@go-to-k/cdkd 0.310.0 → 0.312.0

package/dist/{deploy-engine-DZO2SOQJ.js → deploy-engine-CVNzK__j.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
+import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-BT2Dfnpt.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-QOtLxcEo.js";
+import { t as getCdkdVersion } from "./version-BqCEt5Wu.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4987,7 +4987,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	11,
 	12,
 	13,
-	14
+	14,
+	15
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -6047,7 +6048,7 @@ var S3StateBackend = class S3StateBackend {
 		const body = {
 			...state,
 			...stackInstanceIdCarriedFrom(state),
-			version: 14,
+			version: 15,
 			stackName,
 			region
 		};
@@ -10278,6 +10279,11 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedProvenan
 			secrets
 		});
 	}
+	const attemptedItems = record.unsettledItems;
+	if (typeof attemptedItems === "object" && attemptedItems !== null && !Array.isArray(attemptedItems)) next.unsettledItems = redactForState(attemptedItems, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
 	return next;
 }
@@ -12691,6 +12697,20 @@ function elastiCachePreferredAvailabilityZonesMovedToDisjoint(oldValue, newValue
 	if (![...oldValue, ...newValue].every((z) => typeof z === "string")) return false;
 	return !newValue.some((z) => oldValue.includes(z));
 }
+function elastiCacheLeftSingleAzWithoutZones(siblings) {
+	if (siblings === void 0) return false;
+	const { oldProperties: prev, newProperties: next } = siblings;
+	return prev["Engine"] === "memcached" && next["Engine"] === "memcached" && prev["PreferredAvailabilityZone"] == null && next["PreferredAvailabilityZone"] == null && next["PreferredAvailabilityZones"] == null && (next["AZMode"] == null || next["AZMode"] === "single-az");
+}
+function elastiCacheAzModeRemovedFromSingleAz(oldValue, newValue, siblings) {
+	return oldValue === "single-az" && newValue == null && elastiCacheLeftSingleAzWithoutZones(siblings);
+}
+function elastiCachePreferredAvailabilityZonesRemovedFromSingleAz(oldValue, newValue, siblings) {
+	return Array.isArray(oldValue) && oldValue.length > 0 && newValue == null && siblings?.oldProperties["AZMode"] === "single-az" && elastiCacheLeftSingleAzWithoutZones(siblings);
+}
+function elastiCachePreferredAvailabilityZonesReplaced(oldValue, newValue, siblings) {
+	return elastiCachePreferredAvailabilityZonesMovedToDisjoint(oldValue, newValue) || elastiCachePreferredAvailabilityZonesRemovedFromSingleAz(oldValue, newValue, siblings);
+}
 function emrClusterInstancesReplaced(oldValue, newValue) {
 	if (oldValue === void 0 && newValue === void 0) return true;
 	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
@@ -13025,13 +13045,23 @@ var ReplacementRulesRegistry = class {
 		this.rules.set("AWS::RDS::DBProxy", { replacementProperties: /* @__PURE__ */ new Set([
 			"DBProxyName",
 			"EngineFamily",
-			"VpcSubnetIds"
+			"VpcSubnetIds",
+			"EndpointNetworkType",
+			"TargetConnectionNetworkType"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyEndpoint", { replacementProperties: /* @__PURE__ */ new Set([
 			"DBProxyName",
 			"DBProxyEndpointName",
 			"VpcSubnetIds",
-			"TargetRole"
+			"TargetRole",
+			"EndpointNetworkType"
+		]) });
+		this.rules.set("AWS::S3Tables::Table", { replacementProperties: /* @__PURE__ */ new Set([
+			"TableBucketARN",
+			"OpenTableFormat",
+			"IcebergMetadata",
+			"StorageClassConfiguration",
+			"WithoutMetadata"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
 		this.rules.set("AWS::EC2::VPC", {
@@ -13109,7 +13139,7 @@ var ReplacementRulesRegistry = class {
 		});
 		this.rules.set("AWS::ElastiCache::CacheCluster", {
 			replacementProperties: /* @__PURE__ */ new Set(),
-			conditionalReplacements: /* @__PURE__ */ new Map([["PreferredAvailabilityZones", elastiCachePreferredAvailabilityZonesMovedToDisjoint]])
+			conditionalReplacements: /* @__PURE__ */ new Map([["AZMode", elastiCacheAzModeRemovedFromSingleAz], ["PreferredAvailabilityZones", elastiCachePreferredAvailabilityZonesReplaced]])
 		});
 		this.rules.set("AWS::EMR::Cluster", {
 			replacementProperties: /* @__PURE__ */ new Set(),
@@ -13929,7 +13959,8 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		["SourceDbClusterResourceId"],
 		["SourceRegion"],
 		["StorageEncrypted"],
-		["UseLatestRestorableTime"]
+		["UseLatestRestorableTime"],
+		["WithExpressConfiguration"]
 	]],
 	["AWS::RDS::DBInstance", [
 		["BackupTarget"],
@@ -15233,6 +15264,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::MemoryDB::Snapshot",
 	"AWS::Redshift::Snapshot",
 	"AWS::Timestream::InfluxDBBackup",
+	"AWS::EC2::Snapshot",
 	"AWS::StorageGateway::Volume",
 	"AWS::FSx::FileCache",
 	"AWS::DirectoryService::MicrosoftAD",
@@ -16283,21 +16315,20 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"AgentRuntimeArtifact",
 			"AgentRuntimeName",
 			"AuthorizerConfiguration",
+			"CapacityProviderConfiguration",
 			"ClientToken",
 			"Description",
 			"EnvironmentVariables",
+			"FilesystemConfigurations",
 			"LifecycleConfiguration",
 			"NetworkConfiguration",
+			"PlatformVersion",
 			"ProtocolConfiguration",
-			"RoleArn"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["CapacityProviderConfiguration", "not yet implemented by cdkd"],
-			["FilesystemConfigurations", "not yet implemented by cdkd"],
-			["PlatformVersion", "not yet implemented by cdkd"],
-			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
-			["Tags", "not yet implemented by cdkd"]
+			"RequestHeaderConfiguration",
+			"RoleArn",
+			"Tags"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"AgentRuntimeArn",
@@ -16424,6 +16455,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::CloudWatch::Alarm", {
 		handled: /* @__PURE__ */ new Set([
+			"ActionConfiguration",
 			"ActionsEnabled",
 			"AlarmActions",
 			"AlarmDescription",
@@ -16432,7 +16464,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DatapointsToAlarm",
 			"Dimensions",
 			"EvaluateLowSampleCountPercentile",
+			"EvaluationCriteria",
+			"EvaluationInterval",
 			"EvaluationPeriods",
+			"EvaluationWindow",
 			"ExtendedStatistic",
 			"InsufficientDataActions",
 			"MetricName",
@@ -16445,15 +16480,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Threshold",
 			"ThresholdMetricId",
 			"TreatMissingData",
-			"Unit"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["ActionConfiguration", "not yet implemented by cdkd"],
-			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationWindow", "not yet implemented by cdkd"],
-			["WarmUpConfiguration", "not yet implemented by cdkd"]
+			"Unit",
+			"WarmUpConfiguration"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
@@ -16503,7 +16533,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["Triggers", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeCommit::Repository", {
@@ -16695,6 +16725,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["MultiRegionConsistency", "not yet implemented by cdkd"],
 			["ReadOnDemandThroughputSettings", "not yet implemented by cdkd"],
 			["ReadProvisionedThroughputSettings", "not yet implemented by cdkd"],
+			["TableType", "not yet implemented by cdkd"],
 			["VectorIndexes", "not yet implemented by cdkd"],
 			["WarmThroughput", "not yet implemented by cdkd"]
 		]),
@@ -16726,9 +16757,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TableName",
 			"Tags",
 			"TimeToLiveSpecification",
+			"VectorIndexes",
 			"WarmThroughput"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"], ["VectorIndexes", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["ImportSourceSpecification"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "StreamArn"]),
 		ccRouteUnavailable: false
@@ -17096,7 +17128,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VolumeConfigurations",
 			"VpcLatticeConfigurations"
 		]),
-		silentDrop: /* @__PURE__ */ new Map(),
+		silentDrop: /* @__PURE__ */ new Map([["GatewayConnectors", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Name", "ServiceArn"]),
 		ccRouteUnavailable: false
@@ -17995,7 +18027,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RetentionInDays",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ResourcePolicyDocument", "covered by the separate account-wide AWS::Logs::ResourcePolicy resource type; logs:PutResourcePolicy is account-scoped, not per-log-group, so it has no CreateLogGroup / PutRetentionPolicy counterpart — routed via Cloud Control instead"]]),
+		silentDrop: /* @__PURE__ */ new Map([["ResourcePolicyDocument", "not driven by this provider by decision (issue #1412): no CreateLogGroup / PutRetentionPolicy member carries it, and both policy lifecycles — the account-scoped AWS::Logs::ResourcePolicy type and the log-group-scoped logs:PutResourcePolicy (resourceArn + policyScope RESOURCE) — are ones this provider does not take on — routed via Cloud Control, whose handler applies it"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
@@ -18175,7 +18207,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["SourceDbClusterResourceId", "not yet implemented by cdkd"],
 			["SourceRegion", "not yet implemented by cdkd"],
 			["StorageType", "not yet implemented by cdkd"],
-			["UseLatestRestorableTime", "not yet implemented by cdkd"]
+			["UseLatestRestorableTime", "not yet implemented by cdkd"],
+			["WithExpressConfiguration", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
 			"ClusterScalabilityType",
@@ -18187,7 +18220,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceDBClusterIdentifier",
 			"SourceDbClusterResourceId",
 			"SourceRegion",
-			"UseLatestRestorableTime"
+			"UseLatestRestorableTime",
+			"WithExpressConfiguration"
 		]),
 		readOnly: /* @__PURE__ */ new Set([
 			"DBClusterArn",
@@ -18324,20 +18358,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Auth",
 			"DBProxyName",
 			"DebugLogging",
+			"DefaultAuthScheme",
+			"EndpointNetworkType",
 			"EngineFamily",
 			"IdleClientTimeout",
 			"RequireTLS",
 			"RoleArn",
 			"Tags",
+			"TargetConnectionNetworkType",
 			"VpcSecurityGroupIds",
 			"VpcSubnetIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["DefaultAuthScheme", "not yet implemented by cdkd"],
-			["EndpointNetworkType", "not yet implemented by cdkd"],
-			["TargetConnectionNetworkType", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType", "TargetConnectionNetworkType"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"DBProxyArn",
 			"Endpoint",
@@ -18349,13 +18382,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set([
 			"DBProxyEndpointName",
 			"DBProxyName",
+			"EndpointNetworkType",
 			"Tags",
 			"TargetRole",
 			"VpcSecurityGroupIds",
 			"VpcSubnetIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["EndpointNetworkType", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"DBProxyEndpointArn",
 			"Endpoint",
@@ -18479,17 +18513,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::S3Express::DirectoryBucket", {
 		handled: /* @__PURE__ */ new Set([
+			"BucketEncryption",
 			"BucketName",
 			"DataRedundancy",
+			"InventoryConfigurations",
+			"LifecycleConfiguration",
 			"LocationName",
+			"MetricsConfigurations",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["BucketEncryption", "not yet implemented by cdkd"],
-			["InventoryConfigurations", "not yet implemented by cdkd"],
-			["LifecycleConfiguration", "not yet implemented by cdkd"],
-			["MetricsConfigurations", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "AvailabilityZoneName"]),
 		ccRouteUnavailable: false
@@ -18503,26 +18536,21 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::S3Tables::Table", {
 		handled: /* @__PURE__ */ new Set([
+			"Compaction",
 			"Format",
+			"IcebergMetadata",
 			"Name",
 			"Namespace",
 			"OpenTableFormat",
+			"SnapshotManagement",
+			"StorageClassConfiguration",
 			"TableBucketARN",
 			"TableName",
-			"Tags"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["Compaction", "not yet implemented by cdkd"],
-			["IcebergMetadata", "not yet implemented by cdkd"],
-			["SnapshotManagement", "not yet implemented by cdkd"],
-			["StorageClassConfiguration", "not yet implemented by cdkd"],
-			["WithoutMetadata", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"IcebergMetadata",
-			"StorageClassConfiguration",
+			"Tags",
 			"WithoutMetadata"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"TableARN",
 			"VersionToken",
@@ -18531,14 +18559,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		ccRouteUnavailable: false
 	}],
 	["AWS::S3Tables::TableBucket", {
-		handled: /* @__PURE__ */ new Set(["TableBucketName", "Tags"]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["EncryptionConfiguration", "not yet implemented by cdkd"],
-			["MetricsConfiguration", "not yet implemented by cdkd"],
-			["ReplicationConfiguration", "not yet implemented by cdkd"],
-			["StorageClassConfiguration", "not yet implemented by cdkd"],
-			["UnreferencedFileRemoval", "not yet implemented by cdkd"]
+		handled: /* @__PURE__ */ new Set([
+			"EncryptionConfiguration",
+			"MetricsConfiguration",
+			"ReplicationConfiguration",
+			"StorageClassConfiguration",
+			"TableBucketName",
+			"Tags",
+			"UnreferencedFileRemoval"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["TableBucketARN"]),
 		ccRouteUnavailable: false
@@ -18770,25 +18800,24 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::WAFv2::WebACL", {
 		handled: /* @__PURE__ */ new Set([
+			"ApplicationConfig",
 			"AssociationConfig",
 			"CaptchaConfig",
 			"ChallengeConfig",
 			"CustomResponseBodies",
+			"DataProtectionConfig",
 			"DefaultAction",
 			"Description",
+			"MonetizationConfig",
 			"Name",
+			"OnSourceDDoSProtectionConfig",
 			"Rules",
 			"Scope",
 			"Tags",
 			"TokenDomains",
 			"VisibilityConfig"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["ApplicationConfig", "not yet implemented by cdkd"],
-			["DataProtectionConfig", "not yet implemented by cdkd"],
-			["MonetizationConfig", "not yet implemented by cdkd"],
-			["OnSourceDDoSProtectionConfig", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Arn",
@@ -19130,7 +19159,8 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::WAFRegional::XssMatchSet",
 	"AWS::Wisdom::Session",
 	"AWS::WorkSpaces::WorkSpaceApplication",
-	"AWS::WorkSpaces::WorkspaceBundle"
+	"AWS::WorkSpaces::WorkspaceBundle",
+	"AWS::WorkSpaces::WorkspaceImage"
 ]);
 
 //#endregion
@@ -19253,21 +19283,39 @@ function excludeCreateOnly(resourceType, names) {
 	return names.filter((property) => !createOnly.has(property));
 }
 function withoutUnwrittenSilentDropProperties(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
-	const drops = findSilentDropProperties(resourceType, recordedProperties);
-	if (drops.length === 0) return recordedProperties;
 	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
-	const removable = drops.map(({ property }) => property).filter((property) => createOnly?.has(property) !== true || evidence.has(property) && !accepted.has(property));
+	const removable = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly?.has(property) !== true).concat(evidenceNamedUnwritten(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence).filter((property) => desiredProperties === void 0 || !Object.hasOwn(desiredProperties, property) || askedUnchanged(recordedProperties, desiredProperties, property)));
 	if (removable.length === 0) return recordedProperties;
 	const narrowed = { ...recordedProperties };
 	for (const property of removable) delete narrowed[property];
 	return narrowed;
 }
 function findUnwrittenCreateOnlyDrops(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
-	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-	if (createOnly === void 0 || createOnly.size === 0 || evidence.size === 0) return [];
+	return evidenceNamedUnwritten(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence).filter((property) => Object.hasOwn(desiredProperties, property) && askedUnchanged(recordedProperties, desiredProperties, property));
+}
+function evidenceNamedUnwritten(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
+	if (evidence.size === 0) return [];
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops ?? /* @__PURE__ */ new Set();
 	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
-	return findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && evidence.has(property) && !accepted.has(property) && Object.hasOwn(desiredProperties, property) && sameJsonValue(recordedProperties[property], desiredProperties[property], "unchanged"));
+	return [...findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && evidence.has(property) && !accepted.has(property)), ...findHandledUnwrittenCreateOnly(resourceType, recordedProperties, evidence)].sort((a, b) => a.localeCompare(b));
+}
+function askedUnchanged(recordedProperties, desiredProperties, property) {
+	return sameJsonValue(recordedProperties[property], desiredProperties[property], "unchanged");
+}
+function findHandledUnwrittenCreateOnly(resourceType, recordedProperties, evidence) {
+	if (evidence.size === 0) return [];
+	const handled = getPropertyCoverage(resourceType)?.handled;
+	if (handled === void 0) return [];
+	const createOnlyRoots = new Set((CREATE_ONLY_PATHS_SNAPSHOT.get(resourceType) ?? []).filter((path) => path.length === 1).map((path) => path[0]));
+	return [...evidence].filter((property) => handled.has(property) && createOnlyRoots.has(property) && Object.hasOwn(recordedProperties, property)).sort((a, b) => a.localeCompare(b));
+}
+function acceptedCreateOnlyDropsEvidence(recordedProperties, resourceType, provisionedBy, carried) {
+	if (provisionedBy !== "sdk") return void 0;
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops ?? /* @__PURE__ */ new Set();
+	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
+	const handled = carried === void 0 ? [] : findHandledUnwrittenCreateOnly(resourceType, recordedProperties, carried);
+	const all = [...names, ...handled].sort((a, b) => a.localeCompare(b));
+	return all.length > 0 ? all : void 0;
 }
 function unwrittenCreateOnlyReplacement(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence, replacingPaths) {
 	if (replacingPaths.length === 0) return [];
@@ -21107,6 +21155,9 @@ const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 	["AWS::AppSync::DataSource", ["DataSourceArn"]],
 	["AWS::AppSync::Resolver", ["ResolverArn"]]
 ]);
+function graphQLSchemaCfnId(physicalId) {
+	return /^[a-z0-9]+$/.test(physicalId) ? `${physicalId}GraphQLSchema` : physicalId;
+}
 function isStalePlaceholderArnAttribute(resourceType, attributeName, value) {
 	if (!REF_RETURNS_ARN_FROM_STATE.get(resourceType)?.includes(attributeName)) return false;
 	return typeof value === "string" && isPlaceholderArn(value);
@@ -21187,6 +21238,7 @@ function lacksRecordedTableArn(resource) {
 }
 function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
 	if (resourceType === "AWS::S3Tables::Table") return s3TablesTableRefFromPhysicalId(physicalId, stateLookup);
+	if (resourceType === "AWS::AppSync::GraphQLSchema") return graphQLSchemaCfnId(physicalId);
 	if (resourceType === "AWS::Glue::Table") {
 		const tableName = glueTableRefFromPhysicalId(physicalId, stateLookup);
 		if (tableName !== void 0) return tableName;
@@ -23956,6 +24008,7 @@ async function constructAttributeForAppTypes(resolver, resource, attributeName,
 		case "ApiId": return physicalId;
 		default: return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 	}
+	if (resourceType === "AWS::AppSync::GraphQLSchema" && attributeName === "Id") return graphQLSchemaCfnId(physicalId);
 	if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
 		case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
 		case "ApiId": return physicalId;
@@ -26006,14 +26059,80 @@ function withUnsettledProperties(record, names) {
 	};
 }
 function withoutUnsettledProperties(record) {
-	if (!Object.hasOwn(record, "unsettledProperties")) return record;
-	const { unsettledProperties: _cleared, ...rest } = record;
+	if (!Object.hasOwn(record, "unsettledProperties") && !Object.hasOwn(record, "unsettledItems")) return record;
