@go-to-k/cdkd 0.311.0 → 0.312.0

package/dist/{deploy-engine-BF5exXUb.js → deploy-engine-CVNzK__j.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as observeThenDisableProtection, $n as shellBoundedDisplay, $t as recoveryCommandFlags, A as RESOURCE_NOT_FOUND, An as ProvisioningError, Ar as wrapMaskedAwsError, At as isSecretDerivedValue, B as refusalTypeShown, Bn as normalizeAwsError, Bt as isAuxiliaryFailure, Cr as isTransientServerError, Ct as logicalIdShown, Dn as MalformedProducerRecordRefusalError, Dr as isThrottlingError, Dt as stateOrphanRecordRemedy, En as MacroExpansionError, Er as isMarkedNonRetryable, Et as segmentAfterAnchor, Fn as StateError, Ft as carryCreatedBeforeFailure, G as compensateProtectionFlip, Gn as UNSHOWABLE_VALUE, Gt as replayMadeAnotherResource, H as resolveExplicitPhysicalId, Ht as markAuxiliaryFailure, In as SynthesisError, Jn as isInertUnquoted, Kn as commandHole, Kt as UNREPRODUCIBLE_LOCK_CLAUSE, L as isQuotableImportValue, Lt as createdBeforeFailure, M as markNotGone, Mn as ResourceUpdateNotSupportedError, Mt as maskerOrIdentity, N as assertRegionMatch, Nt as withDerivedNameMasks, Or as markNonRetryable, Ot as createMaskedLogSinks, Pt as RETRY_AUXILIARY_OWNER, Qn as quotedOrDescribed, Qt as formatLockOwner, R as normalizeAwsTagsToCfn, Rt as createdResourceIdentityBeforeFailure, Sn as IntrinsicResolutionRefusalError, Sr as isRetryableTransientError, Tn as LockError, Tt as resourceTypeShown, Un as SHELL_ACTIVE, Ut as markCreatedBeforeFailure, Vt as isAuxiliaryMarkOf, W as ProtectionFlipRegistry, Wn as SHELL_ACTIVE_WHY, Xn as physicalIdShownBesideCommand, Xt as formatLockExpiry, Yn as pasteableCommand, Z as isTerminalDeleteFailure, Zn as plainOrDescribed, Zt as formatLockOperation, _ as removalWarning, _n as CrossAccountSecretRefusalError, _r as formatRetryClassificationSignals, _t as isInterruptedWaitError, a as retractCreatedResource, ar as hasReplayMayCollide, at as DELETION_PROTECTION_DOC_POINTER, bn as DeploymentNotApprovedError, cn as withPasteableAwsProfile, cr as isRecreateRetryableError, dn as clientDefaultsFor, dr as markReplayMayCollide, en as sanitizeRecoveryValue, er as shellQuote, et as protectionFlipKey, fn as credentialFingerprint, fr as relayedNameCollision, ft as ElapsedBudgetRegistry, g as prepareRemovalForUpdate, hn as CdkdError, i as reportCreatedResource, ir as isUpdateUnsupportedError, j as isMarkedNotGone, jn as ResourceTimeoutError, jt as maskDeep, k as withoutServerErrorRetries, kr as markRedactedCause, kt as createMaskedRetryLogger, l as holdsSecretDerivedEntry, ln as ambientClientDefaults, lr as isReplayedNameCollisionFrom, lt as pasteableAwsCommand, m as withUnchangedSecretPrincipalLists, mn as AssetError, mr as stripControlChars, n as clearCreatedReport, nn as DEFAULT_STATE_PREFIX, nt as runDeleteAttempt, on as producerRecordKey, or as isNameCollisionErrorFrom, pn as AccountIdUnavailableError, pr as escapeRegExp$3, pt as monotonicNowMs, q as deleteWithProtectionCompensation, qt as buildForceUnlockCommand, r as collectCreatedResources, rn as injectiveKey, sr as isNameCooldownError, t as CreatedResourceSink, tn as CUSTOM_RESOURCE_RESPONSE_PREFIX, tr as withheldTargetClause, un as ambientCredentialConfig, ut as protectedReplacementAdvice, vn as DependencyError, vr as isAmbiguousCcHandlerErrorCode, vt as startInterruptWatch, wr as retryClassificationText, xn as DynamicReferenceRegionAmbiguousError, xr as isIamPropagationError, xt as compositeIdSeparatorRefusal, y as withoutInjectedRemovals, yr as isAmbiguousOutcomeError, yt as canonicalizeRoute53QueryName, z as quotedRemedyLogicalId, zn as isSoftAbort, zt as hasCreatedBeforeFailure } from "./created-resource-sink-DlzoIY-1.js";
+import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-BT2Dfnpt.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-BA4rBBLp.js";
+import { t as getCdkdVersion } from "./version-BqCEt5Wu.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12697,6 +12697,20 @@ function elastiCachePreferredAvailabilityZonesMovedToDisjoint(oldValue, newValue
 	if (![...oldValue, ...newValue].every((z) => typeof z === "string")) return false;
 	return !newValue.some((z) => oldValue.includes(z));
 }
+function elastiCacheLeftSingleAzWithoutZones(siblings) {
+	if (siblings === void 0) return false;
+	const { oldProperties: prev, newProperties: next } = siblings;
+	return prev["Engine"] === "memcached" && next["Engine"] === "memcached" && prev["PreferredAvailabilityZone"] == null && next["PreferredAvailabilityZone"] == null && next["PreferredAvailabilityZones"] == null && (next["AZMode"] == null || next["AZMode"] === "single-az");
+}
+function elastiCacheAzModeRemovedFromSingleAz(oldValue, newValue, siblings) {
+	return oldValue === "single-az" && newValue == null && elastiCacheLeftSingleAzWithoutZones(siblings);
+}
+function elastiCachePreferredAvailabilityZonesRemovedFromSingleAz(oldValue, newValue, siblings) {
+	return Array.isArray(oldValue) && oldValue.length > 0 && newValue == null && siblings?.oldProperties["AZMode"] === "single-az" && elastiCacheLeftSingleAzWithoutZones(siblings);
+}
+function elastiCachePreferredAvailabilityZonesReplaced(oldValue, newValue, siblings) {
+	return elastiCachePreferredAvailabilityZonesMovedToDisjoint(oldValue, newValue) || elastiCachePreferredAvailabilityZonesRemovedFromSingleAz(oldValue, newValue, siblings);
+}
 function emrClusterInstancesReplaced(oldValue, newValue) {
 	if (oldValue === void 0 && newValue === void 0) return true;
 	return !isDeepStrictEqual(emrInstancesReplacingPart(oldValue), emrInstancesReplacingPart(newValue));
@@ -13031,13 +13045,23 @@ var ReplacementRulesRegistry = class {
 		this.rules.set("AWS::RDS::DBProxy", { replacementProperties: /* @__PURE__ */ new Set([
 			"DBProxyName",
 			"EngineFamily",
-			"VpcSubnetIds"
+			"VpcSubnetIds",
+			"EndpointNetworkType",
+			"TargetConnectionNetworkType"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyEndpoint", { replacementProperties: /* @__PURE__ */ new Set([
 			"DBProxyName",
 			"DBProxyEndpointName",
 			"VpcSubnetIds",
-			"TargetRole"
+			"TargetRole",
+			"EndpointNetworkType"
+		]) });
+		this.rules.set("AWS::S3Tables::Table", { replacementProperties: /* @__PURE__ */ new Set([
+			"TableBucketARN",
+			"OpenTableFormat",
+			"IcebergMetadata",
+			"StorageClassConfiguration",
+			"WithoutMetadata"
 		]) });
 		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
 		this.rules.set("AWS::EC2::VPC", {
@@ -13115,7 +13139,7 @@ var ReplacementRulesRegistry = class {
 		});
 		this.rules.set("AWS::ElastiCache::CacheCluster", {
 			replacementProperties: /* @__PURE__ */ new Set(),
-			conditionalReplacements: /* @__PURE__ */ new Map([["PreferredAvailabilityZones", elastiCachePreferredAvailabilityZonesMovedToDisjoint]])
+			conditionalReplacements: /* @__PURE__ */ new Map([["AZMode", elastiCacheAzModeRemovedFromSingleAz], ["PreferredAvailabilityZones", elastiCachePreferredAvailabilityZonesReplaced]])
 		});
 		this.rules.set("AWS::EMR::Cluster", {
 			replacementProperties: /* @__PURE__ */ new Set(),
@@ -13935,7 +13959,8 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		["SourceDbClusterResourceId"],
 		["SourceRegion"],
 		["StorageEncrypted"],
-		["UseLatestRestorableTime"]
+		["UseLatestRestorableTime"],
+		["WithExpressConfiguration"]
 	]],
 	["AWS::RDS::DBInstance", [
 		["BackupTarget"],
@@ -16508,7 +16533,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["Triggers", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeCommit::Repository", {
@@ -16700,6 +16725,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["MultiRegionConsistency", "not yet implemented by cdkd"],
 			["ReadOnDemandThroughputSettings", "not yet implemented by cdkd"],
 			["ReadProvisionedThroughputSettings", "not yet implemented by cdkd"],
+			["TableType", "not yet implemented by cdkd"],
 			["VectorIndexes", "not yet implemented by cdkd"],
 			["WarmThroughput", "not yet implemented by cdkd"]
 		]),
@@ -16731,9 +16757,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TableName",
 			"Tags",
 			"TimeToLiveSpecification",
+			"VectorIndexes",
 			"WarmThroughput"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"], ["VectorIndexes", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["ImportSourceSpecification"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "StreamArn"]),
 		ccRouteUnavailable: false
@@ -17101,7 +17128,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VolumeConfigurations",
 			"VpcLatticeConfigurations"
 		]),
-		silentDrop: /* @__PURE__ */ new Map(),
+		silentDrop: /* @__PURE__ */ new Map([["GatewayConnectors", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Name", "ServiceArn"]),
 		ccRouteUnavailable: false
@@ -18180,7 +18207,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["SourceDbClusterResourceId", "not yet implemented by cdkd"],
 			["SourceRegion", "not yet implemented by cdkd"],
 			["StorageType", "not yet implemented by cdkd"],
-			["UseLatestRestorableTime", "not yet implemented by cdkd"]
+			["UseLatestRestorableTime", "not yet implemented by cdkd"],
+			["WithExpressConfiguration", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
 			"ClusterScalabilityType",
@@ -18192,7 +18220,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceDBClusterIdentifier",
 			"SourceDbClusterResourceId",
 			"SourceRegion",
-			"UseLatestRestorableTime"
+			"UseLatestRestorableTime",
+			"WithExpressConfiguration"
 		]),
 		readOnly: /* @__PURE__ */ new Set([
 			"DBClusterArn",
@@ -18329,20 +18358,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Auth",
 			"DBProxyName",
 			"DebugLogging",
+			"DefaultAuthScheme",
+			"EndpointNetworkType",
 			"EngineFamily",
 			"IdleClientTimeout",
 			"RequireTLS",
 			"RoleArn",
 			"Tags",
+			"TargetConnectionNetworkType",
 			"VpcSecurityGroupIds",
 			"VpcSubnetIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["DefaultAuthScheme", "not yet implemented by cdkd"],
-			["EndpointNetworkType", "not yet implemented by cdkd"],
-			["TargetConnectionNetworkType", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType", "TargetConnectionNetworkType"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"DBProxyArn",
 			"Endpoint",
@@ -18354,13 +18382,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set([
 			"DBProxyEndpointName",
 			"DBProxyName",
+			"EndpointNetworkType",
 			"Tags",
 			"TargetRole",
 			"VpcSecurityGroupIds",
 			"VpcSubnetIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["EndpointNetworkType", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"DBProxyEndpointArn",
 			"Endpoint",
@@ -18507,26 +18536,21 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::S3Tables::Table", {
 		handled: /* @__PURE__ */ new Set([
+			"Compaction",
 			"Format",
+			"IcebergMetadata",
 			"Name",
 			"Namespace",
 			"OpenTableFormat",
+			"SnapshotManagement",
+			"StorageClassConfiguration",
 			"TableBucketARN",
 			"TableName",
-			"Tags"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["Compaction", "not yet implemented by cdkd"],
-			["IcebergMetadata", "not yet implemented by cdkd"],
-			["SnapshotManagement", "not yet implemented by cdkd"],
-			["StorageClassConfiguration", "not yet implemented by cdkd"],
-			["WithoutMetadata", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"IcebergMetadata",
-			"StorageClassConfiguration",
+			"Tags",
 			"WithoutMetadata"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"TableARN",
 			"VersionToken",
@@ -18535,14 +18559,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		ccRouteUnavailable: false
 	}],
 	["AWS::S3Tables::TableBucket", {
-		handled: /* @__PURE__ */ new Set(["TableBucketName", "Tags"]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["EncryptionConfiguration", "not yet implemented by cdkd"],
-			["MetricsConfiguration", "not yet implemented by cdkd"],
-			["ReplicationConfiguration", "not yet implemented by cdkd"],
-			["StorageClassConfiguration", "not yet implemented by cdkd"],
-			["UnreferencedFileRemoval", "not yet implemented by cdkd"]
+		handled: /* @__PURE__ */ new Set([
+			"EncryptionConfiguration",
+			"MetricsConfiguration",
+			"ReplicationConfiguration",
+			"StorageClassConfiguration",
+			"TableBucketName",
+			"Tags",
+			"UnreferencedFileRemoval"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["TableBucketARN"]),
 		ccRouteUnavailable: false
@@ -19133,7 +19159,8 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::WAFRegional::XssMatchSet",
 	"AWS::Wisdom::Session",
 	"AWS::WorkSpaces::WorkSpaceApplication",
-	"AWS::WorkSpaces::WorkspaceBundle"
+	"AWS::WorkSpaces::WorkspaceBundle",
+	"AWS::WorkSpaces::WorkspaceImage"
 ]);
 
 //#endregion
@@ -19256,21 +19283,39 @@ function excludeCreateOnly(resourceType, names) {
 	return names.filter((property) => !createOnly.has(property));
 }
 function withoutUnwrittenSilentDropProperties(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
-	const drops = findSilentDropProperties(resourceType, recordedProperties);
-	if (drops.length === 0) return recordedProperties;
 	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
-	const removable = drops.map(({ property }) => property).filter((property) => createOnly?.has(property) !== true || evidence.has(property) && !accepted.has(property));
