@go-to-k/cdkd 0.313.0 → 0.315.0

package/dist/{deploy-engine-CwpnkMCZ.js → deploy-engine--bCIMkkk.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
-import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-BT2Dfnpt.js";
+import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-agWtoyga.js";
+import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-QECX8C-Z.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-CsWxTnUg.js";
+import { t as getCdkdVersion } from "./version-Caty7J3x.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12780,8 +12780,14 @@ var ReplacementRulesRegistry = class {
 	}
 	initializeRules() {
 		this.rules.set("AWS::S3::Bucket", {
-			replacementProperties: /* @__PURE__ */ new Set(["BucketName"]),
+			replacementProperties: /* @__PURE__ */ new Set([
+				"BucketName",
+				"BucketNamePrefix",
+				"BucketNamespace"
+			]),
 			updateableProperties: /* @__PURE__ */ new Set([
+				"AbacStatus",
+				"MetadataConfiguration",
 				"Tags",
 				"VersioningConfiguration",
 				"LifecycleConfiguration",
@@ -14669,6 +14675,7 @@ function generatedReplacementName(resourceType, createdVia, desired, logicalId)
 		const value = desired?.[property];
 		return value !== void 0 && value !== null && value !== "";
 	};
+	if (alternateNamePropertiesFor(resourceType).some(declared)) return void 0;
 	const fallbackProperty = fallbackNamePropertyFor(resourceType);
 	if (createdVia === "cc-api" || GENERATED_NAME_VERBATIM.has(resourceType)) {
 		if (fallbackProperty === void 0 || declared(fallbackProperty)) return void 0;
@@ -14809,7 +14816,7 @@ function holderVerdict(input, v) {
 		generatedName = wantName !== void 0;
 	}
 	const derived = ownEntry$1(DERIVED_GENERATED_NAMES, oldResourceType);
-	const derivedName = namePath === void 0 && v.derivedNames && derived !== void 0 && input.createdVia !== "cc-api" && typeof input.logicalId === "string" && input.logicalId !== "" ? derived.derive(input.logicalId) : "";
+	const derivedName = namePath === void 0 && v.derivedNames && derived !== void 0 && !alternateNamePropertiesFor(oldResourceType).some((p) => input.requested[p] !== void 0) && input.createdVia !== "cc-api" && typeof input.logicalId === "string" && input.logicalId !== "" ? derived.derive(input.logicalId) : "";
 	if (derivedName !== "") {
 		namePath = oldKey.name[0];
 		wantName = derivedName;
@@ -16221,6 +16228,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set([
 			"AutoScalingGroupName",
 			"AvailabilityZoneDistribution",
+			"AvailabilityZoneIds",
 			"AvailabilityZoneImpairmentPolicy",
 			"AvailabilityZones",
 			"CapacityRebalance",
@@ -16234,6 +16242,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DesiredCapacityType",
 			"HealthCheckGracePeriod",
 			"HealthCheckType",
+			"InstanceLifecyclePolicy",
 			"InstanceMaintenancePolicy",
 			"LaunchTemplate",
 			"LifecycleHookSpecificationList",
@@ -16245,6 +16254,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"MixedInstancesPolicy",
 			"NewInstancesProtectedFromScaleIn",
 			"NotificationConfigurations",
+			"PlacementGroup",
 			"ServiceLinkedRoleARN",
 			"SkipZonalShiftValidation",
 			"Tags",
@@ -16254,12 +16264,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VPCZoneIdentifier"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityZoneIds", "not yet implemented by cdkd"],
-			["InstanceId", "not yet implemented by cdkd"],
-			["InstanceLifecyclePolicy", "not yet implemented by cdkd"],
+			["InstanceId", "CreateAutoScalingGroup derives a new launch configuration from the instance, and AWS Launch Configurations are end-of-life 2024-10 like LaunchConfigurationName; use LaunchTemplate instead"],
 			["LaunchConfigurationName", "AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead"],
-			["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"],
-			["PlacementGroup", "not yet implemented by cdkd"]
+			["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["InstanceId"]),
 		readOnly: /* @__PURE__ */ new Set(["AutoScalingGroupARN"]),
@@ -16570,6 +16577,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EmailVerificationMessage",
 			"EmailVerificationSubject",
 			"EnabledMfas",
+			"IssuerConfiguration",
+			"KeyConfiguration",