+	const { unsettledProperties: _cleared, unsettledItems: _items, ...rest } = record;
 	return rest;
 }
+const UNSETTLED_ITEMS_PER_PATH_CAP = 100;
+const UNSETTLED_ITEM_LENGTH_CAP = 255;
+function unsettledItemsTopKey(path) {
+	const cut = path.search(/[.[]/);
+	return cut === -1 ? path : path.slice(0, cut);
+}
+function unsettledItemsOf(record) {
+	const out = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return out;
+	const value = record.unsettledItems;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return out;
+	const unsettled = unsettledPropertiesOf(record);
+	for (const [path, entries] of Object.entries(value)) {
+		if (!unsettled.has(unsettledItemsTopKey(path))) continue;
+		if (!Array.isArray(entries) || entries.length > 100) continue;
+		const names = entries.filter((entry) => typeof entry === "string" && entry !== "" && entry.length <= 255);
+		if (names.length > 0) out.set(path, new Set(names));
+	}
+	return out;
+}
+function isUsableAttemptedName(name) {
+	return !name.includes("{{resolve:") && !name.includes("***");
+}
+function withUnsettledItems(record, items) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const [path, names] of unsettledItemsOf(record)) merged.set(path, new Set(names));
+	const unsettled = unsettledPropertiesOf(record);
+	let added = false;
+	for (const [path, names] of items) {
+		if (!unsettled.has(unsettledItemsTopKey(path))) continue;
+		const set = merged.get(path) ?? /* @__PURE__ */ new Set();
+		for (const name of names) {
+			if (typeof name !== "string" || name === "" || name.length > 255) continue;
+			if (!set.has(name)) {
+				set.add(name);
+				added = true;
+			}
+		}
+		if (set.size > 0) merged.set(path, set);
+	}
+	if (!added) return record;
+	const field = {};
+	for (const [path, set] of [...merged].sort(([a], [b]) => a.localeCompare(b))) if (set.size <= 100) field[path] = [...set].sort();
+	return {
+		...record,
+		unsettledItems: field
+	};
+}
+function unsettledItemsField(source, keys) {
+	const allowed = new Set(keys);
+	const field = {};
+	for (const [path, names] of unsettledItemsOf(source)) if (allowed.has(unsettledItemsTopKey(path))) field[path] = [...names].sort();
+	return Object.keys(field).length > 0 ? { unsettledItems: field } : {};
+}
 function unsettledContextOf(...records) {
 	const names = /* @__PURE__ */ new Set();
-	for (const record of records) for (const name of unsettledPropertiesOf(record)) names.add(name);
-	return names.size > 0 ? { unsettledProperties: names } : {};
+	const items = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		for (const name of unsettledPropertiesOf(record)) names.add(name);
+		for (const [path, set] of unsettledItemsOf(record)) {
+			const merged = items.get(path) ?? /* @__PURE__ */ new Set();
+			for (const name of set) merged.add(name);
+			items.set(path, merged);
+		}
+	}
+	if (names.size === 0) return {};
+	return {
+		unsettledProperties: names,
+		...items.size > 0 && { unsettledItems: items }
+	};
 }
 
 //#endregion
@@ -28671,7 +28790,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-I1bFHVsO.js");
+			const { ASGProvider } = await import("./asg-provider-CVLTQtQr.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28780,7 +28899,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BqwTQeS-.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-8kjFmR1l.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CXSZq1c8.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-qdoLunCh.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -31592,6 +31711,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["Source.Auth", ["Type"]],
 		["Source.GitSubmodulesConfig", ["FetchSubmodules"]],
 		["Tags", ["Key", "Value"]],
+		["Triggers.FilterGroups", ["Pattern", "Type"]],
 		["Triggers.PullRequestBuildPolicy", ["RequiresCommentApproval"]],
 		["Triggers.ScopeConfiguration", ["Name"]]
 	])],
@@ -31770,6 +31890,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration", ["Type", "Value"]],
 		["DeploymentConfiguration.LifecycleHooks", ["LifecycleStages"]],
 		["ForceNewDeployment", ["EnableForceNewDeployment"]],
+		["GatewayConnectors", ["PortName"]],
 		["LoadBalancers.AdvancedConfiguration", ["AlternateTargetGroupArn"]],
 		["Monitoring", ["MetricConfigurations"]],
 		["Monitoring.MetricConfigurations", ["MetricNames", "ResolutionSeconds"]],
@@ -31799,6 +31920,8 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["ContainerDefinitions.LogConfiguration", ["LogDriver"]],
 		["ContainerDefinitions.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
 		["ContainerDefinitions.ResourceRequirements", ["Type"]],
+		["ContainerDefinitions.ResourceRequirements.SharingStrategy", ["NvidiaMps"]],
+		["ContainerDefinitions.ResourceRequirements.SharingStrategy.NvidiaMps", ["Memory"]],
 		["ContainerDefinitions.Secrets", ["Name", "ValueFrom"]],
 		["ContainerDefinitions.Ulimits", [
 			"HardLimit",
@@ -32876,6 +32999,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudWatch::Alarm", "{\"ActionConfiguration\":\"object\",\"ActionConfiguration.AlarmTagsPropagation\":\"object\",\"ActionConfiguration.AlarmTagsPropagation.ExcludedTagKeys\":\"array\",\"ActionConfiguration.AlarmTagsPropagation.IncludedTagKeys\":\"array\",\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
+	["AWS::CodeBuild::Project", "{\"Artifacts\":\"object\",\"BuildBatchConfig\":\"object\",\"BuildBatchConfig.Restrictions\":\"object\",\"BuildBatchConfig.Restrictions.ComputeTypesAllowed\":\"array\",\"BuildBatchConfig.Restrictions.FleetsAllowed\":\"array\",\"Cache\":\"object\",\"Cache.Modes\":\"array\",\"Environment\":\"object\",\"Environment.DockerServer\":\"object\",\"Environment.DockerServer.SecurityGroupIds\":\"array\",\"Environment.EnvironmentVariables\":\"array\",\"Environment.EnvironmentVariables[]\":\"object\",\"Environment.Fleet\":\"object\",\"Environment.RegistryCredential\":\"object\",\"FileSystemLocations\":\"array\",\"FileSystemLocations[]\":\"object\",\"LogsConfig\":\"object\",\"LogsConfig.CloudWatchLogs\":\"object\",\"LogsConfig.S3Logs\":\"object\",\"SecondaryArtifacts\":\"array\",\"SecondaryArtifacts[]\":\"object\",\"SecondarySourceVersions\":\"array\",\"SecondarySourceVersions[]\":\"object\",\"SecondarySources\":\"array\",\"SecondarySources[]\":\"object\",\"SecondarySources[].Auth\":\"object\",\"SecondarySources[].BuildStatusConfig\":\"object\",\"SecondarySources[].GitSubmodulesConfig\":\"object\",\"Source\":\"object\",\"Source.Auth\":\"object\",\"Source.BuildStatusConfig\":\"object\",\"Source.GitSubmodulesConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"object\",\"Triggers.FilterGroups\":\"array\",\"Triggers.FilterGroups[]\":\"array\",\"Triggers.FilterGroups[][]\":\"object\",\"Triggers.PullRequestBuildPolicy\":\"object\",\"Triggers.PullRequestBuildPolicy.ApproverRoles\":\"array\",\"Triggers.ScopeConfiguration\":\"object\",\"VpcConfig\":\"object\",\"VpcConfig.SecurityGroupIds\":\"array\",\"VpcConfig.Subnets\":\"array\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -32894,8 +33018,8 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::EC2::VPC", "{\"CidrBlockAssociations\":\"array\",\"Ipv6CidrBlocks\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VpcEncryptionControl\":\"object\",\"VpcEncryptionControl.ResourceExclusions\":\"object\",\"VpcEncryptionControl.ResourceExclusions.EgressOnlyInternetGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.ElasticFileSystem\":\"object\",\"VpcEncryptionControl.ResourceExclusions.InternetGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.Lambda\":\"object\",\"VpcEncryptionControl.ResourceExclusions.NatGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.VirtualPrivateGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.VpcLattice\":\"object\",\"VpcEncryptionControl.ResourceExclusions.VpcPeering\":\"object\"}"],
 	["AWS::ECR::Repository", "{\"EncryptionConfiguration\":\"object\",\"ImageScanningConfiguration\":\"object\",\"ImageTagMutabilityExclusionFilters\":\"array\",\"ImageTagMutabilityExclusionFilters[]\":\"object\",\"LifecyclePolicy\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::ECS::Cluster", "{\"CapacityProviders\":\"array\",\"ClusterSettings\":\"array\",\"ClusterSettings[]\":\"object\",\"Configuration\":\"object\",\"Configuration.ExecuteCommandConfiguration\":\"object\",\"Configuration.ExecuteCommandConfiguration.LogConfiguration\":\"object\",\"Configuration.ManagedStorageConfiguration\":\"object\",\"DefaultCapacityProviderStrategy\":\"array\",\"DefaultCapacityProviderStrategy[]\":\"object\",\"ServiceConnectDefaults\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
-	["AWS::ECS::Service", "{\"CapacityProviderStrategy\":\"array\",\"CapacityProviderStrategy[]\":\"object\",\"DeploymentConfiguration\":\"object\",\"DeploymentConfiguration.Alarms\":\"object\",\"DeploymentConfiguration.Alarms.AlarmNames\":\"array\",\"DeploymentConfiguration.CanaryConfiguration\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration\":\"object\",\"DeploymentConfiguration.EarlySuccessCriteria\":\"object\",\"DeploymentConfiguration.LifecycleHooks\":\"array\",\"DeploymentConfiguration.LifecycleHooks[]\":\"object\",\"DeploymentConfiguration.LifecycleHooks[].LifecycleStages\":\"array\",\"DeploymentConfiguration.LifecycleHooks[].TimeoutConfiguration\":\"object\",\"DeploymentConfiguration.LinearConfiguration\":\"object\",\"DeploymentController\":\"object\",\"ForceNewDeployment\":\"object\",\"LoadBalancers\":\"array\",\"LoadBalancers[]\":\"object\",\"LoadBalancers[].AdvancedConfiguration\":\"object\",\"Monitoring\":\"object\",\"Monitoring.MetricConfigurations\":\"array\",\"Monitoring.MetricConfigurations[]\":\"object\",\"Monitoring.MetricConfigurations[].MetricNames\":\"array\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration.SecurityGroups\":\"array\",\"NetworkConfiguration.AwsvpcConfiguration.Subnets\":\"array\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"PlacementStrategies\":\"array\",\"PlacementStrategies[]\":\"object\",\"ServiceConnectConfiguration\":\"object\",\"ServiceConnectConfiguration.AccessLogConfiguration\":\"object\",\"ServiceConnectConfiguration.LogConfiguration\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.Options\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions\":\"array\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions[]\":\"object\",\"ServiceConnectConfiguration.Services\":\"array\",\"ServiceConnectConfiguration.Services[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases\":\"array\",\"ServiceConnectConfiguration.Services[].ClientAliases[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header.Value\":\"object\",\"ServiceConnectConfiguration.Services[].Timeout\":\"object\",\"ServiceConnectConfiguration.Services[].Tls\":\"object\",\"ServiceConnectConfiguration.Services[].Tls.IssuerCertificateAuthority\":\"object\",\"ServiceRegistries\":\"array\",\"ServiceRegistries[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VolumeConfigurations\":\"array\",\"VolumeConfigurations[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags[]\":\"object\",\"VpcLatticeConfigurations\":\"array\",\"VpcLatticeConfigurations[]\":\"object\",\"VpcLatticeConfigurations[].AdvancedConfiguration\":\"object\"}"],
-	["AWS::ECS::TaskDefinition", "{\"ContainerDefinitions\":\"array\",\"ContainerDefinitions[]\":\"object\",\"ContainerDefinitions[].Command\":\"array\",\"ContainerDefinitions[].CredentialSpecs\":\"array\",\"ContainerDefinitions[].DependsOn\":\"array\",\"ContainerDefinitions[].DependsOn[]\":\"object\",\"ContainerDefinitions[].DnsSearchDomains\":\"array\",\"ContainerDefinitions[].DnsServers\":\"array\",\"ContainerDefinitions[].DockerLabels\":\"object\",\"ContainerDefinitions[].DockerSecurityOptions\":\"array\",\"ContainerDefinitions[].EntryPoint\":\"array\",\"ContainerDefinitions[].Environment\":\"array\",\"ContainerDefinitions[].EnvironmentFiles\":\"array\",\"ContainerDefinitions[].EnvironmentFiles[]\":\"object\",\"ContainerDefinitions[].Environment[]\":\"object\",\"ContainerDefinitions[].ExtraHosts\":\"array\",\"ContainerDefinitions[].ExtraHosts[]\":\"object\",\"ContainerDefinitions[].FirelensConfiguration\":\"object\",\"ContainerDefinitions[].FirelensConfiguration.Options\":\"object\",\"ContainerDefinitions[].HealthCheck\":\"object\",\"ContainerDefinitions[].HealthCheck.Command\":\"array\",\"ContainerDefinitions[].Links\":\"array\",\"ContainerDefinitions[].LinuxParameters\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Add\":\"array\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Drop\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Devices[].Permissions\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[].MountOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration\":\"object\",\"ContainerDefinitions[].LogConfiguration.Options\":\"object\",\"ContainerDefinitions[].LogConfiguration.SecretOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration.SecretOptions[]\":\"object\",\"ContainerDefinitions[].MountPoints\":\"array\",\"ContainerDefinitions[].MountPoints[]\":\"object\",\"ContainerDefinitions[].PortMappings\":\"array\",\"ContainerDefinitions[].PortMappings[]\":\"object\",\"ContainerDefinitions[].RepositoryCredentials\":\"object\",\"ContainerDefinitions[].ResourceRequirements\":\"array\",\"ContainerDefinitions[].ResourceRequirements[]\":\"object\",\"ContainerDefinitions[].RestartPolicy\":\"object\",\"ContainerDefinitions[].RestartPolicy.IgnoredExitCodes\":\"array\",\"ContainerDefinitions[].Secrets\":\"array\",\"ContainerDefinitions[].Secrets[]\":\"object\",\"ContainerDefinitions[].SystemControls\":\"array\",\"ContainerDefinitions[].SystemControls[]\":\"object\",\"ContainerDefinitions[].Ulimits\":\"array\",\"ContainerDefinitions[].Ulimits[]\":\"object\",\"ContainerDefinitions[].VolumesFrom\":\"array\",\"ContainerDefinitions[].VolumesFrom[]\":\"object\",\"EphemeralStorage\":\"object\",\"InferenceAccelerators\":\"array\",\"InferenceAccelerators[]\":\"object\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"ProxyConfiguration\":\"object\",\"ProxyConfiguration.ProxyConfigurationProperties\":\"array\",\"ProxyConfiguration.ProxyConfigurationProperties[]\":\"object\",\"RequiresCompatibilities\":\"array\",\"RuntimePlatform\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Volumes\":\"array\",\"Volumes[]\":\"object\",\"Volumes[].DockerVolumeConfiguration\":\"object\",\"Volumes[].DockerVolumeConfiguration.DriverOpts\":\"object\",\"Volumes[].DockerVolumeConfiguration.Labels\":\"object\",\"Volumes[].EFSVolumeConfiguration\":\"object\",\"Volumes[].EFSVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].Host\":\"object\",\"Volumes[].S3FilesVolumeConfiguration\":\"object\"}"],
+	["AWS::ECS::Service", "{\"CapacityProviderStrategy\":\"array\",\"CapacityProviderStrategy[]\":\"object\",\"DeploymentConfiguration\":\"object\",\"DeploymentConfiguration.Alarms\":\"object\",\"DeploymentConfiguration.Alarms.AlarmNames\":\"array\",\"DeploymentConfiguration.CanaryConfiguration\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration\":\"object\",\"DeploymentConfiguration.EarlySuccessCriteria\":\"object\",\"DeploymentConfiguration.LifecycleHooks\":\"array\",\"DeploymentConfiguration.LifecycleHooks[]\":\"object\",\"DeploymentConfiguration.LifecycleHooks[].LifecycleStages\":\"array\",\"DeploymentConfiguration.LifecycleHooks[].TimeoutConfiguration\":\"object\",\"DeploymentConfiguration.LinearConfiguration\":\"object\",\"DeploymentController\":\"object\",\"ForceNewDeployment\":\"object\",\"GatewayConnectors\":\"array\",\"GatewayConnectors[]\":\"object\",\"GatewayConnectors[].Filters\":\"object\",\"GatewayConnectors[].Filters.AccessTypes\":\"array\",\"GatewayConnectors[].HealthCheck\":\"object\",\"GatewayConnectors[].HealthCheck.Matcher\":\"object\",\"LoadBalancers\":\"array\",\"LoadBalancers[]\":\"object\",\"LoadBalancers[].AdvancedConfiguration\":\"object\",\"Monitoring\":\"object\",\"Monitoring.MetricConfigurations\":\"array\",\"Monitoring.MetricConfigurations[]\":\"object\",\"Monitoring.MetricConfigurations[].MetricNames\":\"array\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration.SecurityGroups\":\"array\",\"NetworkConfiguration.AwsvpcConfiguration.Subnets\":\"array\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"PlacementStrategies\":\"array\",\"PlacementStrategies[]\":\"object\",\"ServiceConnectConfiguration\":\"object\",\"ServiceConnectConfiguration.AccessLogConfiguration\":\"object\",\"ServiceConnectConfiguration.ContainerConfigurations\":\"array\",\"ServiceConnectConfiguration.ContainerConfigurations[]\":\"object\",\"ServiceConnectConfiguration.LogConfiguration\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.Options\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions\":\"array\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions[]\":\"object\",\"ServiceConnectConfiguration.Services\":\"array\",\"ServiceConnectConfiguration.Services[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases\":\"array\",\"ServiceConnectConfiguration.Services[].ClientAliases[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header.Value\":\"object\",\"ServiceConnectConfiguration.Services[].Timeout\":\"object\",\"ServiceConnectConfiguration.Services[].Tls\":\"object\",\"ServiceConnectConfiguration.Services[].Tls.IssuerCertificateAuthority\":\"object\",\"ServiceRegistries\":\"array\",\"ServiceRegistries[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VolumeConfigurations\":\"array\",\"VolumeConfigurations[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags[]\":\"object\",\"VpcLatticeConfigurations\":\"array\",\"VpcLatticeConfigurations[]\":\"object\",\"VpcLatticeConfigurations[].AdvancedConfiguration\":\"object\"}"],
+	["AWS::ECS::TaskDefinition", "{\"ContainerDefinitions\":\"array\",\"ContainerDefinitions[]\":\"object\",\"ContainerDefinitions[].Command\":\"array\",\"ContainerDefinitions[].CredentialSpecs\":\"array\",\"ContainerDefinitions[].DependsOn\":\"array\",\"ContainerDefinitions[].DependsOn[]\":\"object\",\"ContainerDefinitions[].DnsSearchDomains\":\"array\",\"ContainerDefinitions[].DnsServers\":\"array\",\"ContainerDefinitions[].DockerLabels\":\"object\",\"ContainerDefinitions[].DockerSecurityOptions\":\"array\",\"ContainerDefinitions[].EntryPoint\":\"array\",\"ContainerDefinitions[].Environment\":\"array\",\"ContainerDefinitions[].EnvironmentFiles\":\"array\",\"ContainerDefinitions[].EnvironmentFiles[]\":\"object\",\"ContainerDefinitions[].Environment[]\":\"object\",\"ContainerDefinitions[].ExtraHosts\":\"array\",\"ContainerDefinitions[].ExtraHosts[]\":\"object\",\"ContainerDefinitions[].FirelensConfiguration\":\"object\",\"ContainerDefinitions[].FirelensConfiguration.Options\":\"object\",\"ContainerDefinitions[].HealthCheck\":\"object\",\"ContainerDefinitions[].HealthCheck.Command\":\"array\",\"ContainerDefinitions[].Links\":\"array\",\"ContainerDefinitions[].LinuxParameters\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Add\":\"array\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Drop\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Devices[].Permissions\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[].MountOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration\":\"object\",\"ContainerDefinitions[].LogConfiguration.Options\":\"object\",\"ContainerDefinitions[].LogConfiguration.SecretOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration.SecretOptions[]\":\"object\",\"ContainerDefinitions[].MountPoints\":\"array\",\"ContainerDefinitions[].MountPoints[]\":\"object\",\"ContainerDefinitions[].PortMappings\":\"array\",\"ContainerDefinitions[].PortMappings[]\":\"object\",\"ContainerDefinitions[].RepositoryCredentials\":\"object\",\"ContainerDefinitions[].ResourceRequirements\":\"array\",\"ContainerDefinitions[].ResourceRequirements[]\":\"object\",\"ContainerDefinitions[].ResourceRequirements[].SharingStrategy\":\"object\",\"ContainerDefinitions[].ResourceRequirements[].SharingStrategy.NvidiaMps\":\"object\",\"ContainerDefinitions[].RestartPolicy\":\"object\",\"ContainerDefinitions[].RestartPolicy.IgnoredExitCodes\":\"array\",\"ContainerDefinitions[].Secrets\":\"array\",\"ContainerDefinitions[].Secrets[]\":\"object\",\"ContainerDefinitions[].SystemControls\":\"array\",\"ContainerDefinitions[].SystemControls[]\":\"object\",\"ContainerDefinitions[].Ulimits\":\"array\",\"ContainerDefinitions[].Ulimits[]\":\"object\",\"ContainerDefinitions[].VolumesFrom\":\"array\",\"ContainerDefinitions[].VolumesFrom[]\":\"object\",\"EphemeralStorage\":\"object\",\"InferenceAccelerators\":\"array\",\"InferenceAccelerators[]\":\"object\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"ProxyConfiguration\":\"object\",\"ProxyConfiguration.ProxyConfigurationProperties\":\"array\",\"ProxyConfiguration.ProxyConfigurationProperties[]\":\"object\",\"RequiresCompatibilities\":\"array\",\"RuntimePlatform\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Volumes\":\"array\",\"Volumes[]\":\"object\",\"Volumes[].DockerVolumeConfiguration\":\"object\",\"Volumes[].DockerVolumeConfiguration.DriverOpts\":\"object\",\"Volumes[].DockerVolumeConfiguration.Labels\":\"object\",\"Volumes[].EFSVolumeConfiguration\":\"object\",\"Volumes[].EFSVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].Host\":\"object\",\"Volumes[].S3FilesVolumeConfiguration\":\"object\"}"],