+	const removable = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly?.has(property) !== true).concat(evidenceNamedUnwritten(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence).filter((property) => desiredProperties === void 0 || !Object.hasOwn(desiredProperties, property) || askedUnchanged(recordedProperties, desiredProperties, property)));
 	if (removable.length === 0) return recordedProperties;
 	const narrowed = { ...recordedProperties };
 	for (const property of removable) delete narrowed[property];
 	return narrowed;
 }
 function findUnwrittenCreateOnlyDrops(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
-	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-	if (createOnly === void 0 || createOnly.size === 0 || evidence.size === 0) return [];
+	return evidenceNamedUnwritten(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence).filter((property) => Object.hasOwn(desiredProperties, property) && askedUnchanged(recordedProperties, desiredProperties, property));
+}
+function evidenceNamedUnwritten(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
+	if (evidence.size === 0) return [];
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops ?? /* @__PURE__ */ new Set();
 	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
-	return findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && evidence.has(property) && !accepted.has(property) && Object.hasOwn(desiredProperties, property) && sameJsonValue(recordedProperties[property], desiredProperties[property], "unchanged"));
+	return [...findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && evidence.has(property) && !accepted.has(property)), ...findHandledUnwrittenCreateOnly(resourceType, recordedProperties, evidence)].sort((a, b) => a.localeCompare(b));
+}
+function askedUnchanged(recordedProperties, desiredProperties, property) {
+	return sameJsonValue(recordedProperties[property], desiredProperties[property], "unchanged");
+}
+function findHandledUnwrittenCreateOnly(resourceType, recordedProperties, evidence) {
+	if (evidence.size === 0) return [];
+	const handled = getPropertyCoverage(resourceType)?.handled;
+	if (handled === void 0) return [];
+	const createOnlyRoots = new Set((CREATE_ONLY_PATHS_SNAPSHOT.get(resourceType) ?? []).filter((path) => path.length === 1).map((path) => path[0]));
+	return [...evidence].filter((property) => handled.has(property) && createOnlyRoots.has(property) && Object.hasOwn(recordedProperties, property)).sort((a, b) => a.localeCompare(b));
+}
+function acceptedCreateOnlyDropsEvidence(recordedProperties, resourceType, provisionedBy, carried) {
+	if (provisionedBy !== "sdk") return void 0;
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops ?? /* @__PURE__ */ new Set();
+	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
+	const handled = carried === void 0 ? [] : findHandledUnwrittenCreateOnly(resourceType, recordedProperties, carried);
+	const all = [...names, ...handled].sort((a, b) => a.localeCompare(b));
+	return all.length > 0 ? all : void 0;
 }
 function unwrittenCreateOnlyReplacement(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence, replacingPaths) {
 	if (replacingPaths.length === 0) return [];
@@ -21110,6 +21155,9 @@ const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 	["AWS::AppSync::DataSource", ["DataSourceArn"]],
 	["AWS::AppSync::Resolver", ["ResolverArn"]]
 ]);
+function graphQLSchemaCfnId(physicalId) {
+	return /^[a-z0-9]+$/.test(physicalId) ? `${physicalId}GraphQLSchema` : physicalId;
+}
 function isStalePlaceholderArnAttribute(resourceType, attributeName, value) {
 	if (!REF_RETURNS_ARN_FROM_STATE.get(resourceType)?.includes(attributeName)) return false;
 	return typeof value === "string" && isPlaceholderArn(value);
@@ -21190,6 +21238,7 @@ function lacksRecordedTableArn(resource) {
 }
 function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
 	if (resourceType === "AWS::S3Tables::Table") return s3TablesTableRefFromPhysicalId(physicalId, stateLookup);
+	if (resourceType === "AWS::AppSync::GraphQLSchema") return graphQLSchemaCfnId(physicalId);
 	if (resourceType === "AWS::Glue::Table") {
 		const tableName = glueTableRefFromPhysicalId(physicalId, stateLookup);
 		if (tableName !== void 0) return tableName;
@@ -23959,6 +24008,7 @@ async function constructAttributeForAppTypes(resolver, resource, attributeName,
 		case "ApiId": return physicalId;
 		default: return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 	}
+	if (resourceType === "AWS::AppSync::GraphQLSchema" && attributeName === "Id") return graphQLSchemaCfnId(physicalId);
 	if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
 		case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
 		case "ApiId": return physicalId;
@@ -28740,7 +28790,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CIg_guZ-.js");
+			const { ASGProvider } = await import("./asg-provider-CVLTQtQr.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28849,7 +28899,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-0LUsn9Wl.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D9ac71Ca.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CXSZq1c8.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-qdoLunCh.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -31661,6 +31711,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["Source.Auth", ["Type"]],
 		["Source.GitSubmodulesConfig", ["FetchSubmodules"]],
 		["Tags", ["Key", "Value"]],
+		["Triggers.FilterGroups", ["Pattern", "Type"]],
 		["Triggers.PullRequestBuildPolicy", ["RequiresCommentApproval"]],
 		["Triggers.ScopeConfiguration", ["Name"]]
 	])],
@@ -31839,6 +31890,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration", ["Type", "Value"]],
 		["DeploymentConfiguration.LifecycleHooks", ["LifecycleStages"]],
 		["ForceNewDeployment", ["EnableForceNewDeployment"]],
+		["GatewayConnectors", ["PortName"]],
 		["LoadBalancers.AdvancedConfiguration", ["AlternateTargetGroupArn"]],
 		["Monitoring", ["MetricConfigurations"]],
 		["Monitoring.MetricConfigurations", ["MetricNames", "ResolutionSeconds"]],
@@ -31868,6 +31920,8 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["ContainerDefinitions.LogConfiguration", ["LogDriver"]],
 		["ContainerDefinitions.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
 		["ContainerDefinitions.ResourceRequirements", ["Type"]],
+		["ContainerDefinitions.ResourceRequirements.SharingStrategy", ["NvidiaMps"]],
+		["ContainerDefinitions.ResourceRequirements.SharingStrategy.NvidiaMps", ["Memory"]],
 		["ContainerDefinitions.Secrets", ["Name", "ValueFrom"]],
 		["ContainerDefinitions.Ulimits", [
 			"HardLimit",
@@ -32945,6 +32999,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudWatch::Alarm", "{\"ActionConfiguration\":\"object\",\"ActionConfiguration.AlarmTagsPropagation\":\"object\",\"ActionConfiguration.AlarmTagsPropagation.ExcludedTagKeys\":\"array\",\"ActionConfiguration.AlarmTagsPropagation.IncludedTagKeys\":\"array\",\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
+	["AWS::CodeBuild::Project", "{\"Artifacts\":\"object\",\"BuildBatchConfig\":\"object\",\"BuildBatchConfig.Restrictions\":\"object\",\"BuildBatchConfig.Restrictions.ComputeTypesAllowed\":\"array\",\"BuildBatchConfig.Restrictions.FleetsAllowed\":\"array\",\"Cache\":\"object\",\"Cache.Modes\":\"array\",\"Environment\":\"object\",\"Environment.DockerServer\":\"object\",\"Environment.DockerServer.SecurityGroupIds\":\"array\",\"Environment.EnvironmentVariables\":\"array\",\"Environment.EnvironmentVariables[]\":\"object\",\"Environment.Fleet\":\"object\",\"Environment.RegistryCredential\":\"object\",\"FileSystemLocations\":\"array\",\"FileSystemLocations[]\":\"object\",\"LogsConfig\":\"object\",\"LogsConfig.CloudWatchLogs\":\"object\",\"LogsConfig.S3Logs\":\"object\",\"SecondaryArtifacts\":\"array\",\"SecondaryArtifacts[]\":\"object\",\"SecondarySourceVersions\":\"array\",\"SecondarySourceVersions[]\":\"object\",\"SecondarySources\":\"array\",\"SecondarySources[]\":\"object\",\"SecondarySources[].Auth\":\"object\",\"SecondarySources[].BuildStatusConfig\":\"object\",\"SecondarySources[].GitSubmodulesConfig\":\"object\",\"Source\":\"object\",\"Source.Auth\":\"object\",\"Source.BuildStatusConfig\":\"object\",\"Source.GitSubmodulesConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"object\",\"Triggers.FilterGroups\":\"array\",\"Triggers.FilterGroups[]\":\"array\",\"Triggers.FilterGroups[][]\":\"object\",\"Triggers.PullRequestBuildPolicy\":\"object\",\"Triggers.PullRequestBuildPolicy.ApproverRoles\":\"array\",\"Triggers.ScopeConfiguration\":\"object\",\"VpcConfig\":\"object\",\"VpcConfig.SecurityGroupIds\":\"array\",\"VpcConfig.Subnets\":\"array\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -32963,8 +33018,8 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::EC2::VPC", "{\"CidrBlockAssociations\":\"array\",\"Ipv6CidrBlocks\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VpcEncryptionControl\":\"object\",\"VpcEncryptionControl.ResourceExclusions\":\"object\",\"VpcEncryptionControl.ResourceExclusions.EgressOnlyInternetGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.ElasticFileSystem\":\"object\",\"VpcEncryptionControl.ResourceExclusions.InternetGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.Lambda\":\"object\",\"VpcEncryptionControl.ResourceExclusions.NatGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.VirtualPrivateGateway\":\"object\",\"VpcEncryptionControl.ResourceExclusions.VpcLattice\":\"object\",\"VpcEncryptionControl.ResourceExclusions.VpcPeering\":\"object\"}"],
 	["AWS::ECR::Repository", "{\"EncryptionConfiguration\":\"object\",\"ImageScanningConfiguration\":\"object\",\"ImageTagMutabilityExclusionFilters\":\"array\",\"ImageTagMutabilityExclusionFilters[]\":\"object\",\"LifecyclePolicy\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::ECS::Cluster", "{\"CapacityProviders\":\"array\",\"ClusterSettings\":\"array\",\"ClusterSettings[]\":\"object\",\"Configuration\":\"object\",\"Configuration.ExecuteCommandConfiguration\":\"object\",\"Configuration.ExecuteCommandConfiguration.LogConfiguration\":\"object\",\"Configuration.ManagedStorageConfiguration\":\"object\",\"DefaultCapacityProviderStrategy\":\"array\",\"DefaultCapacityProviderStrategy[]\":\"object\",\"ServiceConnectDefaults\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
-	["AWS::ECS::Service", "{\"CapacityProviderStrategy\":\"array\",\"CapacityProviderStrategy[]\":\"object\",\"DeploymentConfiguration\":\"object\",\"DeploymentConfiguration.Alarms\":\"object\",\"DeploymentConfiguration.Alarms.AlarmNames\":\"array\",\"DeploymentConfiguration.CanaryConfiguration\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration\":\"object\",\"DeploymentConfiguration.EarlySuccessCriteria\":\"object\",\"DeploymentConfiguration.LifecycleHooks\":\"array\",\"DeploymentConfiguration.LifecycleHooks[]\":\"object\",\"DeploymentConfiguration.LifecycleHooks[].LifecycleStages\":\"array\",\"DeploymentConfiguration.LifecycleHooks[].TimeoutConfiguration\":\"object\",\"DeploymentConfiguration.LinearConfiguration\":\"object\",\"DeploymentController\":\"object\",\"ForceNewDeployment\":\"object\",\"LoadBalancers\":\"array\",\"LoadBalancers[]\":\"object\",\"LoadBalancers[].AdvancedConfiguration\":\"object\",\"Monitoring\":\"object\",\"Monitoring.MetricConfigurations\":\"array\",\"Monitoring.MetricConfigurations[]\":\"object\",\"Monitoring.MetricConfigurations[].MetricNames\":\"array\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration.SecurityGroups\":\"array\",\"NetworkConfiguration.AwsvpcConfiguration.Subnets\":\"array\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"PlacementStrategies\":\"array\",\"PlacementStrategies[]\":\"object\",\"ServiceConnectConfiguration\":\"object\",\"ServiceConnectConfiguration.AccessLogConfiguration\":\"object\",\"ServiceConnectConfiguration.LogConfiguration\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.Options\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions\":\"array\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions[]\":\"object\",\"ServiceConnectConfiguration.Services\":\"array\",\"ServiceConnectConfiguration.Services[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases\":\"array\",\"ServiceConnectConfiguration.Services[].ClientAliases[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header.Value\":\"object\",\"ServiceConnectConfiguration.Services[].Timeout\":\"object\",\"ServiceConnectConfiguration.Services[].Tls\":\"object\",\"ServiceConnectConfiguration.Services[].Tls.IssuerCertificateAuthority\":\"object\",\"ServiceRegistries\":\"array\",\"ServiceRegistries[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VolumeConfigurations\":\"array\",\"VolumeConfigurations[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags[]\":\"object\",\"VpcLatticeConfigurations\":\"array\",\"VpcLatticeConfigurations[]\":\"object\",\"VpcLatticeConfigurations[].AdvancedConfiguration\":\"object\"}"],
