is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
 		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(log.mask(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
-		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(log.mask(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
+		if (!deepEqual(lsiListOrEmpty(properties["LocalSecondaryIndexes"]), lsiListOrEmpty(previousProperties["LocalSecondaryIndexes"]))) throw new ProvisioningError(log.mask(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`), resourceType, logicalId, physicalId);
 		const oldAttrs = previousProperties["AttributeDefinitions"] ?? [];
 		const newAttrs = properties["AttributeDefinitions"] ?? [];
 		const desiredKeyAttrNames = collectDesiredKeyAttributeNames(properties);
@@ -48463,6 +49277,9 @@ var DynamoDBGlobalTableProvider = class {
 				flatChanged = true;
 			}
 			if (flatChanged) {
+				if (flatUpdate.DeletionProtectionEnabled !== void 0) markUnsettled("Replicas");
+				if (flatUpdate.StreamSpecification !== void 0) markUnsettled("StreamSpecification");
+				if (flatUpdate.OnDemandThroughput !== void 0) markUnsettled("WriteOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
@@ -48518,10 +49335,13 @@ var DynamoDBGlobalTableProvider = class {
 					}
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
+				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings");
+				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			if (deferCeilingsPastFlip) {
+				markUnsettled("WriteOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					OnDemandThroughput: onDemandPayload
@@ -48539,6 +49359,8 @@ var DynamoDBGlobalTableProvider = class {
 					region: currentRegion
 				}));
 			}
+			const modeUpdate = replicationModeUpdate(properties, previousProperties);
+			if (modeUpdate === "DISABLED" && readReplicationMode(properties).kind === "absent") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
 			const replicaDiff = diffReplicas(previousProperties["Replicas"] ?? [], properties["Replicas"] ?? []);
 			for (const replica of replicaDiff.removed) {
 				const region = replica["Region"];
@@ -48552,6 +49374,7 @@ var DynamoDBGlobalTableProvider = class {
 						region
 					}));
 				}
+				markUnsettled("Replicas");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					ReplicaUpdates: [{ Delete: { RegionName: region } }]
@@ -48611,6 +49434,7 @@ var DynamoDBGlobalTableProvider = class {
 					debug(`Cross-region replica ${region} of ${maskSecrets(physicalId)}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
+				markUnsettled("Replicas");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					ReplicaUpdates: [{ Update: updateAction }]
@@ -48618,16 +49442,24 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
 			}
 			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
+			if (modeUpdate !== void 0 && readReplicationMode(properties).kind === "usable") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
+			else {
+				const correction = replicationModeCorrection(properties, previousProperties, describeResp.Table?.GlobalTableSettingsReplicationMode);
+				if (correction !== void 0) await this.sendReplicationMode(physicalId, logicalId, correction, maskSecrets, false);
+			}
 			await this.convergeReplicaDeletionProtection(physicalId, logicalId, currentRegion, previousProperties, properties, addedReplicaRegions, context?.desiredFromAwsReadback === true, warn, maskSecrets);
 			await this.convergeReplicaSettings(physicalId, logicalId, currentRegion, properties, addedReplicaRegions, maskSecrets);
 			await this.applyReplicaKeys(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, deferredSseUpdate, deferredSseFromTemplate, keylessSseFromTemplate, maskSecrets);
-			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, new Set(context?.desiredFromAwsReadback === true ? [
+			const replicaKeepOnRemoval = new Set(context?.desiredFromAwsReadback === true ? [
 				"pitr",
 				"contributorInsights",
 				"kinesis",
 				"tablePolicy",
-				"streamPolicy"
-			] : context?.replayingState === true ? ["pitr"] : []), describeResp.Table?.LatestStreamArn, warn, maskSecrets);
+				"streamPolicy",
+				"indexContributorInsights",
+				"streamTags"
+			] : context?.replayingState === true ? ["pitr"] : []);
+			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, replicaKeepOnRemoval, describeResp.Table?.LatestStreamArn, warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -48650,6 +49482,7 @@ var DynamoDBGlobalTableProvider = class {
 			for (const gsi of gsiDiff.removed) {
 				if (!gsi.IndexName) continue;
 				const gsiUpdate = { Delete: { IndexName: gsi.IndexName } };
+				markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -48667,6 +49500,7 @@ var DynamoDBGlobalTableProvider = class {
 					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput },
 					...addedWarmToSend && { WarmThroughput: addedWarmToSend }
 				} };
+				markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					AttributeDefinitions: newAttrs,
@@ -48707,6 +49541,7 @@ var DynamoDBGlobalTableProvider = class {
 					continue;
 				}
 				const gsiUpdate = { Update: update };
+				markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -48720,6 +49555,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId, { maskSecrets });
 				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied, maskSecrets);
 			}
+			await this.applyReplicaIndexInsights(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, replicaKeepOnRemoval, context?.replayingState === true || context?.desiredFromAwsReadback === true, warn, maskSecrets);
 			if (!deepEqual(properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"])) {
 				const sendTtl = async (cmd) => {
 					try {
@@ -48754,13 +49590,16 @@ var DynamoDBGlobalTableProvider = class {
 						attributeName: live.AttributeName
 					};
 				}
-				if (ttlTarget) await sendTtl(new UpdateTimeToLiveCommand({
-					TableName: physicalId,
-					TimeToLiveSpecification: {
-						Enabled: ttlTarget.enabled,
-						AttributeName: ttlTarget.attributeName
-					}
-				}));
+				if (ttlTarget) {
+					markUnsettled("TimeToLiveSpecification");
+					await sendTtl(new UpdateTimeToLiveCommand({
+						TableName: physicalId,
+						TimeToLiveSpecification: {
+							Enabled: ttlTarget.enabled,
+							AttributeName: ttlTarget.attributeName
+						}
+					}));
+				}
 			}
 			const finalDescribe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const impliedStream = replicationImpliedStreamSpecification(properties);
@@ -48791,7 +49630,7 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async applyCrossRegionReplicaTagsDiff(tableArn, region, oldTags, newTags, resourceType, logicalId, physicalIdForLogs, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		if (deepEqual(oldTags, newTags)) return;
+		if (deepEqual(oldTags, newTags) && !isUnsettled("Replicas")) return;
 		if (!tableArn) {
 			warn(`Local DescribeTable returned no TableArn — cannot propagate Tags to cross-region replica ${region} of ${physicalIdForLogs}`);
 			return;
@@ -48812,11 +49651,12 @@ var DynamoDBGlobalTableProvider = class {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, id);
 		if (tagWarning !== void 0) this.logger.warn(maskSecrets(tagWarning));
-		const tagsToAdd = [...plan.set].map(([k, v]) => ({
+		const tagsToAdd = [...isUnsettled("Replicas") ? planTagDiff(void 0, newTagsRaw).set : plan.set].map(([k, v]) => ({
 			Key: k,
 			Value: v
 		}));
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || tagsToAdd.length > 0) markUnsettled("Replicas");
 		if (tagsToRemove.length > 0) {
 			await client.send(new UntagResourceCommand$2({
 				ResourceArn: tableArn,
@@ -48833,6 +49673,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text, progress) {
+		const autoScalingKey = indexName !== void 0 ? "GlobalSecondaryIndexes" : dimension.includes("Write") ? "WriteProvisionedThroughputSettings" : "Replicas";
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const asMaxRetries = autoScalingRetriesWithinDeleteBudget(budget, 8);
 		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
@@ -48852,6 +49693,7 @@ var DynamoDBGlobalTableProvider = class {
 					return;
 				}
 				try {
+					markUnsettled(autoScalingKey);
 					await withRetry(() => asClient.send(new RegisterScalableTargetCommand({
 						ServiceNamespace: "dynamodb",
 						ResourceId: resourceId,
@@ -48892,6 +49734,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				if (tttCfg["DisableScaleIn"] !== void 0) targetTrackingConfig["DisableScaleIn"] = Boolean(tttCfg["DisableScaleIn"]);
 				try {
+					markUnsettled(autoScalingKey);
 					await withRetry(() => asClient.send(new PutScalingPolicyCommand({
 						PolicyName: policyName,
 						ServiceNamespace: "dynamodb",
@@ -48920,6 +49763,7 @@ var DynamoDBGlobalTableProvider = class {
 				return name === "ObjectNotFoundException" || msg.includes("No scaling policy found") || msg.includes("No scalable target found");
 			};
 			try {
