@go-to-k/cdkd 0.313.0 → 0.314.0

package/dist/{deploy-engine-CwpnkMCZ.js → deploy-engine-ClIUqDQL.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
-import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-BT2Dfnpt.js";
+import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-agWtoyga.js";
+import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-QECX8C-Z.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-CsWxTnUg.js";
+import { t as getCdkdVersion } from "./version-B2PvJ12r.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12780,8 +12780,14 @@ var ReplacementRulesRegistry = class {
 	}
 	initializeRules() {
 		this.rules.set("AWS::S3::Bucket", {
-			replacementProperties: /* @__PURE__ */ new Set(["BucketName"]),
+			replacementProperties: /* @__PURE__ */ new Set([
+				"BucketName",
+				"BucketNamePrefix",
+				"BucketNamespace"
+			]),
 			updateableProperties: /* @__PURE__ */ new Set([
+				"AbacStatus",
+				"MetadataConfiguration",
 				"Tags",
 				"VersioningConfiguration",
 				"LifecycleConfiguration",
@@ -14669,6 +14675,7 @@ function generatedReplacementName(resourceType, createdVia, desired, logicalId)
 		const value = desired?.[property];
 		return value !== void 0 && value !== null && value !== "";
 	};
+	if (alternateNamePropertiesFor(resourceType).some(declared)) return void 0;
 	const fallbackProperty = fallbackNamePropertyFor(resourceType);
 	if (createdVia === "cc-api" || GENERATED_NAME_VERBATIM.has(resourceType)) {
 		if (fallbackProperty === void 0 || declared(fallbackProperty)) return void 0;
@@ -14809,7 +14816,7 @@ function holderVerdict(input, v) {
 		generatedName = wantName !== void 0;
 	}
 	const derived = ownEntry$1(DERIVED_GENERATED_NAMES, oldResourceType);
-	const derivedName = namePath === void 0 && v.derivedNames && derived !== void 0 && input.createdVia !== "cc-api" && typeof input.logicalId === "string" && input.logicalId !== "" ? derived.derive(input.logicalId) : "";
+	const derivedName = namePath === void 0 && v.derivedNames && derived !== void 0 && !alternateNamePropertiesFor(oldResourceType).some((p) => input.requested[p] !== void 0) && input.createdVia !== "cc-api" && typeof input.logicalId === "string" && input.logicalId !== "" ? derived.derive(input.logicalId) : "";
 	if (derivedName !== "") {
 		namePath = oldKey.name[0];
 		wantName = derivedName;
@@ -16221,6 +16228,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set([
 			"AutoScalingGroupName",
 			"AvailabilityZoneDistribution",
+			"AvailabilityZoneIds",
 			"AvailabilityZoneImpairmentPolicy",
 			"AvailabilityZones",
 			"CapacityRebalance",
@@ -16234,6 +16242,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DesiredCapacityType",
 			"HealthCheckGracePeriod",
 			"HealthCheckType",
+			"InstanceLifecyclePolicy",
 			"InstanceMaintenancePolicy",
 			"LaunchTemplate",
 			"LifecycleHookSpecificationList",
@@ -16245,6 +16254,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"MixedInstancesPolicy",
 			"NewInstancesProtectedFromScaleIn",
 			"NotificationConfigurations",
+			"PlacementGroup",
 			"ServiceLinkedRoleARN",
 			"SkipZonalShiftValidation",
 			"Tags",
@@ -16254,12 +16264,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VPCZoneIdentifier"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityZoneIds", "not yet implemented by cdkd"],
-			["InstanceId", "not yet implemented by cdkd"],
-			["InstanceLifecyclePolicy", "not yet implemented by cdkd"],
+			["InstanceId", "CreateAutoScalingGroup derives a new launch configuration from the instance, and AWS Launch Configurations are end-of-life 2024-10 like LaunchConfigurationName; use LaunchTemplate instead"],
 			["LaunchConfigurationName", "AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead"],
-			["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"],
-			["PlacementGroup", "not yet implemented by cdkd"]
+			["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["InstanceId"]),
 		readOnly: /* @__PURE__ */ new Set(["AutoScalingGroupARN"]),
@@ -16570,6 +16577,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EmailVerificationMessage",
 			"EmailVerificationSubject",
 			"EnabledMfas",
+			"IssuerConfiguration",
+			"KeyConfiguration",
 			"LambdaConfig",
 			"MfaConfiguration",
 			"Policies",
@@ -16589,7 +16598,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WebAuthnRelyingPartyID",
 			"WebAuthnUserVerification"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["IssuerConfiguration", "not yet implemented by cdkd"], ["KeyConfiguration", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Arn",
@@ -16711,24 +16720,24 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"GlobalSecondaryIndexes",
 			"KeySchema",
 			"LocalSecondaryIndexes",
+			"ReadOnDemandThroughputSettings",
+			"ReadProvisionedThroughputSettings",
 			"Replicas",
 			"SSESpecification",
 			"StreamSpecification",
 			"TableClass",
 			"TableName",
+			"TableType",
 			"TimeToLiveSpecification",
+			"VectorIndexes",
+			"WarmThroughput",
 			"WriteOnDemandThroughputSettings",
 			"WriteProvisionedThroughputSettings"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["GlobalTableSourceArn", "not yet implemented by cdkd"],
 			["GlobalTableWitnesses", "not yet implemented by cdkd"],
-			["MultiRegionConsistency", "not yet implemented by cdkd"],
-			["ReadOnDemandThroughputSettings", "not yet implemented by cdkd"],
-			["ReadProvisionedThroughputSettings", "not yet implemented by cdkd"],
-			["TableType", "not yet implemented by cdkd"],
-			["VectorIndexes", "not yet implemented by cdkd"],
-			["WarmThroughput", "not yet implemented by cdkd"]
+			["MultiRegionConsistency", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
@@ -18467,15 +18476,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::S3::Bucket", {
 		handled: /* @__PURE__ */ new Set([
+			"AbacStatus",
 			"AccelerateConfiguration",
 			"AnalyticsConfigurations",
 			"BucketEncryption",
 			"BucketName",
+			"BucketNamePrefix",
+			"BucketNamespace",
 			"CorsConfiguration",
 			"IntelligentTieringConfigurations",
 			"InventoryConfigurations",
 			"LifecycleConfiguration",
 			"LoggingConfiguration",
+			"MetadataConfiguration",
 			"MetricsConfigurations",
 			"NotificationConfiguration",
 			"ObjectLockConfiguration",
@@ -18487,15 +18500,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VersioningConfiguration",
 			"WebsiteConfiguration"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AbacStatus", "not yet implemented by cdkd"],
-			["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"],
-			["BucketNamePrefix", "not yet implemented by cdkd"],
-			["BucketNamespace", "not yet implemented by cdkd"],
-			["MetadataConfiguration", "not yet implemented by cdkd"],
-			["MetadataTableConfiguration", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["BucketNamePrefix", "BucketNamespace"]),
+		silentDrop: /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"], ["MetadataTableConfiguration", "V1 S3 Metadata, which the schema says to replace with MetadataConfiguration; S3 answered V1APIsNotAllowed where it was probed, so an SDK path could not be verified. Stays on Cloud Control"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Arn",
 			"DomainName",
@@ -28791,7 +28797,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CqPtIngx.js");
+			const { ASGProvider } = await import("./asg-provider-_nun2Jda.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28900,7 +28906,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Dn-7U1CR.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DfPOAG0q.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-C2fHUNSE.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CGZ_G4Vz.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -35259,6 +35265,7 @@ function createOpMasker(logger, secrets, deployBag) {
 	};
 }
 const OTHER_SPELLED_NAME_KEYS = {
+	"AWS::S3::Bucket": ["BucketNamePrefix"],
 	"AWS::Cognito::UserPoolDomain": ["Domain"],
 	"AWS::Cognito::UserPoolUser": ["Username"],
 	"AWS::ECS::TaskDefinition": ["Family"],
@@ -43264,6 +43271,7 @@ function keptUnderGeneratedName(resource) {
 	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
 	const property = explicitNamePropertyFor(resource.resourceType);
 	const properties = resource.properties;
+	if (alternateNamePropertiesFor(resource.resourceType).some((p) => properties?.[p])) return false;
 	return property === void 0 || !properties?.[property];
 }
 function keptForRetainedRecord(resource) {
@@ -43666,7 +43674,7 @@ function templateStillDeclares(template, record, nameProperties) {
 	if (!declared) return false;
 	if (declared.Type !== record.state.resourceType) return false;
 	const properties = declared.Properties ?? {};
-	return !nameProperties.some((p) => properties[p] !== void 0 && properties[p] !== null);
+	return ![...nameProperties, ...alternateNamePropertiesFor(declared.Type)].some((p) => properties[p] !== void 0 && properties[p] !== null);
 }
 const ADOPTION_REFUSED_TYPES = /* @__PURE__ */ new Set(["AWS::Lambda::LayerVersion", "AWS::ECS::TaskDefinition"]);
 async function planOrphanAdoption(params) {
@@ -47279,6 +47287,125 @@ async function sendTtlWaitingOutRateLimit(send, options) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-vector-indexes.ts
+function vectorIndexesByName(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") out.set(name, entry);
+	}
+	return out;
+}
+function vectorIndexesShapeDetail(value) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) return `VectorIndexes must be a list, got ${typeof value}`;
+	return value.every((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && typeof entry["IndexName"] === "string") ? void 0 : `every VectorIndexes entry must carry a string IndexName`;
+}
+function vectorIndexForSend(entry) {
+	const out = {};
+	for (const key of [
+		"IndexName",
+		"VectorAttribute",
+		"Projection",
+		"DistanceFunction"
+	]) if (entry[key] !== void 0) out[key] = entry[key];
+	if (entry["Dimensions"] !== void 0) out["Dimensions"] = coerceCfnInteger(entry["Dimensions"]) ?? entry["Dimensions"];
+	if (entry["SearchSchema"] !== void 0) out["SearchSchema"] = entry["SearchSchema"];
+	return out;
+}
+function vectorIndexesForCreate(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Array.isArray(value)) return value;
+	return value.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? vectorIndexForSend(entry) : entry);
+}
+function sortedByJson(list) {
+	if (!Array.isArray(list)) return list;
+	return [...list].sort((a, b) => {
+		const x = JSON.stringify(a) ?? "";
+		const y = JSON.stringify(b) ?? "";
+		return x < y ? -1 : x > y ? 1 : 0;
+	});
+}
+function vectorIndexKey(entry) {
+	const e = entry;
+	const projection = e["Projection"];
+	const normalizedProjection = typeof projection === "object" && projection !== null && !Array.isArray(projection) ? {
+		ProjectionType: projection["ProjectionType"],
+		NonKeyAttributes: sortedByJson(nonEmpty(projection["NonKeyAttributes"]))
+	} : projection;
+	const attribute = e["VectorAttribute"];
+	return JSON.stringify([
+		e["IndexName"],
+		typeof attribute === "object" && attribute !== null ? attribute["AttributeName"] : attribute,
+		coerceCfnInteger(e["Dimensions"]) ?? e["Dimensions"],
+		e["DistanceFunction"],
+		normalizedProjection,
+		sortedByJson(Array.isArray(e["SearchSchema"]) && e["SearchSchema"].length > 0 ? e["SearchSchema"].map((s) => typeof s === "object" && s !== null ? {
+			AttributeName: s["AttributeName"],
+			SearchSchemaElementType: s["SearchSchemaElementType"]
+		} : s) : nonEmpty(e["SearchSchema"]))
+	]);
+}
+function nonEmpty(value) {
+	return Array.isArray(value) && value.length === 0 ? void 0 : value;
+}
+function planVectorIndexUpdates(previous, desired, live) {
+	const prevByName = vectorIndexesByName(previous);
+	const desiredByName = vectorIndexesByName(desired);
+	const liveByName = live === void 0 ? void 0 : new Map(live.filter((d) => typeof d.IndexName === "string").map((d) => [d.IndexName, d]));