 			"LambdaConfig",
 			"MfaConfiguration",
 			"Policies",
@@ -16589,7 +16598,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WebAuthnRelyingPartyID",
 			"WebAuthnUserVerification"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["IssuerConfiguration", "not yet implemented by cdkd"], ["KeyConfiguration", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Arn",
@@ -16621,44 +16630,40 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::DocDB::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
+			"AvailabilityZones",
 			"BackupRetentionPeriod",
+			"CopyTagsToSnapshot",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
 			"DBSubnetGroupName",
 			"DeletionProtection",
+			"EnableCloudwatchLogsExports",
 			"EngineVersion",
 			"KmsKeyId",
+			"ManageMasterUserPassword",
 			"MasterUsername",
 			"MasterUserPassword",
+			"MasterUserSecretKmsKeyId",
+			"NetworkType",
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"RotateMasterUserPassword",
+			"ServerlessV2ScalingConfiguration",
 			"StorageEncrypted",
+			"StorageType",
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityZones", "not yet implemented by cdkd"],
-			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
-			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
 			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
-			["ManageMasterUserPassword", "not yet implemented by cdkd"],
-			["MasterUserSecretKmsKeyId", "not yet implemented by cdkd"],
-			["NetworkType", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
-			["RotateMasterUserPassword", "not yet implemented by cdkd"],
-			["ServerlessV2ScalingConfiguration", "not yet implemented by cdkd"],
 			["SnapshotIdentifier", "not yet implemented by cdkd"],
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
-			["StorageType", "not yet implemented by cdkd"],
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
-			"SnapshotIdentifier",
-			"SourceDBClusterIdentifier"
-		]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotIdentifier", "SourceDBClusterIdentifier"]),
 		readOnly: /* @__PURE__ */ new Set([
 			"ClusterResourceId",
 			"Endpoint",
@@ -16672,17 +16677,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set([
 			"AutoMinorVersionUpgrade",
 			"AvailabilityZone",
+			"CACertificateIdentifier",
+			"CertificateRotationRestart",
 			"DBClusterIdentifier",
 			"DBInstanceClass",
 			"DBInstanceIdentifier",
+			"EnablePerformanceInsights",
 			"PreferredMaintenanceWindow",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["CACertificateIdentifier", "not yet implemented by cdkd"],
-			["CertificateRotationRestart", "not yet implemented by cdkd"],
-			["EnablePerformanceInsights", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Endpoint",
@@ -16711,24 +16715,24 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"GlobalSecondaryIndexes",
 			"KeySchema",
 			"LocalSecondaryIndexes",
+			"ReadOnDemandThroughputSettings",
+			"ReadProvisionedThroughputSettings",
 			"Replicas",
 			"SSESpecification",
 			"StreamSpecification",
 			"TableClass",
 			"TableName",
+			"TableType",
 			"TimeToLiveSpecification",
+			"VectorIndexes",
+			"WarmThroughput",
 			"WriteOnDemandThroughputSettings",
 			"WriteProvisionedThroughputSettings"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["GlobalTableSourceArn", "not yet implemented by cdkd"],
 			["GlobalTableWitnesses", "not yet implemented by cdkd"],
-			["MultiRegionConsistency", "not yet implemented by cdkd"],
-			["ReadOnDemandThroughputSettings", "not yet implemented by cdkd"],
-			["ReadProvisionedThroughputSettings", "not yet implemented by cdkd"],
-			["TableType", "not yet implemented by cdkd"],
-			["VectorIndexes", "not yet implemented by cdkd"],
-			["WarmThroughput", "not yet implemented by cdkd"]
+			["MultiRegionConsistency", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
@@ -17738,6 +17742,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DeliveryStreamEncryptionConfigurationInput",
 			"DeliveryStreamName",
 			"DeliveryStreamType",
+			"DirectPutSourceConfiguration",
 			"ElasticsearchDestinationConfiguration",
 			"ExtendedS3DestinationConfiguration",
 			"HttpEndpointDestinationConfiguration",