+				markUnsettled(autoScalingKey);
 				await withRetry(() => asClient.send(new DeleteScalingPolicyCommand({
 					PolicyName: policyName,
 					ServiceNamespace: "dynamodb",
@@ -48939,6 +49783,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: ${pasteableAwsCommand(maskSecrets)`aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`.render()}`);
 			}
 			try {
+				markUnsettled(autoScalingKey);
 				await withRetry(() => asClient.send(new DeregisterScalableTargetCommand({
 					ServiceNamespace: "dynamodb",
 					ResourceId: resourceId,
@@ -49243,6 +50088,44 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+		const live = await strictReadScope.run(names, () => this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties));
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		if (out["BillingMode"] === "PAY_PER_REQUEST") delete out["WriteProvisionedThroughputSettings"];
+		const unnamed = [];
+		for (const name of names) {
+			if (!Object.hasOwn(out, name)) continue;
+			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed);
+		}
+		for (const entry of unnamed.filter((e) => e.ambiguous === true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS has entries cdkd cannot key by an identity, so convergence keeps the recorded ${entry.path} rather than risk removing an entry neither the record nor the template declares. Check it with 'cdkd drift'.`);
+		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete).`);
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		const MOVING = /* @__PURE__ */ new Set([
+			"CREATING",
+			"UPDATING",
+			"DELETING"
+		]);
+		try {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			const moving = /* @__PURE__ */ new Set();
+			if (table?.TableStatus !== void 0 && MOVING.has(table.TableStatus)) {
+				for (const name of names) if (name !== "TimeToLiveSpecification") moving.add(name);
+			}
+			if (names.has("Replicas") && (table?.Replicas ?? []).some((replica) => replica.ReplicaStatus !== void 0 && MOVING.has(replica.ReplicaStatus))) moving.add("Replicas");
+			if (names.has("GlobalSecondaryIndexes") && (table?.GlobalSecondaryIndexes ?? []).some((index) => index.IndexStatus !== void 0 && MOVING.has(index.IndexStatus))) moving.add("GlobalSecondaryIndexes");
+			const sse = table?.SSEDescription?.Status;
+			if (names.has("SSESpecification") && (sse === "ENABLING" || sse === "DISABLING" || sse === "UPDATING")) moving.add("SSESpecification");
+			if (names.has("TimeToLiveSpecification")) {
+				if ((await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription?.TimeToLiveStatus === "ENABLING") moving.add("TimeToLiveSpecification");
+			}
+			return moving;
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		const afterOwnWrite = context?.afterOwnWrite === true;
 		try {
@@ -49267,7 +50150,7 @@ var DynamoDBGlobalTableProvider = class {
 			const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 			const tableNameForSubs = table.TableName ?? physicalId;
 			const sdkReplicas = table.Replicas && table.Replicas.length > 0 ? currentRegion && !table.Replicas.some((r) => r.RegionName === currentRegion) ? [...table.Replicas, { RegionName: currentRegion }] : table.Replicas : [{ RegionName: currentRegion }];
-			const replicas = await Promise.all(sdkReplicas.map(async (r) => {
+			const replicas = await Promise.all(sdkReplicas.map(async (r) => strictReadScope.run(replicaStrictness(r.ReplicaStatus), async () => {
 				const entry = { Region: r.RegionName };
 				if (!r.RegionName) return entry;
 				const isLocal = r.RegionName === currentRegion;
@@ -49290,6 +50173,7 @@ var DynamoDBGlobalTableProvider = class {
 					protection = regional.Table?.DeletionProtectionEnabled;
 					streamArn = regional.Table?.LatestStreamArn;
 				} catch (err) {
+					if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 					if (err instanceof ResourceNotFoundException$1) this.logger.debug(safeMsg`Cross-region replica ${regionLabel} returned RNF on DescribeTable; omitting its protection and stream policy`);
 					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
 				}
@@ -49299,6 +50183,7 @@ var DynamoDBGlobalTableProvider = class {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
 					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 				} catch (tagErr) {
+					if (strictFor("Replicas") && !(tagErr instanceof ResourceNotFoundException$1)) throw tagErr;
 					if (tagErr instanceof ResourceNotFoundException$1) {
 						if (isLocal) throw tagErr;
 						this.logger.debug(`Cross-region replica ${regionLabel} returned RNF on ListTagsOfResource; omitting Tags`);
@@ -49315,7 +50200,7 @@ var DynamoDBGlobalTableProvider = class {
 					if (readAutoScaling) entry["ReadProvisionedThroughputSettings"] = { ReadCapacityAutoScalingSettings: readAutoScaling };
 				}
 				return entry;
-			}));
+			})));
 			result["Replicas"] = replicas;
 			const localReplica = replicas.find((r) => r["Region"] === currentRegion);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
@@ -49371,6 +50256,7 @@ var DynamoDBGlobalTableProvider = class {
 				};
 				else if (ttlStatus === "DISABLED") {}
 			} catch (ttlErr) {
+				if (strictFor("TimeToLiveSpecification")) throw ttlErr;
 				this.logger.debug(`Could not read TimeToLive for ${tableNameForSubs}: ${describeAwsFailure(ttlErr).detail}`);
 			}
 			return result;
@@ -49386,6 +50272,7 @@ var DynamoDBGlobalTableProvider = class {
 			const block = reverseMapReplicaContributorInsights(ci.ContributorInsightsStatus, ci.ContributorInsightsMode, declaredReplica?.["ContributorInsightsSpecification"]);
 			if (block !== void 0) out["ContributorInsightsSpecification"] = block;
 		} catch (err) {
+			if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
@@ -49393,6 +50280,7 @@ var DynamoDBGlobalTableProvider = class {
 			const block = reverseMapReplicaPitr(description?.PointInTimeRecoveryStatus, description?.RecoveryPeriodInDays, declaredReplica?.["PointInTimeRecoverySpecification"]);
 			if (block !== void 0) out["PointInTimeRecoverySpecification"] = block;
 		} catch (err) {
+			if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		try {
@@ -49403,6 +50291,7 @@ var DynamoDBGlobalTableProvider = class {
 				out["KinesisStreamSpecification"] = ksOut;
 			}
 		} catch (err) {
+			if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 			this.logger.debug(`Could not read KinesisStreamingDestination for ${tableName} in ${regionLabel}: ${describeAwsFailure(err).detail}`);
 		}
 		return out;
@@ -49440,6 +50329,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				return reverseMapStreamPolicy(live, container);
 			} catch (err) {
+				if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
 				this.logger.debug(safeMsg`Could not read the ${what} of the ${regionLabel} replica of ${tableName}: ${describeAwsFailure(err).detail}`);
 				if (afterOwnWrite && last !== void 0 && last !== "") return reverseMapStreamPolicy(last, container);
 				if (afterOwnWrite && (isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1)) return declaredMember();
@@ -49488,6 +50378,7 @@ var DynamoDBGlobalTableProvider = class {
 				TargetTrackingScalingPolicyConfiguration: tttConfig
 			};
 		} catch (err) {
+			if (strictFor(indexName !== void 0 ? "GlobalSecondaryIndexes" : scalableDimension.includes("Write") ? "WriteProvisionedThroughputSettings" : "Replicas")) throw err;
 			this.logger.debug(`Could not read application-autoscaling settings for ${resourceId} (${scalableDimension}): ${describeAwsFailure(err).detail}`);
 			return null;
 		}
@@ -49707,9 +50598,48 @@ const REPLICA_SETTING_MEMBERS = [
 	"ContributorInsightsSpecification",
 	"KinesisStreamSpecification",
 	"ResourcePolicy",
-	"ReplicaStreamSpecification"
+	"ReplicaStreamSpecification",
+	"GlobalSecondaryIndexes"
 ];
+const REPLICATION_MODE_KEY = "GlobalTableSettingsReplicationMode";
+function readReplicationMode(properties) {
+	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	const declared = replicas.map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY]).filter((value) => value !== void 0 && value !== null);
+	if (declared.length === 0) return { kind: "absent" };
+	const [first] = declared;
+	if (typeof first !== "string" || first === "" || declared.some((v) => v !== first)) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICATION_MODE_KEY} must be one non-empty string`
+	};
+	if (replicas.length !== 1) return {
+		kind: "unusable",
+		reason: `Replicas[].${REPLICATION_MODE_KEY} can be declared only on a table with exactly one replica, as CloudFormation refuses it ("GlobalTableSettingsReplicationMode can be specified when exactly one replica is present"); remove it, or keep one replica`
+	};
+	return {
+		kind: "usable",
+		mode: first
+	};
+}
+function replicationModeShape(properties) {
+	return (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY] ?? null);
+}
+function replicationModeUpdate(properties, previousProperties) {
+	const want = readReplicationMode(properties);
+	if (want.kind === "unusable") return void 0;