+	const plan = {
+		ops: [],
+		changed: [],
+		adopted: [],
+		alreadyGone: []
+	};
+	const liveHolds = (name, entry) => {
+		const l = liveByName?.get(name);
+		return l !== void 0 && l.IndexStatus !== "DELETING" && vectorIndexKey(l) === vectorIndexKey(entry);
+	};
+	for (const name of prevByName.keys()) {
+		if (desiredByName.has(name)) continue;
+		const l = liveByName?.get(name);
+		if (liveByName !== void 0 && (l === void 0 || l.IndexStatus === "DELETING")) {
+			plan.alreadyGone.push(name);
+			continue;
+		}
+		plan.ops.push({ Delete: { IndexName: name } });
+	}
+	for (const [name, entry] of desiredByName) {
+		const before = prevByName.get(name);
+		if (before === void 0) {
+			const l = liveByName?.get(name);
+			if (l === void 0 || l.IndexStatus === "DELETING") plan.ops.push({ Create: vectorIndexForSend(entry) });
+			else if (liveHolds(name, entry)) plan.adopted.push(name);
+			else plan.changed.push(name);
+			continue;
+		}
+		if (vectorIndexKey(before) === vectorIndexKey(entry)) continue;
+		if (!liveHolds(name, entry)) plan.changed.push(name);
+	}
+	return plan;
+}
+function readbackVectorIndexes(live) {
+	if (live === void 0 || live.length === 0) return void 0;
+	return live.map((d) => {
+		const out = {};
+		if (d.IndexName !== void 0) out["IndexName"] = d.IndexName;
+		if (d.VectorAttribute !== void 0) out["VectorAttribute"] = d.VectorAttribute;
+		if (d.Dimensions !== void 0) out["Dimensions"] = d.Dimensions;
+		if (d.DistanceFunction !== void 0) out["DistanceFunction"] = d.DistanceFunction;
+		if (d.Projection !== void 0) out["Projection"] = d.Projection;
+		if (d.SearchSchema !== void 0 && d.SearchSchema.length > 0) out["SearchSchema"] = d.SearchSchema;
+		return out;
+	});
+}
+function vectorIndexesSettled(live) {
+	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
@@ -48519,7 +48646,12 @@ var DynamoDBGlobalTableProvider = class {
 		"TimeToLiveSpecification",
 		"WriteProvisionedThroughputSettings",
 		"WriteOnDemandThroughputSettings",
-		"DeletionProtectionEnabled"
+		"DeletionProtectionEnabled",
+		"ReadOnDemandThroughputSettings",
+		"ReadProvisionedThroughputSettings",
+		"TableType",
+		"VectorIndexes",
+		"WarmThroughput"
 	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -48578,12 +48710,12 @@ var DynamoDBGlobalTableProvider = class {
 	operationSinks(context, pairs) {
 		return withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), pairs);
 	}
-	wrapMaskedError(log, error, build) {
+	wrapMaskedError(log, error, build, indexNoun) {
 		const failure = describeAwsFailure(error);
 		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
 		log.debug(build(log.mask(failure.detail)).message);
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}` + relayedEncryptionChangeLimit(failure.detail));
+		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail, indexNoun)}` + relayedEncryptionChangeLimit(failure.detail));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	cleanupFailureText(log, head, error) {
@@ -48592,8 +48724,8 @@ var DynamoDBGlobalTableProvider = class {
 		log.debug(`${head}${log.mask(failure.detail)}`);
 		return log.mask(failure.summary);
 	}
-	wrapDeleteError(log, error, build) {
-		const thrown = this.wrapMaskedError(log, error, build);
+	wrapDeleteError(log, error, build, indexNoun) {
+		const thrown = this.wrapMaskedError(log, error, build, indexNoun);
 		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -48719,6 +48851,12 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
+		const createVectorIndexes = vectorIndexesForCreate(properties["VectorIndexes"]);
+		if (createVectorIndexes !== void 0) createParams.VectorIndexes = createVectorIndexes;
+		const warmCoercion = coerceWarmThroughput(properties["WarmThroughput"]);
+		if (warmCoercion.spec) createParams.WarmThroughput = warmCoercion.spec;
+		const warmDiagnostic = warmThroughputDiagnostic(properties["WarmThroughput"], warmCoercion, void 0);
+		if (warmDiagnostic) diagnostics.push(warmDiagnostic);
 		const createMode = readReplicationMode(properties);
 		if (createMode.kind === "usable") createParams.GlobalTableSettingsReplicationMode = createMode.mode;
 		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
@@ -48765,6 +48903,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			const tableInfo = await this.waitForTableActive(tableName, logicalId, void 0, maskSecrets);
+			if (createVectorIndexes !== void 0) await this.waitForVectorIndexesSettled(tableName, logicalId, maskSecrets);
 			for (const replica of wiringReplicas) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
@@ -48830,7 +48969,8 @@ var DynamoDBGlobalTableProvider = class {
 						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup: failed to drop replica ${region} on ${tableName}: `, replicaCleanupErr)} Run: ${pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName='${region}'}' --region ${currentRegion}`.render()}`);
 					}
 				}
-				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+				if (createVectorIndexes !== void 0) await this.rollBackCreatedVectorTable(logicalId, tableName, maskSecrets);
+				else await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 				retractCreatedResource(logicalId, resourceType, tableName);
 			} catch (cleanupErr) {
 				tableLeftBehind = true;
@@ -48843,6 +48983,32 @@ var DynamoDBGlobalTableProvider = class {
 			throw thrown;
 		}
 	}
+	async rollBackCreatedVectorTable(logicalId, tableName, maskSecrets) {
+		const logger = maskedLogger(this.logger, maskSecrets, tableName);
+		const allowanceMs = Math.min(resolveDynamoDbDeleteBudgetMs(), enclosingDeadlineRemainingMs() - DYNAMODB_DELETE_DEADLINE_MARGIN_MS);
+		const budget = allowanceMs > 0 ? new ElapsedBudget(allowanceMs, resolveDynamoDbDeleteBudgetClock()) : void 0;
+		await deleteTableWithIndexBusyRetry({
+			logicalId,
+			physicalId: tableName,
+			typeLabel: "GlobalTable",
+			indexNoun: TABLE_INDEX_NOUN,
+			maxRetries: 8,
+			logger,
+			deleteTable: async () => {
+				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+			},
+			reArm: () => this.waitForIndexesActive(tableName, logicalId, {
+				maxAttempts: 900,
+				shortCapUnlessVectorBusy: 60,
+				proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
+				...budget !== void 0 && { budget },
+				maskSecrets
+			}),
+			shouldKeepRetrying: () => budget !== void 0 && !budget.isExhausted(),
+			retryWarning: () => `DynamoDB GlobalTable ${logicalId}: AWS refused the DeleteTable rolling back the partially-created table ${tableName} because ${TABLE_INDEX_NOUN} is still being created, updated or deleted. Waiting for the indexes to settle and retrying (up to ${8} retries in all, within ~${Math.max(1, Math.round((budget?.totalMs ?? 0) / 6e4))} minutes).`,
+			sleepSeam: deleteTableRetryDelays
+		});
+	}
 	reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const seen = /* @__PURE__ */ new Set();
@@ -48861,6 +49027,47 @@ var DynamoDBGlobalTableProvider = class {
 		const format = (spec) => WARM_THROUGHPUT_MEMBERS.filter((m) => spec?.[m] !== void 0).map((m) => `${m}=${spec?.[m]}`).join(", ");
 		warn(`DynamoDB GlobalTable ${logicalId}: GSI '${maskSecrets(indexName)}' on ${physicalId}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease ("decreasing WarmThroughput is not supported"). Warm throughput only rises with a table's traffic, so a template below the live value can never be applied; raise it to at least the live value, or remove it. Every other change to this index is applied normally.`);
 	}
+	tableWarmThroughputForSend(desired, live, logicalId, physicalId, maskSecrets) {
+		if (!desired) return void 0;
+		const declared = WARM_THROUGHPUT_MEMBERS.filter((m) => desired[m] !== void 0);
+		if (declared.every((m) => desired[m] === live?.[m])) return void 0;
+		if (!isWarmThroughputDecrease(desired, live)) return desired;
+		const format = (spec) => declared.map((m) => `${m}=${spec?.[m]}`).join(", ");
+		this.logger.warn(maskSecrets(`DynamoDB GlobalTable ${logicalId}: table ${maskSecrets(physicalId)}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease. Raise it to at least the live value, or remove it. Every other change to this table is applied normally.`));
+	}
+	async applyVectorIndexUpdates(physicalId, logicalId, plan, desiredAttributeDefinitions, maskSecrets) {
+		const scope = (name) => `vector index ${typeof name === "string" ? maskSecrets(name) : "<unnamed>"} on DynamoDB GlobalTable ${maskSecrets(physicalId)}`;
+		for (const name of plan.alreadyGone) this.logger.debug(maskSecrets(`${scope(name)} is recorded but not live; skipping its Delete`));
+		for (const name of plan.adopted) this.logger.warn(maskSecrets(`${scope(name)} already exists in AWS with the declared definition but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`));
+		if (plan.ops.length === 0) return;
+		await this.waitForVectorIndexesSettled(physicalId, logicalId, maskSecrets);
+		markUnsettled("VectorIndexes");
+		for (const op of plan.ops) {
+			const input = {
+				TableName: physicalId,
+				VectorIndexUpdates: [op]
+			};
+			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			if (op.Create?.IndexName !== void 0) markAttemptedItems("VectorIndexes", [op.Create.IndexName]);
+			await this.waitForVectorIndexesSettled(physicalId, logicalId, maskSecrets);
+			this.logger.debug(maskSecrets(`${op.Create ? "created" : "deleted"} ` + scope(op.Create?.IndexName ?? op.Delete?.IndexName)));
+		}
+	}
+	async waitForVectorIndexesSettled(tableName, logicalId, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB vector indexes on ${maskSecrets(tableName)}`));
+		try {
+			for (let attempt = 1; attempt <= VECTOR_INDEX_SETTLE_ATTEMPTS; attempt++) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
+				if (table?.TableStatus === "ACTIVE" && vectorIndexesSettled(table.VectorIndexes)) return;
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new Error(maskSecrets(`DynamoDB GlobalTable ${logicalId}: table ${maskSecrets(tableName)} and its vector indexes did not settle within ${VECTOR_INDEX_SETTLE_ATTEMPTS} polls`));
+	}
 	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics, maskSecrets = (text) => text) {
 		const create = { RegionName: region };
 		const kmsMasterKeyId = readReplicaKmsMasterKeyId(replica);
@@ -49666,6 +49873,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
 			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
+			if (refusal === void 0 && changed("VectorIndexes")) refusal = vectorIndexesShapeDetail(properties["VectorIndexes"]);
 			if (refusal === void 0) refusal = replicaSettingsRefusal(properties, previousProperties);
 			if (refusal !== void 0) refuse(refusal);
 		} else {
@@ -49678,6 +49886,15 @@ var DynamoDBGlobalTableProvider = class {
 			await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
+			const vectorIndexesChanged = !deepEqual(properties["VectorIndexes"], previousProperties["VectorIndexes"]);
+			const vectorIndexShape = vectorIndexesShapeDetail(properties["VectorIndexes"]);
+			if (vectorIndexShape !== void 0 && vectorIndexesChanged) warn(`${vectorIndexShape}; the VectorIndexes change was not applied`);
+			const vectorIndexPlan = vectorIndexShape === void 0 && vectorIndexesChanged ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], describeResp.Table === void 0 ? void 0 : describeResp.Table.VectorIndexes ?? []) : void 0;
+			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
+				const vectorMessage = `AWS::DynamoDB::GlobalTable ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((name) => maskSecrets(name)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
+				warn(`${vectorMessage}; that change was not applied`);
+			}
 			const extractLocalTags = (props) => {
 				return localReplicaEntry(props, currentRegion)?.["Tags"];
 			};
@@ -49711,6 +49928,10 @@ var DynamoDBGlobalTableProvider = class {
 			const newBilling = billingUnusable ? oldBilling : requestedBilling;