-	["AWS::ECS::TaskDefinition", "{\"ContainerDefinitions\":\"array\",\"ContainerDefinitions[]\":\"object\",\"ContainerDefinitions[].Command\":\"array\",\"ContainerDefinitions[].CredentialSpecs\":\"array\",\"ContainerDefinitions[].DependsOn\":\"array\",\"ContainerDefinitions[].DependsOn[]\":\"object\",\"ContainerDefinitions[].DnsSearchDomains\":\"array\",\"ContainerDefinitions[].DnsServers\":\"array\",\"ContainerDefinitions[].DockerLabels\":\"object\",\"ContainerDefinitions[].DockerSecurityOptions\":\"array\",\"ContainerDefinitions[].EntryPoint\":\"array\",\"ContainerDefinitions[].Environment\":\"array\",\"ContainerDefinitions[].EnvironmentFiles\":\"array\",\"ContainerDefinitions[].EnvironmentFiles[]\":\"object\",\"ContainerDefinitions[].Environment[]\":\"object\",\"ContainerDefinitions[].ExtraHosts\":\"array\",\"ContainerDefinitions[].ExtraHosts[]\":\"object\",\"ContainerDefinitions[].FirelensConfiguration\":\"object\",\"ContainerDefinitions[].FirelensConfiguration.Options\":\"object\",\"ContainerDefinitions[].HealthCheck\":\"object\",\"ContainerDefinitions[].HealthCheck.Command\":\"array\",\"ContainerDefinitions[].Links\":\"array\",\"ContainerDefinitions[].LinuxParameters\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Add\":\"array\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Drop\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Devices[].Permissions\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[].MountOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration\":\"object\",\"ContainerDefinitions[].LogConfiguration.Options\":\"object\",\"ContainerDefinitions[].LogConfiguration.SecretOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration.SecretOptions[]\":\"object\",\"ContainerDefinitions[].MountPoints\":\"array\",\"ContainerDefinitions[].MountPoints[]\":\"object\",\"ContainerDefinitions[].PortMappings\":\"array\",\"ContainerDefinitions[].PortMappings[]\":\"object\",\"ContainerDefinitions[].RepositoryCredentials\":\"object\",\"ContainerDefinitions[].ResourceRequirements\":\"array\",\"ContainerDefinitions[].ResourceRequirements[]\":\"object\",\"ContainerDefinitions[].RestartPolicy\":\"object\",\"ContainerDefinitions[].RestartPolicy.IgnoredExitCodes\":\"array\",\"ContainerDefinitions[].Secrets\":\"array\",\"ContainerDefinitions[].Secrets[]\":\"object\",\"ContainerDefinitions[].SystemControls\":\"array\",\"ContainerDefinitions[].SystemControls[]\":\"object\",\"ContainerDefinitions[].Ulimits\":\"array\",\"ContainerDefinitions[].Ulimits[]\":\"object\",\"ContainerDefinitions[].VolumesFrom\":\"array\",\"ContainerDefinitions[].VolumesFrom[]\":\"object\",\"EphemeralStorage\":\"object\",\"InferenceAccelerators\":\"array\",\"InferenceAccelerators[]\":\"object\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"ProxyConfiguration\":\"object\",\"ProxyConfiguration.ProxyConfigurationProperties\":\"array\",\"ProxyConfiguration.ProxyConfigurationProperties[]\":\"object\",\"RequiresCompatibilities\":\"array\",\"RuntimePlatform\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Volumes\":\"array\",\"Volumes[]\":\"object\",\"Volumes[].DockerVolumeConfiguration\":\"object\",\"Volumes[].DockerVolumeConfiguration.DriverOpts\":\"object\",\"Volumes[].DockerVolumeConfiguration.Labels\":\"object\",\"Volumes[].EFSVolumeConfiguration\":\"object\",\"Volumes[].EFSVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].Host\":\"object\",\"Volumes[].S3FilesVolumeConfiguration\":\"object\"}"],
+	["AWS::ECS::Service", "{\"CapacityProviderStrategy\":\"array\",\"CapacityProviderStrategy[]\":\"object\",\"DeploymentConfiguration\":\"object\",\"DeploymentConfiguration.Alarms\":\"object\",\"DeploymentConfiguration.Alarms.AlarmNames\":\"array\",\"DeploymentConfiguration.CanaryConfiguration\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker\":\"object\",\"DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration\":\"object\",\"DeploymentConfiguration.EarlySuccessCriteria\":\"object\",\"DeploymentConfiguration.LifecycleHooks\":\"array\",\"DeploymentConfiguration.LifecycleHooks[]\":\"object\",\"DeploymentConfiguration.LifecycleHooks[].LifecycleStages\":\"array\",\"DeploymentConfiguration.LifecycleHooks[].TimeoutConfiguration\":\"object\",\"DeploymentConfiguration.LinearConfiguration\":\"object\",\"DeploymentController\":\"object\",\"ForceNewDeployment\":\"object\",\"GatewayConnectors\":\"array\",\"GatewayConnectors[]\":\"object\",\"GatewayConnectors[].Filters\":\"object\",\"GatewayConnectors[].Filters.AccessTypes\":\"array\",\"GatewayConnectors[].HealthCheck\":\"object\",\"GatewayConnectors[].HealthCheck.Matcher\":\"object\",\"LoadBalancers\":\"array\",\"LoadBalancers[]\":\"object\",\"LoadBalancers[].AdvancedConfiguration\":\"object\",\"Monitoring\":\"object\",\"Monitoring.MetricConfigurations\":\"array\",\"Monitoring.MetricConfigurations[]\":\"object\",\"Monitoring.MetricConfigurations[].MetricNames\":\"array\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration\":\"object\",\"NetworkConfiguration.AwsvpcConfiguration.SecurityGroups\":\"array\",\"NetworkConfiguration.AwsvpcConfiguration.Subnets\":\"array\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"PlacementStrategies\":\"array\",\"PlacementStrategies[]\":\"object\",\"ServiceConnectConfiguration\":\"object\",\"ServiceConnectConfiguration.AccessLogConfiguration\":\"object\",\"ServiceConnectConfiguration.ContainerConfigurations\":\"array\",\"ServiceConnectConfiguration.ContainerConfigurations[]\":\"object\",\"ServiceConnectConfiguration.LogConfiguration\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.Options\":\"object\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions\":\"array\",\"ServiceConnectConfiguration.LogConfiguration.SecretOptions[]\":\"object\",\"ServiceConnectConfiguration.Services\":\"array\",\"ServiceConnectConfiguration.Services[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases\":\"array\",\"ServiceConnectConfiguration.Services[].ClientAliases[]\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header\":\"object\",\"ServiceConnectConfiguration.Services[].ClientAliases[].TestTrafficRules.Header.Value\":\"object\",\"ServiceConnectConfiguration.Services[].Timeout\":\"object\",\"ServiceConnectConfiguration.Services[].Tls\":\"object\",\"ServiceConnectConfiguration.Services[].Tls.IssuerCertificateAuthority\":\"object\",\"ServiceRegistries\":\"array\",\"ServiceRegistries[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VolumeConfigurations\":\"array\",\"VolumeConfigurations[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[]\":\"object\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags\":\"array\",\"VolumeConfigurations[].ManagedEBSVolume.TagSpecifications[].Tags[]\":\"object\",\"VpcLatticeConfigurations\":\"array\",\"VpcLatticeConfigurations[]\":\"object\",\"VpcLatticeConfigurations[].AdvancedConfiguration\":\"object\"}"],
+	["AWS::ECS::TaskDefinition", "{\"ContainerDefinitions\":\"array\",\"ContainerDefinitions[]\":\"object\",\"ContainerDefinitions[].Command\":\"array\",\"ContainerDefinitions[].CredentialSpecs\":\"array\",\"ContainerDefinitions[].DependsOn\":\"array\",\"ContainerDefinitions[].DependsOn[]\":\"object\",\"ContainerDefinitions[].DnsSearchDomains\":\"array\",\"ContainerDefinitions[].DnsServers\":\"array\",\"ContainerDefinitions[].DockerLabels\":\"object\",\"ContainerDefinitions[].DockerSecurityOptions\":\"array\",\"ContainerDefinitions[].EntryPoint\":\"array\",\"ContainerDefinitions[].Environment\":\"array\",\"ContainerDefinitions[].EnvironmentFiles\":\"array\",\"ContainerDefinitions[].EnvironmentFiles[]\":\"object\",\"ContainerDefinitions[].Environment[]\":\"object\",\"ContainerDefinitions[].ExtraHosts\":\"array\",\"ContainerDefinitions[].ExtraHosts[]\":\"object\",\"ContainerDefinitions[].FirelensConfiguration\":\"object\",\"ContainerDefinitions[].FirelensConfiguration.Options\":\"object\",\"ContainerDefinitions[].HealthCheck\":\"object\",\"ContainerDefinitions[].HealthCheck.Command\":\"array\",\"ContainerDefinitions[].Links\":\"array\",\"ContainerDefinitions[].LinuxParameters\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities\":\"object\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Add\":\"array\",\"ContainerDefinitions[].LinuxParameters.Capabilities.Drop\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices\":\"array\",\"ContainerDefinitions[].LinuxParameters.Devices[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Devices[].Permissions\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs\":\"array\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[]\":\"object\",\"ContainerDefinitions[].LinuxParameters.Tmpfs[].MountOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration\":\"object\",\"ContainerDefinitions[].LogConfiguration.Options\":\"object\",\"ContainerDefinitions[].LogConfiguration.SecretOptions\":\"array\",\"ContainerDefinitions[].LogConfiguration.SecretOptions[]\":\"object\",\"ContainerDefinitions[].MountPoints\":\"array\",\"ContainerDefinitions[].MountPoints[]\":\"object\",\"ContainerDefinitions[].PortMappings\":\"array\",\"ContainerDefinitions[].PortMappings[]\":\"object\",\"ContainerDefinitions[].RepositoryCredentials\":\"object\",\"ContainerDefinitions[].ResourceRequirements\":\"array\",\"ContainerDefinitions[].ResourceRequirements[]\":\"object\",\"ContainerDefinitions[].ResourceRequirements[].SharingStrategy\":\"object\",\"ContainerDefinitions[].ResourceRequirements[].SharingStrategy.NvidiaMps\":\"object\",\"ContainerDefinitions[].RestartPolicy\":\"object\",\"ContainerDefinitions[].RestartPolicy.IgnoredExitCodes\":\"array\",\"ContainerDefinitions[].Secrets\":\"array\",\"ContainerDefinitions[].Secrets[]\":\"object\",\"ContainerDefinitions[].SystemControls\":\"array\",\"ContainerDefinitions[].SystemControls[]\":\"object\",\"ContainerDefinitions[].Ulimits\":\"array\",\"ContainerDefinitions[].Ulimits[]\":\"object\",\"ContainerDefinitions[].VolumesFrom\":\"array\",\"ContainerDefinitions[].VolumesFrom[]\":\"object\",\"EphemeralStorage\":\"object\",\"InferenceAccelerators\":\"array\",\"InferenceAccelerators[]\":\"object\",\"PlacementConstraints\":\"array\",\"PlacementConstraints[]\":\"object\",\"ProxyConfiguration\":\"object\",\"ProxyConfiguration.ProxyConfigurationProperties\":\"array\",\"ProxyConfiguration.ProxyConfigurationProperties[]\":\"object\",\"RequiresCompatibilities\":\"array\",\"RuntimePlatform\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Volumes\":\"array\",\"Volumes[]\":\"object\",\"Volumes[].DockerVolumeConfiguration\":\"object\",\"Volumes[].DockerVolumeConfiguration.DriverOpts\":\"object\",\"Volumes[].DockerVolumeConfiguration.Labels\":\"object\",\"Volumes[].EFSVolumeConfiguration\":\"object\",\"Volumes[].EFSVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration\":\"object\",\"Volumes[].FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig\":\"object\",\"Volumes[].Host\":\"object\",\"Volumes[].S3FilesVolumeConfiguration\":\"object\"}"],
 	["AWS::EFS::AccessPoint", "{\"AccessPointTags\":\"array\",\"AccessPointTags[]\":\"object\",\"PosixUser\":\"object\",\"PosixUser.SecondaryGids\":\"array\",\"RootDirectory\":\"object\",\"RootDirectory.CreationInfo\":\"object\"}"],
 	["AWS::EFS::FileSystem", "{\"BackupPolicy\":\"object\",\"FileSystemPolicy\":\"object\",\"FileSystemProtection\":\"object\",\"FileSystemTags\":\"array\",\"FileSystemTags[]\":\"object\",\"LifecyclePolicies\":\"array\",\"LifecyclePolicies[]\":\"object\",\"ReplicationConfiguration\":\"object\",\"ReplicationConfiguration.Destinations\":\"array\",\"ReplicationConfiguration.Destinations[]\":\"object\"}"],
 	["AWS::EFS::MountTarget", "{\"SecurityGroups\":\"array\"}"],
@@ -40438,11 +40493,13 @@ async function replayReverseReplacement(s) {
 	}
 	const { observedProperties: _staleObserved, ...prevRecord } = prev;
 	recordNoEchoAttributeValues(createResult, secrets, resolvedPrevProps);
+	const restoredProperties = recordedPropertiesAfterReplayCreate(prevRecord, createResult);
 	stateResources[op.logicalId] = redactRollbackRecord({
 		...withNameGenerationReached(prevRecord, op.logicalId, op.nameGeneration),
 		physicalId: createResult.physicalId,
 		attributes: createResult.attributes ?? {},
-		properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
+		properties: restoredProperties,
+		acceptedCreateOnlyDrops: acceptedCreateOnlyDropsEvidence(restoredProperties, oldType, createProvisionedBy)
 	}, secrets, prevRecord.properties, prevRecord.attributes);
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
 	const deferral = s.deferral !== void 0 && !deletedNewFirst && !adoptedLiveNewResource && !rollbackRetainsNewResource(current) ? s.deferral : void 0;
@@ -46635,12 +46692,8 @@ function extractTemplateAttributes(template, logicalId) {
 	};
 }
 function acceptedCreateOnlyDropsField(recordedProperties, resourceType, provisionedBy, mode, previous) {
-	if (provisionedBy !== "sdk") return { acceptedCreateOnlyDrops: void 0 };
-	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-	if (createOnly === void 0 || createOnly.size === 0) return { acceptedCreateOnlyDrops: void 0 };
 	const carried = mode === "in-place" ? acceptedCreateOnlyDropsOf(previous) : void 0;
-	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
-	return { acceptedCreateOnlyDrops: names.length > 0 ? names : void 0 };
+	return { acceptedCreateOnlyDrops: acceptedCreateOnlyDropsEvidence(recordedProperties, resourceType, provisionedBy, carried) };
 }
 function secretNamedAttributesField(result, previous) {
 	const reported = result.secretNamedAttributeNames;
@@ -47247,12 +47300,17 @@ const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
 function hasTransitionalIndex(indexes) {
 	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
 }