+	const had = readReplicationMode(previousProperties);
+	const desired = want.kind === "usable" ? want.mode : void 0;
+	if (desired === (had.kind === "usable" ? had.mode : void 0)) return void 0;
+	return desired ?? "DISABLED";
+}
+function replicationModeCorrection(properties, previousProperties, liveMode) {
+	const want = readReplicationMode(properties);
+	if (want.kind !== "usable") return void 0;
+	if (replicationModeUpdate(properties, previousProperties) !== void 0) return void 0;
+	return (liveMode ?? "DISABLED") === want.mode ? void 0 : want.mode;
+}
 function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
+	const mode = readReplicationMode(properties);
+	if (mode.kind === "unusable" && (previousProperties === void 0 || !deepEqual(replicationModeShape(properties), replicationModeShape(previousProperties)))) return mode.reason;
 	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
 		const region = asRecord(entry)?.["Region"];
@@ -50386,7 +51316,7 @@ function buildLiveRecoveryGsiBaseline(desiredSdkIndexes, liveIndexes, options) {
 }
 function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnostics, maskSecrets = (text) => text) {
 	if (!Array.isArray(replicaIndexes) || replicaIndexes.length === 0) return void 0;
-	return replicaIndexes.map((entry) => {
+	const sendable = replicaIndexes.map((entry) => {
 		const cfn = asRecord(entry);
 		if (!cfn) return entry;
 		const indexName = cfn["IndexName"];
@@ -50395,7 +51325,8 @@ function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes, billingMode, diagnos
 		if (overrides.ProvisionedThroughputOverride) sdk.ProvisionedThroughputOverride = overrides.ProvisionedThroughputOverride;
 		if (overrides.OnDemandThroughputOverride) sdk.OnDemandThroughputOverride = overrides.OnDemandThroughputOverride;
 		return sdk;
-	});
+	}).filter((sdk) => asRecord(sdk) === void 0 || sdk.ProvisionedThroughputOverride !== void 0 || sdk.OnDemandThroughputOverride !== void 0);
+	return sendable.length > 0 ? sendable : void 0;
 }
 function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context, maskSecrets = (text) => text) {
 	const explicitProvisioned = asRecord(cfn["ProvisionedThroughputOverride"]);
@@ -50513,6 +51444,10 @@ function deepEqual(a, b) {
 		return false;
 	}
 }
+function lsiListOrEmpty(value) {
+	if (value === void 0 || value === null) return [];
+	return value;
+}
 
 //#endregion
 //#region src/provisioning/protection-flags.ts
@@ -50942,31 +51877,63 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	const previousForUpdate = reattached?.previous ?? previousWithSecretsDropped;
 	const changedForProvider = new Set(changedProperties);
 	for (const key of /* @__PURE__ */ new Set([...Object.keys(previousWithNoEchoHeld), ...Object.keys(previousForUpdate)])) if (keyOrderFreeJson(previousForUpdate[key]) !== keyOrderFreeJson(previousWithNoEchoHeld[key])) changedForProvider.add(key);
+	const unsettled = unsettledPropertiesOf(currentResource);
 	if (changedForProvider.size === 0) for (const key of /* @__PURE__ */ new Set([...Object.keys(updateProps), ...Object.keys(previousForUpdate)])) changedForProvider.add(key);
 	if (reattached !== void 0) engine.logger.info(safeMsg`  ${logicalId} (${resourceType}) lost its attachment to ${reattached.parents.join(", ")}, which this deploy re-created under the same name: attaching it again`);
 	if (droppedPrincipalKinds.length > 0) {
 		const kinds = droppedPrincipalKinds.join(" / ");
 		engine.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${kinds} holds a secret reference the template still spells the same way, so cdkd re-applies it to the principals this deploy resolved it to and removes it from none of them. If that secret's value changed since the last deploy, a principal only the OLD value named still has the policy or membership: remove it from that principal by hand.`);
 	}
-	const removal = prepareRemovalForUpdate(updateProvider, resourceType, updateProps, previousForUpdate);
+	const unsettledIdentity = {
+		provider: updateProvider,
+		logicalId,
+		physicalId: currentResource.physicalId,
+		resourceType,
+		recordedProperties: currentResource.properties ?? {}
+	};
+	const previousSettled = await settleUnsettledPrevious({
+		...unsettledIdentity,
+		names: unsettled,
+		previous: previousForUpdate,
+		desired: updateProps
+	});
+	if (unsettled.has("Tags")) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): an earlier failed update left Tags unsettled. cdkd re-applies the template's tags and removes only the recorded ones the template dropped; a tag that failed update added and no template declares is left on the resource. Remove it by hand if it should not be there.`);
+	const removal = prepareRemovalForUpdate(updateProvider, resourceType, updateProps, previousSettled);
 	let result;
 	let resultProvisionedBy = updateDecision.provisionedBy;
 	let captureProvider = updateProvider;
 	let replacedAtGeneration;
 	const inlinePolicyClaimed = engine.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
 	try {
-		result = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, removal.properties, previousForUpdate, {
+		result = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, removal.properties, previousSettled, {
 			maskSecrets: createSecretMasker(updateSecrets),
 			expectedRegion: engine.stackRegion,
 			recordedAttributes: currentResource.attributes,
 			...inlinePolicyClaimed && { inlinePolicyClaimed },
 			...removal.context,
-			changedProperties: changedForProvider
+			changedProperties: changedForProvider,
+			markUnsettled: (propertyName) => {
+				if (typeof propertyName !== "string" || propertyName === "") return;
+				if (!Object.hasOwn(resolvedProps, propertyName) && !Object.hasOwn(currentResource.properties ?? {}, propertyName)) {
+					engine.logger.debug(safeMsg`${logicalId}: ignored an unsettled mark for ${propertyName}, which is not one of its properties`);
+					return;
+				}
+				let marks = engine.unsettledMarks.get(logicalId);
+				if (marks === void 0) {
+					marks = /* @__PURE__ */ new Set();
+					engine.unsettledMarks.set(logicalId, marks);
+				}
+				marks.add(propertyName);
+			},
+			...unsettled.size > 0 && { unsettledProperties: unsettled }
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) engine.replacementRun.updatesThatSentNothing.add(logicalId);
+		engine.unsettledMarks.delete(logicalId);
 		if (result.wasReplaced === true && result.outcome === "partial") engine.replacementRun.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
 		result = withoutInjectedRemovals(result, removal.injected);
-		if (removal.unhandled.length > 0) engine.logger.warn(removalWarning(logicalId, resourceType, removal.unhandled));
+		const unhandledByCause = splitUnhandledRemovals(removal.unhandled, previousForUpdate, unsettled);
+		if (unhandledByCause.removedFromTemplate.length > 0) engine.logger.warn(removalWarning(logicalId, resourceType, unhandledByCause.removedFromTemplate));
+		if (unhandledByCause.addedByFailedUpdate.length > 0) engine.logger.warn(addedByFailedUpdateWarning(logicalId, resourceType, unhandledByCause.addedByFailedUpdate));
 	} catch (updateError) {
 		const ccUnsupported = isUpdateUnsupportedError(updateError, logicalId);
 		const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && engine.options.replace === true;
@@ -51146,6 +52113,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				logicalId,
 				generation: fallbackGeneration
 			}, replaceFallback));
+			engine.unsettledMarks.delete(logicalId);
 			result = fallbackOutcome.result;
 			resultProvisionedBy = fallbackOutcome.provisionedBy;
 			captureProvider = fallbackOutcome.captureProvider;
@@ -51166,6 +52134,12 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 			throw updateError;
 		}
 	}
+	const stillUnsettled = result.wasReplaced ? [] : await unsettledAfterUpdate({
+		...unsettledIdentity,
+		names: unsettled,
+		desired: updateProps
+	});
+	if (stillUnsettled.length > 0) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): the update succeeded, but AWS does not yet show the template's ${stillUnsettled.join(", ")}; cdkd keeps ${stillUnsettled.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
 	engine.replacementRun.updateWasReplaced.set(logicalId, result.wasReplaced === true);
 	if (result.wasReplaced !== true && (hasPassProvenance(updateSecrets) || referenceProvenanceOf(currentResource) !== void 0)) {
 		const cached = cachedCreateOnlyPropertyPaths(resourceType);
@@ -51202,6 +52176,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
+		...stillUnsettled.length > 0 && { unsettledProperties: stillUnsettled },
 		...keepsParameterRefusal && {
 			observedBaselineRefused: true,
 			observedBaselineRefusalReason: "unverifiable-parameter"
@@ -51610,6 +52585,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	for (const path of provenanceMoved.paths) rewrittenPaths.add(path);