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
 			const diagnostics = [];
+			if (!deepEqual(properties["WarmThroughput"], previousProperties["WarmThroughput"])) {
+				const warmUpdateDiagnostic = warmThroughputDiagnostic(properties["WarmThroughput"], coerceWarmThroughput(properties["WarmThroughput"]), void 0);
+				if (warmUpdateDiagnostic) diagnostics.push(warmUpdateDiagnostic);
+			}
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
 			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics, maskSecrets);
@@ -49828,7 +50049,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (flatChanged) {
 				if (flatUpdate.DeletionProtectionEnabled !== void 0) markUnsettled("Replicas");
 				if (flatUpdate.StreamSpecification !== void 0) markUnsettled("StreamSpecification");
-				if (flatUpdate.OnDemandThroughput !== void 0) markUnsettled("WriteOnDemandThroughputSettings");
+				if (flatUpdate.OnDemandThroughput !== void 0) markUnsettled("WriteOnDemandThroughputSettings", "ReadOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
@@ -49884,7 +50105,7 @@ var DynamoDBGlobalTableProvider = class {
 					}
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
-				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings");
+				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings", TABLE_READ_PROVISIONED_KEY);
 				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) {
 					markUnsettled("GlobalSecondaryIndexes");
 					for (const indexUpdate of billingUpdate.GlobalSecondaryIndexUpdates) debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Update for index ${maskSecrets(indexUpdate.Update?.IndexName ?? "")} on ${physicalId} (with the billing mode change)`);
@@ -49893,13 +50114,29 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			if (deferCeilingsPastFlip) {
-				markUnsettled("WriteOnDemandThroughputSettings");
+				markUnsettled("WriteOnDemandThroughputSettings", "ReadOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					OnDemandThroughput: onDemandPayload
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			const readBlockOf = (bag) => localReplicaEntry(bag, currentRegion)?.[TABLE_READ_PROVISIONED_KEY] ?? bag[TABLE_READ_PROVISIONED_KEY];
+			if (oldBilling === "PROVISIONED" && newBilling === "PROVISIONED" && liveBillingMode === "PROVISIONED" && (properties[TABLE_READ_PROVISIONED_KEY] !== void 0 || previousProperties[TABLE_READ_PROVISIONED_KEY] !== void 0) && !deepEqual(readBlockOf(properties), readBlockOf(previousProperties))) {
+				const wantRead = coerceCfnInteger(asRecord(readBlockOf(properties))?.["ReadCapacityUnits"]);
+				const liveThroughput = describeResp.Table?.ProvisionedThroughput;
+				if (wantRead !== void 0 && liveThroughput?.WriteCapacityUnits !== void 0 && wantRead !== liveThroughput.ReadCapacityUnits) {
+					markUnsettled(TABLE_READ_PROVISIONED_KEY);
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						ProvisionedThroughput: {
+							ReadCapacityUnits: wantRead,
+							WriteCapacityUnits: liveThroughput.WriteCapacityUnits
+						}
+					}));
+					await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
+				}
+			}
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
@@ -50106,6 +50343,19 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			if (vectorIndexPlan !== void 0) await this.applyVectorIndexUpdates(physicalId, logicalId, vectorIndexPlan, properties["AttributeDefinitions"], maskSecrets);
+			if (!deepEqual(properties["WarmThroughput"], previousProperties["WarmThroughput"])) {
+				const warmCoercion = coerceWarmThroughput(properties["WarmThroughput"]);
+				const warmToSend = this.tableWarmThroughputForSend(warmCoercion.spec, describeResp.Table?.WarmThroughput, logicalId, physicalId, maskSecrets);
+				if (warmToSend) {
+					markUnsettled("WarmThroughput");
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						WarmThroughput: warmToSend
+					}));
+					await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
+				}
+			}
 			const skipAutoScalingForUnusableGsi = desiredGsiUnusable && newBilling !== "PAY_PER_REQUEST";
 			const autoScalingMeaningfulForIndexes = (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !skipAutoScalingForUnusableGsi;
 			if (skipAutoScalingForUnusableGsi && oldBilling === "PROVISIONED") warn(`AWS::DynamoDB::GlobalTable ${logicalId}: skipping the auto-scaling target reconcile because the GlobalSecondaryIndexes block is unusable — the per-index targets are derived from it, so reconciling would deregister the live indexes' scalable targets. Existing targets are left untouched.`);
@@ -50516,11 +50766,13 @@ var DynamoDBGlobalTableProvider = class {
 			const cause = regionErr instanceof Error ? regionErr : void 0;
 			throw new ProvisioningError(`Could not resolve client region for DynamoDB GlobalTable ${logicalId} delete — would risk dropping the local replica`, resourceType, logicalId, physicalId, cause);
 		}
-		let preDeleteIndexes;
+		let preDeleteTable;
+		let indexNoun;
 		try {
 			const describe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const replicas = describe.Table?.Replicas ?? [];
-			preDeleteIndexes = describe.Table?.GlobalSecondaryIndexes;
+			preDeleteTable = describe.Table;
+			if ((describe.Table?.VectorIndexes ?? []).length > 0) indexNoun = TABLE_INDEX_NOUN;
 			const tableIndexNames = (describe.Table?.GlobalSecondaryIndexes ?? []).map((gsi) => gsi.IndexName).filter((name) => typeof name === "string");
 			for (const replica of replicas) {
 				const region = replica.RegionName;
@@ -50556,8 +50808,8 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		}
 		try {
-			if (hasTransitionalIndex(preDeleteIndexes)) {
-				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
+			if (hasTransitionalTableIndex(preDeleteTable)) {
+				deleteLog.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
 				await this.waitForIndexesActive(physicalId, logicalId, {
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget,
@@ -50568,6 +50820,7 @@ var DynamoDBGlobalTableProvider = class {
 				logicalId,
 				physicalId,
 				typeLabel: "GlobalTable",
+				...indexNoun !== void 0 && { indexNoun },
 				maxRetries: 8,
 				logger: loopLogger,
 				deleteTable: async () => {
@@ -50575,7 +50828,8 @@ var DynamoDBGlobalTableProvider = class {
 					flip.deleteAccepted = true;
 				},
 				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
-					maxAttempts: 60,
+					maxAttempts: 900,
+					shortCapUnlessVectorBusy: 60,
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget,
 					...context?.maskSecrets && { maskSecrets: context.maskSecrets }
@@ -50602,7 +50856,7 @@ var DynamoDBGlobalTableProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapDeleteError(deleteLog, error, (text) => new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapDeleteError(deleteLog, error, (text) => new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause), indexNoun);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -50671,7 +50925,7 @@ var DynamoDBGlobalTableProvider = class {
 			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed, attemptedItems);
 		}
 		for (const entry of unnamed.filter((e) => e.ambiguous === true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS has entries cdkd cannot key by an identity, so convergence keeps the recorded ${entry.path} rather than risk removing an entry neither the record nor the template declares. Check it with 'cdkd drift'.`);
-		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete).`);
+		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete; for a vector index: --vector-index-updates Delete).`);
 		return out;
 	}
 	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
@@ -50688,6 +50942,8 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			if (names.has("Replicas") && (table?.Replicas ?? []).some((replica) => replica.ReplicaStatus !== void 0 && MOVING.has(replica.ReplicaStatus))) moving.add("Replicas");
 			if (names.has("GlobalSecondaryIndexes") && (table?.GlobalSecondaryIndexes ?? []).some((index) => index.IndexStatus !== void 0 && MOVING.has(index.IndexStatus))) moving.add("GlobalSecondaryIndexes");
+			if (names.has("VectorIndexes") && (table?.VectorIndexes ?? []).some((index) => index.IndexStatus !== void 0 && MOVING.has(index.IndexStatus))) moving.add("VectorIndexes");
+			if (names.has("WarmThroughput") && table?.WarmThroughput?.Status === "UPDATING") moving.add("WarmThroughput");
 			const sse = table?.SSEDescription?.Status;
 			if (names.has("SSESpecification") && (sse === "ENABLING" || sse === "DISABLING" || sse === "UPDATING")) moving.add("SSESpecification");
 			if (names.has("TimeToLiveSpecification")) {
@@ -50823,6 +51079,21 @@ var DynamoDBGlobalTableProvider = class {
 					else result["WriteProvisionedThroughputSettings"] = {};
 				}
 			} else result["WriteProvisionedThroughputSettings"] = {};
+			const liveVectorIndexes = readbackVectorIndexes(table.VectorIndexes);
+			if (liveVectorIndexes !== void 0) result["VectorIndexes"] = liveVectorIndexes;
+			const declaredWarm = coerceWarmThroughput(properties?.["WarmThroughput"]).spec;
+			if (declaredWarm && table.WarmThroughput) {
+				const warm = {};
+				for (const member of WARM_THROUGHPUT_MEMBERS) {
+					const value = table.WarmThroughput[member];
+					const declared = declaredWarm[member];
+					if (declared === void 0 || value === void 0) continue;
+					warm[member] = table.WarmThroughput.Status === "UPDATING" ? Math.max(value, declared) : value;
+				}
+				if (Object.keys(warm).length > 0) result["WarmThroughput"] = warm;
+			}
+			if (properties?.[TABLE_READ_ON_DEMAND_KEY] !== void 0 && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) result[TABLE_READ_ON_DEMAND_KEY] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
+			if (properties?.[TABLE_READ_PROVISIONED_KEY] !== void 0 && billingMode !== "PAY_PER_REQUEST" && table.ProvisionedThroughput?.ReadCapacityUnits !== void 0) result[TABLE_READ_PROVISIONED_KEY] = { ReadCapacityUnits: table.ProvisionedThroughput.ReadCapacityUnits };
 			try {
 				const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableNameForSubs }))).TimeToLiveDescription;
 				const ttlStatus = ttlDesc?.TimeToLiveStatus;
@@ -50959,11 +51230,19 @@ var DynamoDBGlobalTableProvider = class {
 			return null;
 		}
 	}
-	getDriftUnknownPaths(_resourceType) {
-		return [];
+	getDriftUnknownPaths(_resourceType, properties) {
+		const paths = ["TableType"];
+		if (properties === void 0 || Object.keys(properties).length === 0) return paths;
+		if (properties["BillingMode"] !== "PROVISIONED") paths.push(TABLE_READ_PROVISIONED_KEY);
+		if (!coerceWarmThroughput(properties["WarmThroughput"]).spec) paths.push("WarmThroughput");
+		return paths;
 	}
 	getDriftUnorderedPaths(_resourceType) {
-		return ["AttributeDefinitions", "Replicas[]"];
+		return [
+			"AttributeDefinitions",
+			"Replicas[]",
+			"VectorIndexes"
+		];
 	}
 	canonicalizeDriftProperties(resourceType, properties) {
 		if (resourceType !== "AWS::DynamoDB::GlobalTable") return properties;
@@ -51059,7 +51338,7 @@ var DynamoDBGlobalTableProvider = class {
 			const response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
 			if (response.Table?.TableStatus === "ACTIVE") {
 				tableReachedActive = true;
-				if (!hasTransitionalIndex(response.Table?.GlobalSecondaryIndexes)) return;
+				if (!hasTransitionalTableIndex(response.Table)) return;
 			}
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
@@ -51078,6 +51357,7 @@ var DynamoDBGlobalTableProvider = class {
 			logger: maskedLogger(this.logger, opts?.maskSecrets, tableName),
 			describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName })),
 			maxAttempts: gateWait.grantedPolls,
+			...opts?.shortCapUnlessVectorBusy !== void 0 && { shortCapUnlessVectorBusy: opts.shortCapUnlessVectorBusy },
 			budgetWait: gateWait,
 			proceedNote: opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it."