@@ -17749,16 +17754,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["DatabaseSourceConfiguration", "not yet implemented by cdkd"],
-			["DirectPutSourceConfiguration", "not yet implemented by cdkd"],
 			["IcebergDestinationConfiguration", "not yet implemented by cdkd"],
 			["MSKSourceConfiguration", "not yet implemented by cdkd"],
 			["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"DatabaseSourceConfiguration",
-			"DirectPutSourceConfiguration",
-			"MSKSourceConfiguration"
-		]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["DatabaseSourceConfiguration", "MSKSourceConfiguration"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
 	}],
@@ -18035,39 +18035,38 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Neptune::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
+			"AssociatedRoles",
+			"AvailabilityZones",
 			"BackupRetentionPeriod",
+			"CopyTagsToSnapshot",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
+			"DBInstanceParameterGroupName",
 			"DBPort",
 			"DBSubnetGroupName",
 			"DeletionProtection",
+			"EnableCloudwatchLogsExports",
 			"EngineVersion",
 			"IamAuthEnabled",
 			"KmsKeyId",
+			"NetworkType",
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"ServerlessScalingConfiguration",
 			"StorageEncrypted",
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["AssociatedRoles", "not yet implemented by cdkd"],
-			["AvailabilityZones", "not yet implemented by cdkd"],
-			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
-			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
-			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
-			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
-			["NetworkType", "not yet implemented by cdkd"],
+			["GlobalClusterIdentifier", "Cloud Control owns a global-cluster member: NeptuneProvider has no detach, and a member cannot be deleted while attached (deletesThroughSdkProvider keeps its delete there too)"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
-			["ServerlessScalingConfiguration", "not yet implemented by cdkd"],
 			["SnapshotIdentifier", "not yet implemented by cdkd"],
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
 			"GlobalClusterIdentifier",
 			"RestoreToTime",
 			"RestoreType",
@@ -18085,6 +18084,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Neptune::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
+			"AllowMajorVersionUpgrade",
 			"AutoMinorVersionUpgrade",
 			"AvailabilityZone",
 			"DBClusterIdentifier",
@@ -18094,13 +18094,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DBSubnetGroupName",
 			"DeletionProtection",
 			"PreferredMaintenanceWindow",
+			"PubliclyAccessible",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AllowMajorVersionUpgrade", "not yet implemented by cdkd"],
-			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
-			["PubliclyAccessible", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map([["DBSnapshotIdentifier", "The CloudFormation schema documents it as not supported, and CreateDBInstance has no such member: a Neptune instance is not restored from a snapshot, its cluster is"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["DBSnapshotIdentifier"]),
 		readOnly: /* @__PURE__ */ new Set(["Endpoint", "Port"]),
 		ccRouteUnavailable: false
@@ -18147,8 +18144,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::RDS::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
 			"BackupRetentionPeriod",
+			"CopyTagsToSnapshot",
 			"DatabaseName",
 			"DBClusterIdentifier",
+			"DBClusterParameterGroupName",
 			"DBSubnetGroupName",
 			"DeletionProtection",
 			"EnableIAMDatabaseAuthentication",
@@ -18162,9 +18161,12 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"MonitoringInterval",
 			"MonitoringRoleArn",
 			"Port",
+			"PreferredBackupWindow",
+			"PreferredMaintenanceWindow",
 			"PubliclyAccessible",
 			"ServerlessV2ScalingConfiguration",
 			"StorageEncrypted",
+			"StorageType",
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
@@ -18175,10 +18177,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AvailabilityZones", "not yet implemented by cdkd"],
 			["BacktrackWindow", "not yet implemented by cdkd"],