+function hasTransitionalTableIndex(table) {
+	return hasTransitionalIndex(table?.GlobalSecondaryIndexes) || hasTransitionalIndex(table?.VectorIndexes);
+}
+const GSI_INDEX_NOUN = "a global secondary index";
+const TABLE_INDEX_NOUN = "a global secondary index or vector index";
 const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
 function isIndexBusyDeleteError(message) {
 	return INDEX_BUSY_DELETE_MESSAGE.test(message);
 }
-function relayedIndexBusyDelete(withheldText) {
-	return isIndexBusyDeleteError(withheldText) ? " AWS reports that a global secondary index is still being created, updated or deleted; re-running the destroy succeeds once the index is ACTIVE." : "";
+function relayedIndexBusyDelete(withheldText, indexNoun = GSI_INDEX_NOUN) {
+	return isIndexBusyDeleteError(withheldText) ? ` AWS reports that ${indexNoun} is still being created, updated or deleted; re-running the destroy succeeds once the index is ACTIVE.` : "";
 }
 const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
 const INDEX_SETTLE_POLL_INTERVAL_MS = 1e3;
@@ -47260,21 +47318,43 @@ const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AW
 async function waitForIndexesSettled(opts) {
 	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
 	const budgetWait = opts.budgetWait;
+	const shortCap = opts.shortCapUnlessVectorBusy;
+	let vectorOnlyBusy = false;
+	let stoppedAtShortCap = false;
+	let announced = false;
+	const effectiveCap = () => shortCap !== void 0 && !vectorOnlyBusy ? Math.min(shortCap, maxAttempts) : maxAttempts;
 	const watch = startInterruptWatch(`index settle wait on ${tableName}`);
 	let attempt = 0;
 	try {
-		while (budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts) {
+		for (;;) {
+			if (shortCap !== void 0 && attempt >= shortCap && !vectorOnlyBusy) {
+				stoppedAtShortCap = true;
+				break;
+			}
+			if (!(budgetWait ? budgetWait.nextPoll() : attempt < maxAttempts)) break;
 			attempt += 1;
 			if (watch.isInterrupted()) {
 				logger.debug(`Interrupted while waiting for indexes on ${tableName} (${logicalId}) after ${attempt - 1} DescribeTable polls; ${proceedNote}`);
 				return;
 			}
 			try {
-				if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
+				const response = await describeTable();
+				if (!hasTransitionalTableIndex(response.Table)) {
+					if (attempt > 1) logger.debug(safeMsg`Indexes on ${tableName} (${logicalId}) settled after ${attempt} DescribeTable polls`);
+					return;
+				}
+				const gsiBusy = hasTransitionalIndex(response.Table?.GlobalSecondaryIndexes);
+				const vectorBusy = hasTransitionalIndex(response.Table?.VectorIndexes);
+				vectorOnlyBusy = vectorBusy && !gsiBusy;
+				if (!announced) {
+					announced = true;
+					const busyKinds = gsiBusy ? vectorBusy ? "a global secondary index and a vector index" : "a global secondary index" : "a vector index";
+					logger.debug(safeMsg`Index settle wait on ${tableName} (${logicalId}): ${busyKinds} still transitioning (poll ${attempt})`);
+				}
 			} catch (err) {
 				const message = describeAwsFailure(err).detail;
 				if (isThrottlingError(err)) {
-					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${effectiveCap()}); still waiting: ${message}`);
 					await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 					continue;
 				}
@@ -47293,14 +47373,14 @@ async function waitForIndexesSettled(opts) {
 		watch.dispose();
 	}
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
-	const pollsRun = budgetWait ? budgetWait.pollsRun : maxAttempts;
-	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${pollsRun} DescribeTable polls (~${pollSeconds}s apart, so a little over ${pollsRun * pollSeconds}s of wall clock).${budgetWait?.note() ?? ""} ${proceedNote}`);
+	const pollsRun = budgetWait ? budgetWait.pollsRun : attempt;
+	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${pollsRun} DescribeTable polls (~${pollSeconds}s apart, so a little over ${pollsRun * pollSeconds}s of wall clock).${stoppedAtShortCap ? "" : budgetWait?.note(shortCap !== void 0 && !vectorOnlyBusy ? shortCap : void 0) ?? ""} ${proceedNote}`);
 }
 function indexBusyRetryWarning(opts) {
 	const remainingAttempts = Math.max(0, 1 + opts.maxRetries - opts.attemptNumber);
 	const settleFloorMinutes = Math.max(1, Math.round((remainingAttempts + 1) * 60 * INDEX_SETTLE_POLL_INTERVAL_MS / 6e4));
 	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
-	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~${pollSeconds}s apart before its DeleteTable, so cdkd will not give up for at least ~${settleFloorMinutes} more minutes while those settle waits run). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails on AWS's refusal (re-run with --verbose for AWS's own message) and re-running it succeeds once the index is ACTIVE.`;
+	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because ${opts.indexNoun ?? "a global secondary index"} is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~${pollSeconds}s apart before its DeleteTable, so cdkd will not give up for at least ~${settleFloorMinutes} more minutes while those settle waits run). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails on AWS's refusal (re-run with --verbose for AWS's own message) and re-running it succeeds once the index is ACTIVE.`;
 }
 async function deleteTableWithIndexBusyRetry(opts) {
 	let deleteAttempts = 0;
@@ -47308,12 +47388,13 @@ async function deleteTableWithIndexBusyRetry(opts) {
 	try {
 		await withRetry(async () => {
 			if (deleteAttempts++ > 0) {
-				if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
+				if (deleteAttempts === 2) opts.logger.warn(opts.retryWarning?.() ?? indexBusyRetryWarning({
 					typeLabel: opts.typeLabel,
 					logicalId: opts.logicalId,
 					physicalId: opts.physicalId,
 					attemptNumber: deleteAttempts,
-					maxRetries: opts.maxRetries
+					maxRetries: opts.maxRetries,
+					...opts.indexNoun !== void 0 && { indexNoun: opts.indexNoun }
 				}));
 				await opts.reArm();
 			}
@@ -47336,6 +47417,7 @@ async function deleteTableWithIndexBusyRetry(opts) {
 const DYNAMODB_DELETE_POLL_RTT_MS = 200;
 const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
 const DYNAMODB_DELETE_BUDGET_MS = 156e4;
+const DYNAMODB_DELETE_DEADLINE_MARGIN_MS = 24e4;
 const DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS = 18e5;
 const dynamoDbDeleteBudgetOverride = {};
 function resolveDynamoDbDeleteBudgetMs() {
@@ -47394,11 +47476,12 @@ var DeleteWaitImpl = class {
 	get cutShort() {
 		return this.endedByBudget && this.ran < 60;
 	}
-	note() {
+	note(shownCap) {
 		if (!this.endedByBudget) return "";
+		const cap = shownCap ?? this.cap;
 		const minutes = Math.max(1, Math.round((this.budget?.totalMs ?? 0) / 6e4));
-		if (this.cutShort) return ` — cdkd's shared ~${minutes}-minute delete allowance was already spent, so this wait made only ${this.ran} of its ${this.cap} polls and AWS was not given a real wait. Nothing is necessarily wrong with the table; re-run the destroy.`;
-		return ` (cdkd's shared ~${minutes}-minute delete allowance capped this wait at ${this.ran} of its ${this.cap} polls.)`;
+		if (this.cutShort) return ` — cdkd's shared ~${minutes}-minute delete allowance was already spent, so this wait made only ${this.ran} of its ${cap} polls and AWS was not given a real wait. Nothing is necessarily wrong with the table; re-run the destroy.`;
+		return ` (cdkd's shared ~${minutes}-minute delete allowance capped this wait at ${this.ran} of its ${cap} polls.)`;
 	}
 };
 function beginDeleteWait(cap, budget) {
@@ -48518,6 +48601,11 @@ var DynamoDBGlobalTableProvider = class {
 		const warn = log.warn;
 		log.debug(`Creating DynamoDB GlobalTable ${logicalId}`);
 		const desiredReplicaTags = refuseMalformedReplicaTags(properties, resourceType, logicalId);
+		const disassociationRefusal = disassociationProtectionRefusal(properties, void 0, logicalId);
+		if (disassociationRefusal !== void 0) {
+			if (context?.replayingState !== true) throw new ProvisioningError(log.mask(disassociationRefusal), resourceType, logicalId);
+			warn(`${disassociationRefusal} Proceeding: this create replays a cdkd state record.`);
+		}
 		const tableName = properties["TableName"] || generatedNameFor("AWS::DynamoDB::GlobalTable", logicalId);
 		const keySchema = properties["KeySchema"];
 		const attributeDefinitions = properties["AttributeDefinitions"];
@@ -48689,6 +48777,7 @@ var DynamoDBGlobalTableProvider = class {
 				await this.applyCrossRegionReplicaTagsDiff(tableInfo.tableArn, region, void 0, replicaTags, resourceType, logicalId, tableName, maskSecrets);
 			}
 			await this.applyReplicaSettings(tableName, logicalId, currentRegion, wiringProperties, void 0, /* @__PURE__ */ new Set(), false, replayWarn(log, context).onUnusable !== void 0, /* @__PURE__ */ new Set(), void 0, warn, maskSecrets);
+			await this.convergeReplicaDisassociationProtection(tableName, logicalId, currentRegion, wiringProperties, void 0, context?.replayingState === true ? "replay" : "template", warn, maskSecrets);
 			const createTtl = planTimeToLive(properties["TimeToLiveSpecification"], void 0, "create");
 			if (createTtl.kind === "enable") await this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
 				TableName: tableName,
@@ -48816,14 +48905,14 @@ var DynamoDBGlobalTableProvider = class {
 			DeletionProtectionEnabled: enabled
 		}));
 	}
-	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget) {
+	async waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, budget, member = "DeletionProtectionEnabled", replicaClient = this.getRegionalClient(region)) {
 		const wait = beginDeleteWait(60, budget);
-		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} deletion-protection change on ${tableName}`));
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB replica ${region} ${member === "DeletionProtectionEnabled" ? "deletion-protection" : "disassociation-protection"} change on ${tableName}`));
 		try {
 			while (wait.nextPoll()) {
 				if (watch.isInterrupted()) throw watch.onInterrupted();
-				const replica = await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: tableName }));
-				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table.DeletionProtectionEnabled === enabled) {
+				const replica = await replicaClient.send(new DescribeTableCommand({ TableName: tableName }));
+				if (replica.Table?.TableStatus === "ACTIVE" && replica.Table[member] === enabled) {
 					if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
 				}
 				await new Promise((resolve) => setTimeout(resolve, REPLICA_PROTECTION_SETTLE_POLL_MS));
@@ -48831,7 +48920,7 @@ var DynamoDBGlobalTableProvider = class {
 		} finally {
 			watch.dispose();
 		}
-		throw new ProvisioningError(maskSecrets(`DeletionProtectionEnabled=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		throw new ProvisioningError(maskSecrets(`${member}=${enabled} on the ${region} replica of ${tableName} did not settle within ${wait.pollsRun} polls${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 	async convergeReplicaDeletionProtection(tableName, logicalId, currentRegion, previousProperties, properties, addedRegions, desiredFromReadback, warn, maskSecrets) {
 		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
@@ -48860,6 +48949,63 @@ var DynamoDBGlobalTableProvider = class {
 			if (typeof live === "boolean" && live !== newDpe) await this.setReplicaDeletionProtection(tableName, region, newDpe, logicalId, maskSecrets);
 		}
 	}
+	async convergeReplicaDisassociationProtection(tableName, logicalId, currentRegion, properties, previousProperties, origin, warn, maskSecrets) {
+		const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+		let wrote = false;
+		const multiRegion = isMultiRegionReplicaSet(properties);
+		for (const entry of desired) {
+			const replica = asRecord(entry);
+			const region = replica?.["Region"];
+			if (typeof region !== "string" || region === "") continue;
+			const declared = readReplicaDisassociationProtection(replica);
+			const previous = previousProperties === void 0 ? void 0 : readReplicaDisassociationProtection(localReplicaEntry(previousProperties, region));
+			const clientFor = () => region === currentRegion ? this.dynamoDBClient : this.getRegionalClient(region);
+			const readLive = async () => {
+				const client = clientFor();
+				try {
+					return (await client.send(new DescribeTableCommand({ TableName: tableName }))).Table?.DisassociationProtectionEnabled;
+				} catch (readError) {
+					this.logger.debug(maskSecrets(`Could not read ${DISASSOCIATION_PROTECTION_KEY} on the ${region} replica of ${tableName}: ${describeAwsFailure(readError).detail}`));
+					return;
+				}
+			};
+			if (!multiRegion) {
+				if (declared !== void 0) {
+					const message = `${DISASSOCIATION_PROTECTION_KEY}=${declared} on the ${region} replica of ${tableName} is not sent: DynamoDB applies it only to a replica of a multi-Region global table, and this table's Replicas name a single Region.`;
+					const justShrunk = previousProperties !== void 0 && isMultiRegionReplicaSet(previousProperties);
+					if (origin === "template" && (justShrunk || declared !== previous)) warn(message);
+					else this.logger.debug(maskSecrets(message));