 	["AWS::EFS::AccessPoint", "{\"AccessPointTags\":\"array\",\"AccessPointTags[]\":\"object\",\"PosixUser\":\"object\",\"PosixUser.SecondaryGids\":\"array\",\"RootDirectory\":\"object\",\"RootDirectory.CreationInfo\":\"object\"}"],
 	["AWS::EFS::FileSystem", "{\"BackupPolicy\":\"object\",\"FileSystemPolicy\":\"object\",\"FileSystemProtection\":\"object\",\"FileSystemTags\":\"array\",\"FileSystemTags[]\":\"object\",\"LifecyclePolicies\":\"array\",\"LifecyclePolicies[]\":\"object\",\"ReplicationConfiguration\":\"object\",\"ReplicationConfiguration.Destinations\":\"array\",\"ReplicationConfiguration.Destinations[]\":\"object\"}"],
 	["AWS::EFS::MountTarget", "{\"SecurityGroups\":\"array\"}"],
@@ -35758,7 +35882,50 @@ function noEchoAttributeNamesFor(run, logicalId, record, carried, leaves) {
 	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
 	return [...names].sort();
 }
+function withNoEchoItemsMasked(run, deps, logicalId, record) {
+	const items = record.unsettledItems;
+	if (typeof items !== "object" || items === null || Array.isArray(items)) return record;
+	const secrets = deps.perResourceSecrets().get(logicalId);
+	const plaintexts = secrets === void 0 ? [] : noEchoParameterPlaintextsOf(secrets).filter((plaintext) => plaintext !== "");
+	const positioned = /* @__PURE__ */ new Set();
+	for (const json of run.noEchoPositionedValues.get(logicalId) ?? []) {
+		let value;
+		try {
+			value = JSON.parse(json);
+		} catch {
+			continue;
+		}
+		if (typeof value === "string" && value !== "") positioned.add(value);
+	}
+	if (plaintexts.length === 0 && positioned.size === 0) return record;
+	return withAttemptedItemsMasked(record, [...positioned, ...plaintexts]);
+}
+function withAttemptedItemsMasked(record, needles) {
+	const items = record.unsettledItems;
+	if (typeof items !== "object" || items === null || Array.isArray(items)) return record;
+	const usable = needles.filter((needle) => needle !== "" && needle !== "***");
+	if (usable.length === 0) return record;
+	let changed = false;
+	const masked = {};
+	for (const [path, entries] of Object.entries(items)) {
+		if (!Array.isArray(entries)) {
+			masked[path] = entries;
+			continue;
+		}
+		masked[path] = [...new Set(entries.map((entry) => {
+			if (typeof entry !== "string") return entry;
+			const served = usable.some((needle) => entry.includes(needle));
+			if (served) changed = true;
+			return served ? "***" : entry;
+		}))];
+	}
+	return changed ? {
+		...record,
+		unsettledItems: masked
+	} : record;
+}
 function applyNoEchoPersist(run, deps, logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
+	scrubbed = withNoEchoItemsMasked(run, deps, logicalId, scrubbed);
 	const sources = noEchoPositionSources(run, resources);
 	if (sources === void 0) return scrubbed;
 	const leaves = noEchoLeavesFor(run, deps, logicalId, record, templateProps, sources);
@@ -37258,6 +37425,10 @@ function maskingRetryLogger(logger, secrets) {
 //#region src/deployment/deploy-engine/options.ts
 const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
+const DEFAULT_UNSETTLED_REVERT_WAIT = {
+	timeoutMs: DEFAULT_RESOURCE_TIMEOUT_MS,
+	pollMs: 1e4
+};
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
@@ -39533,7 +39704,7 @@ const MERGE_SEMANTICS_KEYS = /* @__PURE__ */ new Set(["Tags"]);
 async function readLive(args, names) {
 	const { provider, physicalId, logicalId, resourceType, recordedProperties } = args;
 	let live;
-	if (provider.readUnsettled !== void 0) live = await provider.readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, args.desired);
+	if (provider.readUnsettled !== void 0) live = await provider.readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, args.desired, args.attemptedItems);
 	else if (provider.readCurrentState !== void 0) live = await provider.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
 	else return;
 	if (typeof live !== "object" || live === null || Array.isArray(live)) return "unreadable";
@@ -39551,23 +39722,55 @@ async function settleUnsettledPrevious(args) {
 		if (moving.size > 0) throw refusal(args, moving, "AWS is still changing it or cdkd could not confirm it settled");
 	}
 	const substituted = new Set([...names].filter((name) => !MERGE_SEMANTICS_KEYS.has(name)));
-	if (substituted.size === 0) return previous;
+	const attemptedTags = [...args.attemptedItems?.get("Tags") ?? []].filter(isUsableAttemptedName);
+	const mergeNeedsLive = names.has("Tags") && attemptedTags.length > 0;
+	if (substituted.size === 0 && !mergeNeedsLive) return previous;
 	let live;
 	try {
-		live = await readLive(args, substituted);
+		live = await readLive(args, substituted.size > 0 ? substituted : /* @__PURE__ */ new Set(["Tags"]));
 	} catch (error) {
+		if (substituted.size === 0) return previous;
 		if (error instanceof ProvisioningError) throw error;
 		const wrapped = refusal(args, substituted, "the resource could not be read to converge it");
 		if (error instanceof Error) wrapped.cause = error;
 		throw wrapped;
 	}
 	if (live === void 0) return previous;
-	if (live === "unreadable") throw refusal(args, substituted, "the resource could not be read to converge it");
+	if (live === "unreadable") {
+		if (substituted.size === 0) return previous;
+		throw refusal(args, substituted, "the resource could not be read to converge it");
+	}
 	const out = { ...previous };
 	for (const name of substituted) if (Object.hasOwn(live, name) && live[name] !== void 0) out[name] = live[name];
 	else delete out[name];
+	if (mergeNeedsLive) {
+		const withAttempted = withAttemptedTags(out["Tags"], live["Tags"], args.desired?.["Tags"], attemptedTags);
+		if (withAttempted !== void 0) out["Tags"] = withAttempted;
+	}
 	return out;
 }
+function withAttemptedTags(recorded, live, desired, attempted) {
+	const keysOf = (value) => {
+		if (value === void 0 || value === null) return /* @__PURE__ */ new Set();
+		if (!Array.isArray(value)) return void 0;
+		const keys = /* @__PURE__ */ new Set();
+		for (const entry of value) {
+			const key = entry?.Key;
+			if (typeof key !== "string") return void 0;
+			keys.add(key);
+		}
+		return keys;
+	};
+	const recordedKeys = keysOf(recorded);
+	const desiredKeys = keysOf(desired);
+	if (recordedKeys === void 0 || desiredKeys === void 0 || !Array.isArray(live)) return void 0;
+	const removable = live.filter((entry) => {
+		const key = entry?.Key;
+		return typeof key === "string" && attempted.includes(key) && !recordedKeys.has(key) && !desiredKeys.has(key);
+	});
+	if (removable.length === 0) return void 0;
+	return [...recorded ?? [], ...removable];
+}
 function tagsHeld(desired, live) {
 	const asMap = (value) => {
 		if (value === void 0 || value === null) return /* @__PURE__ */ new Map();
@@ -39624,7 +39827,42 @@ async function withUnprovenUnsettled(record, args, warn) {
 	const kept = await unsettledAfterUpdate(args);
 	if (kept.length === 0) return record;
 	warn(safeMsg`${args.logicalId} (${args.resourceType}): the update succeeded, but AWS does not yet show the requested ${kept.join(", ")}; cdkd keeps ${kept.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
-	return withUnsettledProperties(record, kept);
+	const withNames = withUnsettledProperties(record, kept);
+	return withUnsettledItems(withNames, args.attemptedItems ?? /* @__PURE__ */ new Map());
+}
+async function waitForUnsettledSettled(args) {
+	const { provider, names } = args;
+	const deadline = Date.now() + args.timeoutMs;
+	if (args.running !== void 0) {
+		let returned = false;
+		const done = args.running.then(() => {
+			returned = true;
+		}, () => {
+			returned = true;
+		});
+		while (!returned) {
+			if (args.isInterrupted()) return "interrupted";
+			const left = deadline - Date.now();
+			if (left <= 0) return "moving";
+			await Promise.race([done, new Promise((resolve) => setTimeout(resolve, Math.min(250, left)))]);
+		}
+	}
+	if (provider.unsettledInTransition === void 0 || names.size === 0) return "settled";
+	for (;;) {
+		if (args.isInterrupted()) return "interrupted";
+		let moving = true;
+		try {
+			moving = (await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties)).size > 0;
+		} catch {}
+		if (!moving) return "settled";
+		const left = deadline - Date.now();
+		if (left <= 0) return "moving";
+		const until = Date.now() + Math.min(args.pollMs, left);
+		while (Date.now() < until) {
+			if (args.isInterrupted()) return "interrupted";
+			await new Promise((resolve) => setTimeout(resolve, Math.min(250, until - Date.now())));
+		}
+	}
 }
 function splitUnhandledRemovals(unhandled, recordedPrevious, unsettled) {
 	const addedByFailedUpdate = unhandled.filter((name) => unsettled.has(name) && !Object.hasOwn(recordedPrevious, name));
@@ -39655,7 +39893,8 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 		recordedProperties: recordedPrevious,
 		names: context?.unsettledProperties ?? /* @__PURE__ */ new Set(),
 		previous: recordedPrevious,
-		desired
+		desired,
+		...context?.unsettledItems !== void 0 && { attemptedItems: context.unsettledItems }
 	});
 	const removal = prepareRemovalForUpdate(provider, resourceType, desired, previous);
 	const revertArgs = [
@@ -40012,7 +40251,8 @@ async function replayRevert(s) {
 		resourceType: op.resourceType,
 		recordedProperties: current.properties ?? {},
 		names: unsettledContextOf(current, previousState).unsettledProperties ?? /* @__PURE__ */ new Set(),
-		desired: desiredProps ?? {}
+		desired: desiredProps ?? {},
+		...unsettledContextOf(current, previousState).unsettledItems !== void 0 && { attemptedItems: unsettledContextOf(current, previousState).unsettledItems }
 	}, (message) => logger.warn(mask(message)));
 	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
@@ -40253,11 +40493,13 @@ async function replayReverseReplacement(s) {
 	}
 	const { observedProperties: _staleObserved, ...prevRecord } = prev;
 	recordNoEchoAttributeValues(createResult, secrets, resolvedPrevProps);
+	const restoredProperties = recordedPropertiesAfterReplayCreate(prevRecord, createResult);
 	stateResources[op.logicalId] = redactRollbackRecord({
 		...withNameGenerationReached(prevRecord, op.logicalId, op.nameGeneration),
 		physicalId: createResult.physicalId,
 		attributes: createResult.attributes ?? {},
-		properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
+		properties: restoredProperties,
+		acceptedCreateOnlyDrops: acceptedCreateOnlyDropsEvidence(restoredProperties, oldType, createProvisionedBy)
 	}, secrets, prevRecord.properties, prevRecord.attributes);
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
 	const deferral = s.deferral !== void 0 && !deletedNewFirst && !adoptedLiveNewResource && !rollbackRetainsNewResource(current) ? s.deferral : void 0;
@@ -40674,6 +40916,12 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 function ownRecord(stateResources, logicalId) {
 	return Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
 }
+function withKeysFrom(bag, source, keys) {
+	const out = { ...bag };
+	for (const key of keys) if (source !== void 0 && Object.hasOwn(source, key)) out[key] = source[key];
+	else delete out[key];
+	return out;
+}
 async function replayFailedOperationsUnbound(failedOps, stateResources, stackName, ctx, options = {}) {
 	const inlinePolicyWriters = options.inlinePolicyWriters ?? new RollbackInlinePolicyWriters();
 	const result = {
@@ -40906,7 +41154,14 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						skipUnaddressableReplay(skipScope, logger, op, "force-revert failed UPDATE of");
 						break;
 					}
-					logger.info(`  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
+					const own = options.previousFromRecord?.get(op.logicalId);
+					const fromRecord = own !== void 0;
+					const attemptedBag = fromRecord ? void 0 : op.attemptedProperties;
+					const revertUnsettled = fromRecord ? own.names.size === 0 ? {} : {
+						unsettledProperties: own.names,
+						...own.items.size > 0 && { unsettledItems: own.items }
+					} : unsettledContextOf(current, prev);
+					logger.info(!fromRecord ? `  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)` : own.lateSuccess ? `  Rollback: reverting the failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}), whose call completed after the deploy gave up on it, to its pre-deploy properties` : `  Rollback: reverting what the failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) left unsettled (${[...own.names].map(safe).join(", ")}) to its pre-deploy properties`);
 					const { provider, provisionedBy: revertVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
@@ -40923,7 +41178,13 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					});
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
-					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
+					const resolvedPrevious = noEcho.onPreviousSide(await resolveReplayProps(attemptedBag ?? current.properties, resolver, secrets, ctx, op.logicalId, attemptedBag === void 0 ? current : void 0));
+					const excludedKeys = own?.lateSuccess === true ? [...unsettledPropertiesOf(prev)] : [];
+					const attemptedProps = excludedKeys.length === 0 || resolvedPrevious === void 0 ? resolvedPrevious : withKeysFrom(resolvedPrevious, desiredProps, excludedKeys);
+					if (excludedKeys.length > 0) {
+						const one = excludedKeys.length === 1;
+						logger.warn(safeMsg`  Rollback: ${safe(op.logicalId)} (${safe(op.resourceType)}): ${excludedKeys.map(safe).join(", ")} ${one ? "was" : "were"} left unsettled by an earlier failed deploy, so this revert leaves ${one ? "it" : "them"} as AWS holds ${one ? "it" : "them"}; the next deploy converges ${one ? "it" : "them"}.`);
+					}
 					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, "state-derived");
 					opMasker.addNamed({
 						resourceType: op.resourceType,
@@ -40957,7 +41218,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 							replayingState: true,
 							recordedAttributes: current.attributes,
 							...revertFailedClaimed && { inlinePolicyClaimed: revertFailedClaimed },
-							...unsettledContextOf(current, prev)
+							...revertUnsettled
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
@@ -40968,10 +41229,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						physicalId: current.physicalId,
 						resourceType: op.resourceType,
 						recordedProperties: current.properties ?? {},
-						names: unsettledContextOf(current, prev).unsettledProperties ?? /* @__PURE__ */ new Set(),
-						desired: desiredProps ?? {}
+						names: revertUnsettled.unsettledProperties ?? /* @__PURE__ */ new Set(),
+						desired: desiredProps ?? {},
+						...revertUnsettled.unsettledItems !== void 0 && { attemptedItems: revertUnsettled.unsettledItems }
 					}, (message) => logger.warn(mask(message)));
-					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
+					if (fromRecord) stateResources[op.logicalId] = withUnsettledItems(withUnsettledProperties(stateResources[op.logicalId], unsettledPropertiesOf(prev)), unsettledItemsOf(prev));
+					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(prev.properties?.["Policies"], (attemptedBag ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
 					else logger.info(`  Rollback: ${safe(op.logicalId)} reverted successfully`);
@@ -42885,7 +43148,7 @@ async function revertNestedChildFromJournal(args) {
 			...carried,
 			...stackInstanceIdCarriedFrom(base),
 			...supersededAfterRollback(base, supersededHost),
-			version: 14,
+			version: 15,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
@@ -43652,7 +43915,7 @@ function replayPrintingBag(deps, entries, stateResources) {
 		read
 	]);
 }
-async function performRollback(deps, completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = []) {
+async function performRollback(deps, completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = [], unsettledRevert) {
 	const orphanIndexes = [];
 	const orphanOps = [];
 	failedOperations.forEach((op, i) => {
@@ -43677,7 +43940,7 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const supersededHost = {};
 	const runId = deps.options.eventRecorder?.runId;
-	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
+	const { result, failed, unsettled, run } = await withNestedRevertRun(runId, async (scope) => {
 		return {
 			failed: orphanOps.length > 0 ? await withPrintingSecrets(replayPrintingBag(deps, orphanOps.map((op) => ({
 				...op,
@@ -43686,6 +43949,11 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 				emitEnvelope: completedOperations.length === 0,
 				inlinePolicyWriters
 			})) : void 0,
+			unsettled: await revertUnsettledFailedUpdates(deps, ctx, stackName, stateResources, failedOperations, new Set(orphanIndexes), {
+				emitEnvelope: completedOperations.length === 0 && orphanOps.length === 0,
+				inlinePolicyWriters,
+				hooks: unsettledRevert
+			}),
 			result: await withPrintingSecrets(replayPrintingBag(deps, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, {
 				inlinePolicyWriters,
 				failedOperations,
@@ -43698,11 +43966,12 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 	});
 	const pendingOrphans = new Set(failed?.remainingFailedOps ?? []);
 	const handled = new Set(orphanIndexes.filter((_, k) => !pendingOrphans.has(orphanOps[k])));
+	for (const index of unsettled.handled) handled.add(index);
 	return {
 		failures: result.failures + (failed?.failures ?? 0),
-		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0),
+		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0) + unsettled.warnings,
 		skipped: result.skipped + (failed?.skipped ?? 0),
-		interrupted: result.interrupted,
+		interrupted: result.interrupted || unsettled.interrupted,
 		orphaned: [...failed?.orphaned ?? [], ...result.orphaned],
 		rolledBackCreates: [...failed?.rolledBackCreates ?? [], ...result.rolledBackCreates],
 		superseded: supersededHost.supersededResources ?? [],
@@ -43710,6 +43979,152 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
 }
+function waitText(ms) {
+	return ms >= 6e4 ? `${Math.round(ms / 6e4)} min` : `${Math.max(1, Math.round(ms / 1e3))}s`;
+}
+async function revertUnsettledFailedUpdates(deps, ctx, stackName, stateResources, failedOperations, alreadyReplayed, options) {
+	const out = {
+		handled: [],
+		warnings: 0,
+		interrupted: false
+	};
+	const hooks = options.hooks;
+	if (hooks === void 0) return out;
+	const ownMarks = (logicalId) => {
+		const onRecord = unsettledPropertiesOf(stateResources[logicalId]);
+		const marks = hooks.runMarks(logicalId);
+		const names = new Set([...marks.names].filter((name) => onRecord.has(name)));
+		return {
+			names,
+			items: new Map([...marks.items].filter(([path]) => names.has(unsettledItemsTopKey(path)))),
+			lateSuccess: false
+		};
+	};
+	const candidates = [];
+	failedOperations.forEach((op, index) => {
+		if (alreadyReplayed.has(index) || op.changeType !== "UPDATE") return;
+		if (failedOpOwnRecord(op, stateResources) === void 0) return;
+		const own = ownMarks(op.logicalId);
+		const running = hooks.stillRunning(op.logicalId);
+		if (own.names.size === 0 && running === void 0) return;
+		if (classifyFailedOp(op, stateResources, [...failedOperations]) !== "revert-failed-update") return;