 	if (provenanceMoved.paths.size > 0) engine.logger.info(safeMsg`${logicalId} is sent: ${[...provenanceMoved.paths].sort().join(", ")} read a secret-derived value at a newer version than ${logicalId} was deployed with (its upstream changed since then)`);
 	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const unsettledNames = unsettledPropertiesOf(currentResource);
 	const movedAsWritten = (key) => movedMasked.has(key) || rewrittenPaths.has(key) || keyOrderFreeJson(desiredForSkipCheckAsWritten[key]) !== keyOrderFreeJson(currentPropsAsWritten[key]);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
@@ -51684,7 +52660,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${engine.options.requireApproval ?? "never"})`;
 	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired) {
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired && unsettledNames.size === 0) {
 		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -51820,7 +52796,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		}
 	}
 	const confirmedPaths = /* @__PURE__ */ new Set([...noEchoHeldPaths, ...parameterSettledPaths]);
-	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
+	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && recreateDirectionFor(engine.options, stackName, logicalId) === void 0 && recordMatchesDesired && unsettledNames.size === 0 && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
 		engine.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
 		const staleHeld = staleCoordinates.filter((coordinate) => typeof coordinate[0] === "string" && parameterHeldKeys.has(coordinate[0]));
 		if (staleHeld.length > 0) {
@@ -51935,8 +52911,9 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const changedProperties = new Set([.../* @__PURE__ */ new Set([
 		...Object.keys(desiredForSkipCheckAsWritten),
 		...Object.keys(currentPropsAsWritten),
-		...Object.keys(resolvedProps)
-	])].filter((key) => movedAsWritten(key) || !confirmedPaths.has(key) && (pendingParameterLeaves.has(key) || otherFreshAt(key).length > 0)));
+		...Object.keys(resolvedProps),
+		...unsettledNames
+	])].filter((key) => unsettledNames.has(key) || movedAsWritten(key) || !confirmedPaths.has(key) && (pendingParameterLeaves.has(key) || otherFreshAt(key).length > 0)));
 	let previousForProvider = currentPropsAsWritten;
 	for (const coordinate of witness?.confirmed ?? []) {
 		const value = valueAtCoordinate(resolvedProps, coordinate);
@@ -52223,7 +53200,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			const savedFor = savedIds.join(", ");
 			try {
 				const partialState = {
-					version: 13,
+					version: 14,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -52352,6 +53329,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				} catch (provisionError) {
 					engine.interrupted = true;
 					engine.interruptCause ??= "sibling-failure";
+					if (change.changeType === "UPDATE") recordUnsettledMarks(engine, newResources, logicalId);
 					const refused = isRefusedBeforeApplying(provisionError, logicalId);
 					const attemptedGeneration = change.changeType === "UPDATE" && !refused && !isReplacementNameRefusal(provisionError, logicalId) ? engine.replacementRun.attemptedNameGeneration.get(logicalId) : void 0;
 					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
@@ -52518,6 +53496,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			await retryCarriedSupersededResources(engine, currentState, carriedSuperseded, newResources, { waitInUse: releasedSomething });
 		}
 	} catch (error) {
+		recordUnsettledMarks(engine, newResources);
 		warnUnretriedReplacedDeletes(engine.replacementRun, engine.replacementDeps(), engine.interruptCause === "user" ? "interrupted" : "failed");
 		const initialDeploy = currentEtag === void 0;
 		const written = /* @__PURE__ */ new Set([...engine.replacementRun.restoredLostChildren, ...completedOperations.map((op) => op.logicalId)]);
@@ -52574,7 +53553,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		}
 		try {
 			const preRollbackState = {
-				version: 13,
+				version: 14,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -52637,9 +53616,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			rollbackSettledNested = rollbackResult.settledNested;
 			rollbackRemainingFailedOps = rollbackResult.remainingFailedOps;
 		}
+		recordUnsettledMarks(engine, newResources);
 		try {
 			const postRollbackState = {
-				version: 13,
+				version: 14,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -52660,8 +53640,9 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			engine.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 			try {
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
+				recordUnsettledMarks(engine, newResources);
 				const postRollbackState = {
-					version: 13,
+					version: 14,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -52698,7 +53679,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	}
 	return {
 		state: {
-			version: 13,
+			version: 14,
 			region: engine.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
@@ -52717,7 +53698,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 }
 async function persistStateAfterOutputFailure(engine, stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 13,
+		version: 14,
 		region: engine.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -52751,6 +53732,13 @@ function journaledOrphanPolicy(policy) {
 	if (policy === void 0) return void 0;
 	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
 }
+function recordUnsettledMarks(engine, newResources, only) {
+	for (const [logicalId, marks] of engine.unsettledMarks) {
+		if (only !== void 0 && logicalId !== only) continue;
+		if (marks.size === 0 || !Object.hasOwn(newResources, logicalId)) continue;
+		newResources[logicalId] = withUnsettledProperties(newResources[logicalId], marks);
+	}
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/deploy-flow.ts
@@ -52792,7 +53780,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		clock.lap("state load");
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 13,
+			version: 14,
 			region: engine.stackRegion,
 			stackName,
 			resources: {},
@@ -53095,7 +54083,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					await resolveStackInstanceId();
 					try {
 						const refreshedState = {
-							version: 13,
+							version: 14,
 							region: engine.stackRegion,
 							stackName: currentState.stackName,
 							resources: currentState.resources,
@@ -53383,6 +54371,7 @@ var DeployEngine = class {
 	replacementRun = new ReplacementRunState();
 	outputsRun = new OutputsRunState();
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	unsettledMarks = /* @__PURE__ */ new Map();
 	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
@@ -53575,6 +54564,7 @@ var DeployEngine = class {
 		this.noEchoRun = new NoEchoRunState();
 		this.replacementRun = new ReplacementRunState();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
+		this.unsettledMarks = /* @__PURE__ */ new Map();
 		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
@@ -53779,5 +54769,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { computeImplicitDeleteEdges as $, AWS_NO_VALUE as $a, recordAttributeIdCopy as $c, RollbackInlinePolicyWriters as $i, getBootstrapMarkerKey as $l, carriedExportAliasExposure as $n, refuseMalformedResourceEntriesForDeploy as $o, namingSecretsWithRecordedNoEcho as $r, blockDeviceMappingsDifferOnlyInDeleteOnTermination as $s, lookupEachName as $t, StageLoadError as $u, beginDeleteWait as A, applyRoleArnIfSet as Aa, logOnlyValueCount as Ac, refuseMalformedDesiredTags as Ai, hasUnverifiableParameterRefusal as Al, REDACTED_DELETE_ADDRESS_SKIP_REASON as An, malformedOrphanRowsKeptWarning as Ao, cyan as Ar, MULTI_REGION_RECREATE_BLOCKED_TYPES as As, displacedOpClause as At, loadCdkJson as Au, waitForIndexesSettled as B, classifyRecordedSecretRegion as Ba, scrubResourceRecord as Bc, waitForLambdaFunctionActive as Bi, timePhase as Bl, retiredNameGenerationsAfter as Bn, malformedStateRefusalMessage as Bo, supersededAfterRollback as Br, coerceCfnInteger as Bs, getCurrentNestedStackContext as Bt, ssmResolvedValueType as Bu, planContributorInsightsOp as C, resolveDynamicReferences as Ca, redactForState as Cc, extractDeploymentEventError as Ci, withStackInstanceIdWithheld as Cl, replacementNeverSwapped as Cn, malformedExportNamesWarning as Co, proposeRenames as Cr, findSilentDropProperties as Cs, makeSiblingClaimReader as Ct, warnFinchArgvExposure as Cu, reverseMapTableContributorInsights as D, outputReferenceProvenanceOf as Da, createUnionSecretMasker as Dc, DBPROXY_TAG_OPTIONS as Di, exportNamesCarriedFrom as Dl, findNestedStackTypeChanges as Dn, malformedLocalResourcesWarning as Do, withStackRecords as Dr, hasNoCloudControlHandlers as Ds, keptForRetainedRecord as Dt, synthesisStatusMessage as Du, reverseMapIndexContributorInsights as E, keepHeldTokenProvenance as Ea, carryLogOnlyValues as Ec, DBPROXY_TAGS_WHAT as Ei, describeRegionValueKind as El, orphanNeedsIdentity as En, malformedLocalResourceEntriesWarning as Eo, getStackRecords as Er, NO_CC_HANDLERS_REASON as