 		});
@@ -51295,6 +51575,8 @@ const REPLICA_SETTING_MEMBERS = [
 	"GlobalSecondaryIndexes"
 ];
 const REPLICATION_MODE_KEY = "GlobalTableSettingsReplicationMode";
+const TABLE_READ_ON_DEMAND_KEY = "ReadOnDemandThroughputSettings";
+const TABLE_READ_PROVISIONED_KEY = "ReadProvisionedThroughputSettings";
 function readReplicationMode(properties) {
 	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const declared = replicas.map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY]).filter((value) => value !== void 0 && value !== null);
@@ -51330,9 +51612,35 @@ function replicationModeCorrection(properties, previousProperties, liveMode) {
 	if (replicationModeUpdate(properties, previousProperties) !== void 0) return void 0;
 	return (liveMode ?? "DISABLED") === want.mode ? void 0 : want.mode;
 }
+function tableLevelSettingsRefusal(properties) {
+	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	if (properties["TableType"] === "Regional" && replicas.length > 1) return "TableType Regional cannot be declared with more than one replica, as CloudFormation refuses it; declare TableType GlobalTableReplica or omit TableType";
+	const mode = readReplicationMode(properties);
+	for (const key of [TABLE_READ_ON_DEMAND_KEY, TABLE_READ_PROVISIONED_KEY]) {
+		if (properties[key] === void 0 || properties[key] === null) continue;
+		if (mode.kind !== "usable" || mode.mode !== "ENABLED") return `${key} at the table level needs Replicas[].${REPLICATION_MODE_KEY} ENABLED, as CloudFormation refuses it otherwise; enable it on the replica, or move the block to the replica`;
+		if (replicas.some((entry) => asRecord(entry)?.[key] !== void 0)) return `${key} cannot be declared at both the table level and a replica, as CloudFormation refuses it; keep one`;
+	}
+	if (properties[TABLE_READ_ON_DEMAND_KEY] !== void 0 && properties[TABLE_READ_ON_DEMAND_KEY] !== null && properties["BillingMode"] === "PROVISIONED") return `${TABLE_READ_ON_DEMAND_KEY} cannot be declared on a PROVISIONED table, as CloudFormation refuses it; remove it, or set BillingMode to PAY_PER_REQUEST`;
+}
+function replicaReadBlockShape(properties) {
+	return (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map((entry) => [asRecord(entry)?.[TABLE_READ_ON_DEMAND_KEY], asRecord(entry)?.[TABLE_READ_PROVISIONED_KEY]]);
+}
+const TABLE_LEVEL_SETTING_INPUTS = [
+	"TableType",
+	"BillingMode",
+	TABLE_READ_ON_DEMAND_KEY,
+	TABLE_READ_PROVISIONED_KEY
+];
 function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
 	const mode = readReplicationMode(properties);
-	if (mode.kind === "unusable" && (previousProperties === void 0 || !deepEqual(replicationModeShape(properties), replicationModeShape(previousProperties)))) return mode.reason;
+	const modeShapeChanged = previousProperties === void 0 || !deepEqual(replicationModeShape(properties), replicationModeShape(previousProperties));
+	if (mode.kind === "unusable" && modeShapeChanged) return mode.reason;
+	if (modeShapeChanged || previousProperties === void 0 || !deepEqual(replicaReadBlockShape(properties), replicaReadBlockShape(previousProperties)) || TABLE_LEVEL_SETTING_INPUTS.some((key) => !deepEqual(properties[key], previousProperties?.[key]))) {
+		const tableLevelRefusal = tableLevelSettingsRefusal(properties);
+		if (tableLevelRefusal !== void 0) return tableLevelRefusal;
+	}
+	if (previousProperties?.[TABLE_READ_PROVISIONED_KEY] != null && properties[TABLE_READ_PROVISIONED_KEY] == null && properties["BillingMode"] === "PROVISIONED" && !(Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).some((entry) => asRecord(entry)?.[TABLE_READ_PROVISIONED_KEY] != null)) return `${TABLE_READ_PROVISIONED_KEY} cannot be removed from a PROVISIONED table with no replica declaring its own, as CloudFormation refuses it; keep it, declare it on the replica, or set BillingMode to PAY_PER_REQUEST`;
 	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
 		const region = asRecord(entry)?.["Region"];
@@ -51403,11 +51711,12 @@ function extractLocalTableClass(props, region) {
 }
 function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics, maskSecrets = (text) => text) {
 	const rawReplicas = properties["Replicas"];
-	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
+	const localReplica = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region);
+	const rawRead = localReplica?.["ReadProvisionedThroughputSettings"] ?? properties[TABLE_READ_PROVISIONED_KEY];
 	const rawWrite = properties["WriteProvisionedThroughputSettings"];
 	const read = deriveReadCapacityUnits(asRecord(rawRead), source);
 	const write = deriveWriteCapacityUnits(asRecord(rawWrite), source);
-	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "Replicas[local].ReadProvisionedThroughputSettings" }, maskSecrets);
+	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: localReplica?.["ReadProvisionedThroughputSettings"] !== void 0 ? "Replicas[local].ReadProvisionedThroughputSettings" : TABLE_READ_PROVISIONED_KEY }, maskSecrets);
 	if (write === void 0) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "WriteProvisionedThroughputSettings" }, maskSecrets);
 	return {
 		ReadCapacityUnits: read ?? DEFAULT_CAPACITY_UNITS,
@@ -51433,6 +51742,7 @@ function autoScalingResourceId(tableName, indexName) {
 const autoScalingRetryDelays = {};
 const REPLICA_GONE_WAIT_ATTEMPTS = 600;
 const GLOBAL_TABLE_ACTIVE_WAIT_ATTEMPTS = 600;
+const VECTOR_INDEX_SETTLE_ATTEMPTS = 1800;
 const TABLE_GONE_WAIT_ATTEMPTS = 600;
 const deleteTableRetryDelays = {};
 const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
@@ -51554,6 +51864,8 @@ function collectDesiredKeyAttributeNames(properties, options) {
 		if (!Array.isArray(indexes)) continue;
 		for (const index of indexes) addKeySchema(asRecord(index)?.["KeySchema"]);
 	}
+	const vectorIndexes = properties["VectorIndexes"];
+	if (Array.isArray(vectorIndexes)) for (const index of vectorIndexes) addKeySchema(asRecord(index)?.["SearchSchema"]);
 	return names;
 }
 function asRecord(value) {
@@ -51798,6 +52110,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 function stripProvisionedCapacityKeys(properties) {
 	const result = { ...properties };
 	delete result["WriteProvisionedThroughputSettings"];
+	delete result[TABLE_READ_PROVISIONED_KEY];
 	const indexes = result["GlobalSecondaryIndexes"];
 	if (Array.isArray(indexes)) result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
 		const gsi = asRecord(entry);
@@ -51837,7 +52150,7 @@ function stripProvisionedCapacityKeys(properties) {
 	return result;
 }
 const PROVISIONED_ONLY_CAPACITY_KEYS = {
-	table: ["WriteProvisionedThroughputSettings"],
+	table: ["WriteProvisionedThroughputSettings", "ReadProvisionedThroughputSettings"],
 	index: [
 		"WriteProvisionedThroughputSettings",
 		"ReadProvisionedThroughputSettings",
@@ -51847,7 +52160,7 @@ const PROVISIONED_ONLY_CAPACITY_KEYS = {
 	replicaIndex: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"]
 };
 const ON_DEMAND_ONLY_CAPACITY_KEYS = {
-	table: ["WriteOnDemandThroughputSettings"],
+	table: ["WriteOnDemandThroughputSettings", "ReadOnDemandThroughputSettings"],
 	index: [
 		"WriteOnDemandThroughputSettings",
 		"ReadOnDemandThroughputSettings",
@@ -52074,11 +52387,12 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context,
 function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecrets = (text) => text) {
 	const writeBlock = properties["WriteOnDemandThroughputSettings"];
 	const replicas = properties["Replicas"];
-	const readBlock = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["ReadOnDemandThroughputSettings"];
+	const replicaReadBlock = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["ReadOnDemandThroughputSettings"];
+	const readBlock = replicaReadBlock ?? properties[TABLE_READ_ON_DEMAND_KEY];
 	const rawRead = asRecord(readBlock)?.["MaxReadRequestUnits"];
 	const rawWrite = asRecord(writeBlock)?.["MaxWriteRequestUnits"];
 	reportUnresolvedRawMember(rawRead, diagnostics, {
-		blockName: "Replicas[local].ReadOnDemandThroughputSettings",
+		blockName: replicaReadBlock !== void 0 ? "Replicas[local].ReadOnDemandThroughputSettings" : TABLE_READ_ON_DEMAND_KEY,
 		member: "MaxReadRequestUnits"
 	}, maskSecrets);
 	reportUnresolvedRawMember(rawWrite, diagnostics, {