+				} else if (origin !== "readback" && replica?.[DISASSOCIATION_PROTECTION_KEY] === void 0 && previous !== void 0) warn(`${DISASSOCIATION_PROTECTION_KEY} was removed from the ${region} replica of ${tableName}, whose Replicas now name a single Region, so nothing is sent and the replica keeps its current setting (${previous} when last deployed).`);
+				continue;
+			}
+			if (declared === void 0) {
+				if (replica?.[DISASSOCIATION_PROTECTION_KEY] !== void 0 || previous === void 0) continue;
+				if (origin === "template") warn(`${DISASSOCIATION_PROTECTION_KEY} was removed from the ${region} replica of ${tableName}; DynamoDB keeps the replica's current setting (${previous} when last deployed), so nothing is sent. Declare it to change it.`);
+				else if (origin === "replay" && previous === false && await readLive() === false) {
+					await this.setReplicaDisassociationProtection(tableName, region, clientFor(), true, logicalId, maskSecrets);
+					wrote = true;
+				}
+				continue;
+			}
+			const changed = declared !== previous || isUnsettled("Replicas");
+			const live = await readLive();
+			if (live === declared) continue;
+			if (live === void 0 && !changed) continue;
+			await this.setReplicaDisassociationProtection(tableName, region, clientFor(), declared, logicalId, maskSecrets);
+			wrote = true;
+		}
+		if (wrote) await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+	}
+	async setReplicaDisassociationProtection(tableName, region, client, enabled, logicalId, maskSecrets) {
+		await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets, client === this.dynamoDBClient ? {} : { region });
+		markUnsettled("Replicas");
+		this.logger.debug(maskSecrets(`Sending UpdateTable ${DISASSOCIATION_PROTECTION_KEY}=${enabled} to the ${region} replica of ${tableName}`));
+		await client.send(new UpdateTableCommand({
+			TableName: tableName,
+			DisassociationProtectionEnabled: enabled
+		}));
+		await this.waitForReplicaProtectionSettled(tableName, region, enabled, logicalId, maskSecrets, void 0, DISASSOCIATION_PROTECTION_KEY, client);
+	}
 	async convergeReplicaSettings(tableName, logicalId, currentRegion, properties, addedRegions, maskSecrets) {
 		const kept = (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map(asRecord).filter((r) => typeof r?.["Region"] === "string" && r["Region"] !== currentRegion && !addedRegions.has(r["Region"]));
 		if (kept.every((r) => readReplicaTableClass(r) === void 0)) return;
@@ -49454,6 +49600,11 @@ var DynamoDBGlobalTableProvider = class {
 		const debug = log.debug;
 		debug(`Updating DynamoDB GlobalTable ${logicalId}: ${log.value(physicalId)}`);
 		refuseMalformedReplicaTags(properties, resourceType, logicalId, physicalId);
+		const disassociationRefusal = disassociationProtectionRefusal(properties, previousProperties, logicalId);
+		if (disassociationRefusal !== void 0) {
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(log.mask(disassociationRefusal), resourceType, logicalId, physicalId);
+			warn(`${disassociationRefusal} Proceeding: this update restores a recorded or read-back configuration.`);
+		}
 		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
 		const replaceRemedy = async () => {
 			let guardRegion = "";
@@ -49732,7 +49883,10 @@ var DynamoDBGlobalTableProvider = class {
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
 				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings");
-				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
+				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) {
+					markUnsettled("GlobalSecondaryIndexes");
+					for (const indexUpdate of billingUpdate.GlobalSecondaryIndexUpdates) debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Update for index ${maskSecrets(indexUpdate.Update?.IndexName ?? "")} on ${physicalId} (with the billing mode change)`);
+				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(billingUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
@@ -49856,6 +50010,7 @@ var DynamoDBGlobalTableProvider = class {
 				"streamTags"
 			] : context?.replayingState === true ? ["pitr"] : []);
 			await this.applyReplicaSettings(physicalId, logicalId, currentRegion, properties, previousProperties, addedReplicaRegions, !deepEqual(asRecord(properties["StreamSpecification"])?.["StreamViewType"], asRecord(previousProperties["StreamSpecification"])?.["StreamViewType"]), context?.replayingState === true || context?.desiredFromAwsReadback === true, replicaKeepOnRemoval, describeResp.Table?.LatestStreamArn, warn, maskSecrets);
+			await this.convergeReplicaDisassociationProtection(physicalId, logicalId, currentRegion, properties, previousProperties, context?.desiredFromAwsReadback === true ? "readback" : context?.replayingState === true ? "replay" : "template", warn, maskSecrets);
 			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock, maskSecrets);
 			const previousSdkIndexes = previousGsiUnusable ? buildLiveRecoveryGsiBaseline(desiredSdkIndexes, describeResp.Table?.GlobalSecondaryIndexes, {
 				carryLiveValues: oldBilling === newBilling && liveBillingMode === newBilling,
@@ -49879,6 +50034,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (!gsi.IndexName) continue;
 				const gsiUpdate = { Delete: { IndexName: gsi.IndexName } };
 				markUnsettled("GlobalSecondaryIndexes");
+				debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Delete for index ${maskSecrets(gsi.IndexName)} on ${physicalId}`);
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -49897,6 +50053,7 @@ var DynamoDBGlobalTableProvider = class {
 					...addedWarmToSend && { WarmThroughput: addedWarmToSend }
 				} };
 				markUnsettled("GlobalSecondaryIndexes");
+				debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Create for index ${maskSecrets(gsi.IndexName ?? "")} on ${physicalId}`);
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					AttributeDefinitions: newAttrs,
@@ -49939,6 +50096,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				const gsiUpdate = { Update: update };
 				markUnsettled("GlobalSecondaryIndexes");
+				debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Update for index ${maskSecrets(gsi.IndexName ?? "")} on ${physicalId}`);
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
@@ -50570,13 +50728,16 @@ var DynamoDBGlobalTableProvider = class {
 				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel, declaredReplica);
 				Object.assign(entry, subs);
 				let protection;
+				let disassociationProtection;
 				let streamArn;
 				if (isLocal) {
 					protection = table.DeletionProtectionEnabled;
+					disassociationProtection = table.DisassociationProtectionEnabled;
 					streamArn = table.LatestStreamArn;
 				} else try {
 					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
 					protection = regional.Table?.DeletionProtectionEnabled;
+					disassociationProtection = regional.Table?.DisassociationProtectionEnabled;
 					streamArn = regional.Table?.LatestStreamArn;
 				} catch (err) {
 					if (strictFor("Replicas") && !(err instanceof ResourceNotFoundException$1)) throw err;
@@ -50584,6 +50745,7 @@ var DynamoDBGlobalTableProvider = class {
 					else this.logger.debug(safeMsg`Could not read the ${regionLabel} replica of ${tableNameForSubs}: ${describeAwsFailure(err).detail}`);
 				}
 				if (typeof protection === "boolean") entry["DeletionProtectionEnabled"] = protection;
+				if (typeof disassociationProtection === "boolean" && declaredReplica?.[DISASSOCIATION_PROTECTION_KEY] !== void 0) entry[DISASSOCIATION_PROTECTION_KEY] = disassociationProtection;
 				await this.readReplicaPolicies(client, tableNameForSubs, regionLabel, replicaArn, streamArn, declaredReplica, afterOwnWrite, entry);
 				if (replicaArn) try {
 					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
@@ -50979,6 +51141,46 @@ function refuseMalformedReplicaTags(properties, resourceType, logicalId, physica
 	});
 	return tagsByReplica;
 }
+const DISASSOCIATION_PROTECTION_KEY = "DisassociationProtectionEnabled";
+function disassociationProtectionRefusal(properties, previousProperties, logicalId) {
+	const replicas = properties["Replicas"];
+	if (!Array.isArray(replicas)) return void 0;
+	const malformed = [];
+	const singleRegion = [];
+	const multiRegion = isMultiRegionReplicaSet(properties);
+	replicas.forEach((entry, index) => {
+		const replica = asRecord(entry);
+		if (replica === void 0) return;
+		const refusal = configBooleanRefusal(replica, DISASSOCIATION_PROTECTION_KEY, `Replicas[${index}]`);
+		if (refusal !== void 0) {
+			malformed.push(refusal);
+			return;
+		}
+		const declared = readReplicaDisassociationProtection(replica);
+		if (declared === void 0 || multiRegion) return;
+		const region = replica["Region"];
+		const previous = previousProperties === void 0 || typeof region !== "string" ? void 0 : readReplicaDisassociationProtection(localReplicaEntry(previousProperties, region));
+		if (declared === false && declared !== previous) singleRegion.push(`Replicas[${index}].${DISASSOCIATION_PROTECTION_KEY}`);
+	});
+	const parts = [];
+	if (malformed.length > 0) parts.push(`${malformed.join("; ")}. That replica's disassociation protection is left as it is.`);
+	if (singleRegion.length > 0) parts.push(`${singleRegion.join(", ")} is applied by DynamoDB only to a replica of a multi-Region (MREC) global table, and this table's Replicas name a single Region, so cdkd does not send it. Remove ${DISASSOCIATION_PROTECTION_KEY}, or add a replica in another Region.`);
+	if (parts.length === 0) return void 0;
+	return `AWS::DynamoDB::GlobalTable ${logicalId}: ${parts.join(" ")}`;
+}
+function isMultiRegionReplicaSet(properties) {
+	const replicas = properties["Replicas"];
+	if (!Array.isArray(replicas)) return false;
+	const regions = /* @__PURE__ */ new Set();
+	for (const entry of replicas) {
+		const region = asRecord(entry)?.["Region"];
+		if (typeof region === "string" && region !== "") regions.add(region);
+	}
+	return regions.size > 1;
+}
+function readReplicaDisassociationProtection(replica) {
+	return coerceCfnBoolean(replica?.[DISASSOCIATION_PROTECTION_KEY]);
+}
 function completeLegacyLocalReplica(baseline, aws, localRegion) {
 	const key = "Replicas";
 	const baselineReplicas = baseline[key];
@@ -53262,6 +53464,8 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 			unwritten,
 			routeDriving: findActionableSilentDrops(resourceType, desiredForSkipCheck, allowedForRecord, currentProps).map(({ property }) => property),
 			nested: engine.options.parentStackInfo !== void 0,
+			nowWritten: findHandledUnwrittenCreateOnly(resourceType, currentProps, createOnlyEvidence),
+			evidence: [...createOnlyEvidence],
 			protectionEvidence: recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, engine.stackRegion)
 		}), "CREATE_ONLY_DROP_NEEDS_REPLACEMENT")));
 	}
@@ -53373,13 +53577,34 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 }
 function unwrittenCreateOnlyRefusal(input) {
 	const { logicalId, resourceType, unwritten, routeDriving, nested, protectionEvidence } = input;
+	const nowWritten = (input.nowWritten ?? []).filter((property) => unwritten.includes(property));
+	if (nowWritten.length > 0) return nowWrittenCreateOnlyRefusal({
+		...input,
+		nowWritten
+	});
 	const one = unwritten.length === 1;
 	const list = unwritten.join(", ");
 	const keep = [.../* @__PURE__ */ new Set([...unwritten, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
-	const replaceFlags = nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
+	const replaceFlags = unwrittenReplaceFlags(logicalId, nested);
 	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
 	return safeMsg`${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the ` + `state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through ` + safeMsg`Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only ` + `property means replacing the resource, which cdkd does not do on its own. This ` + safeMsg`resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a ` + `stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? safeMsg` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + safeMsg` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
 }
+function unwrittenReplaceFlags(logicalId, nested) {
+	return nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
+}
+function nowWrittenCreateOnlyRefusal(input) {
+	const { logicalId, resourceType, unwritten, routeDriving, nested, protectionEvidence } = input;
+	const nowWritten = input.nowWritten;
+	const one = unwritten.length === 1;
+	const list = unwritten.join(", ");
+	const written = nowWritten.join(", ");
+	const writtenOne = nowWritten.length === 1;
+	const stillDropped = unwritten.filter((property) => !nowWritten.includes(property));
+	const keep = [.../* @__PURE__ */ new Set([...stillDropped, ...routeDriving])].filter((property) => !nowWritten.includes(property)).sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
+	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
+	const replaceFlags = unwrittenReplaceFlags(logicalId, nested);