+		candidates.push({
+			index,
+			op,
+			own,
+			running
+		});
+	});
+	if (candidates.length === 0) return out;
+	const { logger } = deps;
+	const isInterrupted = () => deps.userInterrupted();
+	const fallback = (names) => {
+		const one = names.size === 1;
+		const retry = deps.options.parentStackInfo === void 0 ? `, or revert ${one ? "it" : "them"} now with: ${pasteableCommand("cdkd rollback", [{
+			value: stackName,
+			hole: "stack"
+		}, { literal: "--revert-failed" }]).command}` : "";
+		return `cdkd keeps ${one ? "it" : "them"} unsettled: the next deploy converges ${one ? "it" : "them"}${retry}`;
+	};
+	const wait = deps.options.unsettledRevertWait ?? DEFAULT_UNSETTLED_REVERT_WAIT;
+	const verdicts = await Promise.all(candidates.map(async (candidate) => {
+		const { op } = candidate;
+		let provider;
+		try {
+			provider = ctx.providerRegistry.getProviderFor({
+				resourceType: op.resourceType,
+				provisionedBy: op.provisionedBy ?? stateResources[op.logicalId].provisionedBy
+			}).provider;
+		} catch {
+			return "error";
+		}
+		logger.info(safeMsg`  Rollback: waiting for ${op.logicalId} (${op.resourceType}) to settle before reverting the failed update`);
+		const started = Date.now();
+		const identity = () => {
+			const record = stateResources[op.logicalId];
+			return {
+				provider,
+				logicalId: op.logicalId,
+				physicalId: record.physicalId,
+				resourceType: op.resourceType,
+				recordedProperties: record.properties ?? {},
+				names: candidate.own.names,
+				timeoutMs: Math.max(0, wait.timeoutMs - (Date.now() - started)),
+				pollMs: wait.pollMs,
+				isInterrupted
+			};
+		};
+		if (candidate.running !== void 0) {
+			let succeeded = false;
+			const returned = await waitForUnsettledSettled({
+				...identity(),
+				names: /* @__PURE__ */ new Set(),
+				running: candidate.running.then((ok) => {
+					succeeded = ok;
+				})
+			});
+			if (returned === "moving") return "call-running";
+			if (returned === "interrupted") return returned;
+			hooks.recordMarks(op.logicalId);
+			candidate.own = {
+				...ownMarks(op.logicalId),
+				lateSuccess: succeeded
+			};
+			if (!succeeded && candidate.own.names.size === 0) return "none";
+		}
+		try {
+			return await waitForUnsettledSettled(identity());
+		} catch {
+			return "error";
+		}
+	}));
+	const ready = [];
+	candidates.forEach((candidate, k) => {
+		const verdict = verdicts[k];
+		if (verdict === "settled") {
+			ready.push(candidate);
+			return;
+		}
+		if (verdict === "none") return;
+		if (verdict === "interrupted") {
+			out.interrupted = true;
+			return;
+		}
+		const { op } = candidate;
+		const names = candidate.own.names;
+		const them = names.size === 1 ? "it" : "them";
+		const subject = names.size > 0 ? `the failed update left ${[...names].join(", ")} unsettled` : "the failed update may have applied part of the template";
+		const why = verdict === "call-running" ? `cdkd's own update call, abandoned at the per-resource deadline, had not returned after ${waitText(wait.timeoutMs)}` : verdict === "error" ? "cdkd could not reach its provider to wait for it" : `AWS had not settled ${them} after ${waitText(wait.timeoutMs)}`;
+		logger.warn(safeMsg`${op.logicalId} (${op.resourceType}): ${subject}, and ${why}, so the automatic rollback did not revert ${names.size > 0 ? them : "it"}. ${fallback(names)}`);
+		out.warnings++;
+	});
+	if (ready.length === 0 || out.interrupted) return out;
+	const ops = ready.map(({ op }) => ({ ...op }));
+	const own = new Map(ready.map(({ op, own: marks }) => [op.logicalId, marks]));
+	const replay = await withPrintingSecrets(replayPrintingBag(deps, ops.map((op) => ({
+		...op,
+		properties: op.attemptedProperties
+	})), stateResources), () => replayFailedOperations(ops, stateResources, stackName, ctx, {
+		emitEnvelope: options.emitEnvelope,
+		inlinePolicyWriters: options.inlinePolicyWriters,
+		isInterrupted,
+		previousFromRecord: own
+	}));
+	out.warnings += replay.warnings + replay.failures;
+	if (replay.interrupted) out.interrupted = true;
+	const pending = new Set(replay.remainingFailedOps);
+	const skipped = new Set(replay.skippedOps ?? []);
+	ops.forEach((op, k) => {
+		const { index, own: marks } = ready[k];
+		if (pending.has(op) || skipped.has(op)) {
+			if (!replay.interrupted) logger.warn(safeMsg`${op.logicalId} (${op.resourceType}): the automatic rollback could not revert ${marks.names.size > 0 ? `what the failed update left unsettled (${[...marks.names].join(", ")})` : "the failed update"} (see above). ${fallback(marks.names)}`);
+			return;
+		}
+		out.handled.push(index);
+		hooks.onReverted(op.logicalId, marks.names);
+	});
+	return out;
+}
 function foreignHolderResolver(deps) {
 	const sameBucketHolderFor = makeForeignHolderScan(deps.stateBackend);
 	const crossPrefixHolder = deps.options.crossPrefixHolder;
@@ -46277,12 +46692,8 @@ function extractTemplateAttributes(template, logicalId) {
 	};
 }
 function acceptedCreateOnlyDropsField(recordedProperties, resourceType, provisionedBy, mode, previous) {
-	if (provisionedBy !== "sdk") return { acceptedCreateOnlyDrops: void 0 };
-	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-	if (createOnly === void 0 || createOnly.size === 0) return { acceptedCreateOnlyDrops: void 0 };
 	const carried = mode === "in-place" ? acceptedCreateOnlyDropsOf(previous) : void 0;
-	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
-	return { acceptedCreateOnlyDrops: names.length > 0 ? names : void 0 };
+	return { acceptedCreateOnlyDrops: acceptedCreateOnlyDropsEvidence(recordedProperties, resourceType, provisionedBy, carried) };
 }
 function secretNamedAttributesField(result, previous) {
 	const reported = result.secretNamedAttributeNames;
@@ -46604,6 +47015,7 @@ async function provisionCreate(engine, logicalId, change, stateResources, stackN
 		...templateAttrs,
 		provisionedBy: createDecision.provisionedBy
 	};
+	clearCreatedReport();
 	engine.recordInlinePolicyWrite(logicalId, "create");
 	await establishNoEchoEchoFidelity(engine.noEchoRun, engine.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
 	const createCaptureSiblings = await buildObservedCaptureSiblings({
@@ -46888,12 +47300,17 @@ const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
 function hasTransitionalIndex(indexes) {
 	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
 }
+function hasTransitionalTableIndex(table) {
+	return hasTransitionalIndex(table?.GlobalSecondaryIndexes) || hasTransitionalIndex(table?.VectorIndexes);
+}
+const GSI_INDEX_NOUN = "a global secondary index";
+const TABLE_INDEX_NOUN = "a global secondary index or vector index";
 const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
 function isIndexBusyDeleteError(message) {
 	return INDEX_BUSY_DELETE_MESSAGE.test(message);
 }
-function relayedIndexBusyDelete(withheldText) {
-	return isIndexBusyDeleteError(withheldText) ? " AWS reports that a global secondary index is still being created, updated or deleted; re-running the destroy succeeds once the index is ACTIVE." : "";
+function relayedIndexBusyDelete(withheldText, indexNoun = GSI_INDEX_NOUN) {
+	return isIndexBusyDeleteError(withheldText) ? ` AWS reports that ${indexNoun} is still being created, updated or deleted; re-running the destroy succeeds once the index is ACTIVE.` : "";
 }
 const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
 const INDEX_SETTLE_POLL_INTERVAL_MS = 1e3;
@@ -46901,21 +47318,43 @@ const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AW
 async function waitForIndexesSettled(opts) {
 	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
 	const budgetWait = opts.budgetWait;
+	const shortCap = opts.shortCapUnlessVectorBusy;
+	let vectorOnlyBusy = false;
+	let stoppedAtShortCap = false;
+	let announced = false;
+	const effectiveCap = () => shortCap !== void 0 && !vectorOnlyBusy ? Math.min(shortCap, maxAttempts) : maxAttempts;
 	const watch = startInterruptWatch(`index settle wait on ${tableName}`);
 	let attempt = 0;
 	try {
-		while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
+		for (;;) {
+			if (shortCap !== void 0 && attempt >= shortCap && !vectorOnlyBusy) {
+				stoppedAtShortCap = true;
+				break;
+			}
+			if (!(budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts)) break;
 			attempt += 1;
 			if (watch.isInterrupted()) {
 				logger.debug(`Interrupted while waiting for indexes on ${tableName} (${logicalId}) after ${attempt - 1} DescribeTable polls; ${proceedNote}`);
 				return;
 			}
 			try {
-				if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
+				const response = await describeTable();
+				if (!hasTransitionalTableIndex(response.Table)) {
+					if (attempt > 1) logger.debug(safeMsg`Indexes on ${tableName} (${logicalId}) settled after ${attempt} DescribeTable polls`);
+					return;
+				}
+				const gsiBusy = hasTransitionalIndex(response.Table?.GlobalSecondaryIndexes);
+				const vectorBusy = hasTransitionalIndex(response.Table?.VectorIndexes);
+				vectorOnlyBusy = vectorBusy && !gsiBusy;
+				if (!announced) {
+					announced = true;
+					const busyKinds = gsiBusy ? vectorBusy ? "a global secondary index and a vector index" : "a global secondary index" : "a vector index";
+					logger.debug(safeMsg`Index settle wait on ${tableName} (${logicalId}): ${busyKinds} still transitioning (poll ${attempt})`);
+				}
 			} catch (err) {
 				const message = describeAwsFailure(err).detail;
 				if (isThrottlingError(err)) {
-					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${effectiveCap()}); still waiting: ${message}`);
 					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 					continue;
 				}
@@ -46934,14 +47373,14 @@ async function waitForIndexesSettled(opts) {
 		watch.dispose();
 	}
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
-	const pollsRun = budgetWait ? budgetWait.pollsRun : maxAttempts;
-	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${pollsRun} DescribeTable polls (~${pollSeconds}s apart, so a little over ${pollsRun * pollSeconds}s of wall clock).${budgetWait?.note() ?? ""} ${proceedNote}`);
+	const pollsRun = budgetWait ? budgetWait.pollsRun : attempt;
+	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${pollsRun} DescribeTable polls (~${pollSeconds}s apart, so a little over ${pollsRun * pollSeconds}s of wall clock).${stoppedAtShortCap ? "" : budgetWait?.note(shortCap !== void 0 && !vectorOnlyBusy ? shortCap : void 0) ?? ""} ${proceedNote}`);
 }
 function indexBusyRetryWarning(opts) {
 	const remainingAttempts = Math.max(0, 1 + opts.maxRetries - opts.attemptNumber);
 	const settleFloorMinutes = Math.max(1, Math.round((remainingAttempts + 1) * 60 * INDEX_SETTLE_POLL_INTERVAL_MS / 6e4));
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
-	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~${pollSeconds}s apart before its DeleteTable, so cdkd will not give up for at least ~${settleFloorMinutes} more minutes while those settle waits run). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails on AWS's refusal (re-run with --verbose for AWS's own message) and re-running it succeeds once the index is ACTIVE.`;
+	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because ${opts.indexNoun ?? "a global secondary index"} is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~${pollSeconds}s apart before its DeleteTable, so cdkd will not give up for at least ~${settleFloorMinutes} more minutes while those settle waits run). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails on AWS's refusal (re-run with --verbose for AWS's own message) and re-running it succeeds once the index is ACTIVE.`;
 }
 async function deleteTableWithIndexBusyRetry(opts) {
 	let deleteAttempts = 0;
@@ -46949,12 +47388,13 @@ async function deleteTableWithIndexBusyRetry(opts) {
 	try {
 		await withRetry(async () => {
 			if (deleteAttempts++ > 0) {
-				if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
+				if (deleteAttempts === 2) opts.logger.warn(opts.retryWarning?.() ?? indexBusyRetryWarning({
 					typeLabel: opts.typeLabel,
 					logicalId: opts.logicalId,
 					physicalId: opts.physicalId,
 					attemptNumber: deleteAttempts,
-					maxRetries: opts.maxRetries
+					maxRetries: opts.maxRetries,
+					...opts.indexNoun !== void 0 && { indexNoun: opts.indexNoun }
 				}));
 				await opts.reArm();
 			}
@@ -46977,6 +47417,7 @@ async function deleteTableWithIndexBusyRetry(opts) {
 const DYNAMODB_DELETE_POLL_RTT_MS = 200;
 const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
 const DYNAMODB_DELETE_BUDGET_MS = 156e4;
+const DYNAMODB_DELETE_DEADLINE_MARGIN_MS = 24e4;
 const DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS = 18e5;
 const dynamoDbDeleteBudgetOverride = {};
 function resolveDynamoDbDeleteBudgetMs() {
@@ -47035,11 +47476,12 @@ var DeleteWaitImpl = class {
 	get cutShort() {
 		return this.endedByBudget && this.ran < 60;
 	}
-	note() {
+	note(shownCap) {
 		if (!this.endedByBudget) return "";
+		const cap = shownCap ?? this.cap;
 		const minutes = Math.max(1, Math.round((this.budget?.totalMs ?? 0) / 6e4));
-		if (this.cutShort) return ` — cdkd's shared ~${minutes}-minute delete allowance was already spent, so this wait made only ${this.ran} of its ${this.cap} polls and AWS was not given a real wait. Nothing is necessarily wrong with the table; re-run the destroy.`;
-		return ` (cdkd's shared ~${minutes}-minute delete allowance capped this wait at ${this.ran} of its ${this.cap} polls.)`;
+		if (this.cutShort) return ` — cdkd's shared ~${minutes}-minute delete allowance was already spent, so this wait made only ${this.ran} of its ${cap} polls and AWS was not given a real wait. Nothing is necessarily wrong with the table; re-run the destroy.`;
+		return ` (cdkd's shared ~${minutes}-minute delete allowance capped this wait at ${this.ran} of its ${cap} polls.)`;
 	}
 };
 function beginDeleteWait(cap, budget) {
@@ -47945,7 +48387,8 @@ function identityKeyOf(...lists) {
 	return entries.some((entry) => isPlainObject(entry) && IDENTITY_KEYS.some((candidate) => typeof entry[candidate] === "string")) ? "ambiguous" : void 0;
 }
 const POSITIONAL_LIST_KEYS = /* @__PURE__ */ new Set(["KeySchema"]);
-function projectNamed(live, own, wanted, path, unnamed) {
+function projectNamed(live, own, wanted, path, unnamed, attempted = /* @__PURE__ */ new Map()) {
+	const attemptedAt = (at) => new Set([...attempted.get(at) ?? []].filter(isUsableAttemptedName));
 	if (isPlainObject(live) && (isPlainObject(own) || isPlainObject(wanted))) {
 		const ownBag = isPlainObject(own) ? own : void 0;
 		const wantedBag = isPlainObject(wanted) ? wanted : void 0;
@@ -47956,10 +48399,12 @@ function projectNamed(live, own, wanted, path, unnamed) {
 			if (IDENTITY_KEYS.includes(key)) continue;
 			if (key === "Tags") {
 				if (ownBag !== void 0 && Object.hasOwn(ownBag, "Tags")) out["Tags"] = ownBag["Tags"];
+				const withAttempted = withAttemptedReplicaTags(ownBag?.["Tags"], wantedBag?.["Tags"], live["Tags"], attemptedAt(`${path}.Tags`));
+				if (withAttempted !== void 0) out["Tags"] = withAttempted;
 				continue;
 			}
 			if (!Object.hasOwn(live, key) || live[key] === void 0) continue;
-			out[key] = POSITIONAL_LIST_KEYS.has(key) ? live[key] : projectNamed(live[key], ownBag?.[key], wantedBag?.[key], `${path}.${key}`, unnamed);
+			out[key] = POSITIONAL_LIST_KEYS.has(key) ? live[key] : projectNamed(live[key], ownBag?.[key], wantedBag?.[key], `${path}.${key}`, unnamed, attempted);
 		}
 		return out;
 	}
@@ -47986,6 +48431,7 @@ function projectNamed(live, own, wanted, path, unnamed) {
 			const ownEntry = ownById.get(value);
 			const wantedEntry = wantedById.get(value);
 			if (ownEntry === void 0 && wantedEntry === void 0) {
+				if (attemptedAt(path).has(value)) return [entry];
 				unnamed.push({
 					identity: id,
 					value,
@@ -47993,11 +48439,34 @@ function projectNamed(live, own, wanted, path, unnamed) {
 				});
 				return [];
 			}
-			return [projectNamed(entry, ownEntry, wantedEntry, `${path}[${value}]`, unnamed)];
+			return [projectNamed(entry, ownEntry, wantedEntry, `${path}[${value}]`, unnamed, attempted)];
 		});
 	}
 	return live;
 }
+function withAttemptedReplicaTags(recorded, desired, live, attempted) {
+	if (attempted.size === 0 || !Array.isArray(live)) return void 0;
+	const keysOf = (value) => {
+		if (value === void 0 || value === null) return /* @__PURE__ */ new Set();
+		if (!Array.isArray(value)) return void 0;
+		const keys = /* @__PURE__ */ new Set();
+		for (const entry of value) {
+			const key = entry?.Key;
+			if (typeof key !== "string") return void 0;
+			keys.add(key);
+		}
+		return keys;
+	};
+	const recordedKeys = keysOf(recorded);
+	const desiredKeys = keysOf(desired);
+	if (recordedKeys === void 0 || desiredKeys === void 0) return void 0;
+	const removable = live.filter((entry) => {
+		const key = entry?.Key;
+		return typeof key === "string" && attempted.has(key) && !recordedKeys.has(key) && !desiredKeys.has(key);
+	});
+	if (removable.length === 0) return void 0;
+	return [...recorded ?? [], ...removable];
+}
 const strictReadScope = new AsyncLocalStorage();
 function strictFor(key) {
 	return strictReadScope.getStore()?.has(key) === true;
@@ -48008,6 +48477,12 @@ function replicaStrictness(status) {
 	return new Set([...current].filter((key) => key !== "Replicas"));
 }
 const unsettledScope = new AsyncLocalStorage();
+const REGION_SEGMENT = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function markAttemptedItems(path, items) {
+	const scope = unsettledScope.getStore();
+	if (scope?.attempted === void 0 || items.length === 0) return;
+	scope.attempted(path, items);
+}
 function markUnsettled(...keys) {
 	const scope = unsettledScope.getStore();
 	if (scope === void 0) return;
@@ -48126,6 +48601,11 @@ var DynamoDBGlobalTableProvider = class {
 		const warn = log.warn;
 		log.debug(`Creating DynamoDB GlobalTable ${logicalId}`);
 		const desiredReplicaTags = refuseMalformedReplicaTags(properties, resourceType, logicalId);
+		const disassociationRefusal = disassociationProtectionRefusal(properties, void 0, logicalId);
+		if (disassociationRefusal !== void 0) {
+			if (context?.replayingState !== true) throw new ProvisioningError(log.mask(disassociationRefusal), resourceType, logicalId);
+			warn(`${disassociationRefusal} Proceeding: this create replays a cdkd state record.`);
+		}
 		const tableName = properties["TableName"] || generatedNameFor("AWS::DynamoDB::GlobalTable", logicalId);
 		const keySchema = properties["KeySchema"];
 		const attributeDefinitions = properties["AttributeDefinitions"];
@@ -48276,6 +48756,7 @@ var DynamoDBGlobalTableProvider = class {
 		let createdTableId;
 		try {
 			createdTableId = (await (await this.getCreateClient()).send(new CreateTableCommand(createParams)))?.TableDescription?.TableId;
+			reportCreatedResource(logicalId, resourceType, tableName, createdTableId);
 			log.debug(`CreateTable initiated for ${log.value(tableName)}, waiting for ACTIVE`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -48296,6 +48777,7 @@ var DynamoDBGlobalTableProvider = class {
 				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, resourceType, logicalId, tableName, maskSecrets);
 			}
 			await this.applyReplicaSettings(tableName, logicalId, currentRegion, wiringProperties, void 0, /* @__PURE__ */ new Set(), false, replayWarn(log, context).onUnusable !== void 0, /* @__PURE__ */ new Set(), void 0, warn, maskSecrets);
+			await this.convergeReplicaDisassociationProtection(tableName, logicalId, currentRegion, wiringProperties, void 0, context?.replayingState === true ? "replay" : "template", warn, maskSecrets);
 			const createTtl = planTimeToLive(properties["TimeToLiveSpecification"], void 0, "create");
 			if (createTtl.kind === "enable") await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
 				TableName: tableName,
@@ -48347,6 +48829,7 @@ var DynamoDBGlobalTableProvider = class {
 					}
 				}
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+				retractCreatedResource(logicalId, resourceType, tableName);
 			} catch (cleanupErr) {
 				tableLeftBehind = true;