@@ -55592,5 +55906,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { getPriorAttempts as $, applyCallerIdentityCredentials as $a, unionOfSecretBags as $c, isCustomResourceType as $i, orphansCarriedFrom as $l, namesAnyDeclaredParameter as $n, malformedResourcePropertiesWarning as $o, withoutSuperseded as $r, isWarmThroughputDecrease as $s, formatResourceLine as $t, resolveStateBucketWithDefault as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, withoutUnsettledProperties as Aa, maskedLeafCoordinatesOf as Ac, renderAssemblyPathEscape as Ad, acquireIdempotencyToken as Ai, LockManager as Al, recheckFailedPlan as An, accountArgs as Ao, mappingPairs as Ar, repairMalformedOutputsForReadOnly as As, keptForRetainedRecord as At, finchSecretArgvRefusal as Au, deleteTableWithIndexBusyRetry as B, producerLookupOver as Ba, markSameGenerationBag as Bc, refuseMalformedDesiredTags as Bi, stackInstanceIdOf as Bl, isRedactedRecordedValue as Bn, malformedExportSourceWarning as Bo, gray as Br, findSilentDropProperties as Bs, revertedNestedRowIds as Bt, runDockerStreaming as Bu, planContributorInsightsOp as C, DiffCalculator as Ca, DagBuilder as Cc, hasOwnKey as Cd, isFinalSnapshotError as Ci, recordMaskOnlyValuesIn as Cl, equalModuloMask as Cn, passedParameterClassesOf as Co, findRefactorHints as Cr, refuseMalformedResourcePropertiesForOrphan as Cs, keptWholeReasonText as Ct, buildDenyExternalAccessPolicy as Cu, reverseMapTableContributorInsights as D, unsettledItemsOf as Da, maskAtCoordinates as Dc, absoluteAssemblyPathEscape as Dd, ledgerForStack as Di, wholeStringLeavesOf as Dl, isReplacementOrphan as Dn, STATE_RESOURCES_MALFORMED as Do, withMovedTo as Dr, refuseMalformedState as Ds, planOrphanAdoption as Dt, describeDockerExecFailure as Du, reverseMapIndexContributorInsights as E, unsettledItemsField as Ea, isMarkedCoordinate as Ec, ownValue as Ed, earliestDefined as Ei, recordProvenPublicExpression as El, isJournaledOrphan as En, STATE_REGION_DIVERGED as Eo, rollbackOrphanIds as Er, refuseMalformedResourcesForExport as Es, makeSiblingClaimReader as Et, describeDockerCapturedOutput as Eu, resolveDynamoDbDeleteBudgetClock as F, s3BucketDomainName as Fa, readbackPathFor as Fc, resolveBucketRegion as Fd, markDeleteStarted as Fi, CrossPrefixScanCache as Fl, orphanNeedsIdentity as Fn, hasReadableResources as Fo, getStackRecords as Fr, unreadableOrphanRecords as Fs, dropSettledNestedJournals as Ft, partitionSensitiveEnv as Fu, isTtlRateLimited as G, recordedReferenceRegions as Ga, createUnionSecretMasker as Gc, CC_BROKEN_REASON as Gi, exportNamesCarriedFrom as Gl, nameGenerationCarriedFrom as Gn, malformedOrphanRecordsWarning as Go, deleteSupersededEntry as Gr, findReplacedReadersOfRecreateTargets as Gs, deleteJournaledOrphans as Gt, synthesisStatusMessage as Gu, relayedIndexBusyDelete as H, keepHeldTokenProvenance as Ha, recordReferenceProvenanceEntry as Hc, tagPlanWarning as Hi, splitImportedOps as Hl, redactedDeleteAddressSkip as Hn, malformedLocalResourceEntriesWarning as Ho, red as Hr, withoutSilentDropProperties as Hs, collectNestedChildUnaddressed as Ht, AssetManifestLoader as Hu, resolveDynamoDbDeleteBudgetMs as I, s3BucketDualStackDomainName as Ia, readsNoEchoSource as Ic, DBPROXY_TAGS_WHAT as Ii, applyCrossPrefixScan as Il, findNestedStackTypeChanges as In, isReadableOrphanRecord as Io, withStackRecords as Ir, unreadableResourceEntries as Is, getNestedRevertRun as It, redactDockerArgvValues as Iu, sendTtlWaitingOutRateLimit as J, assertSendableRoleArn as Ja, logOnlyValueCount as Jc, isCustomResource as Ji, hasUnverifiableParameterRefusal as Jl, retiredAfterRollback as Jn, malformedOrphansWarning as Jo, removeSuperseded as Jr, isStatefulRecreateTargetForReplace as Js, isHandledOrphan as Jt, loadCdkJson as Ju, planTimeToLive as K, applyRoleArnIfSet as Ka, hasMaskableValues as Kc, ProviderRegistry as Ki, hasReadableExportSet as Kl, nameGenerationHighWaterOf as Kn, malformedOrphanRowsKeptWarning as Ko, holdsSupersededResources as Kr, shownType as Ks, dropFailedCommands as Kt, getDefaultStateBucketName as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, s3BucketRegionalDomainName as La, recordedNoEchoValuesOf as Lc, DBPROXY_TAG_OPTIONS as Li, crossPrefixDeniedWarning as Ll, getCurrentProducerRegions as Ln, isReadableResourceEntry as Lo, replacedDeleteFailureVerdict as Lr, withheldAccountClause as Ls, nestedChildStackName as Lt, redactedCause as Lu, beginDeleteWait as M, poisonRenderedSpellingsCollidingIn as Ma, noEchoLeavesOf as Mc, injectAwsRegion as Md, DeploymentEventsStore as Mi, S3StateBackend as Ml, replacementNeverSwapped as Mn, displayLogicalId as Mo, proposeRenames as Mr, repairMalformedResourcePropertiesForReadOnly as Ms, NESTED_PENDING_PARENT_REASON as Mt, getDockerCmd as Mu, compensateRemovedDeletionProtection as N, isSettledInstanceState as Na, noEchoOutputsComparison as Nc, injectedAwsRegionValue as Nd, extractDeploymentEventError as Ni, rebuildClientForBucketRegion as Nl, resolveReplacementOldType as Nn, hasReadableOrphans as No, awaitInFlightSibling as Nr, repairMalformedResourcesForReadOnly as Ns, displacedOpClause as Nt, isDockerClientEnvKey as Nu, stripIndexContributorInsights as O, unsettledPropertiesOf as Oa, maskReadbackAtCoordinates as Oc, describeFileReadFailure as Od, reserveStackCreateToken as Oi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ol, planFailedOps as On, UNREADABLE_ORPHANS_CONTAINER_ROW as Oo, isPairableType as Or, repairMalformedOrphanRecordsForReadOnly as Os, pendingRequestCount as Ot, describeDockerFailure as Ou, deleteBudgetKey as P, s3BucketArn as Pa, passedNoEchoParametersOf as Pc, clearBucketRegionCache as Pd, isRefusedByName as Pi, CrossPrefixReadError as Pl, seedsDeleteFirstGuard as Pn, hasReadableOutputs as Po, destroyStackRecordsView as Pr, unpreviewableOrphanRecords as Ps, displacedPhysicalIdShown as Pt, isMalformedEnvKey as Pu, isTruthyCfnBoolean as Q, AWS_CREDENTIAL_ENV_KEYS as Qa, shareLogOnlyValues as Qc, readsNoEchoDeleteValues as Qi, orphansAfterRollback as Ql, computeParameterTaint as Qn, malformedResourceEntriesWarning as Qo, supersededResourcesOf as Qr, coerceWarmThroughput as Qs, sameJournaledOrphans as Qt, resolveSkipPrefix as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, s3BucketWebsiteUrl as Ra, valueAtCoordinate as Rc, planTagDiff as Ri, isAccessDenied$1 as Rl, inheritProducerRegions as Rn, malformedDriftResourcePropertiesWarning as Ro, bold as Rr, findActionableSilentDrops as Rs, recordDisplacedSkips as Rt, redactedDockerCause as Ru, indexDeclaresContributorInsights as S, reEnableInstanceApiTermination as Sa, sameLambdaFunctionAddress as Sc, defineOwnKey as Sd, effectiveDeletionPolicy as Si, recordMaskOnlyValue as Sl, equalModuloMarkedMask as Sn, parameterInputsFor as So, formatDestructiveChange as Sr, refuseMalformedResourcePropertiesForExport as Ss, isSecretBearingReferenceString as St, validateContainerRepoName as Su, readContributorInsightsSpec as T, isUsableAttemptedName as Ta, canonicalCoordinates as Tc, nullPrototypeRecord as Td, unsupportedFinalSnapshotError as Ti, recordNoEchoParameterFreshValue as Tl, demoteSupersededOrphans as Tn, JSON_LISTING_HOLE_VALUE as To, movedToHint as Tr, refuseMalformedResourcesForDestroy as Ts, makeCanonicalizePropertiesFn as Tt, resolveDockerContextDirectory as Tu, waitForIndexesSettled as U, outputReferenceProvenanceOf as Ua, snapshotPassProvenance as Uc, definedAttributes as Ui, acceptedCreateOnlyDropsOf as Ul, updatePartialMessage as Un, malformedLocalResourcesWarning as Uo, yellow as Ur, NO_CC_HANDLERS_REASON as Us, getCurrentNestedStackContext as Ut, getDockerImageBySourceHash as Uu, maskedLogger as V, refuseUnreadableCdkCrossAccountRefs as Va, redactForState as Vc, tagMapAsList as Vi, withStackInstanceIdWithheld as Vl, redactedDeleteAddressFields as Vn, malformedLocalOutputsWarning as Vo, green as Vr, unwrittenCreateOnlyReplacement as Vs, withNestedRevertRun as Vt, warnFinchArgvExposure as Vu, isTtlAlreadyDisabled as W, recordedOutputReferenceRegions as Wa, carryLogOnlyValues as Wc, stringifyIfAssigned as Wi, describeRegionValueKind as Wl, updatePartialReason as Wn, malformedOrphanRecordsRefusalMessage as Wo, addSuperseded as Wr, hasNoCloudControlHandlers as Ws, withNestedStackContext as Wt, Synthesizer as Wu, S3_AUTO_DELETE_OBJECTS_TAG as X, isIamRoleArn as Xa, recordLogOnlyParameterValue as Xc, waitForLambdaFunctionActive as Xi, importableOutputs as Xl, retiredNameGenerationsLeaving as Xn, malformedOutputsWarning as Xo, supersededHeldByOtherTypeWarning as Xr, renderStatefulReason as Xs, loadJournaledOrphans as Xt, resolveAutoAssetStorage as Xu, ECR_AUTO_DELETE_IMAGES_TAG as Y, explicitRoleArnOrThrow as Ya, printingCorpusOf as Yc, wouldReturnToSdkProvider as Yi, importableOutputKeys as Yl, retiredNameGenerationsAfter as Yn, malformedOutputsRefusalMessage as Yo, supersededAfterRollback as Yr, isStatefulRecreateTargetSync as Ys, journaledOrphanLines as Yt, resolveApp as Yu, hasCdkAutoDeleteTag as Z, sendableAssumeRoleCommand as Za, recordLogOnlyValue as Zc, TemplateNoEchoReresolver as Zi, isReadableBag as Zl, withNameGenerationReached as Zn, malformedRenderedContainersWarning as Zo, supersededHolderOf as Zr, WARM_THROUGHPUT_MEMBERS as Zs, makeForeignHolderScan as Zt, resolveCaptureObservedState as Zu, streamMemberRefusals as _, disableInstanceApiTermination as _a, dbInstanceEngineChangeIsInPlace as _c, StageLoadError as _d, ATOMIC_FINAL_SNAPSHOT_TYPES as _i, recordAttributeIdCopy as _l, removeProtectionTypeList as _n, isStalePlaceholderArnAttribute as _o, DEFAULT_RESOURCE_TIMEOUT_MS as _r, refuseMalformedResourceEntriesForImport as _s, readRecordedConditionVerdicts as _t, getBootstrapMarkerKey as _u, isProtectionValueActive as a, CloudControlProvider as aa, configIntegerRefusal as ac, CFN_TEMPLATE_BODY_LIMIT as ad, createReadOnlyAttributeHealerFactory as ai, withPhysicalNameCopies as al, readRefactorMarkerOnce as an, regionLessSecretName as ao, secretBearing as ar, refuseMalformedNestedChildOutputs as as, deferredServiceTokenWarning as at, AssetPublisher as au, CONTRIBUTOR_INSIGHTS_KEY as b, observeThenDisableInstanceApiTermination as ba, canonicalLambdaFunctionName as bc, parseFailureDebugDetail as bd, ccRoutedFinalSnapshotError as bi, carriesSecretMask as bl, withUnprovenUnsettled as bn, parseWebACLArn as bo, constructPathOf as br, refuseMalformedResourcePropertiesForDestroy as bs, withResourceDeadline as bt, readBootstrapMarkerBody as bu, DynamoDBGlobalTableProvider as c, unchangedBehindSecretReference as ca, replayWarn as cc, findLargeInlineResources as cd, maskEventTextWithBoundBags as ci, dynamicReferenceTokens as