Es, resolvePendingCloudControlRequests as Et, Synthesizer as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, sendableAssumeRoleCommand as Fa, unionOfSecretBags as Fc, CC_BROKEN_REASON as Fi, orphansCarriedFrom as Fl, updatePartialReason as Fn, malformedRenderedContainersWarning as Fo, addSuperseded as Fr, coerceWarmThroughput as Fs, recordDisplacedSkips as Ft, resolveStateBucketWithDefault as Fu, sendTtlWaitingOutRateLimit as G, isUnboundTemplateParameter as Ga, isUncertifiedBaselineMaskPosition as Gc, withPrintingSecrets as Gi, buildAssetRedirectMap as Gl, reachableDivergentParameters as Gn, refuseMalformedOrphanRecordsForDestroy as Go, noEchoAttributeNamesOf as Gr, replayWarn as Gs, isHandledOrphan as Gt, uploadCfnTemplate as Gu, isTtlRateLimited as H, producerRegionsFromState as Ha, withoutPhysicalNameCopies as Hc, readsNoEchoDeleteValues as Hi, isSensitiveAttributeName as Hl, withNameGenerationReached as Hn, refuseDivergentRecordRegionForDestroy as Ho, supersededHolderOf as Hr, configIntegerRefusal as Hs, deleteJournaledOrphans as Ht, CFN_TEMPLATE_URL_LIMIT as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, AWS_CREDENTIAL_ENV_KEYS as Ia, createSecretMasker as Ic, ProviderRegistry as Ii, shouldRetainResource as Il, nameGenerationCarriedFrom as In, malformedResourceEntriesWarning as Io, deleteSupersededEntry as Ir, isWarmThroughputDecrease as Is, revertNestedChildFromJournal as It, resolveStateBucketWithDefaultAndSource as Iu, hasCdkAutoDeleteTag as J, isImpossibleEmptyStoredAttribute as Ja, identityKeyFor as Jc, customResourceResponseExpirationWarning as Ji, rewriteTemplateAssetReferences as Jl, displayTextOrWithheld as Jn, refuseMalformedOrphansForOrphan as Jo, noEchoParameterNamesOf as Jr, requireConfigString as Js, makeForeignHolderScan as Jt, expectedOwnerParam as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, parameterTypeMayLoseSecretIdentity as Ka, pathCrossesDottedKey as Kc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Ki, createAssetRedirectResolver as Kl, resourcesNamingDeclaredParameter as Kn, refuseMalformedOrphans as Ko, noEchoComparisonForTemplate as Kr, requireConfigArray as Ks, journaledOrphanLines as Kt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ku, deleteTableWithIndexBusyRetry as L, applyCallerIdentityCredentials as La, errorCauseChain as Lc, ccBrokenReason as Li, stackInstanceIdCarriedFrom as Ll, nameGenerationHighWaterOf as Ln, malformedResourcePropertiesWarning as Lo, holdsSupersededResources as Lr, toCfnInteger as Ls, revertedNestedRowIds as Lt, resolveUseCdkBootstrapAssets as Lu, deleteBudgetKey as M, assertSendableRoleArn as Ma, recordLogOnlyParameterValue as Mc, tagPlanWarning as Mi, importableOutputs as Ml, redactedDeleteAddressFields as Mn, malformedOrphansWarning as Mo, green as Mr, isStatefulRecreateTargetSync as Ms, dropSettledNestedJournals as Mt, resolveAutoAssetStorage as Mu, resolveDynamoDbDeleteBudgetClock as N, explicitRoleArnOrThrow as Na, recordLogOnlyValue as Nc, definedAttributes as Ni, isReadableBag as Nl, redactedDeleteAddressSkip as Nn, malformedOutputsRefusalMessage as No, red as Nr, renderStatefulReason as Ns, getNestedRevertRun as Nt, resolveCaptureObservedState as Nu, stripIndexContributorInsights as O, recordedOutputReferenceRegions as Oa, hasMaskableValues as Oc, planTagDiff as Oi, hasReadableExportSet as Ol, getCurrentProducerRegions as On, malformedOrphanRecordsRefusalMessage as Oo, replacedDeleteFailureVerdict as Or, findReplacedReadersOfRecreateTargets as Os, recordRetainedForReadoption as Ot, getDefaultStateBucketName as Ou, resolveDynamoDbDeleteBudgetMs as P, isIamRoleArn as Pa, shareLogOnlyValues as Pc, stringifyIfAssigned as Pi, orphansAfterRollback as Pl, updatePartialMessage as Pn, malformedOutputsWarning as Po, yellow as Pr, WARM_THROUGHPUT_MEMBERS as Ps, nestedChildStackName as Pt, resolveSkipPrefix as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, keepsSecretReferenceToken as Qa, physicalNameCopiesOf as Qc, unchangedBehindSecretReference as Qi, ensureAssetStorage as Ql, secretSafeKeyDisplay as Qn, refuseMalformedResourceEntries as Qo, maskEventTextWithBoundBags as Qr, withRetry as Qs, isAccessDeniedError as Qt, AssemblyReader as Qu, maskedLogger as R, callerEnvCredentials as Ra, maskSecretsInError as Rc, isCustomResource as Ri, PhaseClock as Rl, nameScopeOf as Rn, malformedResourcesWarning as Ro, isSupersededResourceRecord as Rr, toFiniteNumber as Rs, withNestedRevertRun as Rt, stateBucketExistenceConfirmed as Ru, indexDeclaresContributorInsights as S, s3BucketWebsiteUrl as Sa, markSameGenerationBag as Sc, DeploymentEventsStore as Si, stackInstanceIdOf as Sl, recordUnderIdIsNotOwn as Sn, malformedDriftResourcePropertiesWarning as So, parseMappingFile as Sr, findActionableSilentDrops as Ss, makeCanonicalizePropertiesFn as St, runDockerStreaming as Su, readContributorInsightsSpec as T, refuseUnreadableCdkCrossAccountRefs as Ta, snapshotPassProvenance as Tc, markDeleteStarted as Ti, acceptedCreateOnlyDropsOf as Tl, seedsDeleteFirstGuard as Tn, malformedLocalOutputsWarning as To, destroyStackRecordsView as Tr, withoutSilentDropProperties as Ts, pendingRequestCount as Tt, getDockerImageBySourceHash as Tu, planTimeToLive as U, regionLessSecretName as Ua, DYNAMIC_REFERENCE_TOKEN_SCAN as Uc, isCustomResourceType as Ui, stringifyValue as Ul, computeParameterTaint as Un, refuseMalformedNestedChildOutputs as Uo, supersededResourcesOf as Ur, configStringRefusal as Us, dropFailedCommands as Ut, MIGRATE_TMP_PREFIX as Uu, isTtlAlreadyDisabled as V, classifyReplaySecretRegion as Va, withPhysicalNameCopies as Vc, TemplateNoEchoReresolver as Vi, AssetPublisher as Vl, retiredNameGenerationsLeaving as Vn, previewableOrphanRecords as Vo, supersededHeldByOtherTypeWarning as Vr, configBooleanRefusal as Vs, withNestedStackContext as Vt, CFN_TEMPLATE_BODY_LIMIT as Vu, readTtlSpec as W, coerceParameterTypedValue as Wa, dynamicReferenceTokens as Wc, getCurrentResourceSecrets as Wi, WorkGraph as Wl, namesAnyDeclaredParameter as Wn, refuseMalformedOrphanRecords as Wo, withoutSuperseded as Wr, readConfigString as Ws, dropFailedHint as Wt, findLargeInlineResources as Wu, getPriorAttempts as X, carriesFetchableDynamicReference as Xa, recordNestedStackParameterExpressions as Xc, slowCcOperationTimeoutMs as Xi, BOOTSTRAP_MARKER_PREFIX as Xl, secretBearing as Xn, refuseMalformedOutputsForDestroy as Xo, completedReplayEntries as Xr, templateResourceTypes as Xs, formatResourceLine as Xt, canonicalizeRegion as Xu, isTruthyCfnBoolean as Y, carriesDynamicReference as Ya, inheritNestedStackParameterAssociations as Yc, CloudControlProvider as Yi, AssetModeResolver as Yl, exportAliasCollisionScrubWarning as Yn, refuseMalformedOutputs as Yo, createReadOnlyAttributeHealerFactory as Yr, prefetchCreateOnlyPropertyPaths as Ys, sameJournaledOrphans as Yt, PARTITION_TABLE as Yu, markRefusedBeforeApplying as Z, isNamelessDynamicReferenceError as Za, recoverMaskedOutput as Zc, onlySecretReferencesDiffer as Zi, assertAssetBucketRegion as Zl, secretBearingStateKeyWarning as Zn, refuseMalformedResourceAttributesForOrphan as Zo, journaledOrphanPrintingBag as Zr, describeTypeWithThrottleRetry as Zs, chunks as Zt, derivePartitionAndUrlSuffix as Zu, streamMemberRefusals as _, isSettledInstanceState as _a, readbackPathFor as _c, resolveBucketRegion as _d, ledgerForStack as _i, CrossPrefixScanCache as _l, isJournaledOrphan as _n, hasReadableOrphans as _o, rollbackOrphanIds as _r, repairMalformedResourcesForReadOnly as _s, withResourceDeadline as _t, partitionSensitiveEnv as _u, isProtectionValueActive as a, isWaitAbandonedError as aa, DagBuilder as ac, hasOwnKey as ad, stateSecretNameNeedles as ai, recordMaskOnlyValuesIn as al, refuseRefactorMarker as an, withSharedDrainBudget as ao, collectPublishedOutputNames as ar, refuseMalformedResourcePropertiesForDrift as as, childTemplateLoader as at, buildDenyExternalAccessPolicy as au, CONTRIBUTOR_INSIGHTS_KEY as b, s3BucketDualStackDomainName as ba, valueAtCoordinate as bc, acquireIdempotencyToken as bi, isAccessDenied$1 as bl, planRollback as bn, isReadableOrphanRecord as bo, looselyEqual as br, unreadableResourceEntries as bs, keptWholeReasonText as bt, redactedDockerCause as bu, DynamoDBGlobalTableProvider as c, ec2InstanceProtectionSite as ca, isMarkedCoordinate as cc, ownValue as cd, PRE_DELETE_SNAPSHOT_TYPES as ci, recordProvenPublicExpression as cl, hasPendingMovesOut as cn, declaresNoEcho as co, DEFAULT_RESOURCE_TIMEOUT_MS as cr, refuseMalformedResourcesForDeploy as cs, listNestedTemplateRows as ct, describeDockerCapturedOutput as cu, declaredStreamPolicyMember as d, reDisableInstanceApiTermination as da, maskWholeValue as dc, displayAssemblyPath as dd, createPreDeleteFinalSnapshot as di, isSingleDynamicReferenceToken as dl, refusePendingMovesOut as dn, STATE_RESOURCES_MALFORMED as do, constructPathOf as dr, refuseMalformedState as ds, conditionFingerprint as dt, dockerSpawnEnvWithSensitive as du, UNSPECIFIED_SKIP_REASON as