+	return safeMsg`${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the ` + `state record holds ${one ? "it" : "them"} although the SDK provider that built the resource did not write ${one ? "it" : "them"} (an earlier deploy accepted dropping ${one ? "it" : "them"} with --prefer-sdk-route), so AWS does not. ` + safeMsg`This cdkd version's SDK provider writes ${written}, so no flag keeps ` + `${writtenOne ? "it" : "them"} dropped any more` + (routed.length > 0 ? safeMsg`, and this deploy routes the resource through Cloud Control (--prefer-sdk-route does not cover ${routed})` : "") + "; applying a create-only property means replacing the resource, which cdkd does not do on its own. This " + safeMsg`resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a ` + `stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? safeMsg` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + safeMsg` To keep the resource as it is, remove ${written} from the template` + (keep.length > 0 ? safeMsg` and re-run with --prefer-sdk-route ${keep}.` : ".") + (nested || stillDropped.length > 0 || (input.evidence ?? []).some((property) => !nowWritten.includes(property)) ? "" : safeMsg` If AWS already holds ${written} (cdkd drift compares it), re-record the ` + safeMsg`resource instead: cdkd import with --resource '${logicalId}=PHYSICAL_ID' (its physical ` + `id, quoted) and --force writes a record without this evidence and changes nothing in AWS.`);
+}
 function scalarLeavesOf(value, into = /* @__PURE__ */ new Set()) {
 	if (typeof value === "string") into.add(value);
 	else if (typeof value === "number") into.add(String(value));
@@ -55273,5 +55498,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { IMPLICIT_DELETE_DEPENDENCIES as $, envCredentialsAreAssumedRole as $a, maskSecretsInError as $c, withPrintingSecrets as $i, PhaseClock as $l, resourcesNamingDeclaredParameter as $n, malformedScrubResourceEntriesRefusalMessage as $o, noEchoComparisonForTemplate as $r, coerceCfnBoolean as $s, isAccessDeniedError as $t, stateBucketExistenceConfirmed as $u, DYNAMODB_DELETE_POLL_COST_MS as A, poisonRenderedSpellingsCollidingIn as Aa, noEchoOutputsComparison as Ac, injectedAwsRegionValue as Ad, DeploymentEventsStore as Ai, rebuildClientForBucketRegion as Al, replacementNeverSwapped as An, displayLogicalId as Ao, proposeRenames as Ar, repairMalformedResourcePropertiesForReadOnly as As, NESTED_PENDING_PARENT_REASON as At, isDockerClientEnvKey as Au, relayedIndexBusyDelete as B, keepHeldTokenProvenance as Ba, snapshotPassProvenance as Bc, tagPlanWarning as Bi, acceptedCreateOnlyDropsOf as Bl, redactedDeleteAddressSkip as Bn, malformedLocalResourceEntriesWarning as Bo, red as Br, NO_CC_HANDLERS_REASON as Bs, collectNestedChildUnaddressed as Bt, getDockerImageBySourceHash as Bu, planContributorInsightsOp as C, isUsableAttemptedName as Ca, isMarkedCoordinate as Cc, ownValue as Cd, unsupportedFinalSnapshotError as Ci, recordProvenPublicExpression as Cl, demoteSupersededOrphans as Cn, JSON_LISTING_HOLE_VALUE as Co, movedToHint as Cr, refuseMalformedResourcesForDestroy as Cs, makeCanonicalizePropertiesFn as Ct, describeDockerCapturedOutput as Cu, reverseMapTableContributorInsights as D, withUnsettledProperties as Da, maskedLeafCoordinatesOf as Dc, renderAssemblyPathEscape as Dd, withCreateTokenLedger as Di, LockManager as Dl, planRollback as Dn, UNREADABLE_RESOURCES_MAP_ROW as Do, looselyEqual as Dr, repairMalformedOrphansForReadOnly as Ds, resolvePendingCloudControlRequests as Dt, finchSecretArgvRefusal as Du, reverseMapIndexContributorInsights as E, unsettledPropertiesOf as Ea, maskWholeValue as Ec, displayAssemblyPath as Ed, reserveStackCreateToken as Ei, isSingleDynamicReferenceToken as El, planFailedOps as En, UNREADABLE_ORPHANS_CONTAINER_ROW as Eo, isPairableType as Er, repairMalformedOrphanRecordsForReadOnly as Es, pendingRequestCount as Et, dockerSpawnEnvWithSensitive as Eu, resolveDynamoDbDeleteBudgetMs as F, s3BucketRegionalDomainName as Fa, valueAtCoordinate as Fc, DBPROXY_TAG_OPTIONS as Fi, isAccessDenied$1 as Fl, getCurrentProducerRegions as Fn, isReadableResourceEntry as Fo, replacedDeleteFailureVerdict as Fr, withheldAccountClause as Fs, nestedChildStackName as Ft, redactedDockerCause as Fu, readTtlSpec as G, assertFlagRoleArn as Ga, logOnlyValueCount as Gc, ccBrokenReason as Gi, hasUnverifiableParameterRefusal as Gl, nameScopeOf as Gn, malformedOrphansRefusalMessage as Go, isSupersededResourceRecord as Gr, isStatefulRecreateTargetForReplace as Gs, dropFailedHint as Gt, loadCdkJson as Gu, isTtlAlreadyDisabled as H, recordedOutputReferenceRegions as Ha, createUnionSecretMasker as Hc, stringifyIfAssigned as Hi, exportNamesCarriedFrom as Hl, updatePartialReason as Hn, malformedOrphanRecordsRefusalMessage as Ho, addSuperseded as Hr, findReplacedReadersOfRecreateTargets as Hs, withNestedStackContext as Ht, synthesisStatusMessage as Hu, DELETE_INDEX_WAIT_PROCEED_NOTE as I, s3BucketWebsiteUrl as Ia, liveMatchesUnresolvedTokenFrame as Ic, planTagDiff as Ii, isNotImplemented as Il, inheritProducerRegions as In, malformedDriftResourcePropertiesWarning as Io, bold as Ir, findActionableSilentDrops as Is, recordDisplacedSkips as It, runDockerForeground as Iu, S3_AUTO_DELETE_OBJECTS_TAG as J, isIamRoleArn as Ja, recordLogOnlyValue as Jc, waitForLambdaFunctionActive as Ji, isReadableBag as Jl, retiredNameGenerationsLeaving as Jn, malformedOutputsWarning as Jo, supersededHeldByOtherTypeWarning as Jr, WARM_THROUGHPUT_MEMBERS as Js, loadJournaledOrphans as Jt, resolveCaptureObservedState as Ju, sendTtlWaitingOutRateLimit as K, assertSendableRoleArn as Ka, printingCorpusOf as Kc, isCustomResource as Ki, importableOutputKeys as Kl, retiredAfterRollback as Kn, malformedOrphansWarning as Ko, removeSuperseded as Kr, isStatefulRecreateTargetSync as Ks, isHandledOrphan as Kt, resolveApp as Ku, INDEX_SETTLE_POLL_INTERVAL_MS as L, resolveDynamicReferences as La, markSameGenerationBag as Lc, readTagList as Li, stackInstanceIdOf as Ll, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ln, malformedExportNamesWarning as Lo, cyan as Lr, findSilentDropProperties as Ls, revertNestedChildFromJournal as Lt, runDockerStreaming as Lu, compensateRemovedDeletionProtection as M, s3BucketArn as Ma, readbackPathFor as Mc, resolveBucketRegion as Md, isRefusedByName as Mi, CrossPrefixScanCache as Ml, seedsDeleteFirstGuard as Mn, hasReadableOutputs as Mo, destroyStackRecordsView as Mr, unpreviewableOrphanRecords as Ms, displacedPhysicalIdShown as Mt, partitionSensitiveEnv as Mu, deleteBudgetKey as N, s3BucketDomainName as Na, readsNoEchoSource as Nc, markDeleteStarted as Ni, applyCrossPrefixScan as Nl, orphanNeedsIdentity as Nn, hasReadableResources as No, getStackRecords as Nr, unreadableOrphanRecords as Ns, dropSettledNestedJournals as Nt, redactDockerArgvValues as Nu, stripIndexContributorInsights as O, withoutUnsettledProperties as Oa, noEchoCoordinatesOf as Oc, resolveAssemblyPath as Od, acquireIdempotencyToken as Oi, isLockInfoExpired as Ol, recheckFailedPlan as On, accountArgs as Oo, mappingPairs as Or, repairMalformedOutputsForReadOnly as Os, keptForRetainedRecord as Ot, formatDockerLoginError as Ou, resolveDynamoDbDeleteBudgetClock as P, s3BucketDualStackDomainName as Pa, recordedNoEchoValuesOf as Pc, DBPROXY_TAGS_WHAT as Pi, crossPrefixDeniedWarning as Pl, findNestedStackTypeChanges as Pn, isReadableOrphanRecord as Po, withStackRecords as Pr, unreadableResourceEntries as Ps, getNestedRevertRun as Pt, redactedCause as Pu, markRefusedBeforeApplying as Q, callerEnvCredentials as Qa, errorCauseChain as Qc, getCurrentResourceSecrets as Qi, stackInstanceIdCarriedFrom as Ql, reachableDivergentParameters as Qn, malformedResourcesWarning as Qo, noEchoAttributeNamesOf as Qr, toFiniteNumber as Qs, chunks as Qt, resolveUseCdkBootstrapAssets as Qu, deleteTableWithIndexBusyRetry as R, producerLookupOver as Ra, redactForState as Rc, refuseMalformedDesiredTags as Ri, withStackInstanceIdWithheld as Rl, isRedactedRecordedValue as Rn, malformedExportSourceWarning as Ro, gray as Rr, unwrittenCreateOnlyReplacement as Rs, revertedNestedRowIds as Rt, warnFinchArgvExposure as Ru, indexDeclaresContributorInsights as S, INTRINSIC_KEYS as Sa, canonicalCoordinates as Sc, nullPrototypeRecord as Sd, refusesFinalSnapshot as Si, recordNoEchoParameterFreshValue as Sl, undeclaredEmptyObservedKeys as Sn, declaresNoEcho as So, hintSidesOf as Sr, refuseMalformedResourcesForDeploy as Ss, mergeNoChangeOutputs as St, resolveDockerContextDirectory as Su, readContributorInsightsSpec as T, unsettledItemsOf as Ta, maskReadbackAtCoordinates as Tc, describeFileReadFailure as Td, ledgerForStack as Ti, WHOLE_DYNAMIC_REFERENCE_PATTERN as Tl, isReplacementOrphan as Tn, STATE_RESOURCES_MALFORMED as To, withMovedTo as Tr, refuseMalformedState as Ts, planOrphanAdoption as Tt, describeDockerFailure as Tu, isTtlRateLimited as U, recordedReferenceRegions as Ua, hasMaskableValues as Uc, CC_BROKEN_REASON as Ui, hasReadableExportSet as Ul, nameGenerationCarriedFrom as Un, malformedOrphanRecordsWarning as Uo, deleteSupersededEntry as Ur, shownType as Us, deleteJournaledOrphans as Ut, getDefaultStateBucketName as Uu, waitForIndexesSettled as V, outputReferenceProvenanceOf as Va, carryLogOnlyValues as Vc, definedAttributes as Vi, describeRegionValueKind as Vl, updatePartialMessage as Vn, malformedLocalResourcesWarning as Vo, yellow as Vr, hasNoCloudControlHandlers as Vs, getCurrentNestedStackContext as Vt, Synthesizer as Vu, planTimeToLive as W, applyRoleArnIfSet as Wa, literalSplitDelimitersOf as Wc, ProviderRegistry as Wi, hasReasonlessBaselineRefusal as Wl, nameGenerationHighWaterOf as Wn, malformedOrphanRowsKeptWarning as Wo, holdsSupersededResources as Wr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ws, dropFailedCommands as Wt, getLegacyStateBucketName as Wu, isTruthyCfnBoolean as X, AWS_CREDENTIAL_ENV_KEYS as Xa, unionOfSecretBags as Xc, readsNoEchoDeleteValues as Xi, orphansCarriedFrom as Xl, computeParameterTaint as Xn, malformedResourceEntriesWarning as Xo, supersededResourcesOf as Xr, isWarmThroughputDecrease as Xs, sameJournaledOrphans as Xt, resolveStateBucketWithDefault as Xu, hasCdkAutoDeleteTag as Y, sendableAssumeRoleCommand as Ya, shareLogOnlyValues as Yc, TemplateNoEchoReresolver as Yi, orphansAfterRollback as Yl, withNameGenerationReached as Yn, malformedRenderedContainersWarning as Yo, supersededHolderOf as Yr, coerceWarmThroughput as Ys, makeForeignHolderScan as Yt, resolveSkipPrefix as Yu, getPriorAttempts as Z, applyCallerIdentityCredentials as Za, createSecretMasker as Zc, isCustomResourceType as Zi, shouldRetainResource as Zl, namesAnyDeclaredParameter as Zn, malformedResourcePropertiesWarning as Zo, withoutSuperseded as Zr, toCfnInteger as Zs, formatResourceLine as Zt, resolveStateBucketWithDefaultAndSource as Zu, streamMemberRefusals as _, isTerminationProtectionPropagationError as _a, canonicalLambdaFunctionName as _c, parseFailureDebugDetail as _d, buildFinalSnapshotIdentifier as _i, carriesSecretMask as _l, settleUnsettledPrevious as _n, refStateLookupFromResource as _o, maskingRetryLogger as _r, refuseMalformedResourceEntriesForOrphan as _s, enclosingDeadlineRemainingMs as _t, readBootstrapMarkerBody as _u, isProtectionValueActive as a, onlySecretReferencesDiffer as aa, replayWarn as ac, findLargeInlineResources as ad, journaledOrphanPrintingBag as ai, dynamicReferenceTokens as al, refactorMarkerRefusalMessage as an, isUnboundTemplateParameter as ao, secretSafeKeyDisplay as ar, refuseMalformedOrphanRecordsForDestroy as as, serviceTokenBlockingReason as at, WorkGraph as au, CONTRIBUTOR_INSIGHTS_KEY as b, reEnableInstanceApiTermination as ba, DagBuilder as bc, hasOwnKey as bd, effectiveDeletionPolicy as bi, recordMaskOnlyValuesIn as bl, equalModuloMarkedMask as bn, parameterInputsFor as bo, formatDestructiveChange as br, refuseMalformedResourcePropertiesForExport as bs, isSecretBearingReferenceString as bt, buildDenyExternalAccessPolicy as bu, DynamoDBGlobalTableProvider as c, UNSPECIFIED_SKIP_REASON as ca, requireConfigString as cc, decodeListingKey as cd, orphanRecordsPrintingBag as ci, spelledKeysOf as cl, updateRefactorMarker as cn, isImpossibleEmptyStoredAttribute as co, exportNameSecretExposure as cr, refuseMalformedOrphansForOrphan as cs, isAbsoluteAssetPath as ct, loadPublishableAssetManifest as cu, declaredStreamPolicyMember as d, deleteSkipReason as da, describeTypeWithThrottleRetry as dc, canonicalizeRegion as dd, secretNamedAttributeNamesOf as di, recordNestedStackParameterExpressions as dl, pendingMovesRefusalMessage as dn, isNamelessDynamicReferenceError as do, collectDeclaredOutputNames as dr, refuseMalformedResourceAttributesForOrphan as ds, templateIdentity as dt, BOOTSTRAP_MARKER_PREFIX as du, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as ea, coerceCfnInteger as ec, warnDeprecatedNoPrefixCliFlag as ed, noEchoExactEchoLeavesOf as ei, maskSecretsInText as el, lookupEachName as en, classifyRecordedSecretRegion as eo, WITHHELD_NAME_DISPLAY as er, malformedStateRefusalMessage as es, computeImplicitDeleteEdges as et, renderPhaseTimings as eu, declaredStreamTagsMember as f, withIndeterminateGuard as fa, withRetry as fc, derivePartitionAndUrlSuffix as fd, secretNamedRecordNeedles as fi, recoverMaskedOutput as fl, refusePendingMovesOut as fn, keepsSecretReferenceToken as fo, collectPublishedOutputNames as fr, refuseMalformedResourceEntries as fs, conditionFingerprint as ft, assertAssetBucketRegion as fu, streamDeclaresTags as g, ec2InstanceProtectionSite as ga, emrClusterInstancesReplaced as gc, describeJsonParseFailure as gd, PRE_DELETE_SNAPSHOT_TYPES as gi, splitGetAttStringForm as gl, recordAfterRollbackUpdate