cl, refuseRefactorMarker as cn, parameterTypeMayLoseSecretIdentity as co, carriedExportAliasExposure as cr, refuseMalformedOrphans as cs, childTemplateLoader as ct, WorkGraph as cu, declaredStreamPolicyMember as d, deleteIndeterminateGuards as da, requireConfigString as dc, decodeListingKey as dd, secretNamePrintingBag as di, spelledKeysOf as dl, hasPendingMovesOut as dn, carriesDynamicReference as do, isWholeDynamicReferenceValue as dr, refuseMalformedOutputs as ds, listNestedTemplateRows as dt, loadPublishableAssetManifest as du, getCurrentResourceSecrets as ea, toCfnInteger as ec, resolveStateBucketWithDefaultAndSource as ed, noEchoAttributeNamesOf as ei, createSecretMasker as el, chunks as en, callerEnvCredentials as eo, reachableDivergentParameters as er, malformedResourcesWarning as es, markRefusedBeforeApplying as et, shouldRetainResource as eu, declaredStreamTagsMember as f, deleteLeftInPlace as fa, prefetchCreateOnlyPropertyPaths as fc, expectedOwnerParam as fd, secretNamePrintingBags as fi, identityKeyFor as fl, pendingMovesOutOf as fn, carriesFetchableDynamicReference as fo, noEchoParameterValueSeed as fr, refuseMalformedOutputsForDestroy as fs, renderNestedTemplateTreeDefect as ft, rewriteTemplateAssetReferences as fu, streamDeclaresTags as g, markWaitAbandoned as ga, blockDeviceMappingsDifferOnlyInDeleteOnTermination as gc, AssemblyReader as gd, storedSecretNameNeedles as gi, physicalNameCopiesOf as gl, replayRollback as gn, cfnRefValueFromPhysicalId as go, bindingSkippedOutputs as gr, refuseMalformedResourceEntriesForDestroy as gs, parentSuppliedValues as gt, ensureAssetStorage as gu, streamDeclaresPolicy as h, isWaitAbandonedError as ha, withRetry as hc, derivePartitionAndUrlSuffix as hd, stateSecretNameNeedles as hi, recoverMaskedOutput as hl, replayFailedOperations as hn, AWS_NO_VALUE as ho, isExportAliasCollision as hr, refuseMalformedResourceEntriesForDeploy as hs, conditionInputsFrom as ht, assertAssetBucketRegion as hu, PROTECTION_PROPERTY_BY_TYPE as i, customResourceResponseExpirationWarning as ia, configBooleanRefusal as ic, ssmResolvedValueType as id, withAttemptedItemsMasked as ii, scrubResourceRecord as il, readRefactorMarker as in, producerRegionsFromState as io, exportAliasCollisionScrubWarning as ir, refuseDivergentRecordRegionForDestroy as is, inheritedProvenanceForChildDiff as it, timePhase as iu, DYNAMODB_DELETE_POLL_COST_MS as j, IntrinsicFunctionResolver as ja, noEchoCoordinatesOf as jc, resolveAssemblyPath as jd, DeploymentEventsReader as ji, isLockInfoExpired as jl, recordUnderIdIsNotOwn as jn, deployRefusesOrphanRowsReason as jo, parseMappingFile as jr, repairMalformedResourceEntriesForReadOnly as js, recordRetainedForReadoption as jt, formatDockerLoginError as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, withUnsettledProperties as ka, maskWholeValue as kc, displayAssemblyPath as kd, withCreateTokenLedger as ki, isSingleDynamicReferenceToken as kl, planRollback as kn, UNREADABLE_RESOURCES_MAP_ROW as ko, looselyEqual as kr, repairMalformedOrphansForReadOnly as ks, resolvePendingCloudControlRequests as kt, dockerSpawnEnvWithSensitive as ku, STREAM_POLICY_KEY as l, RollbackInlinePolicyWriters as la, requireConfigArray as lc, uploadCfnTemplate as ld, namingSecretsWithRecordedNoEcho as li, isUncertifiedBaselineMaskPosition as ll, sameMove as ln, getAccountInfo as lo, exportNameNoEchoParameters as lr, refuseMalformedOrphansForDestroy as ls, findNestedTemplateTreeDefect as lt, buildAssetRedirectMap as lu, reverseMapStreamPolicy as m, withIndeterminateGuard as ma, describeTypeWithThrottleRetry as mc, canonicalizeRegion as md, secretNamedRecordNeedles as mi, recordNestedStackParameterExpressions as ml, refusePendingMovesOut as mn, keepsSecretReferenceToken as mo, collectPublishedOutputNames as mr, refuseMalformedResourceEntries as ms, conditionFingerprint as mt, BOOTSTRAP_MARKER_PREFIX as mu, recordedProtectionEvidence as n, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as na, coerceCfnBoolean as nc, stateBucketExistenceConfirmed as nd, noEchoExactEchoLeavesOf as ni, maskSecretsInError as nl, lookupEachName as nn, classifyRecordedSecretRegion as no, WITHHELD_NAME_DISPLAY as nr, malformedStateRefusalMessage as ns, computeImplicitDeleteEdges as nt, PhaseClock as nu, perType as o, slowCcOperationTimeoutMs as oa, configStringRefusal as oc, CFN_TEMPLATE_URL_LIMIT as od, completedReplayEntries as oi, withoutPhysicalNameCopies as ol, refactorMarkerMovesOf as on, coerceParameterTypedValue as oo, secretBearingStateKeyWarning as or, refuseMalformedOrphanRecords as os, findServiceTokenRefusals as ot, isSensitiveAttributeName as ou, planStreamMemberOps as p, deleteSkipReason as pa, templateResourceTypes as pc, PARTITION_TABLE as pd, secretNamedAttributeNamesOf as pi, inheritNestedStackParameterAssociations as pl, pendingMovesRefusalMessage as pn, isNamelessDynamicReferenceError as po, collectDeclaredOutputNames as pr, refuseMalformedResourceAttributesForOrphan as ps, templateIdentity as pt, AssetModeResolver as pu, readTtlSpec as q, assertFlagRoleArn as qa, literalSplitDelimitersOf as qc, ccBrokenReason as qi, hasReasonlessBaselineRefusal as ql, nameScopeOf as qn, malformedOrphansRefusalMessage as qo, isSupersededResourceRecord as qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as qs, dropFailedHint as qt, getLegacyStateBucketName as qu, recordedProtectionNote as r, applyCustomResourceResponseExpiration as ra, coerceCfnInteger as rc, warnDeprecatedNoPrefixCliFlag as rd, noEchoParameterNamesOf as ri, maskSecretsInText as rl, withApiLimit as rn, classifyReplaySecretRegion as ro, displayTextOrWithheld as rr, previewableOrphanRecords as rs, crossStackOutputProvenanceSource as rt, renderPhaseTimings as ru, readProtection as s, onlySecretReferencesDiffer as sa, readConfigString as sc, MIGRATE_TMP_PREFIX as sd, journaledOrphanPrintingBag as si, DYNAMIC_REFERENCE_TOKEN_SCAN as sl, refactorMarkerRefusalMessage as sn, isUnboundTemplateParameter as so, secretSafeKeyDisplay as sr, refuseMalformedOrphanRecordsForDestroy as ss, serviceTokenBlockingReason as st, stringifyValue as su, DeployEngine as t, withPrintingSecrets as ta, toFiniteNumber as tc, resolveUseCdkBootstrapAssets as td, noEchoComparisonForTemplate as ti, errorCauseChain as tl, isAccessDeniedError as tn, envCredentialsAreAssumedRole as to, resourcesNamingDeclaredParameter as tr, malformedScrubResourceEntriesRefusalMessage as ts, IMPLICIT_DELETE_DEPENDENCIES as tt, stackInstanceIdCarriedFrom as tu, STREAM_TAGS_KEY as u, UNSPECIFIED_SKIP_REASON as ua, requireConfigObject as uc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ud, orphanRecordsPrintingBag as ui, pathCrossesDottedKey as ul, updateRefactorMarker as un, isImpossibleEmptyStoredAttribute as uo, exportNameSecretExposure as ur, refuseMalformedOrphansForOrphan as us, isAbsoluteAssetPath as ut, createAssetRedirectResolver as uu, streamPolicyMatchesDeclared as v, ec2InstanceProtectionSite as va, ecsServiceLaunchTypeSetOrChanged as vc, processStackMessages as vd, PRE_DELETE_SNAPSHOT_TYPES as vi, recordPhysicalNameCopy as vl, recordAfterRollbackUpdate as vn, lacksRecordedTableArn as vo, DEFAULT_RESOURCE_WARN_AFTER_MS as vr, refuseMalformedResourceEntriesForImportSave as vs, enclosingDeadlineExpired as vt, isCrossRegionRedirect as vu, planIndexContributorInsightsOps as w, INTRINSIC_KEYS as wa, TemplateParser as wc, hasPlainPrototype$1 as wd, refusesFinalSnapshot as wi, recordNoEchoAttributeValues as wl, undeclaredEmptyObservedKeys as wn, declaresNoEcho as wo, hintSidesOf as wr, refuseMalformedResourcesForDeploy as ws, mergeNoChangeOutputs as wt, buildDockerImage as wu, contributorInsightsRefusals as x, reDisableInstanceApiTermination as xa, lambdaFunctionNameForMask as xc, utf8ByteLength as xd, createPreDeleteFinalSnapshot as xi, provenPublicValue as xl, calculateResourceDrift as xn, withSharedDrainBudget as xo, findDestructiveChanges as xr, refuseMalformedResourcePropertiesForDrift as xs, diffSecurity as xt, validateAssetBucketName as xu, streamTagsMatchDeclared as y, isTerminationProtectionPropagationError as ya, emrClusterInstancesReplaced as yc, describeJsonParseFailure as yd, buildFinalSnapshotIdentifier as yi, splitGetAttStringForm as yl, settleUnsettledPrevious as yn, refStateLookupFromResource as yo, maskingRetryLogger as yr, refuseMalformedResourceEntriesForOrphan as ys, enclosingDeadlineRemainingMs as yt, parseBootstrapMarker as yu, TABLE_INDEX_NOUN as z, resolveDynamicReferences as za, liveMatchesUnresolvedTokenFrame as zc, readTagList as zi, isNotImplemented as zl, REDACTED_DELETE_ADDRESS_SKIP_REASON as zn, malformedExportNamesWarning as zo, cyan as zr, findHandledUnwrittenCreateOnly as zs, revertNestedChildFromJournal as zt, runDockerForeground as zu };
-//# sourceMappingURL=deploy-engine-CwpnkMCZ.js.map