ea, ecsServiceLaunchTypeSetOrChanged as ec, processStackMessages as ed, orphanRecordsPrintingBag as ei, recordPhysicalNameCopy as el, withApiLimit as en, cfnRefValueFromPhysicalId as eo, exportNameNoEchoParameters as er, refuseMalformedResourceEntriesForDestroy as es, crossStackOutputProvenanceSource as et, isCrossRegionRedirect as eu, declaredStreamTagsMember as f, reEnableInstanceApiTermination as fa, maskedLeafCoordinatesOf as fc, renderAssemblyPathEscape as fd, effectiveDeletionPolicy as fi, LockManager as fl, replayFailedOperations as fn, UNREADABLE_ORPHANS_CONTAINER_ROW as fo, findDestructiveChanges as fr, repairMalformedOrphanRecordsForReadOnly as fs, conditionInputsFrom as ft, finchSecretArgvRefusal as fu, streamDeclaresTags as g, poisonRenderedSpellingsCollidingIn as ga, passedNoEchoParametersOf as gc, clearBucketRegionCache as gd, earliestDefined as gi, CrossPrefixReadError as gl, demoteSupersededOrphans as gn, displayLogicalId as go, movedToHint as gr, repairMalformedResourcePropertiesForReadOnly as gs, enclosingDeadlineRemainingMs as gt, isMalformedEnvKey as gu, streamDeclaresPolicy as h, IntrinsicFunctionResolver as ha, noEchoOutputsComparison as hc, injectedAwsRegionValue as hd, unsupportedFinalSnapshotError as hi, rebuildClientForBucketRegion as hl, recordAfterRollbackUpdate as hn, deployRefusesOrphanRowsReason as ho, hintSidesOf as hr, repairMalformedResourceEntriesForReadOnly as hs, enclosingDeadlineExpired as ht, isDockerClientEnvKey as hu, PROTECTION_PROPERTY_BY_TYPE as i, withIndeterminateGuard as ia, sameLambdaFunctionAddress as ic, defineOwnKey as id, secretNamedRecordNeedles as ii, recordMaskOnlyValue as il, refactorMarkerRefusalMessage as in, parseWebACLArn as io, collectDeclaredOutputNames as ir, refuseMalformedResourcePropertiesForDestroy as is, serviceTokenBlockingReason as it, validateContainerRepoName as iu, compensateRemovedDeletionProtection as j, assertFlagRoleArn as ja, printingCorpusOf as jc, tagMapAsList as ji, importableOutputKeys as jl, isRedactedRecordedValue as jn, malformedOrphansRefusalMessage as jo, gray as jr, isStatefulRecreateTargetForReplace as js, displacedPhysicalIdShown as jt, resolveApp as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, recordedReferenceRegions as ka, literalSplitDelimitersOf as kc, readTagList as ki, hasReasonlessBaselineRefusal as kl, inheritProducerRegions as kn, malformedOrphanRecordsWarning as ko, bold as kr, shownType as ks, NESTED_PENDING_PARENT_REASON as kt, getLegacyStateBucketName as ku, STREAM_POLICY_KEY as l, isTerminationProtectionPropagationError as la, maskAtCoordinates as lc, absoluteAssemblyPathEscape as ld, buildFinalSnapshotIdentifier as li, wholeStringLeavesOf as ll, pendingMovesOutOf as ln, JSON_LISTING_HOLE_VALUE as lo, DEFAULT_RESOURCE_WARN_AFTER_MS as lr, refuseMalformedResourcesForDestroy as ls, renderNestedTemplateTreeDefect as lt, describeDockerExecFailure as lu, reverseMapStreamPolicy as m, INTRINSIC_KEYS as ma, noEchoLeavesOf as mc, injectAwsRegion as md, refusesFinalSnapshot as mi, S3StateBackend as ml, removeProtectionTypeList as mn, accountArgs as mo, findRefactorHints as mr, repairMalformedOutputsForReadOnly as ms, readRecordedConditionVerdicts as mt, getDockerCmd as mu, recordedProtectionEvidence as n, deleteLeftInPlace as na, canonicalLambdaFunctionName as nc, parseFailureDebugDetail as nd, secretNamePrintingBags as ni, carriesSecretMask as nl, readRefactorMarkerOnce as nn, lacksRecordedTableArn as no, isWholeDynamicReferenceValue as nr, refuseMalformedResourceEntriesForImportSave as ns, deferredServiceTokenWarning as nt, readBootstrapMarkerBody as nu, perType as o, markWaitAbandoned as oa, TemplateParser as oc, hasPlainPrototype$1 as od, storedSecretNameNeedles as oi, recordNoEchoAttributeValues as ol, sameMove as on, parameterInputsFor as oo, isExportAliasCollision as or, refuseMalformedResourcePropertiesForExport as os, findNestedTemplateTreeDefect as ot, buildDockerImage as ou, planStreamMemberOps as p, DiffCalculator as pa, noEchoCoordinatesOf as pc, resolveAssemblyPath as pd, isFinalSnapshotError as pi, isLockInfoExpired as pl, replayRollback as pn, UNREADABLE_RESOURCES_MAP_ROW as po, formatDestructiveChange as pr, repairMalformedOrphansForReadOnly as ps, parentSuppliedValues as pt, formatDockerLoginError as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, getAccountInfo as qa, spelledKeysOf as qc, applyCustomResourceResponseExpiration as qi, loadPublishableAssetManifest as ql, WITHHELD_NAME_DISPLAY as qn, refuseMalformedOrphansForDestroy as qo, noEchoExactEchoLeavesOf as qr, requireConfigObject as qs, loadJournaledOrphans as qt, decodeListingKey as qu, recordedProtectionNote as r, deleteSkipReason as ra, lambdaFunctionNameForMask as rc, utf8ByteLength as rd, secretNamedAttributeNamesOf as ri, provenPublicValue as rl, refactorMarkerMovesOf as rn, refStateLookupFromResource as ro, noEchoParameterValueSeed as rr, refuseMalformedResourceEntriesForOrphan as rs, findServiceTokenRefusals as rt, validateAssetBucketName as ru, readProtection as s, disableInstanceApiTermination as sa, canonicalCoordinates as sc, nullPrototypeRecord as sd, ATOMIC_FINAL_SNAPSHOT_TYPES as si, recordNoEchoParameterFreshValue as sl, updateRefactorMarker as sn, passedParameterClassesOf as so, bindingSkippedOutputs as sr, refuseMalformedResourcePropertiesForOrphan as ss, isAbsoluteAssetPath as st, resolveDockerContextDirectory as su, DeployEngine as t, deleteIndeterminateGuards as ta, emrClusterInstancesReplaced as tc, describeJsonParseFailure as td, secretNamePrintingBag as ti, splitGetAttStringForm as tl, readRefactorMarker as tn, isStalePlaceholderArnAttribute as to, exportNameSecretExposure as tr, refuseMalformedResourceEntriesForImport as ts, inheritedProvenanceForChildDiff as tt, parseBootstrapMarker as tu, STREAM_TAGS_KEY as u, observeThenDisableInstanceApiTermination as ua, maskReadbackAtCoordinates as uc, describeFileReadFailure as ud, ccRoutedFinalSnapshotError as ui, WHOLE_DYNAMIC_REFERENCE_PATTERN as ul, pendingMovesRefusalMessage as un, STATE_REGION_DIVERGED as uo, maskingRetryLogger as ur, refuseMalformedResourcesForExport as us, templateIdentity as ut, describeDockerFailure as uu, streamPolicyMatchesDeclared as v, s3BucketArn as va, readsNoEchoSource as vc, reserveStackCreateToken as vi, applyCrossPrefixScan as vl, isReplacementOrphan as vn, hasReadableOutputs as vo, withMovedTo as vr, unpreviewableOrphanRecords as vs, diffSecurity as vt, redactDockerArgvValues as vu, planIndexContributorInsightsOps as w, producerLookupOver as wa, recordReferenceProvenanceEntry as wc, isRefusedByName as wi, splitImportedOps as wl, resolveReplacementOldType as wn, malformedExportSourceWarning as wo, awaitInFlightSibling as wr, unwrittenCreateOnlyReplacement as ws, planOrphanAdoption as wt, AssetManifestLoader as wu, contributorInsightsRefusals as x, s3BucketRegionalDomainName as xa, liveMatchesUnresolvedTokenFrame as xc, DeploymentEventsReader as xi, isNotImplemented as xl, recheckFailedPlan as xn, isReadableResourceEntry as xo, mappingPairs as xr, withheldAccountClause as xs, mergeNoChangeOutputs as xt, runDockerForeground as xu, streamTagsMatchDeclared as y, s3BucketDomainName as ya, recordedNoEchoValuesOf as yc, withCreateTokenLedger as yi, crossPrefixDeniedWarning as yl, planFailedOps as yn, hasReadableResources as yo, isPairableType as yr, unreadableOrphanRecords as ys, isSecretBearingReferenceString as yt, redactedCause as yu, relayedIndexBusyDelete as z, envCredentialsAreAssumedRole as za, maskSecretsInText as zc, wouldReturnToSdkProvider as zi, renderPhaseTimings as zl, retiredAfterRollback as zn, malformedScrubResourceEntriesRefusalMessage as zo, removeSuperseded as zr, coerceCfnBoolean as zs, collectNestedChildUnaddressed as zt, warnDeprecatedNoPrefixCliFlag as zu };
-//# sourceMappingURL=deploy-engine-CDjAtIrn.js.map