 				warn(`Partial-create cleanup failed for ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup failed for ${tableName}: `, cleanupErr)} To remove the orphaned AWS-side table, run: ` + pasteableAwsCommand(maskSecrets)`aws dynamodb delete-table --table-name ${tableName}`.render());
@@ -48394,6 +48877,7 @@ var DynamoDBGlobalTableProvider = class {
 				TableName: tableName,
 				ReplicaUpdates: replicaUpdates
 			}));
+			markAttemptedItems("Replicas", [region]);
 			break;
 		} catch (error) {
 			if (attempt >= 3 || !isReplicaCopyExistsRefusal(error)) throw error;
@@ -48421,14 +48905,14 @@ var DynamoDBGlobalTableProvider = class {
 			DeletionProtectionEnabled: enabled
 		}));
 	}
-	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget) {
+	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget, member = "DeletionProtectionEnabled", replicaClient = this.getRegionalClient(region)) {
 		const wait = beginDeleteWait(60, budget);
-		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} deletion-protection change on ${tableName}`));
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} ${member === "DeletionProtectionEnabled" ? "deletion-protection" : "disassociation-protection"} change on ${tableName}`));
 		try {
 			while (wait.nextPoll()) {
 				if (watch.isInterrupted()) throw watch.onInterrupted();
-				const replica = await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }));
-				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table.DeletionProtectionEnabled === enabled) {
+				const replica = await replicaClient.send(new DescribeTableCommand({ TableName: tableName }));
+				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table[member] === enabled) {
 					if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
 				}
 				await new Promise((resolve) => setTimeout(resolve, REPLICA_PROTECTION_SETTLE_POLL_MS));
@@ -48436,7 +48920,7 @@ var DynamoDBGlobalTableProvider = class {
 		} finally {
 			watch.dispose();
 		}
-		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		throw new ProvisioningError(maskSecrets(`${member}=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, desiredFromReadback, warn, maskSecrets) {
 		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
@@ -48465,6 +48949,63 @@ var DynamoDBGlobalTableProvider = class {
 			if (typeof live === "boolean" && live !== newDpe) await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
 		}
 	}
+	async convergeReplicaDisassociationProtection(tableName, logicalId, currentRegion, properties, previousProperties, origin, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		let wrote = false;
+		const multiRegion = isMultiRegionReplicaSet(properties);
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const declared = readReplicaDisassociationProtection(replica);
+			const previous = previousProperties === void 0 ? void 0 : readReplicaDisassociationProtection(localReplicaEntry(previousProperties, region));
+			const clientFor = () => region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			const readLive = async () => {
+				const client = clientFor();
+				try {
+					return (await client.send(new DescribeTableCommand({ TableName: tableName }))).Table?.DisassociationProtectionEnabled;
+				} catch (readError) {
+					this.logger.debug(maskSecrets(`Could not read ${DISASSOCIATION_PROTECTION_KEY} on the ${region} replica of ${tableName}: ${describeAwsFailure(readError).detail}`));
+					return;
+				}
+			};
+			if (!multiRegion) {
+				if (declared !== void 0) {
+					const message = `${DISASSOCIATION_PROTECTION_KEY}=${declared} on the ${region} replica of ${tableName} is not sent: DynamoDB applies it only to a replica of a multi-Region global table, and this table's Replicas name a single Region.`;
+					const justShrunk = previousProperties !== void 0 && isMultiRegionReplicaSet(previousProperties);
+					if (origin === "template" && (justShrunk || declared !== previous)) warn(message);
+					else this.logger.debug(maskSecrets(message));
+				} else if (origin !== "readback" && replica?.[DISASSOCIATION_PROTECTION_KEY] === void 0 && previous !== void 0) warn(`${DISASSOCIATION_PROTECTION_KEY} was removed from the ${region} replica of ${tableName}, whose Replicas now name a single Region, so nothing is sent and the replica keeps its current setting (${previous} when last deployed).`);
+				continue;
+			}
+			if (declared === void 0) {
+				if (replica?.[DISASSOCIATION_PROTECTION_KEY] !== void 0 || previous === void 0) continue;
+				if (origin === "template") warn(`${DISASSOCIATION_PROTECTION_KEY} was removed from the ${region} replica of ${tableName}; DynamoDB keeps the replica's current setting (${previous} when last deployed), so nothing is sent. Declare it to change it.`);
+				else if (origin === "replay" && previous === false && await readLive() === false) {
+					await this.setReplicaDisassociationProtection(tableName, region, clientFor(), true, logicalId, maskSecrets);
+					wrote = true;
+				}
+				continue;
+			}
+			const changed = declared !== previous || isUnsettled("Replicas");
+			const live = await readLive();
+			if (live === declared) continue;
+			if (live === void 0 && !changed) continue;
+			await this.setReplicaDisassociationProtection(tableName, region, clientFor(), declared, logicalId, maskSecrets);
+			wrote = true;
+		}
+		if (wrote) await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+	}
+	async setReplicaDisassociationProtection(tableName, region, client, enabled, logicalId, maskSecrets) {
+		await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, client === this.dynamoDBClient ? {} : { region });
+		markUnsettled("Replicas");
+		this.logger.debug(maskSecrets(`Sending UpdateTable ${DISASSOCIATION_PROTECTION_KEY}=${enabled} to the ${region} replica of ${tableName}`));
+		await client.send(new UpdateTableCommand({
+			TableName: tableName,
+			DisassociationProtectionEnabled: enabled
+		}));
+		await this.waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, void 0, DISASSOCIATION_PROTECTION_KEY, client);
+	}
 	async convergeReplicaSettings(tableName, logicalId, currentRegion, properties, addedRegions, maskSecrets) {
 		const kept = (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map(asRecord).filter((r) => typeof r?.["Region"] === "string" && r["Region"] !== currentRegion && !addedRegions.has(r["Region"]));
 		if (kept.every((r) => readReplicaTableClass(r) === void 0)) return;
@@ -49047,7 +49588,8 @@ var DynamoDBGlobalTableProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		return unsettledScope.run({
 			mark: (key) => context?.markUnsettled?.(key),
-			unsettled: context?.unsettledProperties ?? /* @__PURE__ */ new Set()
+			unsettled: context?.unsettledProperties ?? /* @__PURE__ */ new Set(),
+			attempted: (path, items) => context?.markAttempted?.(path, items)
 		}, () => this.updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context));
 	}
 	async updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -49058,6 +49600,11 @@ var DynamoDBGlobalTableProvider = class {
 		const debug = log.debug;
 		debug(`Updating DynamoDB GlobalTable ${logicalId}: ${log.value(physicalId)}`);
 		refuseMalformedReplicaTags(properties, resourceType, logicalId, physicalId);
+		const disassociationRefusal = disassociationProtectionRefusal(properties, previousProperties, logicalId);
+		if (disassociationRefusal !== void 0) {
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(log.mask(disassociationRefusal), resourceType, logicalId, physicalId);
+			warn(`${disassociationRefusal} Proceeding: this update restores a recorded or read-back configuration.`);
+		}
 		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
 		const replaceRemedy = async () => {
 			let guardRegion = "";
@@ -49132,7 +49679,7 @@ var DynamoDBGlobalTableProvider = class {
 			const extractLocalTags = (props) => {
 				return localReplicaEntry(props, currentRegion)?.["Tags"];
 			};
-			if (tableArn) await this.applyTagDiff(tableArn, resourceType, logicalId, extractLocalTags(previousProperties), extractLocalTags(properties), maskSecrets);
+			if (tableArn) await this.applyTagDiff(tableArn, resourceType, logicalId, extractLocalTags(previousProperties), extractLocalTags(properties), maskSecrets, currentRegion);
 			const liveWarmByIndexName = /* @__PURE__ */ new Map();
 			for (const liveGsi of describeResp.Table?.GlobalSecondaryIndexes ?? []) {
 				const name = liveGsi.IndexName;
@@ -49336,7 +49883,10 @@ var DynamoDBGlobalTableProvider = class {
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
 				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings");
-				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
+				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) {
+					markUnsettled("GlobalSecondaryIndexes");
+					for (const indexUpdate of billingUpdate.GlobalSecondaryIndexUpdates) debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Update for index ${maskSecrets(indexUpdate.Update?.IndexName ?? "")} on ${physicalId} (with the billing mode change)`);
+				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
@@ -49460,6 +50010,7 @@ var DynamoDBGlobalTableProvider = class {
 				"streamTags"
 			] : context?.replayingState === true ? ["pitr"] : []);
 			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, replicaKeepOnRemoval, describeResp.Table?.LatestStreamArn, warn, maskSecrets);
+			await this.convergeReplicaDisassociationProtection(physicalId, logicalId, currentRegion, properties, previousProperties, context?.desiredFromAwsReadback === true ? "readback" : context?.replayingState === true ? "replay" : "template", warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -49483,6 +50034,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (!gsi.IndexName) continue;
 				const gsiUpdate = { Delete: { IndexName: gsi.IndexName } };
 				markUnsettled("GlobalSecondaryIndexes");
+				debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Delete for index ${maskSecrets(gsi.IndexName)} on ${physicalId}`);
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -49501,11 +50053,13 @@ var DynamoDBGlobalTableProvider = class {
 					...addedWarmToSend && { WarmThroughput: addedWarmToSend }
 				} };
 				markUnsettled("GlobalSecondaryIndexes");
+				debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Create for index ${maskSecrets(gsi.IndexName ?? "")} on ${physicalId}`);
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					AttributeDefinitions: newAttrs,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
 				}));
+				markAttemptedItems("GlobalSecondaryIndexes", [gsi.IndexName]);
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			for (const gsi of gsiDiff.modified) {
@@ -49542,6 +50096,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				const gsiUpdate = { Update: update };
 				markUnsettled("GlobalSecondaryIndexes");
+				debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Update for index ${maskSecrets(gsi.IndexName ?? "")} on ${physicalId}`);
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -49625,8 +50180,8 @@ var DynamoDBGlobalTableProvider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets) {
-		await this.applyTagDiffOnClient(this.dynamoDBClient, tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets);
+	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets, region) {
+		await this.applyTagDiffOnClient(this.dynamoDBClient, tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets, region);
 	}
 	async applyCrossRegionReplicaTagsDiff(tableArn, region, oldTags, newTags, resourceType, logicalId, physicalIdForLogs, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -49642,12 +50197,12 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			const regionalClient = this.getRegionalClient(region);
-			await this.applyTagDiffOnClient(regionalClient, replicaArn, resourceType, `${logicalId} (replica ${region})`, oldTags, newTags, maskSecrets);
+			await this.applyTagDiffOnClient(regionalClient, replicaArn, resourceType, `${logicalId} (replica ${region})`, oldTags, newTags, maskSecrets, region);
 		} catch (tagErr) {
 			warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalIdForLogs}: ${describeAwsFailure(tagErr).detail}. The replica's Tags state will surface as drift until the next successful deploy.`);
 		}
 	}
-	async applyTagDiffOnClient(client, tableArn, resourceType, id, oldTagsRaw, newTagsRaw, maskSecrets = (text) => text) {
+	async applyTagDiffOnClient(client, tableArn, resourceType, id, oldTagsRaw, newTagsRaw, maskSecrets = (text) => text, region) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, id);
 		if (tagWarning !== void 0) this.logger.warn(maskSecrets(tagWarning));
@@ -49669,6 +50224,15 @@ var DynamoDBGlobalTableProvider = class {
 				ResourceArn: tableArn,
 				Tags: tagsToAdd
 			}));
+			if (region !== void 0 && REGION_SEGMENT.test(region)) {
+				let recordedKeys;
+				try {
+					recordedKeys = /* @__PURE__ */ new Set([...planTagDiff(void 0, oldTagsRaw).set.keys()]);
+				} catch {
+					recordedKeys = void 0;
+				}
+				if (recordedKeys !== void 0) markAttemptedItems(`Replicas[${region}].Tags`, tagsToAdd.map((t) => t.Key).filter((key) => !recordedKeys.has(key)));
+			}
 			this.logger.debug(maskSecrets(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB GlobalTable ${tableArn}`));
 		}
 	}
@@ -50088,7 +50652,7 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
 		const live = await strictReadScope.run(names, () => this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties));
 		if (typeof live !== "object" || live === null) return live;
 		const out = { ...live };
@@ -50096,7 +50660,7 @@ var DynamoDBGlobalTableProvider = class {
 		const unnamed = [];
 		for (const name of names) {
 			if (!Object.hasOwn(out, name)) continue;
-			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed);
+			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed, attemptedItems);
 		}
 		for (const entry of unnamed.filter((e) => e.ambiguous === true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS has entries cdkd cannot key by an identity, so convergence keeps the recorded ${entry.path} rather than risk removing an entry neither the record nor the template declares. Check it with 'cdkd drift'.`);
 		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete).`);
@@ -50164,13 +50728,16 @@ var DynamoDBGlobalTableProvider = class {
 				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel, declaredReplica);
 				Object.assign(entry, subs);
 				let protection;
+				let disassociationProtection;
 				let streamArn;
 				if (isLocal) {
 					protection = table.DeletionProtectionEnabled;
+					disassociationProtection = table.DisassociationProtectionEnabled;
 					streamArn = table.LatestStreamArn;
 				} else try {
 					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
 					protection = regional.Table?.DeletionProtectionEnabled;
+					disassociationProtection = regional.Table?.DisassociationProtectionEnabled;
 					streamArn = regional.Table?.LatestStreamArn;
 				} catch (err) {
 					if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
@@ -50178,6 +50745,7 @@ var DynamoDBGlobalTableProvider = class {
 					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
 				}
 				if (typeof protection === "boolean") entry["DeletionProtectionEnabled"] = protection;
+				if (typeof disassociationProtection === "boolean" && declaredReplica?.[DISASSOCIATION_PROTECTION_KEY] !== void 0) entry[DISASSOCIATION_PROTECTION_KEY] = disassociationProtection;
 				await this.readReplicaPolicies(client, tableNameForSubs, regionLabel, replicaArn, streamArn, declaredReplica, afterOwnWrite, entry);
 				if (replicaArn) try {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
@@ -50573,6 +51141,46 @@ function refuseMalformedReplicaTags(properties, resourceType, logicalId, physica
 	});
 	return tagsByReplica;
 }
+const DISASSOCIATION_PROTECTION_KEY = "DisassociationProtectionEnabled";
+function disassociationProtectionRefusal(properties, previousProperties, logicalId) {
+	const replicas = properties["Replicas"];
+	if (!Array.isArray(replicas)) return void 0;
+	const malformed = [];
+	const singleRegion = [];
+	const multiRegion = isMultiRegionReplicaSet(properties);
+	replicas.forEach((entry, index) => {
+		const replica = asRecord(entry);
+		if (replica === void 0) return;
+		const refusal = configBooleanRefusal(replica, DISASSOCIATION_PROTECTION_KEY, `Replicas[${index}]`);
+		if (refusal !== void 0) {
+			malformed.push(refusal);
+			return;
+		}
+		const declared = readReplicaDisassociationProtection(replica);
+		if (declared === void 0 || multiRegion) return;
+		const region = replica["Region"];
+		const previous = previousProperties === void 0 || typeof region !== "string" ? void 0 : readReplicaDisassociationProtection(localReplicaEntry(previousProperties, region));
+		if (declared === false && declared !== previous) singleRegion.push(`Replicas[${index}].${DISASSOCIATION_PROTECTION_KEY}`);
+	});
+	const parts = [];
+	if (malformed.length > 0) parts.push(`${malformed.join("; ")}. That replica's disassociation protection is left as it is.`);
+	if (singleRegion.length > 0) parts.push(`${singleRegion.join(", ")} is applied by DynamoDB only to a replica of a multi-Region (MREC) global table, and this table's Replicas name a single Region, so cdkd does not send it. Remove ${DISASSOCIATION_PROTECTION_KEY}, or add a replica in another Region.`);
+	if (parts.length === 0) return void 0;
+	return `AWS::DynamoDB::GlobalTable ${logicalId}: ${parts.join(" ")}`;
+}
+function isMultiRegionReplicaSet(properties) {
+	const replicas = properties["Replicas"];
+	if (!Array.isArray(replicas)) return false;
+	const regions = /* @__PURE__ */ new Set();
+	for (const entry of replicas) {
+		const region = asRecord(entry)?.["Region"];
+		if (typeof region === "string" && region !== "") regions.add(region);
+	}
+	return regions.size > 1;
+}
+function readReplicaDisassociationProtection(replica) {
+	return coerceCfnBoolean(replica?.[DISASSOCIATION_PROTECTION_KEY]);
+}
 function completeLegacyLocalReplica(baseline, aws, localRegion) {
 	const key = "Replicas";
 	const baselineReplicas = baseline[key];
@@ -51801,6 +52409,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: replaceDecision.provisionedBy
 	};
+	clearCreatedReport();
 	engine.recordInlinePolicyWrite(logicalId, "create");
 	await establishNoEchoEchoFidelity(engine.noEchoRun, engine.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
 	engine.observedCapture.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
@@ -51878,6 +52487,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	const changedForProvider = new Set(changedProperties);
 	for (const key of /* @__PURE__ */ new Set([...Object.keys(previousWithNoEchoHeld), ...Object.keys(previousForUpdate)])) if (keyOrderFreeJson(previousForUpdate[key]) !== keyOrderFreeJson(previousWithNoEchoHeld[key])) changedForProvider.add(key);
 	const unsettled = unsettledPropertiesOf(currentResource);
+	const unsettledItems = unsettledItemsOf(currentResource);
 	if (changedForProvider.size === 0) for (const key of /* @__PURE__ */ new Set([...Object.keys(updateProps), ...Object.keys(previousForUpdate)])) changedForProvider.add(key);
 	if (reattached !== void 0) engine.logger.info(safeMsg`  ${logicalId} (${resourceType}) lost its attachment to ${reattached.parents.join(", ")}, which this deploy re-created under the same name: attaching it again`);
 	if (droppedPrincipalKinds.length > 0) {
@@ -51895,7 +52505,8 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 		...unsettledIdentity,
 		names: unsettled,
 		previous: previousForUpdate,
-		desired: updateProps
+		desired: updateProps,
+		attemptedItems: unsettledItems
 	});
 	if (unsettled.has("Tags")) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): an earlier failed update left Tags unsettled. cdkd re-applies the template's tags and removes only the recorded ones the template dropped; a tag that failed update added and no template declares is left on the resource. Remove it by hand if it should not be there.`);
 	const removal = prepareRemovalForUpdate(updateProvider, resourceType, updateProps, previousSettled);