+export { ECR_AUTO_DELETE_IMAGES_TAG as $, explicitRoleArnOrThrow as $a, printingCorpusOf as $c, wouldReturnToSdkProvider as $i, importableOutputKeys as $l, retiredNameGenerationsAfter as $n, malformedOutputsRefusalMessage as $o, supersededAfterRollback as $r, isStatefulRecreateTargetSync as $s, journaledOrphanLines as $t, resolveApp as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, unsettledItemsField as Aa, isMarkedCoordinate as Ac, ownValue as Ad, earliestDefined as Ai, recordProvenPublicExpression as Al, isJournaledOrphan as An, STATE_REGION_DIVERGED as Ao, rollbackOrphanIds as Ar, refuseMalformedResourcesForExport as As, makeSiblingClaimReader as At, describeDockerCapturedOutput as Au, deleteTableWithIndexBusyRetry as B, s3BucketDualStackDomainName as Ba, readsNoEchoSource as Bc, DBPROXY_TAGS_WHAT as Bi, applyCrossPrefixScan as Bl, findNestedStackTypeChanges as Bn, isReadableOrphanRecord as Bo, withStackRecords as Br, unreadableResourceEntries as Bs, getNestedRevertRun as Bt, redactDockerArgvValues as Bu, planContributorInsightsOp as C, isTerminationProtectionPropagationError as Ca, emrClusterInstancesReplaced as Cc, describeJsonParseFailure as Cd, buildFinalSnapshotIdentifier as Ci, splitGetAttStringForm as Cl, settleUnsettledPrevious as Cn, refStateLookupFromResource as Co, maskingRetryLogger as Cr, refuseMalformedResourceEntriesForOrphan as Cs, enclosingDeadlineRemainingMs as Ct, parseBootstrapMarker as Cu, reverseMapTableContributorInsights as D, DiffCalculator as Da, DagBuilder as Dc, hasOwnKey as Dd, isFinalSnapshotError as Di, recordMaskOnlyValuesIn as Dl, equalModuloMask as Dn, passedParameterClassesOf as Do, findRefactorHints as Dr, refuseMalformedResourcePropertiesForOrphan as Ds, keptWholeReasonText as Dt, buildDenyExternalAccessPolicy as Du, reverseMapIndexContributorInsights as E, reEnableInstanceApiTermination as Ea, sameLambdaFunctionAddress as Ec, defineOwnKey as Ed, effectiveDeletionPolicy as Ei, recordMaskOnlyValue as El, equalModuloMarkedMask as En, parameterInputsFor as Eo, formatDestructiveChange as Er, refuseMalformedResourcePropertiesForExport as Es, isSecretBearingReferenceString as Et, validateContainerRepoName as Eu, resolveDynamoDbDeleteBudgetClock as F, IntrinsicFunctionResolver as Fa, noEchoCoordinatesOf as Fc, resolveAssemblyPath as Fd, DeploymentEventsReader as Fi, isLockInfoExpired as Fl, recordUnderIdIsNotOwn as Fn, deployRefusesOrphanRowsReason as Fo, parseMappingFile as Fr, repairMalformedResourceEntriesForReadOnly as Fs, recordRetainedForReadoption as Ft, formatDockerLoginError as Fu, readbackVectorIndexes as G, refuseUnreadableCdkCrossAccountRefs as Ga, redactForState as Gc, tagMapAsList as Gi, withStackInstanceIdWithheld as Gl, redactedDeleteAddressFields as Gn, malformedLocalOutputsWarning as Go, green as Gr, unwrittenCreateOnlyReplacement as Gs, withNestedRevertRun as Gt, warnFinchArgvExposure as Gu, relayedIndexBusyDelete as H, s3BucketWebsiteUrl as Ha, valueAtCoordinate as Hc, planTagDiff as Hi, isAccessDenied$1 as Hl, inheritProducerRegions as Hn, malformedDriftResourcePropertiesWarning as Ho, bold as Hr, findActionableSilentDrops as Hs, recordDisplacedSkips as Ht, redactedDockerCause as Hu, resolveDynamoDbDeleteBudgetMs as I, poisonRenderedSpellingsCollidingIn as Ia, noEchoLeavesOf as Ic, injectAwsRegion as Id, DeploymentEventsStore as Ii, S3StateBackend as Il, replacementNeverSwapped as In, displayLogicalId as Io, proposeRenames as Ir, repairMalformedResourcePropertiesForReadOnly as Is, NESTED_PENDING_PARENT_REASON as It, getDockerCmd as Iu, isTtlAlreadyDisabled as J, recordedOutputReferenceRegions as Ja, carryLogOnlyValues as Jc, stringifyIfAssigned as Ji, describeRegionValueKind as Jl, updatePartialReason as Jn, malformedOrphanRecordsRefusalMessage as Jo, addSuperseded as Jr, hasNoCloudControlHandlers as Js, withNestedStackContext as Jt, Synthesizer as Ju, vectorIndexesForCreate as K, keepHeldTokenProvenance as Ka, recordReferenceProvenanceEntry as Kc, tagPlanWarning as Ki, splitImportedOps as Kl, redactedDeleteAddressSkip as Kn, malformedLocalResourceEntriesWarning as Ko, red as Kr, withoutSilentDropProperties as Ks, collectNestedChildUnaddressed as Kt, AssetManifestLoader as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, isSettledInstanceState as La, noEchoOutputsComparison as Lc, injectedAwsRegionValue as Ld, extractDeploymentEventError as Li, rebuildClientForBucketRegion as Ll, resolveReplacementOldType as Ln, hasReadableOrphans as Lo, awaitInFlightSibling as Lr, repairMalformedResourcesForReadOnly as Ls, displacedOpClause as Lt, isDockerClientEnvKey as Lu, beginDeleteWait as M, unsettledPropertiesOf as Ma, maskReadbackAtCoordinates as Mc, describeFileReadFailure as Md, reserveStackCreateToken as Mi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ml, planFailedOps as Mn, UNREADABLE_ORPHANS_CONTAINER_ROW as Mo, isPairableType as Mr, repairMalformedOrphanRecordsForReadOnly as Ms, pendingRequestCount as Mt, describeDockerFailure as Mu, compensateRemovedDeletionProtection as N, withUnsettledProperties as Na, maskWholeValue as Nc, displayAssemblyPath as Nd, withCreateTokenLedger as Ni, isSingleDynamicReferenceToken as Nl, planRollback as Nn, UNREADABLE_RESOURCES_MAP_ROW as No, looselyEqual as Nr, repairMalformedOrphansForReadOnly as Ns, resolvePendingCloudControlRequests as Nt, dockerSpawnEnvWithSensitive as Nu, stripIndexContributorInsights as O, INTRINSIC_KEYS as Oa, TemplateParser as Oc, hasPlainPrototype$1 as Od, refusesFinalSnapshot as Oi, recordNoEchoAttributeValues as Ol, undeclaredEmptyObservedKeys as On, declaresNoEcho as Oo, hintSidesOf as Or, refuseMalformedResourcesForDeploy as Os, mergeNoChangeOutputs as Ot, buildDockerImage as Ou, deleteBudgetKey as P, withoutUnsettledProperties as Pa, maskedLeafCoordinatesOf as Pc, renderAssemblyPathEscape as Pd, acquireIdempotencyToken as Pi, LockManager as Pl, recheckFailedPlan as Pn, accountArgs as Po, mappingPairs as Pr, repairMalformedOutputsForReadOnly as Ps, keptForRetainedRecord as Pt, finchSecretArgvRefusal as Pu, sendTtlWaitingOutRateLimit as Q, assertSendableRoleArn as Qa, logOnlyValueCount as Qc, isCustomResource as Qi, hasUnverifiableParameterRefusal as Ql, retiredAfterRollback as Qn, malformedOrphansWarning as Qo, removeSuperseded as Qr, isStatefulRecreateTargetForReplace as Qs, isHandledOrphan as Qt, loadCdkJson as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, s3BucketArn as Ra, passedNoEchoParametersOf as Rc, clearBucketRegionCache as Rd, isRefusedByName as Ri, CrossPrefixReadError as Rl, seedsDeleteFirstGuard as Rn, hasReadableOutputs as Ro, destroyStackRecordsView as Rr, unpreviewableOrphanRecords as Rs, displacedPhysicalIdShown as Rt, isMalformedEnvKey as Ru, indexDeclaresContributorInsights as S, ec2InstanceProtectionSite as Sa, ecsServiceLaunchTypeSetOrChanged as Sc, processStackMessages as Sd, PRE_DELETE_SNAPSHOT_TYPES as Si, recordPhysicalNameCopy as Sl, recordAfterRollbackUpdate as Sn, lacksRecordedTableArn as So, DEFAULT_RESOURCE_WARN_AFTER_MS as Sr, refuseMalformedResourceEntriesForImportSave as Ss, enclosingDeadlineExpired as St, isCrossRegionRedirect as Su, readContributorInsightsSpec as T, reDisableInstanceApiTermination as Ta, lambdaFunctionNameForMask as Tc, utf8ByteLength as Td, createPreDeleteFinalSnapshot as Ti, provenPublicValue as Tl, calculateResourceDrift as Tn, withSharedDrainBudget as To, findDestructiveChanges as Tr, refuseMalformedResourcePropertiesForDrift as Ts, diffSecurity as Tt, validateAssetBucketName as Tu, waitForIndexesSettled as U, resolveDynamicReferences as Ua, liveMatchesUnresolvedTokenFrame as Uc, readTagList as Ui, isNotImplemented as Ul, REDACTED_DELETE_ADDRESS_SKIP_REASON as Un, malformedExportNamesWarning as Uo, cyan as Ur, findHandledUnwrittenCreateOnly as Us, revertNestedChildFromJournal as Ut, runDockerForeground as Uu, maskedLogger as V, s3BucketRegionalDomainName as Va, recordedNoEchoValuesOf as Vc, DBPROXY_TAG_OPTIONS as Vi, crossPrefixDeniedWarning as Vl, getCurrentProducerRegions as Vn, isReadableResourceEntry as Vo, replacedDeleteFailureVerdict as Vr, withheldAccountClause as Vs, nestedChildStackName as Vt, redactedCause as Vu, planVectorIndexUpdates as W, producerLookupOver as Wa, markSameGenerationBag as Wc, refuseMalformedDesiredTags as Wi, stackInstanceIdOf as Wl, isRedactedRecordedValue as Wn, malformedExportSourceWarning as Wo, gray as Wr, findSilentDropProperties as Ws, revertedNestedRowIds as Wt, runDockerStreaming as Wu, planTimeToLive as X, applyRoleArnIfSet as Xa, hasMaskableValues as Xc, ProviderRegistry as Xi, hasReadableExportSet as Xl, nameGenerationHighWaterOf as Xn, malformedOrphanRowsKeptWarning as Xo, holdsSupersededResources as Xr, shownType as Xs, dropFailedCommands as Xt, getDefaultStateBucketName as Xu, isTtlRateLimited as Y, recordedReferenceRegions as Ya, createUnionSecretMasker as Yc, CC_BROKEN_REASON as Yi, exportNamesCarriedFrom as Yl, nameGenerationCarriedFrom as Yn, malformedOrphanRecordsWarning as Yo, deleteSupersededEntry as Yr, findReplacedReadersOfRecreateTargets as Ys, deleteJournaledOrphans as Yt, synthesisStatusMessage as Yu, readTtlSpec as Z, assertFlagRoleArn as Za, literalSplitDelimitersOf as Zc, ccBrokenReason as Zi, hasReasonlessBaselineRefusal as Zl, nameScopeOf as Zn, malformedOrphansRefusalMessage as Zo, isSupersededResourceRecord as Zr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Zs, dropFailedHint as Zt, getLegacyStateBucketName as Zu, streamMemberRefusals as _, deleteSkipReason as _a, templateResourceTypes as _c, PARTITION_TABLE as _d, secretNamedAttributeNamesOf as _i, inheritNestedStackParameterAssociations as _l, pendingMovesRefusalMessage as _n, isNamelessDynamicReferenceError as _o, collectDeclaredOutputNames as _r, refuseMalformedResourceAttributesForOrphan as _s, templateIdentity as _t, AssetModeResolver as _u, isProtectionValueActive as a, withPrintingSecrets as aa, toFiniteNumber as ac, resolveUseCdkBootstrapAssets as ad, noEchoComparisonForTemplate as ai, errorCauseChain as al, isAccessDeniedError as an, envCredentialsAreAssumedRole