+export { computeImplicitDeleteEdges as $, coerceParameterTypedValue as $a, DYNAMIC_REFERENCE_TOKEN_SCAN as $c, applyCustomResourceResponseExpiration as $i, stringifyValue as $l, WITHHELD_NAME_DISPLAY as $n, refuseMalformedOrphanRecords as $o, noEchoExactEchoLeavesOf as $r, readConfigString as $s, lookupEachName as $t, MIGRATE_TMP_PREFIX as $u, beginDeleteWait as A, s3BucketRegionalDomainName as Aa, valueAtCoordinate as Ac, isRefusedByName as Ai, isAccessDenied$1 as Al, resolveReplacementOldType as An, isReadableResourceEntry as Ao, awaitInFlightSibling as Ar, withheldAccountClause as As, displacedOpClause as At, redactedDockerCause as Au, waitForIndexesSettled as B, assertFlagRoleArn as Ba, logOnlyValueCount as Bc, stringifyIfAssigned as Bi, hasUnverifiableParameterRefusal as Bl, updatePartialMessage as Bn, malformedOrphansRefusalMessage as Bo, yellow as Br, isStatefulRecreateTargetForReplace as Bs, getCurrentNestedStackContext as Bt, loadCdkJson as Bu, planContributorInsightsOp as C, withoutUnsettledProperties as Ca, noEchoCoordinatesOf as Cc, resolveAssemblyPath as Cd, ledgerForStack as Ci, isLockInfoExpired as Cl, isJournaledOrphan as Cn, accountArgs as Co, rollbackOrphanIds as Cr, repairMalformedOutputsForReadOnly as Cs, makeSiblingClaimReader as Ct, formatDockerLoginError as Cu, reverseMapTableContributorInsights as D, s3BucketArn as Da, readbackPathFor as Dc, resolveBucketRegion as Dd, DeploymentEventsReader as Di, CrossPrefixScanCache as Dl, recheckFailedPlan as Dn, hasReadableOutputs as Do, mappingPairs as Dr, unpreviewableOrphanRecords as Ds, keptForRetainedRecord as Dt, partitionSensitiveEnv as Du, reverseMapIndexContributorInsights as E, isSettledInstanceState as Ea, passedNoEchoParametersOf as Ec, clearBucketRegionCache as Ed, acquireIdempotencyToken as Ei, CrossPrefixReadError as El, planRollback as En, hasReadableOrphans as Eo, looselyEqual as Er, repairMalformedResourcesForReadOnly as Es, resolvePendingCloudControlRequests as Et, isMalformedEnvKey as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, keepHeldTokenProvenance as Fa, snapshotPassProvenance as Fc, readTagList as Fi, acceptedCreateOnlyDropsOf as Fl, inheritProducerRegions as Fn, malformedLocalResourceEntriesWarning as Fo, bold as Fr, NO_CC_HANDLERS_REASON as Fs, recordDisplacedSkips as Ft, getDockerImageBySourceHash as Fu, sendTtlWaitingOutRateLimit as G, AWS_CREDENTIAL_ENV_KEYS as Ga, unionOfSecretBags as Gc, wouldReturnToSdkProvider as Gi, orphansCarriedFrom as Gl, retiredAfterRollback as Gn, malformedResourceEntriesWarning as Go, removeSuperseded as Gr, isWarmThroughputDecrease as Gs, isHandledOrphan as Gt, resolveStateBucketWithDefault as Gu, isTtlRateLimited as H, explicitRoleArnOrThrow as Ha, recordLogOnlyParameterValue as Hc, ProviderRegistry as Hi, importableOutputs as Hl, nameGenerationCarriedFrom as Hn, malformedOutputsRefusalMessage as Ho, deleteSupersededEntry as Hr, renderStatefulReason as Hs, deleteJournaledOrphans as Ht, resolveAutoAssetStorage as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, outputReferenceProvenanceOf as Ia, carryLogOnlyValues as Ic, refuseMalformedDesiredTags as Ii, describeRegionValueKind as Il, REDACTED_DELETE_ADDRESS_SKIP_REASON as In, malformedLocalResourcesWarning as Io, cyan as Ir, hasNoCloudControlHandlers as Is, revertNestedChildFromJournal as It, Synthesizer as Iu, hasCdkAutoDeleteTag as J, envCredentialsAreAssumedRole as Ja, maskSecretsInError as Jc, readsNoEchoDeleteValues as Ji, PhaseClock as Jl, withNameGenerationReached as Jn, malformedScrubResourceEntriesRefusalMessage as Jo, supersededHolderOf as Jr, coerceCfnBoolean as Js, makeForeignHolderScan as Jt, stateBucketExistenceConfirmed as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, applyCallerIdentityCredentials as Ka, createSecretMasker as Kc, waitForLambdaFunctionActive as Ki, shouldRetainResource as Kl, retiredNameGenerationsAfter as Kn, malformedResourcePropertiesWarning as Ko, supersededAfterRollback as Kr, toCfnInteger as Ks, journaledOrphanLines as Kt, resolveStateBucketWithDefaultAndSource as Ku, deleteTableWithIndexBusyRetry as L, recordedOutputReferenceRegions as La, createUnionSecretMasker as Lc, tagMapAsList as Li, exportNamesCarriedFrom as Ll, isRedactedRecordedValue as Ln, malformedOrphanRecordsRefusalMessage as Lo, gray as Lr, findReplacedReadersOfRecreateTargets as Ls, revertedNestedRowIds as Lt, synthesisStatusMessage as Lu, deleteBudgetKey as M, resolveDynamicReferences as Ma, markSameGenerationBag as Mc, DBPROXY_TAGS_WHAT as Mi, stackInstanceIdOf as Ml, orphanNeedsIdentity as Mn, malformedExportNamesWarning as Mo, getStackRecords as Mr, findSilentDropProperties as Ms, dropSettledNestedJournals as Mt, runDockerStreaming as Mu, resolveDynamoDbDeleteBudgetClock as N, producerLookupOver as Na, redactForState as Nc, DBPROXY_TAG_OPTIONS as Ni, withStackInstanceIdWithheld as Nl, findNestedStackTypeChanges as Nn, malformedExportSourceWarning as No, withStackRecords as Nr, unwrittenCreateOnlyReplacement as Ns, getNestedRevertRun as Nt, warnFinchArgvExposure as Nu, stripIndexContributorInsights as O, s3BucketDomainName as Oa, readsNoEchoSource as Oc, DeploymentEventsStore as Oi, applyCrossPrefixScan as Ol, recordUnderIdIsNotOwn as On, hasReadableResources as Oo, parseMappingFile as Or, unreadableOrphanRecords as Os, recordRetainedForReadoption as Ot, redactDockerArgvValues as Ou, resolveDynamoDbDeleteBudgetMs as P, refuseUnreadableCdkCrossAccountRefs as Pa, recordReferenceProvenanceEntry as Pc, planTagDiff as Pi, splitImportedOps as Pl, getCurrentProducerRegions as Pn, malformedLocalOutputsWarning as Po, replacedDeleteFailureVerdict as Pr, withoutSilentDropProperties as Ps, nestedChildStackName as Pt, AssetManifestLoader as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, regionLessSecretName as Qa, withoutPhysicalNameCopies as Qc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Qi, isSensitiveAttributeName as Ql, resourcesNamingDeclaredParameter as Qn, refuseMalformedNestedChildOutputs as Qo, noEchoComparisonForTemplate as Qr, configStringRefusal as Qs, isAccessDeniedError as Qt, CFN_TEMPLATE_URL_LIMIT as Qu, maskedLogger as R, recordedReferenceRegions as Ra, hasMaskableValues as Rc, tagPlanWarning as Ri, hasReadableExportSet as Rl, redactedDeleteAddressFields as Rn, malformedOrphanRecordsWarning as Ro, green as Rr, shownType as Rs, withNestedRevertRun as Rt, getDefaultStateBucketName as Ru, indexDeclaresContributorInsights as S, withUnsettledProperties as Sa, maskedLeafCoordinatesOf as Sc, renderAssemblyPathEscape as Sd, earliestDefined as Si, LockManager as Sl, demoteSupersededOrphans as Sn, UNREADABLE_RESOURCES_MAP_ROW as So, movedToHint as Sr, repairMalformedOrphansForReadOnly as Ss, makeCanonicalizePropertiesFn as St, finchSecretArgvRefusal as Su, readContributorInsightsSpec as T, poisonRenderedSpellingsCollidingIn as Ta, noEchoOutputsComparison as Tc, injectedAwsRegionValue as Td, withCreateTokenLedger as Ti, rebuildClientForBucketRegion as Tl, planFailedOps as Tn, displayLogicalId as To, isPairableType as Tr, repairMalformedResourcePropertiesForReadOnly as Ts, pendingRequestCount as Tt, isDockerClientEnvKey as Tu, planTimeToLive as U, isIamRoleArn as Ua, recordLogOnlyValue as Uc, ccBrokenReason as Ui, isReadableBag as Ul, nameGenerationHighWaterOf as Un, malformedOutputsWarning as Uo, holdsSupersededResources as Ur, WARM_THROUGHPUT_MEMBERS as Us, dropFailedCommands as Ut, resolveCaptureObservedState as Uu, isTtlAlreadyDisabled as V, assertSendableRoleArn as Va, printingCorpusOf as Vc, CC_BROKEN_REASON as Vi, importableOutputKeys as Vl, updatePartialReason as Vn, malformedOrphansWarning as Vo, addSuperseded as Vr, isStatefulRecreateTargetSync as Vs, withNestedStackContext as Vt, resolveApp as Vu, readTtlSpec as W, sendableAssumeRoleCommand as Wa, shareLogOnlyValues as Wc, isCustomResource as Wi, orphansAfterRollback as Wl, nameScopeOf as Wn, malformedRenderedContainersWarning as Wo, isSupersededResourceRecord as Wr, coerceWarmThroughput as Ws, dropFailedHint as Wt, resolveSkipPrefix as Wu, getPriorAttempts as X, classifyReplaySecretRegion as Xa, scrubResourceRecord as Xc, getCurrentResourceSecrets as Xi, timePhase as Xl, namesAnyDeclaredParameter as Xn, previewableOrphanRecords as Xo, withoutSuperseded as Xr, configBooleanRefusal as Xs, formatResourceLine as Xt, ssmResolvedValueType as Xu, isTruthyCfnBoolean as Y, classifyRecordedSecretRegion as Ya, maskSecretsInText as Yc, isCustomResourceType as Yi, renderPhaseTimings as Yl, computeParameterTaint as Yn, malformedStateRefusalMessage as Yo, supersededResourcesOf as Yr, coerceCfnInteger as Ys, sameJournaledOrphans as Yt, warnDeprecatedNoPrefixCliFlag as Yu, markRefusedBeforeApplying as Z, producerRegionsFromState as Za, withPhysicalNameCopies as Zc, withPrintingSecrets as Zi, AssetPublisher as Zl, reachableDivergentParameters as Zn, refuseDivergentRecordRegionForDestroy as Zo, noEchoAttributeNamesOf as Zr, configIntegerRefusal as Zs, chunks as Zt, CFN_TEMPLATE_BODY_LIMIT as Zu, streamMemberRefusals as _, reDisableInstanceApiTermination as _a, canonicalCoordinates as _c, nullPrototypeRecord as _d, createPreDeleteFinalSnapshot as _i, recordNoEchoParameterFreshValue as _l, withUnprovenUnsettled as _n, declaresNoEcho as _o, constructPathOf as _r, refuseMalformedResourcesForDeploy as _s, withResourceDeadline as _t, resolveDockerContextDirectory as _u, isProtectionValueActive as a, RollbackInlinePolicyWriters as aa, templateResourceTypes as ac, PARTITION_TABLE as ad, namingSecretsWithRecordedNoEcho as ai, inheritNestedStackParameterAssociations as al, refuseRefactorMarker as an, carriesFetchableDynamicReference as ao, carriedExportAliasExposure as ar, refuseMalformedOutputsForDestroy as as, childTemplateLoader as at, AssetModeResolver as au, CONTRIBUTOR_INSIGHTS_KEY as b, INTRINSIC_KEYS as ba, maskReadbackAtCoordinates as bc, describeFileReadFailure as bd, refusesFinalSnapshot as bi, WHOLE_DYNAMIC_REFERENCE_PATTERN as bl, equalModuloMask as bn, STATE_RESOURCES_MALFORMED as bo, findRefactorHints as br, refuseMalformedState as bs, keptWholeReasonText as bt, describeDockerFailure as bu, DynamoDBGlobalTableProvider