@@ -51925,10 +52536,23 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				}
 				marks.add(propertyName);
 			},
-			...unsettled.size > 0 && { unsettledProperties: unsettled }
+			markAttempted: (path, items) => {
+				if (typeof path !== "string" || path === "") return;
+				let byPath = engine.unsettledItemMarks.get(logicalId);
+				if (byPath === void 0) {
+					byPath = /* @__PURE__ */ new Map();
+					engine.unsettledItemMarks.set(logicalId, byPath);
+				}
+				const names = byPath.get(path) ?? /* @__PURE__ */ new Set();
+				for (const item of items) if (typeof item === "string" && item !== "") names.add(item);
+				byPath.set(path, names);
+			},
+			...unsettled.size > 0 && { unsettledProperties: unsettled },
+			...unsettledItems.size > 0 && { unsettledItems }
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) engine.replacementRun.updatesThatSentNothing.add(logicalId);
 		engine.unsettledMarks.delete(logicalId);
+		engine.unsettledItemMarks.delete(logicalId);
 		if (result.wasReplaced === true && result.outcome === "partial") engine.replacementRun.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
 		result = withoutInjectedRemovals(result, removal.injected);
 		const unhandledByCause = splitUnhandledRemovals(removal.unhandled, previousForUpdate, unsettled);
@@ -52114,6 +52738,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				generation: fallbackGeneration
 			}, replaceFallback));
 			engine.unsettledMarks.delete(logicalId);
+			engine.unsettledItemMarks.delete(logicalId);
 			result = fallbackOutcome.result;
 			resultProvisionedBy = fallbackOutcome.provisionedBy;
 			captureProvider = fallbackOutcome.captureProvider;
@@ -52137,7 +52762,8 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	const stillUnsettled = result.wasReplaced ? [] : await unsettledAfterUpdate({
 		...unsettledIdentity,
 		names: unsettled,
-		desired: updateProps
+		desired: updateProps,
+		attemptedItems: unsettledItems
 	});
 	if (stillUnsettled.length > 0) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): the update succeeded, but AWS does not yet show the template's ${stillUnsettled.join(", ")}; cdkd keeps ${stillUnsettled.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
 	engine.replacementRun.updateWasReplaced.set(logicalId, result.wasReplaced === true);
@@ -52176,12 +52802,16 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
-		...stillUnsettled.length > 0 && { unsettledProperties: stillUnsettled },
+		...stillUnsettled.length > 0 && {
+			unsettledProperties: stillUnsettled,
+			...unsettledItemsField(currentResource, stillUnsettled)
+		},
 		...keepsParameterRefusal && {
 			observedBaselineRefused: true,
 			observedBaselineRefusalReason: "unverifiable-parameter"
 		}
 	};
+	clearCreatedReport();
 	if (updatePartialReason(result) === void 0) engine.recordInlinePolicyWrite(logicalId, "update");
 	if (keepsParameterRefusal) engine.logger.debug(safeMsg`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
 	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await buildObservedCaptureSiblings({
@@ -52834,6 +53464,8 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 			unwritten,
 			routeDriving: findActionableSilentDrops(resourceType, desiredForSkipCheck, allowedForRecord, currentProps).map(({ property }) => property),
 			nested: engine.options.parentStackInfo !== void 0,
+			nowWritten: findHandledUnwrittenCreateOnly(resourceType, currentProps, createOnlyEvidence),
+			evidence: [...createOnlyEvidence],
 			protectionEvidence: recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, engine.stackRegion)
 		}), "CREATE_ONLY_DROP_NEEDS_REPLACEMENT")));
 	}
@@ -52945,13 +53577,34 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 }
 function unwrittenCreateOnlyRefusal(input) {
 	const { logicalId, resourceType, unwritten, routeDriving, nested, protectionEvidence } = input;
+	const nowWritten = (input.nowWritten ?? []).filter((property) => unwritten.includes(property));
+	if (nowWritten.length > 0) return nowWrittenCreateOnlyRefusal({
+		...input,
+		nowWritten
+	});
 	const one = unwritten.length === 1;
 	const list = unwritten.join(", ");
 	const keep = [.../* @__PURE__ */ new Set([...unwritten, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
-	const replaceFlags = nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
+	const replaceFlags = unwrittenReplaceFlags(logicalId, nested);
 	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
 	return safeMsg`${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the ` + `state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through ` + safeMsg`Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only ` + `property means replacing the resource, which cdkd does not do on its own. This ` + safeMsg`resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a ` + `stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? safeMsg` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + safeMsg` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
 }
+function unwrittenReplaceFlags(logicalId, nested) {
+	return nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
+}
+function nowWrittenCreateOnlyRefusal(input) {
+	const { logicalId, resourceType, unwritten, routeDriving, nested, protectionEvidence } = input;
+	const nowWritten = input.nowWritten;
+	const one = unwritten.length === 1;
+	const list = unwritten.join(", ");
+	const written = nowWritten.join(", ");
+	const writtenOne = nowWritten.length === 1;
+	const stillDropped = unwritten.filter((property) => !nowWritten.includes(property));
+	const keep = [.../* @__PURE__ */ new Set([...stillDropped, ...routeDriving])].filter((property) => !nowWritten.includes(property)).sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
+	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
+	const replaceFlags = unwrittenReplaceFlags(logicalId, nested);
+	return safeMsg`${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the ` + `state record holds ${one ? "it" : "them"} although the SDK provider that built the resource did not write ${one ? "it" : "them"} (an earlier deploy accepted dropping ${one ? "it" : "them"} with --prefer-sdk-route), so AWS does not. ` + safeMsg`This cdkd version's SDK provider writes ${written}, so no flag keeps ` + `${writtenOne ? "it" : "them"} dropped any more` + (routed.length > 0 ? safeMsg`, and this deploy routes the resource through Cloud Control (--prefer-sdk-route does not cover ${routed})` : "") + "; applying a create-only property means replacing the resource, which cdkd does not do on its own. This " + safeMsg`resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a ` + `stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? safeMsg` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + safeMsg` To keep the resource as it is, remove ${written} from the template` + (keep.length > 0 ? safeMsg` and re-run with --prefer-sdk-route ${keep}.` : ".") + (nested || stillDropped.length > 0 || (input.evidence ?? []).some((property) => !nowWritten.includes(property)) ? "" : safeMsg` If AWS already holds ${written} (cdkd drift compares it), re-record the ` + safeMsg`resource instead: cdkd import with --resource '${logicalId}=PHYSICAL_ID' (its physical ` + `id, quoted) and --force writes a record without this evidence and changes nothing in AWS.`);
+}
 function scalarLeavesOf(value, into = /* @__PURE__ */ new Set()) {
 	if (typeof value === "string") into.add(value);
 	else if (typeof value === "number") into.add(String(value));
@@ -53038,7 +53691,7 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 	let nestedChildUnaddressed;
 	const deleteGuards = [];
 	try {
-		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(async () => {
+		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(trackInFlightBody(engine, logicalId, async () => {
 			try {
 				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => provisionResourceBody(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
 				deleteSkipped = bodyResult?.deleteSkipped;
@@ -53070,7 +53723,7 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 					reason: guard.reason
 				});
 			}
-		}, {
+		}), {
 			warnAfterMs,
 			timeoutMs,
 			onWarn: (elapsedMs) => {
@@ -53148,6 +53801,17 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 		renderer.removeTask(logicalId);
 	}
 }
+function trackInFlightBody(engine, logicalId, body) {
+	return () => {
+		const running = body();
+		const entry = running.then(() => true, () => false);
+		engine.inFlightBodies.set(logicalId, entry);
+		entry.then(() => {
+			if (engine.inFlightBodies.get(logicalId) === entry) engine.inFlightBodies.delete(logicalId);
+		});
+		return running;
+	};
+}
 async function provisionResourceBody(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const loadJournal = () => engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion);
 	const priorAttempts = priorAttemptLookup(logicalId, async () => priorAttemptsInJournal(await loadJournal(), logicalId, change.resourceType), async () => provenOrphanIdsInJournal(await loadJournal(), logicalId, change.resourceType));
@@ -53183,6 +53847,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	};
 	const completedOperations = [];
 	const failedOperations = [];
+	const reportedCreatesToSettle = [];
 	let pendingMigration = migrationPending;
 	const phaseScope = phaseScopeForStack(stackName, engine.stackRegion);
 	let saveChain = Promise.resolve();
@@ -53200,7 +53865,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			const savedFor = savedIds.join(", ");
 			try {
 				const partialState = {
-					version: 14,
+					version: 15,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -53317,9 +53982,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					settle
 				});
 				let succeeded = false;
+				const createdSink = new CreatedResourceSink(logicalId, change.resourceType);
 				try {
 					try {
-						await timePhase(phaseScope, `resource ${change.changeType.toLowerCase()}`, () => provisionResource(engine, logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress), `${logicalId} ${change.resourceType}`);
+						await timePhase(phaseScope, `resource ${change.changeType.toLowerCase()}`, () => collectCreatedResources(createdSink, () => provisionResource(engine, logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress)), `${logicalId} ${change.resourceType}`);
 						settledUpdates.add(logicalId);
 						succeeded = true;
 					} finally {
@@ -53334,10 +54000,11 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					const attemptedGeneration = change.changeType === "UPDATE" && !refused && !isReplacementNameRefusal(provisionError, logicalId) ? engine.replacementRun.attemptedNameGeneration.get(logicalId) : void 0;
 					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
 					if (refused && change.changeType === "CREATE" && statePhysicalId === void 0) throw provisionError;
-					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
+					const markedCreatedId = createdBeforeFailure(provisionError, logicalId, change.resourceType);
+					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? markedCreatedId : void 0;
 					const heldRecord = newResources[logicalId] ?? previousState;
 					const replaced = change.changeType === "UPDATE" && !NO_REPLACEMENT_ORPHAN_TYPES.has(change.resourceType) && statePhysicalId !== void 0 && statePhysicalId !== "" && heldRecord?.physicalId === statePhysicalId ? heldRecord : void 0;
-					const replacementCreatedId = replaced ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
+					const replacementCreatedId = replaced ? markedCreatedId : void 0;
 					const orphanedBy = replaced !== void 0 && replacementCreatedId !== void 0 && replacementCreatedId !== replaced.physicalId ? {
 						record: replaced,
 						createdId: replacementCreatedId
@@ -53373,34 +54040,17 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					if (attemptedGeneration !== void 0 && heldNow !== void 0) newResources[logicalId] = withNameGenerationReached(heldNow, logicalId, attemptedGeneration);
 					let replacementOrphanOp;
 					if (orphanedBy !== void 0) {
-						replacementOrphanOp = {
-							logicalId,
-							changeType: "CREATE",
-							resourceType: change.resourceType,
-							provisionedBy: "sdk",
-							physicalId: orphanedBy.createdId,
-							physicalIdRecoveredFromError: true,
-							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy),
-							replacedPhysicalId: orphanedBy.record.physicalId,
-							replacedResourceType: orphanedBy.record.resourceType,
-							...engine.replacementRun.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
-							...!refused && { attemptedProperties: engine.attemptedResolvedProps.get(logicalId) }
-						};
+						replacementOrphanOp = replacementOrphanOpFor(engine, template, logicalId, change.resourceType, orphanedBy.record, orphanedBy.createdId, refused);
 						failedOperations.push(replacementOrphanOp);
 					}
+					if (markedCreatedId === void 0 && (change.changeType === "CREATE" && statePhysicalId === void 0 || replaced !== void 0) && deadlineFiredFor(provisionError, logicalId)) reportedCreatesToSettle.push({
+						sink: createdSink,
+						failedOp,
+						...replaced !== void 0 && { replaced },
+						refused
+					});
 					const orphanOp = createdId !== void 0 ? failedOp : replacementOrphanOp;
-					if (orphanOp?.physicalId !== void 0 && orphanOp.deletionPolicy !== "Retain" && orphanNeedsIdentity(orphanOp)) {
-						const markedIdentity = createdResourceIdentityBeforeFailure(provisionError, logicalId, change.resourceType);
-						if (markedIdentity !== void 0) orphanOp.createdResourceIdentity = markedIdentity;
-						else if (engine.interruptCause !== "user") {
-							const identity = await readResourceIdentity(engine.providerRegistry, {
-								resourceType: orphanOp.resourceType,
-								physicalId: orphanOp.physicalId,
-								provisionedBy: orphanOp.provisionedBy
-							}, engine.stackRegion);
-							if (typeof identity === "string") orphanOp.createdResourceIdentity = identity;
-						}
-					}
+					if (orphanOp !== void 0) await journalOrphanIdentity(engine, orphanOp, createdResourceIdentityBeforeFailure(provisionError, logicalId, change.resourceType));
 					throw provisionError;
 				}
 				completedOperations.push({
@@ -53551,9 +54201,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				engine.logger.warn(safeMsg`  ⚠ ${lost.logicalId} (${childType}) was removed from a resource this deploy re-created under the same id, and the deploy failed before writing it again: the next deploy writes it there again (its record keeps only the holders it is still on).`.concat(mayStillBeLive));
 			}
 		}
+		await settleReportedCreates(engine, template, failedOperations, reportedCreatesToSettle);
 		try {
 			const preRollbackState = {
-				version: 14,
+				version: 15,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -53594,7 +54245,15 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			engine.logger.warn(safeMsg`Partial state has been saved. ${recoveryHint(engine.rollbackDeps(), "Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.")}`);
 		} else {
 			autoRollbackJournaled = await writeRollbackJournalSegment(engine.rollbackDeps(), stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-			const rollbackResult = await performRollback(engine.rollbackDeps(), completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? []);
+			const rollbackResult = await performRollback(engine.rollbackDeps(), completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? [], {
+				runMarks: (logicalId) => ({
+					names: engine.unsettledMarks.get(logicalId) ?? /* @__PURE__ */ new Set(),
+					items: engine.unsettledItemMarks.get(logicalId) ?? /* @__PURE__ */ new Map()
+				}),
+				stillRunning: (logicalId) => engine.inFlightBodies.get(logicalId),
+				recordMarks: (logicalId) => recordUnsettledMarks(engine, newResources, logicalId),
+				onReverted: (logicalId, settled) => dropUnsettledMarks(engine, logicalId, settled)
+			});
 			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0 && !rollbackResult.interrupted;
 			if (rollbackResult.interrupted && rollbackResult.failures === 0 && rollbackResult.skipped === 0) {
 				const remedy = autoRollbackJournaled ? recoveryHint(engine.rollbackDeps(), "The rollback journal keeps them; finish the rollback with: " + pasteableCommand("cdkd rollback", [{
@@ -53619,7 +54278,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		recordUnsettledMarks(engine, newResources);
 		try {
 			const postRollbackState = {
-				version: 14,
+				version: 15,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -53642,7 +54301,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 				recordUnsettledMarks(engine, newResources);
 				const postRollbackState = {
-					version: 14,
+					version: 15,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -53679,7 +54338,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	}
 	return {
 		state: {
-			version: 14,
+			version: 15,
 			region: engine.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
@@ -53698,7 +54357,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 }
 async function persistStateAfterOutputFailure(engine, stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 14,
+		version: 15,
 		region: engine.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -53737,6 +54396,73 @@ function recordUnsettledMarks(engine, newResources, only) {
 		if (only !== void 0 && logicalId !== only) continue;
 		if (marks.size === 0 || !Object.hasOwn(newResources, logicalId)) continue;
 		newResources[logicalId] = withUnsettledProperties(newResources[logicalId], marks);
+		const items = engine.unsettledItemMarks.get(logicalId);
+		if (items !== void 0 && items.size > 0) newResources[logicalId] = withUnsettledItems(newResources[logicalId], items);
+	}
+}
+function dropUnsettledMarks(engine, logicalId, names) {
+	const marks = engine.unsettledMarks.get(logicalId);
+	if (marks !== void 0) for (const name of names) marks.delete(name);
+	const items = engine.unsettledItemMarks.get(logicalId);
+	if (items !== void 0) {
+		for (const path of [...items.keys()]) if (names.has(unsettledItemsTopKey(path))) items.delete(path);
+	}
+}
+function deadlineFiredFor(error, logicalId) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 5 && typeof current === "object" && current !== null; depth++) {
+			if (current instanceof ResourceTimeoutError) return current.logicalId === logicalId;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+async function settleReportedCreates(engine, template, failedOperations, pending) {
+	for (const { sink, failedOp, replaced, refused } of pending) {
+		const report = sink.report;
+		if (report === void 0) continue;
+		let orphanOp;
+		if (replaced === void 0) {
+			failedOp.provisionedBy = "sdk";
+			failedOp.physicalId = report.physicalId;
+			failedOp.physicalIdRecoveredFromError = true;
+			failedOp.deletionPolicy = journaledOrphanPolicy(extractTemplateAttributes(template, failedOp.logicalId).deletionPolicy);
+			orphanOp = failedOp;
+		} else {
+			if (report.physicalId === replaced.physicalId) continue;
+			failedOp.replacementOrphaned = engine.replacementRun.oldDeletedBeforeCreate.has(failedOp.logicalId) ? "delete-first" : "create-first";
+			orphanOp = replacementOrphanOpFor(engine, template, failedOp.logicalId, failedOp.resourceType, replaced, report.physicalId, refused);
+			failedOperations.push(orphanOp);
+		}
+		await journalOrphanIdentity(engine, orphanOp, report.createdResourceIdentity);
+	}
+}
+function replacementOrphanOpFor(engine, template, logicalId, resourceType, record, createdId, refused) {
+	return {
+		logicalId,
+		changeType: "CREATE",
+		resourceType,
+		provisionedBy: "sdk",
+		physicalId: createdId,
+		physicalIdRecoveredFromError: true,
+		deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy),
+		replacedPhysicalId: record.physicalId,
+		replacedResourceType: record.resourceType,
+		...engine.replacementRun.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
+		...!refused && { attemptedProperties: engine.attemptedResolvedProps.get(logicalId) }
+	};
+}
+async function journalOrphanIdentity(engine, orphanOp, carried) {