as ao, resourcesNamingDeclaredParameter as ar, malformedScrubResourceEntriesRefusalMessage as as, IMPLICIT_DELETE_DEPENDENCIES as at, stackInstanceIdCarriedFrom as au, CONTRIBUTOR_INSIGHTS_KEY as b, markWaitAbandoned as ba, blockDeviceMappingsDifferOnlyInDeleteOnTermination as bc, AssemblyReader as bd, storedSecretNameNeedles as bi, physicalNameCopiesOf as bl, replayRollback as bn, cfnRefValueFromPhysicalId as bo, bindingSkippedOutputs as br, refuseMalformedResourceEntriesForDestroy as bs, parentSuppliedValues as bt, ensureAssetStorage as bu, DynamoDBGlobalTableProvider as c, customResourceResponseExpirationWarning as ca, configBooleanRefusal as cc, ssmResolvedValueType as cd, withAttemptedItemsMasked as ci, scrubResourceRecord as cl, readRefactorMarker as cn, producerRegionsFromState as co, exportAliasCollisionScrubWarning as cr, refuseDivergentRecordRegionForDestroy as cs, inheritedProvenanceForChildDiff as ct, timePhase as cu, declaredStreamPolicyMember as d, onlySecretReferencesDiffer as da, readConfigString as dc, MIGRATE_TMP_PREFIX as dd, journaledOrphanPrintingBag as di, DYNAMIC_REFERENCE_TOKEN_SCAN as dl, refactorMarkerRefusalMessage as dn, isUnboundTemplateParameter as do, secretSafeKeyDisplay as dr, refuseMalformedOrphanRecordsForDestroy as ds, serviceTokenBlockingReason as dt, stringifyValue as du, waitForLambdaFunctionActive as ea, renderStatefulReason as ec, resolveAutoAssetStorage as ed, supersededHeldByOtherTypeWarning as ei, recordLogOnlyParameterValue as el, loadJournaledOrphans as en, isIamRoleArn as eo, retiredNameGenerationsLeaving as er, malformedOutputsWarning as es, S3_AUTO_DELETE_OBJECTS_TAG as et, importableOutputs as eu, declaredStreamTagsMember as f, unchangedBehindSecretReference as fa, replayWarn as fc, findLargeInlineResources as fd, maskEventTextWithBoundBags as fi, dynamicReferenceTokens as fl, refuseRefactorMarker as fn, parameterTypeMayLoseSecretIdentity as fo, carriedExportAliasExposure as fr, refuseMalformedOrphans as fs, childTemplateLoader as ft, WorkGraph as fu, streamDeclaresTags as g, deleteLeftInPlace as ga, prefetchCreateOnlyPropertyPaths as gc, expectedOwnerParam as gd, secretNamePrintingBags as gi, identityKeyFor as gl, pendingMovesOutOf as gn, carriesFetchableDynamicReference as go, noEchoParameterValueSeed as gr, refuseMalformedOutputsForDestroy as gs, renderNestedTemplateTreeDefect as gt, rewriteTemplateAssetReferences as gu, streamDeclaresPolicy as h, deleteIndeterminateGuards as ha, requireConfigString as hc, decodeListingKey as hd, secretNamePrintingBag as hi, spelledKeysOf as hl, hasPendingMovesOut as hn, carriesDynamicReference as ho, isWholeDynamicReferenceValue as hr, refuseMalformedOutputs as hs, listNestedTemplateRows as ht, loadPublishableAssetManifest as hu, PROTECTION_PROPERTY_BY_TYPE as i, getCurrentResourceSecrets as ia, toCfnInteger as ic, resolveStateBucketWithDefaultAndSource as id, noEchoAttributeNamesOf as ii, createSecretMasker as il, chunks as in, callerEnvCredentials as io, reachableDivergentParameters as ir, malformedResourcesWarning as is, markRefusedBeforeApplying as it, shouldRetainResource as iu, DYNAMODB_DELETE_POLL_COST_MS as j, unsettledItemsOf as ja, maskAtCoordinates as jc, absoluteAssemblyPathEscape as jd, ledgerForStack as ji, wholeStringLeavesOf as jl, isReplacementOrphan as jn, STATE_RESOURCES_MALFORMED as jo, withMovedTo as jr, refuseMalformedState as js, planOrphanAdoption as jt, describeDockerExecFailure as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, isUsableAttemptedName as ka, canonicalCoordinates as kc, nullPrototypeRecord as kd, unsupportedFinalSnapshotError as ki, recordNoEchoParameterFreshValue as kl, demoteSupersededOrphans as kn, JSON_LISTING_HOLE_VALUE as ko, movedToHint as kr, refuseMalformedResourcesForDestroy as ks, makeCanonicalizePropertiesFn as kt, resolveDockerContextDirectory as ku, STREAM_POLICY_KEY as l, CloudControlProvider as la, configIntegerRefusal as lc, CFN_TEMPLATE_BODY_LIMIT as ld, createReadOnlyAttributeHealerFactory as li, withPhysicalNameCopies as ll, readRefactorMarkerOnce as ln, regionLessSecretName as lo, secretBearing as lr, refuseMalformedNestedChildOutputs as ls, deferredServiceTokenWarning as lt, AssetPublisher as lu, reverseMapStreamPolicy as m, UNSPECIFIED_SKIP_REASON as ma, requireConfigObject as mc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as md, orphanRecordsPrintingBag as mi, pathCrossesDottedKey as ml, updateRefactorMarker as mn, isImpossibleEmptyStoredAttribute as mo, exportNameSecretExposure as mr, refuseMalformedOrphansForOrphan as ms, isAbsoluteAssetPath as mt, createAssetRedirectResolver as mu, recordedProtectionEvidence as n, readsNoEchoDeleteValues as na, coerceWarmThroughput as nc, resolveSkipPrefix as nd, supersededResourcesOf as ni, shareLogOnlyValues as nl, sameJournaledOrphans as nn, AWS_CREDENTIAL_ENV_KEYS as no, computeParameterTaint as nr, malformedResourceEntriesWarning as ns, isTruthyCfnBoolean as nt, orphansAfterRollback as nu, perType as o, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as oa, coerceCfnBoolean as oc, stateBucketExistenceConfirmed as od, noEchoExactEchoLeavesOf as oi, maskSecretsInError as ol, lookupEachName as on, classifyRecordedSecretRegion as oo, WITHHELD_NAME_DISPLAY as or, malformedStateRefusalMessage as os, computeImplicitDeleteEdges as ot, PhaseClock as ou, planStreamMemberOps as p, RollbackInlinePolicyWriters as pa, requireConfigArray as pc, uploadCfnTemplate as pd, namingSecretsWithRecordedNoEcho as pi, isUncertifiedBaselineMaskPosition as pl, sameMove as pn, getAccountInfo as po, exportNameNoEchoParameters as pr, refuseMalformedOrphansForDestroy as ps, findNestedTemplateTreeDefect as pt, buildAssetRedirectMap as pu, vectorIndexesSettled as q, outputReferenceProvenanceOf as qa, snapshotPassProvenance as qc, definedAttributes as qi, acceptedCreateOnlyDropsOf as ql, updatePartialMessage as qn, malformedLocalResourcesWarning as qo, yellow as qr, NO_CC_HANDLERS_REASON as qs, getCurrentNestedStackContext as qt, getDockerImageBySourceHash as qu, recordedProtectionNote as r, isCustomResourceType as ra, isWarmThroughputDecrease as rc, resolveStateBucketWithDefault as rd, withoutSuperseded as ri, unionOfSecretBags as rl, formatResourceLine as rn, applyCallerIdentityCredentials as ro, namesAnyDeclaredParameter as rr, malformedResourcePropertiesWarning as rs, getPriorAttempts as rt, orphansCarriedFrom as ru, readProtection as s, applyCustomResourceResponseExpiration as sa, coerceCfnInteger as sc, warnDeprecatedNoPrefixCliFlag as sd, noEchoParameterNamesOf as si, maskSecretsInText as sl, withApiLimit as sn, classifyReplaySecretRegion as so, displayTextOrWithheld as sr, previewableOrphanRecords as ss, crossStackOutputProvenanceSource as st, renderPhaseTimings as su, DeployEngine as t, TemplateNoEchoReresolver as ta, WARM_THROUGHPUT_MEMBERS as tc, resolveCaptureObservedState as td, supersededHolderOf as ti, recordLogOnlyValue as tl, makeForeignHolderScan as tn, sendableAssumeRoleCommand as to, withNameGenerationReached as tr, malformedRenderedContainersWarning as ts, hasCdkAutoDeleteTag as tt, isReadableBag as tu, STREAM_TAGS_KEY as u, slowCcOperationTimeoutMs as ua, configStringRefusal as uc, CFN_TEMPLATE_URL_LIMIT as ud, completedReplayEntries as ui, withoutPhysicalNameCopies as ul, refactorMarkerMovesOf as un, coerceParameterTypedValue as uo, secretBearingStateKeyWarning as ur, refuseMalformedOrphanRecords as us, findServiceTokenRefusals as ut, isSensitiveAttributeName as uu, streamPolicyMatchesDeclared as v, withIndeterminateGuard as va, describeTypeWithThrottleRetry as vc, canonicalizeRegion as vd, secretNamedRecordNeedles as vi, recordNestedStackParameterExpressions as vl, refusePendingMovesOut as vn, keepsSecretReferenceToken as vo, collectPublishedOutputNames as vr, refuseMalformedResourceEntries as vs, conditionFingerprint as vt, BOOTSTRAP_MARKER_PREFIX as vu, planIndexContributorInsightsOps as w, observeThenDisableInstanceApiTermination as wa, canonicalLambdaFunctionName as wc, parseFailureDebugDetail as wd, ccRoutedFinalSnapshotError as wi, carriesSecretMask as wl, withUnprovenUnsettled as wn, parseWebACLArn as wo, constructPathOf as wr, refuseMalformedResourcePropertiesForDestroy as ws, withResourceDeadline as wt, readBootstrapMarkerBody as wu, contributorInsightsRefusals as x, disableInstanceApiTermination as xa, dbInstanceEngineChangeIsInPlace as xc, StageLoadError as xd, ATOMIC_FINAL_SNAPSHOT_TYPES as xi, recordAttributeIdCopy as xl, removeProtectionTypeList as xn, isStalePlaceholderArnAttribute as xo, DEFAULT_RESOURCE_TIMEOUT_MS as xr, refuseMalformedResourceEntriesForImport as xs, readRecordedConditionVerdicts as xt, getBootstrapMarkerKey as xu, streamTagsMatchDeclared as y, isWaitAbandonedError as ya, withRetry as yc, derivePartitionAndUrlSuffix as yd, stateSecretNameNeedles as yi, recoverMaskedOutput as yl, replayFailedOperations as yn, AWS_NO_VALUE as yo, isExportAliasCollision as yr, refuseMalformedResourceEntriesForDeploy as ys, conditionInputsFrom as yt, assertAssetBucketRegion as yu, TABLE_INDEX_NOUN as z, s3BucketDomainName as za, readbackPathFor as zc, resolveBucketRegion as zd, markDeleteStarted as zi, CrossPrefixScanCache as zl, orphanNeedsIdentity as zn, hasReadableResources as zo, getStackRecords as zr, unreadableOrphanRecords as zs, dropSettledNestedJournals as zt, partitionSensitiveEnv as zu };
+//# sourceMappingURL=deploy-engine-ClIUqDQL.js.map