as c, deleteLeftInPlace as ca, blockDeviceMappingsDifferOnlyInDeleteOnTermination as cc, AssemblyReader as cd, secretNamePrintingBags as ci, physicalNameCopiesOf as cl, hasPendingMovesOut as cn, AWS_NO_VALUE as co, isWholeDynamicReferenceValue as cr, refuseMalformedResourceEntriesForDeploy as cs, listNestedTemplateRows as ct, ensureAssetStorage as cu, declaredStreamPolicyMember as d, isWaitAbandonedError as da, emrClusterInstancesReplaced as dc, describeJsonParseFailure as dd, stateSecretNameNeedles as di, splitGetAttStringForm as dl, refusePendingMovesOut as dn, lacksRecordedTableArn as do, collectPublishedOutputNames as dr, refuseMalformedResourceEntriesForImportSave as ds, conditionFingerprint as dt, parseBootstrapMarker as du, customResourceResponseExpirationWarning as ea, replayWarn as ec, findLargeInlineResources as ed, noEchoParameterNamesOf as ei, dynamicReferenceTokens as el, withApiLimit as en, isUnboundTemplateParameter as eo, displayTextOrWithheld as er, refuseMalformedOrphanRecordsForDestroy as es, crossStackOutputProvenanceSource as et, WorkGraph as eu, declaredStreamTagsMember as f, markWaitAbandoned as fa, canonicalLambdaFunctionName as fc, parseFailureDebugDetail as fd, storedSecretNameNeedles as fi, carriesSecretMask as fl, replayFailedOperations as fn, refStateLookupFromResource as fo, isExportAliasCollision as fr, refuseMalformedResourceEntriesForOrphan as fs, conditionInputsFrom as ft, readBootstrapMarkerBody as fu, streamDeclaresTags as g, observeThenDisableInstanceApiTermination as ga, TemplateParser as gc, hasPlainPrototype$1 as gd, ccRoutedFinalSnapshotError as gi, recordNoEchoAttributeValues as gl, settleUnsettledPrevious as gn, passedParameterClassesOf as go, maskingRetryLogger as gr, refuseMalformedResourcePropertiesForOrphan as gs, enclosingDeadlineRemainingMs as gt, buildDockerImage as gu, streamDeclaresPolicy as h, isTerminationProtectionPropagationError as ha, DagBuilder as hc, hasOwnKey as hd, buildFinalSnapshotIdentifier as hi, recordMaskOnlyValuesIn as hl, recordAfterRollbackUpdate as hn, parameterInputsFor as ho, DEFAULT_RESOURCE_WARN_AFTER_MS as hr, refuseMalformedResourcePropertiesForExport as hs, enclosingDeadlineExpired as ht, buildDenyExternalAccessPolicy as hu, PROTECTION_PROPERTY_BY_TYPE as i, unchangedBehindSecretReference as ia, prefetchCreateOnlyPropertyPaths as ic, expectedOwnerParam as id, maskEventTextWithBoundBags as ii, identityKeyFor as il, refactorMarkerRefusalMessage as in, carriesDynamicReference as io, secretSafeKeyDisplay as ir, refuseMalformedOutputs as is, serviceTokenBlockingReason as it, rewriteTemplateAssetReferences as iu, compensateRemovedDeletionProtection as j, s3BucketWebsiteUrl as ja, liveMatchesUnresolvedTokenFrame as jc, markDeleteStarted as ji, isNotImplemented as jl, seedsDeleteFirstGuard as jn, malformedDriftResourcePropertiesWarning as jo, destroyStackRecordsView as jr, findActionableSilentDrops as js, displacedPhysicalIdShown as jt, runDockerForeground as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, s3BucketDualStackDomainName as ka, recordedNoEchoValuesOf as kc, extractDeploymentEventError as ki, crossPrefixDeniedWarning as kl, replacementNeverSwapped as kn, isReadableOrphanRecord as ko, proposeRenames as kr, unreadableResourceEntries as ks, NESTED_PENDING_PARENT_REASON as kt, redactedCause as ku, STREAM_POLICY_KEY as l, deleteSkipReason as la, dbInstanceEngineChangeIsInPlace as lc, StageLoadError as ld, secretNamedAttributeNamesOf as li, recordAttributeIdCopy as ll, pendingMovesOutOf as ln, cfnRefValueFromPhysicalId as lo, noEchoParameterValueSeed as lr, refuseMalformedResourceEntriesForDestroy as ls, renderNestedTemplateTreeDefect as lt, getBootstrapMarkerKey as lu, reverseMapStreamPolicy as m, ec2InstanceProtectionSite as ma, sameLambdaFunctionAddress as mc, defineOwnKey as md, PRE_DELETE_SNAPSHOT_TYPES as mi, recordMaskOnlyValue as ml, removeProtectionTypeList as mn, withSharedDrainBudget as mo, DEFAULT_RESOURCE_TIMEOUT_MS as mr, refuseMalformedResourcePropertiesForDrift as ms, readRecordedConditionVerdicts as mt, validateContainerRepoName as mu, recordedProtectionEvidence as n, slowCcOperationTimeoutMs as na, requireConfigObject as nc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as nd, completedReplayEntries as ni, pathCrossesDottedKey as nl, readRefactorMarkerOnce as nn, getAccountInfo as no, secretBearing as nr, refuseMalformedOrphansForDestroy as ns, deferredServiceTokenWarning as nt, createAssetRedirectResolver as nu, perType as o, UNSPECIFIED_SKIP_REASON as oa, describeTypeWithThrottleRetry as oc, canonicalizeRegion as od, orphanRecordsPrintingBag as oi, recordNestedStackParameterExpressions as ol, sameMove as on, isNamelessDynamicReferenceError as oo, exportNameNoEchoParameters as or, refuseMalformedResourceAttributesForOrphan as os, findNestedTemplateTreeDefect as ot, BOOTSTRAP_MARKER_PREFIX as ou, planStreamMemberOps as p, disableInstanceApiTermination as pa, lambdaFunctionNameForMask as pc, utf8ByteLength as pd, ATOMIC_FINAL_SNAPSHOT_TYPES as pi, provenPublicValue as pl, replayRollback as pn, parseWebACLArn as po, bindingSkippedOutputs as pr, refuseMalformedResourcePropertiesForDestroy as ps, parentSuppliedValues as pt, validateAssetBucketName as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, callerEnvCredentials as qa, errorCauseChain as qc, TemplateNoEchoReresolver as qi, stackInstanceIdCarriedFrom as ql, retiredNameGenerationsLeaving as qn, malformedResourcesWarning as qo, supersededHeldByOtherTypeWarning as qr, toFiniteNumber as qs, loadJournaledOrphans as qt, resolveUseCdkBootstrapAssets as qu, recordedProtectionNote as r, onlySecretReferencesDiffer as ra, requireConfigString as rc, decodeListingKey as rd, journaledOrphanPrintingBag as ri, spelledKeysOf as rl, refactorMarkerMovesOf as rn, isImpossibleEmptyStoredAttribute as ro, secretBearingStateKeyWarning as rr, refuseMalformedOrphansForOrphan as rs, findServiceTokenRefusals as rt, loadPublishableAssetManifest as ru, readProtection as s, deleteIndeterminateGuards as sa, withRetry as sc, derivePartitionAndUrlSuffix as sd, secretNamePrintingBag as si, recoverMaskedOutput as sl, updateRefactorMarker as sn, keepsSecretReferenceToken as so, exportNameSecretExposure as sr, refuseMalformedResourceEntries as ss, isAbsoluteAssetPath as st, assertAssetBucketRegion as su, DeployEngine as t, CloudControlProvider as ta, requireConfigArray as tc, uploadCfnTemplate as td, createReadOnlyAttributeHealerFactory as ti, isUncertifiedBaselineMaskPosition as tl, readRefactorMarker as tn, parameterTypeMayLoseSecretIdentity as to, exportAliasCollisionScrubWarning as tr, refuseMalformedOrphans as ts, inheritedProvenanceForChildDiff as tt, buildAssetRedirectMap as tu, STREAM_TAGS_KEY as u, withIndeterminateGuard as ua, ecsServiceLaunchTypeSetOrChanged as uc, processStackMessages as ud, secretNamedRecordNeedles as ui, recordPhysicalNameCopy as ul, pendingMovesRefusalMessage as un, isStalePlaceholderArnAttribute as uo, collectDeclaredOutputNames as ur, refuseMalformedResourceEntriesForImport as us, templateIdentity as ut, isCrossRegionRedirect as uu, streamPolicyMatchesDeclared as v, reEnableInstanceApiTermination as va, isMarkedCoordinate as vc, ownValue as vd, effectiveDeletionPolicy as vi, recordProvenPublicExpression as vl, calculateResourceDrift as vn, JSON_LISTING_HOLE_VALUE as vo, findDestructiveChanges as vr, refuseMalformedResourcesForDestroy as vs, diffSecurity as vt, describeDockerCapturedOutput as vu, planIndexContributorInsightsOps as w, IntrinsicFunctionResolver as wa, noEchoLeavesOf as wc, injectAwsRegion as wd, reserveStackCreateToken as wi, S3StateBackend as wl, isReplacementOrphan as wn, deployRefusesOrphanRowsReason as wo, withMovedTo as wr, repairMalformedResourceEntriesForReadOnly as ws, planOrphanAdoption as wt, getDockerCmd as wu, contributorInsightsRefusals as x, unsettledPropertiesOf as xa, maskWholeValue as xc, displayAssemblyPath as xd, unsupportedFinalSnapshotError as xi, isSingleDynamicReferenceToken as xl, undeclaredEmptyObservedKeys as xn, UNREADABLE_ORPHANS_CONTAINER_ROW as xo, hintSidesOf as xr, repairMalformedOrphanRecordsForReadOnly as xs, mergeNoChangeOutputs as xt, dockerSpawnEnvWithSensitive as xu, streamTagsMatchDeclared as y, DiffCalculator as ya, maskAtCoordinates as yc, absoluteAssemblyPathEscape as yd, isFinalSnapshotError as yi, wholeStringLeavesOf as yl, equalModuloMarkedMask as yn, STATE_REGION_DIVERGED as yo, formatDestructiveChange as yr, refuseMalformedResourcesForExport as ys, isSecretBearingReferenceString as yt, describeDockerExecFailure as yu, relayedIndexBusyDelete as z, applyRoleArnIfSet as za, literalSplitDelimitersOf as zc, definedAttributes as zi, hasReasonlessBaselineRefusal as zl, redactedDeleteAddressSkip as zn, malformedOrphanRowsKeptWarning as zo, red as zr, MULTI_REGION_RECREATE_BLOCKED_TYPES as zs, collectNestedChildUnaddressed as zt, getLegacyStateBucketName as zu };
+//# sourceMappingURL=deploy-engine-DZO2SOQJ.js.map