+	if (orphanOp.physicalId === void 0 || orphanOp.deletionPolicy === "Retain" || !orphanNeedsIdentity(orphanOp)) return;
+	if (carried !== void 0) orphanOp.createdResourceIdentity = carried;
+	else if (engine.interruptCause !== "user") {
+		const identity = await readResourceIdentity(engine.providerRegistry, {
+			resourceType: orphanOp.resourceType,
+			physicalId: orphanOp.physicalId,
+			provisionedBy: orphanOp.provisionedBy
+		}, engine.stackRegion);
+		if (typeof identity === "string") orphanOp.createdResourceIdentity = identity;
 	}
 }
 
@@ -53780,7 +54506,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		clock.lap("state load");
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 14,
+			version: 15,
 			region: engine.stackRegion,
 			stackName,
 			resources: {},
@@ -54083,7 +54809,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					await resolveStackInstanceId();
 					try {
 						const refreshedState = {
-							version: 14,
+							version: 15,
 							region: engine.stackRegion,
 							stackName: currentState.stackName,
 							resources: currentState.resources,
@@ -54372,6 +55098,8 @@ var DeployEngine = class {
 	outputsRun = new OutputsRunState();
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	unsettledMarks = /* @__PURE__ */ new Map();
+	unsettledItemMarks = /* @__PURE__ */ new Map();
+	inFlightBodies = /* @__PURE__ */ new Map();
 	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
@@ -54565,6 +55293,7 @@ var DeployEngine = class {
 		this.replacementRun = new ReplacementRunState();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.unsettledMarks = /* @__PURE__ */ new Map();
+		this.unsettledItemMarks = /* @__PURE__ */ new Map();
 		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
@@ -54769,5 +55498,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { computeImplicitDeleteEdges as $, coerceParameterTypedValue as $a, DYNAMIC_REFERENCE_TOKEN_SCAN as $c, applyCustomResourceResponseExpiration as $i, stringifyValue as $l, WITHHELD_NAME_DISPLAY as $n, refuseMalformedOrphanRecords as $o, noEchoExactEchoLeavesOf as $r, readConfigString as $s, lookupEachName as $t, MIGRATE_TMP_PREFIX as $u, beginDeleteWait as A, s3BucketRegionalDomainName as Aa, valueAtCoordinate as Ac, isRefusedByName as Ai, isAccessDenied$1 as Al, resolveReplacementOldType as An, isReadableResourceEntry as Ao, awaitInFlightSibling as Ar, withheldAccountClause as As, displacedOpClause as At, redactedDockerCause as Au, waitForIndexesSettled as B, assertFlagRoleArn as Ba, logOnlyValueCount as Bc, stringifyIfAssigned as Bi, hasUnverifiableParameterRefusal as Bl, updatePartialMessage as Bn, malformedOrphansRefusalMessage as Bo, yellow as Br, isStatefulRecreateTargetForReplace as Bs, getCurrentNestedStackContext as Bt, loadCdkJson as Bu, planContributorInsightsOp as C, withoutUnsettledProperties as Ca, noEchoCoordinatesOf as Cc, resolveAssemblyPath as Cd, ledgerForStack as Ci, isLockInfoExpired as Cl, isJournaledOrphan as Cn, accountArgs as Co, rollbackOrphanIds as Cr, repairMalformedOutputsForReadOnly as Cs, makeSiblingClaimReader as Ct, formatDockerLoginError as Cu, reverseMapTableContributorInsights as D, s3BucketArn as Da, readbackPathFor as Dc, resolveBucketRegion as Dd, DeploymentEventsReader as Di, CrossPrefixScanCache as Dl, recheckFailedPlan as Dn, hasReadableOutputs as Do, mappingPairs as Dr, unpreviewableOrphanRecords as Ds, keptForRetainedRecord as Dt, partitionSensitiveEnv as Du, reverseMapIndexContributorInsights as E, isSettledInstanceState as Ea, passedNoEchoParametersOf as Ec, clearBucketRegionCache as Ed, acquireIdempotencyToken as Ei, CrossPrefixReadError as El, planRollback as En, hasReadableOrphans as Eo, looselyEqual as Er, repairMalformedResourcesForReadOnly as Es, resolvePendingCloudControlRequests as Et, isMalformedEnvKey as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, keepHeldTokenProvenance as Fa, snapshotPassProvenance as Fc, readTagList as Fi, acceptedCreateOnlyDropsOf as Fl, inheritProducerRegions as Fn, malformedLocalResourceEntriesWarning as Fo, bold as Fr, NO_CC_HANDLERS_REASON as Fs, recordDisplacedSkips as Ft, getDockerImageBySourceHash as Fu, sendTtlWaitingOutRateLimit as G, AWS_CREDENTIAL_ENV_KEYS as Ga, unionOfSecretBags as Gc, wouldReturnToSdkProvider as Gi, orphansCarriedFrom as Gl, retiredAfterRollback as Gn, malformedResourceEntriesWarning as Go, removeSuperseded as Gr, isWarmThroughputDecrease as Gs, isHandledOrphan as Gt, resolveStateBucketWithDefault as Gu, isTtlRateLimited as H, explicitRoleArnOrThrow as Ha, recordLogOnlyParameterValue as Hc, ProviderRegistry as Hi, importableOutputs as Hl, nameGenerationCarriedFrom as Hn, malformedOutputsRefusalMessage as Ho, deleteSupersededEntry as Hr, renderStatefulReason as Hs, deleteJournaledOrphans as Ht, resolveAutoAssetStorage as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, outputReferenceProvenanceOf as Ia, carryLogOnlyValues as Ic, refuseMalformedDesiredTags as Ii, describeRegionValueKind as Il, REDACTED_DELETE_ADDRESS_SKIP_REASON as In, malformedLocalResourcesWarning as Io, cyan as Ir, hasNoCloudControlHandlers as Is, revertNestedChildFromJournal as It, Synthesizer as Iu, hasCdkAutoDeleteTag as J, envCredentialsAreAssumedRole as Ja, maskSecretsInError as Jc, readsNoEchoDeleteValues as Ji, PhaseClock as Jl, withNameGenerationReached as Jn, malformedScrubResourceEntriesRefusalMessage as Jo, supersededHolderOf as Jr, coerceCfnBoolean as Js, makeForeignHolderScan as Jt, stateBucketExistenceConfirmed as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, applyCallerIdentityCredentials as Ka, createSecretMasker as Kc, waitForLambdaFunctionActive as Ki, shouldRetainResource as Kl, retiredNameGenerationsAfter as Kn, malformedResourcePropertiesWarning as Ko, supersededAfterRollback as Kr, toCfnInteger as Ks, journaledOrphanLines as Kt, resolveStateBucketWithDefaultAndSource as Ku, deleteTableWithIndexBusyRetry as L, recordedOutputReferenceRegions as La, createUnionSecretMasker as Lc, tagMapAsList as Li, exportNamesCarriedFrom as Ll, isRedactedRecordedValue as Ln, malformedOrphanRecordsRefusalMessage as Lo, gray as Lr, findReplacedReadersOfRecreateTargets as Ls, revertedNestedRowIds as Lt, synthesisStatusMessage as Lu, deleteBudgetKey as M, resolveDynamicReferences as Ma, markSameGenerationBag as Mc, DBPROXY_TAGS_WHAT as Mi, stackInstanceIdOf as Ml, orphanNeedsIdentity as Mn, malformedExportNamesWarning as Mo, getStackRecords as Mr, findSilentDropProperties as Ms, dropSettledNestedJournals as Mt, runDockerStreaming as Mu, resolveDynamoDbDeleteBudgetClock as N, producerLookupOver as Na, redactForState as Nc, DBPROXY_TAG_OPTIONS as Ni, withStackInstanceIdWithheld as Nl, findNestedStackTypeChanges as Nn, malformedExportSourceWarning as No, withStackRecords as Nr, unwrittenCreateOnlyReplacement as Ns, getNestedRevertRun as Nt, warnFinchArgvExposure as Nu, stripIndexContributorInsights as O, s3BucketDomainName as Oa, readsNoEchoSource as Oc, DeploymentEventsStore as Oi, applyCrossPrefixScan as Ol, recordUnderIdIsNotOwn as On, hasReadableResources as Oo, parseMappingFile as Or, unreadableOrphanRecords as Os, recordRetainedForReadoption as Ot, redactDockerArgvValues as Ou, resolveDynamoDbDeleteBudgetMs as P, refuseUnreadableCdkCrossAccountRefs as Pa, recordReferenceProvenanceEntry as Pc, planTagDiff as Pi, splitImportedOps as Pl, getCurrentProducerRegions as Pn, malformedLocalOutputsWarning as Po, replacedDeleteFailureVerdict as Pr, withoutSilentDropProperties as Ps, nestedChildStackName as Pt, AssetManifestLoader as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, regionLessSecretName as Qa, withoutPhysicalNameCopies as Qc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Qi, isSensitiveAttributeName as Ql, resourcesNamingDeclaredParameter as Qn, refuseMalformedNestedChildOutputs as Qo, noEchoComparisonForTemplate as Qr, configStringRefusal as Qs, isAccessDeniedError as Qt, CFN_TEMPLATE_URL_LIMIT as Qu, maskedLogger as R, recordedReferenceRegions as Ra, hasMaskableValues as Rc, tagPlanWarning as Ri, hasReadableExportSet as Rl, redactedDeleteAddressFields as Rn, malformedOrphanRecordsWarning as Ro, green as Rr, shownType as Rs, withNestedRevertRun as Rt, getDefaultStateBucketName as Ru, indexDeclaresContributorInsights as S, withUnsettledProperties as Sa, maskedLeafCoordinatesOf as Sc, renderAssemblyPathEscape as Sd, earliestDefined as Si, LockManager as Sl, demoteSupersededOrphans as Sn, UNREADABLE_RESOURCES_MAP_ROW as So, movedToHint as Sr, repairMalformedOrphansForReadOnly as Ss, makeCanonicalizePropertiesFn as St, finchSecretArgvRefusal as Su, readContributorInsightsSpec as T, poisonRenderedSpellingsCollidingIn as Ta, noEchoOutputsComparison as Tc, injectedAwsRegionValue as Td, withCreateTokenLedger as Ti, rebuildClientForBucketRegion as Tl, planFailedOps as Tn, displayLogicalId as To, isPairableType as Tr, repairMalformedResourcePropertiesForReadOnly as Ts, pendingRequestCount as Tt, isDockerClientEnvKey as Tu, planTimeToLive as U, isIamRoleArn as Ua, recordLogOnlyValue as Uc, ccBrokenReason as Ui, isReadableBag as Ul, nameGenerationHighWaterOf as Un, malformedOutputsWarning as Uo, holdsSupersededResources as Ur, WARM_THROUGHPUT_MEMBERS as Us, dropFailedCommands as Ut, resolveCaptureObservedState as Uu, isTtlAlreadyDisabled as V, assertSendableRoleArn as Va, printingCorpusOf as Vc, CC_BROKEN_REASON as Vi, importableOutputKeys as Vl, updatePartialReason as Vn, malformedOrphansWarning as Vo, addSuperseded as Vr, isStatefulRecreateTargetSync as Vs, withNestedStackContext as Vt, resolveApp as Vu, readTtlSpec as W, sendableAssumeRoleCommand as Wa, shareLogOnlyValues as Wc, isCustomResource as Wi, orphansAfterRollback as Wl, nameScopeOf as Wn, malformedRenderedContainersWarning as Wo, isSupersededResourceRecord as Wr, coerceWarmThroughput as Ws, dropFailedHint as Wt, resolveSkipPrefix as Wu, getPriorAttempts as X, classifyReplaySecretRegion as Xa, scrubResourceRecord as Xc, getCurrentResourceSecrets as Xi, timePhase as Xl, namesAnyDeclaredParameter as Xn, previewableOrphanRecords as Xo, withoutSuperseded as Xr, configBooleanRefusal as Xs, formatResourceLine as Xt, ssmResolvedValueType as Xu, isTruthyCfnBoolean as Y, classifyRecordedSecretRegion as Ya, maskSecretsInText as Yc, isCustomResourceType as Yi, renderPhaseTimings as Yl, computeParameterTaint as Yn, malformedStateRefusalMessage as Yo, supersededResourcesOf as Yr, coerceCfnInteger as Ys, sameJournaledOrphans as Yt, warnDeprecatedNoPrefixCliFlag as Yu, markRefusedBeforeApplying as Z, producerRegionsFromState as Za, withPhysicalNameCopies as Zc, withPrintingSecrets as Zi, AssetPublisher as Zl, reachableDivergentParameters as Zn, refuseDivergentRecordRegionForDestroy as Zo, noEchoAttributeNamesOf as Zr, configIntegerRefusal as Zs, chunks as Zt, CFN_TEMPLATE_BODY_LIMIT as Zu, streamMemberRefusals as _, reDisableInstanceApiTermination as _a, canonicalCoordinates as _c, nullPrototypeRecord as _d, createPreDeleteFinalSnapshot as _i, recordNoEchoParameterFreshValue as _l, withUnprovenUnsettled as _n, declaresNoEcho as _o, constructPathOf as _r, refuseMalformedResourcesForDeploy as _s, withResourceDeadline as _t, resolveDockerContextDirectory as _u, isProtectionValueActive as a, RollbackInlinePolicyWriters as aa, templateResourceTypes as ac, PARTITION_TABLE as ad, namingSecretsWithRecordedNoEcho as ai, inheritNestedStackParameterAssociations as al, refuseRefactorMarker as an, carriesFetchableDynamicReference as ao, carriedExportAliasExposure as ar, refuseMalformedOutputsForDestroy as as, childTemplateLoader as at, AssetModeResolver as au, CONTRIBUTOR_INSIGHTS_KEY as b, INTRINSIC_KEYS as ba, maskReadbackAtCoordinates as bc, describeFileReadFailure as bd, refusesFinalSnapshot as bi, WHOLE_DYNAMIC_REFERENCE_PATTERN as bl, equalModuloMask as bn, STATE_RESOURCES_MALFORMED as bo, findRefactorHints as br, refuseMalformedState as bs, keptWholeReasonText as bt, describeDockerFailure as bu, DynamoDBGlobalTableProvider as c, deleteLeftInPlace as ca, blockDeviceMappingsDifferOnlyInDeleteOnTermination as cc, AssemblyReader as cd, secretNamePrintingBags as ci, physicalNameCopiesOf as cl, hasPendingMovesOut as cn, AWS_NO_VALUE as co, isWholeDynamicReferenceValue as cr, refuseMalformedResourceEntriesForDeploy as cs, listNestedTemplateRows as ct, ensureAssetStorage as cu, declaredStreamPolicyMember as d, isWaitAbandonedError as da, emrClusterInstancesReplaced as dc, describeJsonParseFailure as dd, stateSecretNameNeedles as di, splitGetAttStringForm as dl, refusePendingMovesOut as dn, lacksRecordedTableArn as do, collectPublishedOutputNames as dr, refuseMalformedResourceEntriesForImportSave as ds, conditionFingerprint as dt, parseBootstrapMarker as du, customResourceResponseExpirationWarning as ea, replayWarn as ec, findLargeInlineResources as ed, noEchoParameterNamesOf as ei, dynamicReferenceTokens as el, withApiLimit as en, isUnboundTemplateParameter as eo, displayTextOrWithheld as er, refuseMalformedOrphanRecordsForDestroy as es, crossStackOutputProvenanceSource as et, WorkGraph as eu, declaredStreamTagsMember as f, markWaitAbandoned as fa, canonicalLambdaFunctionName as fc, parseFailureDebugDetail as fd, storedSecretNameNeedles as fi, carriesSecretMask as fl, replayFailedOperations as fn, refStateLookupFromResource as fo, isExportAliasCollision as fr, refuseMalformedResourceEntriesForOrphan as fs, conditionInputsFrom as ft, readBootstrapMarkerBody as fu, streamDeclaresTags as g, observeThenDisableInstanceApiTermination as ga, TemplateParser as gc, hasPlainPrototype$1 as gd, ccRoutedFinalSnapshotError as gi, recordNoEchoAttributeValues as gl, settleUnsettledPrevious as gn, passedParameterClassesOf as go, maskingRetryLogger as gr, refuseMalformedResourcePropertiesForOrphan as gs, enclosingDeadlineRemainingMs as gt, buildDockerImage as gu, streamDeclaresPolicy as h, isTerminationProtectionPropagationError as ha, DagBuilder as hc, hasOwnKey as hd, buildFinalSnapshotIdentifier as hi, recordMaskOnlyValuesIn as hl, recordAfterRollbackUpdate as hn, parameterInputsFor as ho, DEFAULT_RESOURCE_WARN_AFTER_MS as hr, refuseMalformedResourcePropertiesForExport as hs, enclosingDeadlineExpired as ht, buildDenyExternalAccessPolicy as hu, PROTECTION_PROPERTY_BY_TYPE as i, unchangedBehindSecretReference as ia, prefetchCreateOnlyPropertyPaths as ic, expectedOwnerParam as id, maskEventTextWithBoundBags as ii, identityKeyFor as il, refactorMarkerRefusalMessage as in, carriesDynamicReference as io, secretSafeKeyDisplay as ir, refuseMalformedOutputs as is, serviceTokenBlockingReason as it, rewriteTemplateAssetReferences as iu, compensateRemovedDeletionProtection as j, s3BucketWebsiteUrl as ja, liveMatchesUnresolvedTokenFrame as jc, markDeleteStarted as ji, isNotImplemented as jl, seedsDeleteFirstGuard as jn, malformedDriftResourcePropertiesWarning as jo, destroyStackRecordsView as jr, findActionableSilentDrops as js, displacedPhysicalIdShown as jt, runDockerForeground as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, s3BucketDualStackDomainName as ka, recordedNoEchoValuesOf as kc, extractDeploymentEventError as ki, crossPrefixDeniedWarning as kl, replacementNeverSwapped as kn, isReadableOrphanRecord as ko, proposeRenames as kr, unreadableResourceEntries as ks, NESTED_PENDING_PARENT_REASON as kt, redactedCause as ku, STREAM_POLICY_KEY as l, deleteSkipReason as la, dbInstanceEngineChangeIsInPlace as lc, StageLoadError as ld, secretNamedAttributeNamesOf as li, recordAttributeIdCopy as ll, pendingMovesOutOf as ln, cfnRefValueFromPhysicalId as lo, noEchoParameterValueSeed as lr, refuseMalformedResourceEntriesForDestroy as ls, renderNestedTemplateTreeDefect as lt, getBootstrapMarkerKey as lu, reverseMapStreamPolicy as m, ec2InstanceProtectionSite as ma, sameLambdaFunctionAddress as mc, defineOwnKey as md, PRE_DELETE_SNAPSHOT_TYPES as mi, recordMaskOnlyValue as ml, removeProtectionTypeList as mn, withSharedDrainBudget as mo, DEFAULT_RESOURCE_TIMEOUT_MS as mr, refuseMalformedResourcePropertiesForDrift as ms, readRecordedConditionVerdicts as mt, validateContainerRepoName as mu, recordedProtectionEvidence as n, slowCcOperationTimeoutMs as na, requireConfigObject as nc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as nd, completedReplayEntries as ni, pathCrossesDottedKey as nl, readRefactorMarkerOnce as nn, getAccountInfo as no, secretBearing as nr, refuseMalformedOrphansForDestroy as ns, deferredServiceTokenWarning as nt, createAssetRedirectResolver as nu, perType as o, UNSPECIFIED_SKIP_REASON as oa, describeTypeWithThrottleRetry as oc, canonicalizeRegion as od, orphanRecordsPrintingBag as oi, recordNestedStackParameterExpressions as ol, sameMove as on, isNamelessDynamicReferenceError as oo, exportNameNoEchoParameters as or, refuseMalformedResourceAttributesForOrphan as os, findNestedTemplateTreeDefect as ot, BOOTSTRAP_MARKER_PREFIX as ou, planStreamMemberOps as p, disableInstanceApiTermination as pa, lambdaFunctionNameForMask as pc, utf8ByteLength as pd, ATOMIC_FINAL_SNAPSHOT_TYPES as pi, provenPublicValue as pl, replayRollback as pn, parseWebACLArn as po, bindingSkippedOutputs as pr, refuseMalformedResourcePropertiesForDestroy as ps, parentSuppliedValues as pt, validateAssetBucketName as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, callerEnvCredentials as qa, errorCauseChain as qc, TemplateNoEchoReresolver as qi, stackInstanceIdCarriedFrom as ql, retiredNameGenerationsLeaving as qn, malformedResourcesWarning as qo, supersededHeldByOtherTypeWarning as qr, toFiniteNumber as qs, loadJournaledOrphans as qt, resolveUseCdkBootstrapAssets as qu, recordedProtectionNote as r, onlySecretReferencesDiffer as ra, requireConfigString as rc, decodeListingKey as rd, journaledOrphanPrintingBag as ri, spelledKeysOf as rl, refactorMarkerMovesOf as rn, isImpossibleEmptyStoredAttribute as ro, secretBearingStateKeyWarning as rr, refuseMalformedOrphansForOrphan as rs, findServiceTokenRefusals as rt, loadPublishableAssetManifest as ru, readProtection as s, deleteIndeterminateGuards as sa, withRetry as sc, derivePartitionAndUrlSuffix as sd, secretNamePrintingBag as si, recoverMaskedOutput as sl, updateRefactorMarker as sn, keepsSecretReferenceToken as so, exportNameSecretExposure as sr, refuseMalformedResourceEntries as ss, isAbsoluteAssetPath as st, assertAssetBucketRegion as su, DeployEngine as t, CloudControlProvider as ta, requireConfigArray as tc, uploadCfnTemplate as td, createReadOnlyAttributeHealerFactory as ti, isUncertifiedBaselineMaskPosition as tl, readRefactorMarker as tn, parameterTypeMayLoseSecretIdentity as to, exportAliasCollisionScrubWarning as tr, refuseMalformedOrphans as ts, inheritedProvenanceForChildDiff as tt, buildAssetRedirectMap as tu, STREAM_TAGS_KEY as u, withIndeterminateGuard as ua, ecsServiceLaunchTypeSetOrChanged as uc, processStackMessages as ud, secretNamedRecordNeedles as ui, recordPhysicalNameCopy as ul, pendingMovesRefusalMessage as un, isStalePlaceholderArnAttribute as uo, collectDeclaredOutputNames as ur, refuseMalformedResourceEntriesForImport as us, templateIdentity as ut, isCrossRegionRedirect as uu, streamPolicyMatchesDeclared as v, reEnableInstanceApiTermination as va, isMarkedCoordinate as vc, ownValue as vd, effectiveDeletionPolicy as vi, recordProvenPublicExpression as vl, calculateResourceDrift as vn, JSON_LISTING_HOLE_VALUE as vo, findDestructiveChanges as vr, refuseMalformedResourcesForDestroy as vs, diffSecurity as vt, describeDockerCapturedOutput as vu, planIndexContributorInsightsOps as w, IntrinsicFunctionResolver as wa, noEchoLeavesOf as wc, injectAwsRegion as wd, reserveStackCreateToken as wi, S3StateBackend as wl, isReplacementOrphan as wn, deployRefusesOrphanRowsReason as wo, withMovedTo as wr, repairMalformedResourceEntriesForReadOnly as ws, planOrphanAdoption as wt, getDockerCmd as wu, contributorInsightsRefusals as x, unsettledPropertiesOf as xa, maskWholeValue as xc, displayAssemblyPath as xd, unsupportedFinalSnapshotError as xi, isSingleDynamicReferenceToken as xl, undeclaredEmptyObservedKeys as xn, UNREADABLE_ORPHANS_CONTAINER_ROW as xo, hintSidesOf as xr, repairMalformedOrphanRecordsForReadOnly as xs, mergeNoChangeOutputs as xt, dockerSpawnEnvWithSensitive as xu, streamTagsMatchDeclared as y, DiffCalculator as ya, maskAtCoordinates as yc, absoluteAssemblyPathEscape as yd, isFinalSnapshotError as yi, wholeStringLeavesOf as yl, equalModuloMarkedMask as yn, STATE_REGION_DIVERGED as yo, formatDestructiveChange as yr, refuseMalformedResourcesForExport as ys, isSecretBearingReferenceString as yt, describeDockerExecFailure as yu, relayedIndexBusyDelete as z, applyRoleArnIfSet as za, literalSplitDelimitersOf as zc, definedAttributes as zi, hasReasonlessBaselineRefusal as zl, redactedDeleteAddressSkip as zn, malformedOrphanRowsKeptWarning as zo, red as zr, MULTI_REGION_RECREATE_BLOCKED_TYPES as zs, collectNestedChildUnaddressed as zt, getLegacyStateBucketName as zu };