as gn, lacksRecordedTableArn as go, DEFAULT_RESOURCE_WARN_AFTER_MS as gr, refuseMalformedResourceEntriesForImportSave as gs, enclosingDeadlineExpired as gt, parseBootstrapMarker as gu, streamDeclaresPolicy as h, disableInstanceApiTermination as ha, ecsServiceLaunchTypeSetOrChanged as hc, processStackMessages as hd, ATOMIC_FINAL_SNAPSHOT_TYPES as hi, recordPhysicalNameCopy as hl, removeProtectionTypeList as hn, isStalePlaceholderArnAttribute as ho, DEFAULT_RESOURCE_TIMEOUT_MS as hr, refuseMalformedResourceEntriesForImport as hs, readRecordedConditionVerdicts as ht, isCrossRegionRedirect as hu, PROTECTION_PROPERTY_BY_TYPE as i, slowCcOperationTimeoutMs as ia, readConfigString as ic, MIGRATE_TMP_PREFIX as id, completedReplayEntries as ii, DYNAMIC_REFERENCE_TOKEN_SCAN as il, refactorMarkerMovesOf as in, coerceParameterTypedValue as io, secretBearingStateKeyWarning as ir, refuseMalformedOrphanRecords as is, findServiceTokenRefusals as it, stringifyValue as iu, beginDeleteWait as j, isSettledInstanceState as ja, passedNoEchoParametersOf as jc, clearBucketRegionCache as jd, extractDeploymentEventError as ji, CrossPrefixReadError as jl, resolveReplacementOldType as jn, hasReadableOrphans as jo, awaitInFlightSibling as jr, repairMalformedResourcesForReadOnly as js, displacedOpClause as jt, isMalformedEnvKey as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, IntrinsicFunctionResolver as ka, noEchoLeavesOf as kc, injectAwsRegion as kd, DeploymentEventsReader as ki, S3StateBackend as kl, recordUnderIdIsNotOwn as kn, deployRefusesOrphanRowsReason as ko, parseMappingFile as kr, repairMalformedResourceEntriesForReadOnly as ks, recordRetainedForReadoption as kt, getDockerCmd as ku, STREAM_POLICY_KEY as l, deleteIndeterminateGuards as la, prefetchCreateOnlyPropertyPaths as lc, expectedOwnerParam as ld, secretNamePrintingBag as li, identityKeyFor as ll, hasPendingMovesOut as ln, carriesDynamicReference as lo, isWholeDynamicReferenceValue as lr, refuseMalformedOutputs as ls, listNestedTemplateRows as lt, rewriteTemplateAssetReferences as lu, reverseMapStreamPolicy as m, markWaitAbandoned as ma, dbInstanceEngineChangeIsInPlace as mc, StageLoadError as md, storedSecretNameNeedles as mi, recordAttributeIdCopy as ml, replayRollback as mn, cfnRefValueFromPhysicalId as mo, bindingSkippedOutputs as mr, refuseMalformedResourceEntriesForDestroy as ms, parentSuppliedValues as mt, getBootstrapMarkerKey as mu, recordedProtectionEvidence as n, customResourceResponseExpirationWarning as na, configIntegerRefusal as nc, CFN_TEMPLATE_BODY_LIMIT as nd, withAttemptedItemsMasked as ni, withPhysicalNameCopies as nl, readRefactorMarker as nn, producerRegionsFromState as no, exportAliasCollisionScrubWarning as nr, refuseDivergentRecordRegionForDestroy as ns, inheritedProvenanceForChildDiff as nt, AssetPublisher as nu, perType as o, unchangedBehindSecretReference as oa, requireConfigArray as oc, uploadCfnTemplate as od, maskEventTextWithBoundBags as oi, isUncertifiedBaselineMaskPosition as ol, refuseRefactorMarker as on, parameterTypeMayLoseSecretIdentity as oo, carriedExportAliasExposure as or, refuseMalformedOrphans as os, childTemplateLoader as ot, buildAssetRedirectMap as ou, planStreamMemberOps as p, isWaitAbandonedError as pa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as pc, AssemblyReader as pd, stateSecretNameNeedles as pi, physicalNameCopiesOf as pl, replayFailedOperations as pn, AWS_NO_VALUE as po, isExportAliasCollision as pr, refuseMalformedResourceEntriesForDeploy as ps, conditionInputsFrom as pt, ensureAssetStorage as pu, ECR_AUTO_DELETE_IMAGES_TAG as q, explicitRoleArnOrThrow as qa, recordLogOnlyParameterValue as qc, wouldReturnToSdkProvider as qi, importableOutputs as ql, retiredNameGenerationsAfter as qn, malformedOutputsRefusalMessage as qo, supersededAfterRollback as qr, renderStatefulReason as qs, journaledOrphanLines as qt, resolveAutoAssetStorage as qu, recordedProtectionNote as r, CloudControlProvider as ra, configStringRefusal as rc, CFN_TEMPLATE_URL_LIMIT as rd, createReadOnlyAttributeHealerFactory as ri, withoutPhysicalNameCopies as rl, readRefactorMarkerOnce as rn, regionLessSecretName as ro, secretBearing as rr, refuseMalformedNestedChildOutputs as rs, deferredServiceTokenWarning as rt, isSensitiveAttributeName as ru, readProtection as s, RollbackInlinePolicyWriters as sa, requireConfigObject as sc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sd, namingSecretsWithRecordedNoEcho as si, pathCrossesDottedKey as sl, sameMove as sn, getAccountInfo as so, exportNameNoEchoParameters as sr, refuseMalformedOrphansForDestroy as ss, findNestedTemplateTreeDefect as st, createAssetRedirectResolver as su, DeployEngine as t, applyCustomResourceResponseExpiration as ta, configBooleanRefusal as tc, ssmResolvedValueType as td, noEchoParameterNamesOf as ti, scrubResourceRecord as tl, withApiLimit as tn, classifyReplaySecretRegion as to, displayTextOrWithheld as tr, previewableOrphanRecords as ts, crossStackOutputProvenanceSource as tt, timePhase as tu, STREAM_TAGS_KEY as u, deleteLeftInPlace as ua, templateResourceTypes as uc, PARTITION_TABLE as ud, secretNamePrintingBags as ui, inheritNestedStackParameterAssociations as ul, pendingMovesOutOf as un, carriesFetchableDynamicReference as uo, noEchoParameterValueSeed as ur, refuseMalformedOutputsForDestroy as us, renderNestedTemplateTreeDefect as ut, AssetModeResolver as uu, streamPolicyMatchesDeclared as v, observeThenDisableInstanceApiTermination as va, lambdaFunctionNameForMask as vc, utf8ByteLength as vd, ccRoutedFinalSnapshotError as vi, provenPublicValue as vl, withUnprovenUnsettled as vn, parseWebACLArn as vo, constructPathOf as vr, refuseMalformedResourcePropertiesForDestroy as vs, withResourceDeadline as vt, validateAssetBucketName as vu, planIndexContributorInsightsOps as w, unsettledItemsField as wa, maskAtCoordinates as wc, absoluteAssemblyPathEscape as wd, earliestDefined as wi, wholeStringLeavesOf as wl, isJournaledOrphan as wn, STATE_REGION_DIVERGED as wo, rollbackOrphanIds as wr, refuseMalformedResourcesForExport as ws, makeSiblingClaimReader as wt, describeDockerExecFailure as wu, contributorInsightsRefusals as x, DiffCalculator as xa, TemplateParser as xc, hasPlainPrototype$1 as xd, isFinalSnapshotError as xi, recordNoEchoAttributeValues as xl, equalModuloMask as xn, passedParameterClassesOf as xo, findRefactorHints as xr, refuseMalformedResourcePropertiesForOrphan as xs, keptWholeReasonText as xt, buildDockerImage as xu, streamTagsMatchDeclared as y, reDisableInstanceApiTermination as ya, sameLambdaFunctionAddress as yc, defineOwnKey as yd, createPreDeleteFinalSnapshot as yi, recordMaskOnlyValue as yl, calculateResourceDrift as yn, withSharedDrainBudget as yo, findDestructiveChanges as yr, refuseMalformedResourcePropertiesForDrift as ys, diffSecurity as yt, validateContainerRepoName as yu, maskedLogger as z, refuseUnreadableCdkCrossAccountRefs as za, recordReferenceProvenanceEntry as zc, tagMapAsList as zi, splitImportedOps as zl, redactedDeleteAddressFields as zn, malformedLocalOutputsWarning as zo, green as zr, withoutSilentDropProperties as zs, withNestedRevertRun as zt, AssetManifestLoader as zu };
-//# sourceMappingURL=deploy-engine-BF5exXUb.js.map
+export { getPriorAttempts as $, applyCallerIdentityCredentials as $a, unionOfSecretBags as $c, isCustomResourceType as $i, orphansCarriedFrom as $l, namesAnyDeclaredParameter as $n, malformedResourcePropertiesWarning as $o, withoutSuperseded as $r, isWarmThroughputDecrease as $s, formatResourceLine as $t, resolveStateBucketWithDefault as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, withoutUnsettledProperties as Aa, maskedLeafCoordinatesOf as Ac, renderAssemblyPathEscape as Ad, acquireIdempotencyToken as Ai, LockManager as Al, recheckFailedPlan as An, accountArgs as Ao, mappingPairs as Ar, repairMalformedOutputsForReadOnly as As, keptForRetainedRecord as At, finchSecretArgvRefusal as Au, deleteTableWithIndexBusyRetry as B, producerLookupOver as Ba, markSameGenerationBag as Bc, refuseMalformedDesiredTags as Bi, stackInstanceIdOf as Bl, isRedactedRecordedValue as Bn, malformedExportSourceWarning as Bo, gray as Br, findSilentDropProperties as Bs, revertedNestedRowIds as Bt, runDockerStreaming as Bu, planContributorInsightsOp as C, DiffCalculator as Ca, DagBuilder as Cc, hasOwnKey as Cd, isFinalSnapshotError as Ci, recordMaskOnlyValuesIn as Cl, equalModuloMask as Cn, passedParameterClassesOf as Co, findRefactorHints as Cr, refuseMalformedResourcePropertiesForOrphan as Cs, keptWholeReasonText as Ct, buildDenyExternalAccessPolicy as Cu, reverseMapTableContributorInsights as D, unsettledItemsOf as Da, maskAtCoordinates as Dc, absoluteAssemblyPathEscape as Dd, ledgerForStack as Di, wholeStringLeavesOf as Dl, isReplacementOrphan as Dn, STATE_RESOURCES_MALFORMED as Do, withMovedTo as Dr, refuseMalformedState as Ds, planOrphanAdoption as Dt, describeDockerExecFailure as Du, reverseMapIndexContributorInsights as E, unsettledItemsField as Ea, isMarkedCoordinate as Ec, ownValue as Ed, earliestDefined as Ei, recordProvenPublicExpression as El, isJournaledOrphan as En, STATE_REGION_DIVERGED as Eo, rollbackOrphanIds as Er, refuseMalformedResourcesForExport as Es, makeSiblingClaimReader as Et, describeDockerCapturedOutput as Eu, resolveDynamoDbDeleteBudgetClock as F, s3BucketDomainName as Fa, readbackPathFor as Fc, resolveBucketRegion as Fd, markDeleteStarted as Fi, CrossPrefixScanCache as Fl, orphanNeedsIdentity as Fn, hasReadableResources as Fo, getStackRecords as Fr, unreadableOrphanRecords as Fs, dropSettledNestedJournals as Ft, partitionSensitiveEnv as Fu, isTtlRateLimited as G, recordedReferenceRegions as Ga, createUnionSecretMasker as Gc, CC_BROKEN_REASON as Gi, exportNamesCarriedFrom as Gl, nameGenerationCarriedFrom as Gn, malformedOrphanRecordsWarning as Go, deleteSupersededEntry as Gr, findReplacedReadersOfRecreateTargets as Gs, deleteJournaledOrphans as Gt, synthesisStatusMessage as Gu, relayedIndexBusyDelete as H, keepHeldTokenProvenance as Ha, recordReferenceProvenanceEntry as Hc, tagPlanWarning as Hi, splitImportedOps as Hl, redactedDeleteAddressSkip as Hn, malformedLocalResourceEntriesWarning as Ho, red as Hr, withoutSilentDropProperties as Hs, collectNestedChildUnaddressed as Ht, AssetManifestLoader as Hu, resolveDynamoDbDeleteBudgetMs as I, s3BucketDualStackDomainName as Ia, readsNoEchoSource as Ic, DBPROXY_TAGS_WHAT as Ii, applyCrossPrefixScan as Il, findNestedStackTypeChanges as In, isReadableOrphanRecord as Io, withStackRecords as Ir, unreadableResourceEntries as Is, getNestedRevertRun as It, redactDockerArgvValues as Iu, sendTtlWaitingOutRateLimit as J, assertSendableRoleArn as Ja, logOnlyValueCount as Jc, isCustomResource as Ji, hasUnverifiableParameterRefusal as Jl, retiredAfterRollback as Jn, malformedOrphansWarning as Jo, removeSuperseded as Jr, isStatefulRecreateTargetForReplace as Js, isHandledOrphan as Jt, loadCdkJson as Ju, planTimeToLive as K, applyRoleArnIfSet as Ka, hasMaskableValues as Kc, ProviderRegistry as Ki, hasReadableExportSet as Kl, nameGenerationHighWaterOf as Kn, malformedOrphanRowsKeptWarning as Ko, holdsSupersededResources as Kr, shownType as Ks, dropFailedCommands as Kt, getDefaultStateBucketName as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, s3BucketRegionalDomainName as La, recordedNoEchoValuesOf as Lc, DBPROXY_TAG_OPTIONS as Li, crossPrefixDeniedWarning as Ll, getCurrentProducerRegions as Ln, isReadableResourceEntry as Lo, replacedDeleteFailureVerdict as Lr, withheldAccountClause as Ls, nestedChildStackName as Lt, redactedCause as Lu, beginDeleteWait as M, poisonRenderedSpellingsCollidingIn as Ma, noEchoLeavesOf as Mc, injectAwsRegion as Md, DeploymentEventsStore as Mi, S3StateBackend as Ml, replacementNeverSwapped as Mn, displayLogicalId as Mo, proposeRenames as Mr, repairMalformedResourcePropertiesForReadOnly as Ms, NESTED_PENDING_PARENT_REASON as Mt, getDockerCmd as Mu, compensateRemovedDeletionProtection as N, isSettledInstanceState as Na, noEchoOutputsComparison as Nc, injectedAwsRegionValue as Nd, extractDeploymentEventError as Ni, rebuildClientForBucketRegion as Nl, resolveReplacementOldType as Nn, hasReadableOrphans as No, awaitInFlightSibling as Nr, repairMalformedResourcesForReadOnly as Ns, displacedOpClause as Nt, isDockerClientEnvKey as Nu, stripIndexContributorInsights as O, unsettledPropertiesOf as Oa, maskReadbackAtCoordinates as Oc, describeFileReadFailure as Od, reserveStackCreateToken as Oi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ol, planFailedOps as On, UNREADABLE_ORPHANS_CONTAINER_ROW as Oo, isPairableType as Or, repairMalformedOrphanRecordsForReadOnly as Os, pendingRequestCount as Ot, describeDockerFailure as Ou, deleteBudgetKey as P, s3BucketArn as Pa, passedNoEchoParametersOf as Pc, clearBucketRegionCache as Pd, isRefusedByName as Pi, CrossPrefixReadError as Pl, seedsDeleteFirstGuard as Pn, hasReadableOutputs as Po, destroyStackRecordsView as Pr, unpreviewableOrphanRecords as Ps, displacedPhysicalIdShown as Pt, isMalformedEnvKey as Pu, isTruthyCfnBoolean as Q, AWS_CREDENTIAL_ENV_KEYS as Qa, shareLogOnlyValues as Qc, readsNoEchoDeleteValues as Qi, orphansAfterRollback as Ql, computeParameterTaint as Qn, malformedResourceEntriesWarning as Qo, supersededResourcesOf as Qr, coerceWarmThroughput