-//# sourceMappingURL=deploy-engine-DZO2SOQJ.js.map
+export { getPriorAttempts as $, applyCallerIdentityCredentials as $a, unionOfSecretBags as $c, isCustomResourceType as $i, orphansCarriedFrom as $l, namesAnyDeclaredParameter as $n, malformedResourcePropertiesWarning as $o, withoutSuperseded as $r, isWarmThroughputDecrease as $s, formatResourceLine as $t, resolveStateBucketWithDefault as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, withoutUnsettledProperties as Aa, maskedLeafCoordinatesOf as Ac, renderAssemblyPathEscape as Ad, acquireIdempotencyToken as Ai, LockManager as Al, recheckFailedPlan as An, accountArgs as Ao, mappingPairs as Ar, repairMalformedOutputsForReadOnly as As, keptForRetainedRecord as At, finchSecretArgvRefusal as Au, deleteTableWithIndexBusyRetry as B, producerLookupOver as Ba, markSameGenerationBag as Bc, refuseMalformedDesiredTags as Bi, stackInstanceIdOf as Bl, isRedactedRecordedValue as Bn, malformedExportSourceWarning as Bo, gray as Br, findSilentDropProperties as Bs, revertedNestedRowIds as Bt, runDockerStreaming as Bu, planContributorInsightsOp as C, DiffCalculator as Ca, DagBuilder as Cc, hasOwnKey as Cd, isFinalSnapshotError as Ci, recordMaskOnlyValuesIn as Cl, equalModuloMask as Cn, passedParameterClassesOf as Co, findRefactorHints as Cr, refuseMalformedResourcePropertiesForOrphan as Cs, keptWholeReasonText as Ct, buildDenyExternalAccessPolicy as Cu, reverseMapTableContributorInsights as D, unsettledItemsOf as Da, maskAtCoordinates as Dc, absoluteAssemblyPathEscape as Dd, ledgerForStack as Di, wholeStringLeavesOf as Dl, isReplacementOrphan as Dn, STATE_RESOURCES_MALFORMED as Do, withMovedTo as Dr, refuseMalformedState as Ds, planOrphanAdoption as Dt, describeDockerExecFailure as Du, reverseMapIndexContributorInsights as E, unsettledItemsField as Ea, isMarkedCoordinate as Ec, ownValue as Ed, earliestDefined as Ei, recordProvenPublicExpression as El, isJournaledOrphan as En, STATE_REGION_DIVERGED as Eo, rollbackOrphanIds as Er, refuseMalformedResourcesForExport as Es, makeSiblingClaimReader as Et, describeDockerCapturedOutput as Eu, resolveDynamoDbDeleteBudgetClock as F, s3BucketDomainName as Fa, readbackPathFor as Fc, resolveBucketRegion as Fd, markDeleteStarted as Fi, CrossPrefixScanCache as Fl, orphanNeedsIdentity as Fn, hasReadableResources as Fo, getStackRecords as Fr, unreadableOrphanRecords as Fs, dropSettledNestedJournals as Ft, partitionSensitiveEnv as Fu, isTtlRateLimited as G, recordedReferenceRegions as Ga, createUnionSecretMasker as Gc, CC_BROKEN_REASON as Gi, exportNamesCarriedFrom as Gl, nameGenerationCarriedFrom as Gn, malformedOrphanRecordsWarning as Go, deleteSupersededEntry as Gr, findReplacedReadersOfRecreateTargets as Gs, deleteJournaledOrphans as Gt, synthesisStatusMessage as Gu, relayedIndexBusyDelete as H, keepHeldTokenProvenance as Ha, recordReferenceProvenanceEntry as Hc, tagPlanWarning as Hi, splitImportedOps as Hl, redactedDeleteAddressSkip as Hn, malformedLocalResourceEntriesWarning as Ho, red as Hr, withoutSilentDropProperties as Hs, collectNestedChildUnaddressed as Ht, AssetManifestLoader as Hu, resolveDynamoDbDeleteBudgetMs as I, s3BucketDualStackDomainName as Ia, readsNoEchoSource as Ic, DBPROXY_TAGS_WHAT as Ii, applyCrossPrefixScan as Il, findNestedStackTypeChanges as In, isReadableOrphanRecord as Io, withStackRecords as Ir, unreadableResourceEntries as Is, getNestedRevertRun as It, redactDockerArgvValues as Iu, sendTtlWaitingOutRateLimit as J, assertSendableRoleArn as Ja, logOnlyValueCount as Jc, isCustomResource as Ji, hasUnverifiableParameterRefusal as Jl, retiredAfterRollback as Jn, malformedOrphansWarning as Jo, removeSuperseded as Jr, isStatefulRecreateTargetForReplace as Js, isHandledOrphan as Jt, loadCdkJson as Ju, planTimeToLive as K, applyRoleArnIfSet as Ka, hasMaskableValues as Kc, ProviderRegistry as Ki, hasReadableExportSet as Kl, nameGenerationHighWaterOf as Kn, malformedOrphanRowsKeptWarning as Ko, holdsSupersededResources as Kr, shownType as Ks, dropFailedCommands as Kt, getDefaultStateBucketName as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, s3BucketRegionalDomainName as La, recordedNoEchoValuesOf as Lc, DBPROXY_TAG_OPTIONS as Li, crossPrefixDeniedWarning as Ll, getCurrentProducerRegions as Ln, isReadableResourceEntry as Lo, replacedDeleteFailureVerdict as Lr, withheldAccountClause as Ls, nestedChildStackName as Lt, redactedCause as Lu, beginDeleteWait as M, poisonRenderedSpellingsCollidingIn as Ma, noEchoLeavesOf as Mc, injectAwsRegion as Md, DeploymentEventsStore as Mi, S3StateBackend as Ml, replacementNeverSwapped as Mn, displayLogicalId as Mo, proposeRenames as Mr, repairMalformedResourcePropertiesForReadOnly as Ms, NESTED_PENDING_PARENT_REASON as Mt, getDockerCmd as Mu, compensateRemovedDeletionProtection as N, isSettledInstanceState as Na, noEchoOutputsComparison as Nc, injectedAwsRegionValue as Nd, extractDeploymentEventError as Ni, rebuildClientForBucketRegion as Nl, resolveReplacementOldType as Nn, hasReadableOrphans as No, awaitInFlightSibling as Nr, repairMalformedResourcesForReadOnly as Ns, displacedOpClause as Nt, isDockerClientEnvKey as Nu, stripIndexContributorInsights as O, unsettledPropertiesOf as Oa, maskReadbackAtCoordinates as Oc, describeFileReadFailure as Od, reserveStackCreateToken as Oi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ol, planFailedOps as On, UNREADABLE_ORPHANS_CONTAINER_ROW as Oo, isPairableType as Or, repairMalformedOrphanRecordsForReadOnly as Os, pendingRequestCount as Ot, describeDockerFailure as Ou, deleteBudgetKey as P, s3BucketArn as Pa, passedNoEchoParametersOf as Pc, clearBucketRegionCache as Pd, isRefusedByName as Pi, CrossPrefixReadError as Pl, seedsDeleteFirstGuard as Pn, hasReadableOutputs as Po, destroyStackRecordsView as Pr, unpreviewableOrphanRecords as Ps, displacedPhysicalIdShown as Pt, isMalformedEnvKey as Pu, isTruthyCfnBoolean as Q, AWS_CREDENTIAL_ENV_KEYS as Qa, shareLogOnlyValues as Qc, readsNoEchoDeleteValues as Qi, orphansAfterRollback as Ql, computeParameterTaint as Qn, malformedResourceEntriesWarning as Qo, supersededResourcesOf as Qr, coerceWarmThroughput as Qs, sameJournaledOrphans as Qt, resolveSkipPrefix as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, s3BucketWebsiteUrl as Ra, valueAtCoordinate as Rc, planTagDiff as Ri, isAccessDenied$1 as Rl, inheritProducerRegions as Rn, malformedDriftResourcePropertiesWarning as Ro, bold as Rr, findActionableSilentDrops as Rs, recordDisplacedSkips as Rt, redactedDockerCause as Ru, indexDeclaresContributorInsights as S, reEnableInstanceApiTermination as Sa, sameLambdaFunctionAddress as Sc, defineOwnKey as Sd, effectiveDeletionPolicy as Si, recordMaskOnlyValue as Sl, equalModuloMarkedMask as Sn, parameterInputsFor as So, formatDestructiveChange as Sr, refuseMalformedResourcePropertiesForExport as Ss, isSecretBearingReferenceString as St, validateContainerRepoName as Su, readContributorInsightsSpec as T, isUsableAttemptedName as Ta, canonicalCoordinates as Tc, nullPrototypeRecord as Td, unsupportedFinalSnapshotError as Ti, recordNoEchoParameterFreshValue as Tl, demoteSupersededOrphans as Tn, JSON_LISTING_HOLE_VALUE as To, movedToHint as Tr, refuseMalformedResourcesForDestroy as Ts, makeCanonicalizePropertiesFn as Tt, resolveDockerContextDirectory as Tu, waitForIndexesSettled as U, outputReferenceProvenanceOf as Ua, snapshotPassProvenance as Uc, definedAttributes as Ui, acceptedCreateOnlyDropsOf as Ul, updatePartialMessage as Un, malformedLocalResourcesWarning as Uo, yellow as Ur, NO_CC_HANDLERS_REASON as Us, getCurrentNestedStackContext as Ut, getDockerImageBySourceHash as Uu, maskedLogger as V, refuseUnreadableCdkCrossAccountRefs as Va, redactForState as Vc, tagMapAsList as Vi, withStackInstanceIdWithheld as Vl, redactedDeleteAddressFields as Vn, malformedLocalOutputsWarning as Vo, green as Vr, unwrittenCreateOnlyReplacement as Vs, withNestedRevertRun as Vt, warnFinchArgvExposure as Vu, isTtlAlreadyDisabled as W, recordedOutputReferenceRegions as Wa, carryLogOnlyValues as Wc, stringifyIfAssigned as Wi, describeRegionValueKind as Wl, updatePartialReason as Wn, malformedOrphanRecordsRefusalMessage as Wo, addSuperseded as Wr, hasNoCloudControlHandlers as Ws, withNestedStackContext as Wt, Synthesizer as Wu, S3_AUTO_DELETE_OBJECTS_TAG as X, isIamRoleArn as Xa, recordLogOnlyParameterValue as Xc, waitForLambdaFunctionActive as Xi, importableOutputs as Xl, retiredNameGenerationsLeaving as Xn, malformedOutputsWarning as Xo, supersededHeldByOtherTypeWarning as Xr, renderStatefulReason as Xs, loadJournaledOrphans as Xt, resolveAutoAssetStorage as Xu, ECR_AUTO_DELETE_IMAGES_TAG as Y, explicitRoleArnOrThrow as Ya, printingCorpusOf as Yc, wouldReturnToSdkProvider as Yi, importableOutputKeys as Yl, retiredNameGenerationsAfter as Yn, malformedOutputsRefusalMessage as Yo, supersededAfterRollback as Yr, isStatefulRecreateTargetSync as Ys, journaledOrphanLines as Yt, resolveApp as Yu, hasCdkAutoDeleteTag as Z, sendableAssumeRoleCommand as Za, recordLogOnlyValue as Zc, TemplateNoEchoReresolver as Zi, isReadableBag as Zl, withNameGenerationReached as Zn, malformedRenderedContainersWarning as Zo, supersededHolderOf as Zr, WARM_THROUGHPUT_MEMBERS as Zs, makeForeignHolderScan as Zt, resolveCaptureObservedState as Zu, streamMemberRefusals as _, disableInstanceApiTermination as _a, dbInstanceEngineChangeIsInPlace as _c, StageLoadError as _d, ATOMIC_FINAL_SNAPSHOT_TYPES as _i, recordAttributeIdCopy as _l, removeProtectionTypeList as _n, isStalePlaceholderArnAttribute as _o, DEFAULT_RESOURCE_TIMEOUT_MS as _r, refuseMalformedResourceEntriesForImport as _s, readRecordedConditionVerdicts as _t, getBootstrapMarkerKey as _u, isProtectionValueActive as a, CloudControlProvider as aa, configIntegerRefusal as ac, CFN_TEMPLATE_BODY_LIMIT as ad, createReadOnlyAttributeHealerFactory as ai, withPhysicalNameCopies as al, readRefactorMarkerOnce as an, regionLessSecretName as ao, secretBearing as ar, refuseMalformedNestedChildOutputs as as, deferredServiceTokenWarning as at, AssetPublisher as au, CONTRIBUTOR_INSIGHTS_KEY as b, observeThenDisableInstanceApiTermination as ba, canonicalLambdaFunctionName as bc, parseFailureDebugDetail as bd, ccRoutedFinalSnapshotError as bi, carriesSecretMask as bl, withUnprovenUnsettled as bn, parseWebACLArn as bo, constructPathOf as br, refuseMalformedResourcePropertiesForDestroy as bs, withResourceDeadline as bt, readBootstrapMarkerBody as bu, DynamoDBGlobalTableProvider as c, unchangedBehindSecretReference as ca, replayWarn as cc, findLargeInlineResources as cd, maskEventTextWithBoundBags as ci, dynamicReferenceTokens as cl, refuseRefactorMarker as cn, parameterTypeMayLoseSecretIdentity as co, carriedExportAliasExposure as cr, refuseMalformedOrphans as cs, childTemplateLoader as ct, WorkGraph as cu, declaredStreamPolicyMember as d, deleteIndeterminateGuards as da, requireConfigString as dc, decodeListingKey as dd, secretNamePrintingBag as di, spelledKeysOf as dl, hasPendingMovesOut as dn, carriesDynamicReference as do, isWholeDynamicReferenceValue as dr, refuseMalformedOutputs as ds, listNestedTemplateRows as dt, loadPublishableAssetManifest as du, getCurrentResourceSecrets as ea, toCfnInteger as ec, resolveStateBucketWithDefaultAndSource as ed, noEchoAttributeNamesOf as ei, createSecretMasker as el, chunks as en, callerEnvCredentials as eo, reachableDivergentParameters as er, malformedResourcesWarning as es, markRefusedBeforeApplying as et, shouldRetainResource as eu, declaredStreamTagsMember as f, deleteLeftInPlace as fa, prefetchCreateOnlyPropertyPaths as fc, expectedOwnerParam as fd, secretNamePrintingBags as fi, identityKeyFor as fl, pendingMovesOutOf as fn, carriesFetchableDynamicReference as fo, noEchoParameterValueSeed as fr, refuseMalformedOutputsForDestroy as fs, renderNestedTemplateTreeDefect as ft, rewriteTemplateAssetReferences as fu, streamDeclaresTags as g, markWaitAbandoned as ga, blockDeviceMappingsDifferOnlyInDeleteOnTermination as gc, AssemblyReader as gd, storedSecretNameNeedles as gi, physicalNameCopiesOf as gl, replayRollback as gn, cfnRefValueFromPhysicalId as go, bindingSkippedOutputs as gr, refuseMalformedResourceEntriesForDestroy as gs, parentSuppliedValues as gt, ensureAssetStorage as gu, streamDeclaresPolicy as h, isWaitAbandonedError as ha, withRetry as hc, derivePartitionAndUrlSuffix as hd, stateSecretNameNeedles as hi, recoverMaskedOutput as hl, replayFailedOperations as hn, AWS_NO_VALUE as ho, isExportAliasCollision as hr, refuseMalformedResourceEntriesForDeploy as hs, conditionInputsFrom as ht, assertAssetBucketRegion as hu, PROTECTION_PROPERTY_BY_TYPE as i, customResourceResponseExpirationWarning as ia, configBooleanRefusal as ic, ssmResolvedValueType as id, withAttemptedItemsMasked as ii, scrubResourceRecord as il, readRefactorMarker as in, producerRegionsFromState as io, exportAliasCollisionScrubWarning as ir, refuseDivergentRecordRegionForDestroy as is, inheritedProvenanceForChildDiff as it, timePhase as iu, DYNAMODB_DELETE_POLL_COST_MS as j, IntrinsicFunctionResolver as ja, noEchoCoordinatesOf as jc, resolveAssemblyPath as jd, DeploymentEventsReader as ji, isLockInfoExpired as jl, recordUnderIdIsNotOwn as jn, deployRefusesOrphanRowsReason as jo, parseMappingFile as jr, repairMalformedResourceEntriesForReadOnly as js, recordRetainedForReadoption as jt, formatDockerLoginError as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, withUnsettledProperties as ka, maskWholeValue as kc, displayAssemblyPath as kd, withCreateTokenLedger as ki, isSingleDynamicReferenceToken as kl, planRollback as kn, UNREADABLE_RESOURCES_MAP_ROW as ko, looselyEqual as kr, repairMalformedOrphansForReadOnly as ks, resolvePendingCloudControlRequests as kt, dockerSpawnEnvWithSensitive as ku, STREAM_POLICY_KEY as l, RollbackInlinePolicyWriters as la, requireConfigArray as lc, uploadCfnTemplate as ld, namingSecretsWithRecordedNoEcho as li, isUncertifiedBaselineMaskPosition as ll, sameMove as ln, getAccountInfo as lo, exportNameNoEchoParameters as lr, refuseMalformedOrphansForDestroy as ls, findNestedTemplateTreeDefect as lt, buildAssetRedirectMap as lu, reverseMapStreamPolicy as m, withIndeterminateGuard as ma, describeTypeWithThrottleRetry as mc, canonicalizeRegion as md, secretNamedRecordNeedles as mi, recordNestedStackParameterExpressions as ml, refusePendingMovesOut as mn, keepsSecretReferenceToken as mo, collectPublishedOutputNames as mr, refuseMalformedResourceEntries as ms, conditionFingerprint as mt, BOOTSTRAP_MARKER_PREFIX as mu, recordedProtectionEvidence as n, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as na, coerceCfnBoolean as nc, stateBucketExistenceConfirmed as nd, noEchoExactEchoLeavesOf as ni, maskSecretsInError as nl, lookupEachName as nn, classifyRecordedSecretRegion as no, WITHHELD_NAME_DISPLAY as nr, malformedStateRefusalMessage as ns, computeImplicitDeleteEdges as nt, PhaseClock as nu, perType as o, slowCcOperationTimeoutMs as oa, configStringRefusal as oc, CFN_TEMPLATE_URL_LIMIT as od, completedReplayEntries as oi, withoutPhysicalNameCopies as ol, refactorMarkerMovesOf as on, coerceParameterTypedValue as oo, secretBearingStateKeyWarning as or, refuseMalformedOrphanRecords as os, findServiceTokenRefusals as ot, isSensitiveAttributeName as ou, planStreamMemberOps as p, deleteSkipReason as pa, templateResourceTypes as pc, PARTITION_TABLE as pd, secretNamedAttributeNamesOf as pi, inheritNestedStackParameterAssociations as pl, pendingMovesRefusalMessage as pn, isNamelessDynamicReferenceError as po, collectDeclaredOutputNames as pr, refuseMalformedResourceAttributesForOrphan as ps, templateIdentity as pt, AssetModeResolver as pu, readTtlSpec as q, assertFlagRoleArn as qa, literalSplitDelimitersOf as qc, ccBrokenReason as qi, hasReasonlessBaselineRefusal as ql, nameScopeOf as qn, malformedOrphansRefusalMessage as qo, isSupersededResourceRecord as qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as qs, dropFailedHint as qt, getLegacyStateBucketName as qu, recordedProtectionNote as r, applyCustomResourceResponseExpiration as ra, coerceCfnInteger as rc, warnDeprecatedNoPrefixCliFlag as rd, noEchoParameterNamesOf as ri, maskSecretsInText as rl, withApiLimit as rn, classifyReplaySecretRegion as ro, displayTextOrWithheld as rr, previewableOrphanRecords as rs, crossStackOutputProvenanceSource as rt, renderPhaseTimings as ru, readProtection as s, onlySecretReferencesDiffer as sa, readConfigString as sc, MIGRATE_TMP_PREFIX as sd, journaledOrphanPrintingBag as si, DYNAMIC_REFERENCE_TOKEN_SCAN as sl, refactorMarkerRefusalMessage as sn, isUnboundTemplateParameter as so, secretSafeKeyDisplay as sr, refuseMalformedOrphanRecordsForDestroy as ss, serviceTokenBlockingReason as st, stringifyValue as su, DeployEngine as t, withPrintingSecrets as ta, toFiniteNumber as tc, resolveUseCdkBootstrapAssets as td, noEchoComparisonForTemplate as ti, errorCauseChain as tl, isAccessDeniedError as tn, envCredentialsAreAssumedRole as to, resourcesNamingDeclaredParameter as tr, malformedScrubResourceEntriesRefusalMessage as ts, IMPLICIT_DELETE_DEPENDENCIES as tt, stackInstanceIdCarriedFrom as tu, STREAM_TAGS_KEY as u, UNSPECIFIED_SKIP_REASON as ua, requireConfigObject as uc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ud, orphanRecordsPrintingBag as ui, pathCrossesDottedKey as ul, updateRefactorMarker as un, isImpossibleEmptyStoredAttribute as uo, exportNameSecretExposure as ur, refuseMalformedOrphansForOrphan as us, isAbsoluteAssetPath as ut, createAssetRedirectResolver as uu, streamPolicyMatchesDeclared as v, ec2InstanceProtectionSite as va, ecsServiceLaunchTypeSetOrChanged as vc, processStackMessages as vd, PRE_DELETE_SNAPSHOT_TYPES as vi, recordPhysicalNameCopy as vl, recordAfterRollbackUpdate as vn, lacksRecordedTableArn as vo, DEFAULT_RESOURCE_WARN_AFTER_MS as vr, refuseMalformedResourceEntriesForImportSave as vs, enclosingDeadlineExpired as vt, isCrossRegionRedirect as vu, planIndexContributorInsightsOps as w, INTRINSIC_KEYS as wa, TemplateParser as wc, hasPlainPrototype$1 as wd, refusesFinalSnapshot as wi, recordNoEchoAttributeValues as wl, undeclaredEmptyObservedKeys as wn, declaresNoEcho as wo, hintSidesOf as wr, refuseMalformedResourcesForDeploy as ws, mergeNoChangeOutputs as wt, buildDockerImage as wu, contributorInsightsRefusals as x, reDisableInstanceApiTermination as xa, lambdaFunctionNameForMask as xc, utf8ByteLength as xd, createPreDeleteFinalSnapshot as xi, provenPublicValue as xl, calculateResourceDrift as xn, withSharedDrainBudget as xo, findDestructiveChanges as xr, refuseMalformedResourcePropertiesForDrift as xs, diffSecurity as xt, validateAssetBucketName as xu, streamTagsMatchDeclared as y, isTerminationProtectionPropagationError as ya, emrClusterInstancesReplaced as yc, describeJsonParseFailure as yd, buildFinalSnapshotIdentifier as yi, splitGetAttStringForm as yl, settleUnsettledPrevious as yn, refStateLookupFromResource as yo, maskingRetryLogger as yr, refuseMalformedResourceEntriesForOrphan as ys, enclosingDeadlineRemainingMs as yt, parseBootstrapMarker as yu, TABLE_INDEX_NOUN as z, resolveDynamicReferences as za, liveMatchesUnresolvedTokenFrame as zc, readTagList as zi, isNotImplemented as zl, REDACTED_DELETE_ADDRESS_SKIP_REASON as zn, malformedExportNamesWarning as zo, cyan as zr, findHandledUnwrittenCreateOnly as zs, revertNestedChildFromJournal as zt, runDockerForeground as zu };
+//# sourceMappingURL=deploy-engine-CVNzK__j.js.map