as Qs, sameJournaledOrphans as Qt, resolveSkipPrefix as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, s3BucketWebsiteUrl as Ra, valueAtCoordinate as Rc, planTagDiff as Ri, isAccessDenied$1 as Rl, inheritProducerRegions as Rn, malformedDriftResourcePropertiesWarning as Ro, bold as Rr, findActionableSilentDrops as Rs, recordDisplacedSkips as Rt, redactedDockerCause as Ru, indexDeclaresContributorInsights as S, reEnableInstanceApiTermination as Sa, sameLambdaFunctionAddress as Sc, defineOwnKey as Sd, effectiveDeletionPolicy as Si, recordMaskOnlyValue as Sl, equalModuloMarkedMask as Sn, parameterInputsFor as So, formatDestructiveChange as Sr, refuseMalformedResourcePropertiesForExport as Ss, isSecretBearingReferenceString as St, validateContainerRepoName as Su, readContributorInsightsSpec as T, isUsableAttemptedName as Ta, canonicalCoordinates as Tc, nullPrototypeRecord as Td, unsupportedFinalSnapshotError as Ti, recordNoEchoParameterFreshValue as Tl, demoteSupersededOrphans as Tn, JSON_LISTING_HOLE_VALUE as To, movedToHint as Tr, refuseMalformedResourcesForDestroy as Ts, makeCanonicalizePropertiesFn as Tt, resolveDockerContextDirectory as Tu, waitForIndexesSettled as U, outputReferenceProvenanceOf as Ua, snapshotPassProvenance as Uc, definedAttributes as Ui, acceptedCreateOnlyDropsOf as Ul, updatePartialMessage as Un, malformedLocalResourcesWarning as Uo, yellow as Ur, NO_CC_HANDLERS_REASON as Us, getCurrentNestedStackContext as Ut, getDockerImageBySourceHash as Uu, maskedLogger as V, refuseUnreadableCdkCrossAccountRefs as Va, redactForState as Vc, tagMapAsList as Vi, withStackInstanceIdWithheld as Vl, redactedDeleteAddressFields as Vn, malformedLocalOutputsWarning as Vo, green as Vr, unwrittenCreateOnlyReplacement as Vs, withNestedRevertRun as Vt, warnFinchArgvExposure as Vu, isTtlAlreadyDisabled as W, recordedOutputReferenceRegions as Wa, carryLogOnlyValues as Wc, stringifyIfAssigned as Wi, describeRegionValueKind as Wl, updatePartialReason as Wn, malformedOrphanRecordsRefusalMessage as Wo, addSuperseded as Wr, hasNoCloudControlHandlers as Ws, withNestedStackContext as Wt, Synthesizer as Wu, S3_AUTO_DELETE_OBJECTS_TAG as X, isIamRoleArn as Xa, recordLogOnlyParameterValue as Xc, waitForLambdaFunctionActive as Xi, importableOutputs as Xl, retiredNameGenerationsLeaving as Xn, malformedOutputsWarning as Xo, supersededHeldByOtherTypeWarning as Xr, renderStatefulReason as Xs, loadJournaledOrphans as Xt, resolveAutoAssetStorage as Xu, ECR_AUTO_DELETE_IMAGES_TAG as Y, explicitRoleArnOrThrow as Ya, printingCorpusOf as Yc, wouldReturnToSdkProvider as Yi, importableOutputKeys as Yl, retiredNameGenerationsAfter as Yn, malformedOutputsRefusalMessage as Yo, supersededAfterRollback as Yr, isStatefulRecreateTargetSync as Ys, journaledOrphanLines as Yt, resolveApp as Yu, hasCdkAutoDeleteTag as Z, sendableAssumeRoleCommand as Za, recordLogOnlyValue as Zc, TemplateNoEchoReresolver as Zi, isReadableBag as Zl, withNameGenerationReached as Zn, malformedRenderedContainersWarning as Zo, supersededHolderOf as Zr, WARM_THROUGHPUT_MEMBERS as Zs, makeForeignHolderScan as Zt, resolveCaptureObservedState as Zu, streamMemberRefusals as _, disableInstanceApiTermination as _a, dbInstanceEngineChangeIsInPlace as _c, StageLoadError as _d, ATOMIC_FINAL_SNAPSHOT_TYPES as _i, recordAttributeIdCopy as _l, removeProtectionTypeList as _n, isStalePlaceholderArnAttribute as _o, DEFAULT_RESOURCE_TIMEOUT_MS as _r, refuseMalformedResourceEntriesForImport as _s, readRecordedConditionVerdicts as _t, getBootstrapMarkerKey as _u, isProtectionValueActive as a, CloudControlProvider as aa, configIntegerRefusal as ac, CFN_TEMPLATE_BODY_LIMIT as ad, createReadOnlyAttributeHealerFactory as ai, withPhysicalNameCopies as al, readRefactorMarkerOnce as an, regionLessSecretName as ao, secretBearing as ar, refuseMalformedNestedChildOutputs as as, deferredServiceTokenWarning as at, AssetPublisher as au, CONTRIBUTOR_INSIGHTS_KEY as b, observeThenDisableInstanceApiTermination as ba, canonicalLambdaFunctionName as bc, parseFailureDebugDetail as bd, ccRoutedFinalSnapshotError as bi, carriesSecretMask as bl, withUnprovenUnsettled as bn, parseWebACLArn as bo, constructPathOf as br, refuseMalformedResourcePropertiesForDestroy as bs, withResourceDeadline as bt, readBootstrapMarkerBody as bu, DynamoDBGlobalTableProvider as c, unchangedBehindSecretReference as ca, replayWarn as cc, findLargeInlineResources as cd, maskEventTextWithBoundBags as ci, dynamicReferenceTokens as cl, refuseRefactorMarker as cn, parameterTypeMayLoseSecretIdentity as co, carriedExportAliasExposure as cr, refuseMalformedOrphans as cs, childTemplateLoader as ct, WorkGraph as cu, declaredStreamPolicyMember as d, deleteIndeterminateGuards as da, requireConfigString as dc, decodeListingKey as dd, secretNamePrintingBag as di, spelledKeysOf as dl, hasPendingMovesOut as dn, carriesDynamicReference as do, isWholeDynamicReferenceValue as dr, refuseMalformedOutputs as ds, listNestedTemplateRows as dt, loadPublishableAssetManifest as du, getCurrentResourceSecrets as ea, toCfnInteger as ec, resolveStateBucketWithDefaultAndSource as ed, noEchoAttributeNamesOf as ei, createSecretMasker as el, chunks as en, callerEnvCredentials as eo, reachableDivergentParameters as er, malformedResourcesWarning as es, markRefusedBeforeApplying as et, shouldRetainResource as eu, declaredStreamTagsMember as f, deleteLeftInPlace as fa, prefetchCreateOnlyPropertyPaths as fc, expectedOwnerParam as fd, secretNamePrintingBags as fi, identityKeyFor as fl, pendingMovesOutOf as fn, carriesFetchableDynamicReference as fo, noEchoParameterValueSeed as fr, refuseMalformedOutputsForDestroy as fs, renderNestedTemplateTreeDefect as ft, rewriteTemplateAssetReferences as fu, streamDeclaresTags as g, markWaitAbandoned as ga, blockDeviceMappingsDifferOnlyInDeleteOnTermination as gc, AssemblyReader as gd, storedSecretNameNeedles as gi, physicalNameCopiesOf as gl, replayRollback as gn, cfnRefValueFromPhysicalId as go, bindingSkippedOutputs as gr, refuseMalformedResourceEntriesForDestroy as gs, parentSuppliedValues as gt, ensureAssetStorage as gu, streamDeclaresPolicy as h, isWaitAbandonedError as ha, withRetry as hc, derivePartitionAndUrlSuffix as hd, stateSecretNameNeedles as hi, recoverMaskedOutput as hl, replayFailedOperations as hn, AWS_NO_VALUE as ho, isExportAliasCollision as hr, refuseMalformedResourceEntriesForDeploy as hs, conditionInputsFrom as ht, assertAssetBucketRegion as hu, PROTECTION_PROPERTY_BY_TYPE as i, customResourceResponseExpirationWarning as ia, configBooleanRefusal as ic, ssmResolvedValueType as id, withAttemptedItemsMasked as ii, scrubResourceRecord as il, readRefactorMarker as in, producerRegionsFromState as io, exportAliasCollisionScrubWarning as ir, refuseDivergentRecordRegionForDestroy as is, inheritedProvenanceForChildDiff as it, timePhase as iu, DYNAMODB_DELETE_POLL_COST_MS as j, IntrinsicFunctionResolver as ja, noEchoCoordinatesOf as jc, resolveAssemblyPath as jd, DeploymentEventsReader as ji, isLockInfoExpired as jl, recordUnderIdIsNotOwn as jn, deployRefusesOrphanRowsReason as jo, parseMappingFile as jr, repairMalformedResourceEntriesForReadOnly as js, recordRetainedForReadoption as jt, formatDockerLoginError as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, withUnsettledProperties as ka, maskWholeValue as kc, displayAssemblyPath as kd, withCreateTokenLedger as ki, isSingleDynamicReferenceToken as kl, planRollback as kn, UNREADABLE_RESOURCES_MAP_ROW as ko, looselyEqual as kr, repairMalformedOrphansForReadOnly as ks, resolvePendingCloudControlRequests as kt, dockerSpawnEnvWithSensitive as ku, STREAM_POLICY_KEY as l, RollbackInlinePolicyWriters as la, requireConfigArray as lc, uploadCfnTemplate as ld, namingSecretsWithRecordedNoEcho as li, isUncertifiedBaselineMaskPosition as ll, sameMove as ln, getAccountInfo as lo, exportNameNoEchoParameters as lr, refuseMalformedOrphansForDestroy as ls, findNestedTemplateTreeDefect as lt, buildAssetRedirectMap as lu, reverseMapStreamPolicy as m, withIndeterminateGuard as ma, describeTypeWithThrottleRetry as mc, canonicalizeRegion as md, secretNamedRecordNeedles as mi, recordNestedStackParameterExpressions as ml, refusePendingMovesOut as mn, keepsSecretReferenceToken as mo, collectPublishedOutputNames as mr, refuseMalformedResourceEntries as ms, conditionFingerprint as mt, BOOTSTRAP_MARKER_PREFIX as mu, recordedProtectionEvidence as n, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as na, coerceCfnBoolean as nc, stateBucketExistenceConfirmed as nd, noEchoExactEchoLeavesOf as ni, maskSecretsInError as nl, lookupEachName as nn, classifyRecordedSecretRegion as no, WITHHELD_NAME_DISPLAY as nr, malformedStateRefusalMessage as ns, computeImplicitDeleteEdges as nt, PhaseClock as nu, perType as o, slowCcOperationTimeoutMs as oa, configStringRefusal as oc, CFN_TEMPLATE_URL_LIMIT as od, completedReplayEntries as oi, withoutPhysicalNameCopies as ol, refactorMarkerMovesOf as on, coerceParameterTypedValue as oo, secretBearingStateKeyWarning as or, refuseMalformedOrphanRecords as os, findServiceTokenRefusals as ot, isSensitiveAttributeName as ou, planStreamMemberOps as p, deleteSkipReason as pa, templateResourceTypes as pc, PARTITION_TABLE as pd, secretNamedAttributeNamesOf as pi, inheritNestedStackParameterAssociations as pl, pendingMovesRefusalMessage as pn, isNamelessDynamicReferenceError as po, collectDeclaredOutputNames as pr, refuseMalformedResourceAttributesForOrphan as ps, templateIdentity as pt, AssetModeResolver as pu, readTtlSpec as q, assertFlagRoleArn as qa, literalSplitDelimitersOf as qc, ccBrokenReason as qi, hasReasonlessBaselineRefusal as ql, nameScopeOf as qn, malformedOrphansRefusalMessage as qo, isSupersededResourceRecord as qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as qs, dropFailedHint as qt, getLegacyStateBucketName as qu, recordedProtectionNote as r, applyCustomResourceResponseExpiration as ra, coerceCfnInteger as rc, warnDeprecatedNoPrefixCliFlag as rd, noEchoParameterNamesOf as ri, maskSecretsInText as rl, withApiLimit as rn, classifyReplaySecretRegion as ro, displayTextOrWithheld as rr, previewableOrphanRecords as rs, crossStackOutputProvenanceSource as rt, renderPhaseTimings as ru, readProtection as s, onlySecretReferencesDiffer as sa, readConfigString as sc, MIGRATE_TMP_PREFIX as sd, journaledOrphanPrintingBag as si, DYNAMIC_REFERENCE_TOKEN_SCAN as sl, refactorMarkerRefusalMessage as sn, isUnboundTemplateParameter as so, secretSafeKeyDisplay as sr, refuseMalformedOrphanRecordsForDestroy as ss, serviceTokenBlockingReason as st, stringifyValue as su, DeployEngine as t, withPrintingSecrets as ta, toFiniteNumber as tc, resolveUseCdkBootstrapAssets as td, noEchoComparisonForTemplate as ti, errorCauseChain as tl, isAccessDeniedError as tn, envCredentialsAreAssumedRole as to, resourcesNamingDeclaredParameter as tr, malformedScrubResourceEntriesRefusalMessage as ts, IMPLICIT_DELETE_DEPENDENCIES as tt, stackInstanceIdCarriedFrom as tu, STREAM_TAGS_KEY as u, UNSPECIFIED_SKIP_REASON as ua, requireConfigObject as uc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ud, orphanRecordsPrintingBag as ui, pathCrossesDottedKey as ul, updateRefactorMarker as un, isImpossibleEmptyStoredAttribute as uo, exportNameSecretExposure as ur, refuseMalformedOrphansForOrphan as us, isAbsoluteAssetPath as ut, createAssetRedirectResolver as uu, streamPolicyMatchesDeclared as v, ec2InstanceProtectionSite as va, ecsServiceLaunchTypeSetOrChanged as vc, processStackMessages as vd, PRE_DELETE_SNAPSHOT_TYPES as vi, recordPhysicalNameCopy as vl, recordAfterRollbackUpdate as vn, lacksRecordedTableArn as vo, DEFAULT_RESOURCE_WARN_AFTER_MS as vr, refuseMalformedResourceEntriesForImportSave as vs, enclosingDeadlineExpired as vt, isCrossRegionRedirect as vu, planIndexContributorInsightsOps as w, INTRINSIC_KEYS as wa, TemplateParser as wc, hasPlainPrototype$1 as wd, refusesFinalSnapshot as wi, recordNoEchoAttributeValues as wl, undeclaredEmptyObservedKeys as wn, declaresNoEcho as wo, hintSidesOf as wr, refuseMalformedResourcesForDeploy as ws, mergeNoChangeOutputs as wt, buildDockerImage as wu, contributorInsightsRefusals as x, reDisableInstanceApiTermination as xa, lambdaFunctionNameForMask as xc, utf8ByteLength as xd, createPreDeleteFinalSnapshot as xi, provenPublicValue as xl, calculateResourceDrift as xn, withSharedDrainBudget as xo, findDestructiveChanges as xr, refuseMalformedResourcePropertiesForDrift as xs, diffSecurity as xt, validateAssetBucketName as xu, streamTagsMatchDeclared as y, isTerminationProtectionPropagationError as ya, emrClusterInstancesReplaced as yc, describeJsonParseFailure as yd, buildFinalSnapshotIdentifier as yi, splitGetAttStringForm as yl, settleUnsettledPrevious as yn, refStateLookupFromResource as yo, maskingRetryLogger as yr, refuseMalformedResourceEntriesForOrphan as ys, enclosingDeadlineRemainingMs as yt, parseBootstrapMarker as yu, TABLE_INDEX_NOUN as z, resolveDynamicReferences as za, liveMatchesUnresolvedTokenFrame as zc, readTagList as zi, isNotImplemented as zl, REDACTED_DELETE_ADDRESS_SKIP_REASON as zn, malformedExportNamesWarning as zo, cyan as zr, findHandledUnwrittenCreateOnly as zs, revertNestedChildFromJournal as zt, runDockerForeground as zu };
+//# sourceMappingURL=deploy-engine-CVNzK__j.js.map