 			["ClusterScalabilityType", "not yet implemented by cdkd"],
-			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
 			["DatabaseInsightsMode", "not yet implemented by cdkd"],
 			["DBClusterInstanceClass", "not yet implemented by cdkd"],
-			["DBClusterParameterGroupName", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
 			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
@@ -18197,8 +18197,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["PerformanceInsightsEnabled", "not yet implemented by cdkd"],
 			["PerformanceInsightsKmsKeyId", "not yet implemented by cdkd"],
 			["PerformanceInsightsRetentionPeriod", "not yet implemented by cdkd"],
-			["PreferredBackupWindow", "not yet implemented by cdkd"],
-			["PreferredMaintenanceWindow", "not yet implemented by cdkd"],
 			["ReplicationSourceIdentifier", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
@@ -18207,7 +18205,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
 			["SourceDbClusterResourceId", "not yet implemented by cdkd"],
 			["SourceRegion", "not yet implemented by cdkd"],
-			["StorageType", "not yet implemented by cdkd"],
 			["UseLatestRestorableTime", "not yet implemented by cdkd"],
 			["WithExpressConfiguration", "not yet implemented by cdkd"]
 		]),
@@ -18467,15 +18464,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::S3::Bucket", {
 		handled: /* @__PURE__ */ new Set([
+			"AbacStatus",
 			"AccelerateConfiguration",
 			"AnalyticsConfigurations",
 			"BucketEncryption",
 			"BucketName",
+			"BucketNamePrefix",
+			"BucketNamespace",
 			"CorsConfiguration",
 			"IntelligentTieringConfigurations",
 			"InventoryConfigurations",
 			"LifecycleConfiguration",
 			"LoggingConfiguration",
+			"MetadataConfiguration",
 			"MetricsConfigurations",
 			"NotificationConfiguration",
 			"ObjectLockConfiguration",
@@ -18487,15 +18488,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VersioningConfiguration",
 			"WebsiteConfiguration"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AbacStatus", "not yet implemented by cdkd"],
-			["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"],
-			["BucketNamePrefix", "not yet implemented by cdkd"],
-			["BucketNamespace", "not yet implemented by cdkd"],
-			["MetadataConfiguration", "not yet implemented by cdkd"],
-			["MetadataTableConfiguration", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["BucketNamePrefix", "BucketNamespace"]),
+		silentDrop: /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"], ["MetadataTableConfiguration", "V1 S3 Metadata, which the schema says to replace with MetadataConfiguration; S3 answered V1APIsNotAllowed where it was probed, so an SDK path could not be verified. Stays on Cloud Control"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Arn",
 			"DomainName",
@@ -28791,7 +28785,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CqPtIngx.js");
+			const { ASGProvider } = await import("./asg-provider-DpNkEibf.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28900,7 +28894,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Dn-7U1CR.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DfPOAG0q.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Cm3dsmFW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BNxotnbp.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -35259,6 +35253,7 @@ function createOpMasker(logger, secrets, deployBag) {
 	};
 }
 const OTHER_SPELLED_NAME_KEYS = {
+	"AWS::S3::Bucket": ["BucketNamePrefix"],
 	"AWS::Cognito::UserPoolDomain": ["Domain"],
 	"AWS::Cognito::UserPoolUser": ["Username"],
 	"AWS::ECS::TaskDefinition": ["Family"],
@@ -39797,12 +39792,13 @@ async function unsettledAfterUpdate(args) {
 	const { names, desired, provider } = args;
 	if (names.size === 0) return [];
 	try {
-		const moving = provider.unsettledInTransition === void 0 ? /* @__PURE__ */ new Set() : await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties);
+		const moving = provider.unsettledInTransition === void 0 ? /* @__PURE__ */ new Set() : await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties, desired);
 		const live = await readLive(args, names);
 		if (live === void 0) return [...moving].sort();
 		if (live === "unreadable") return [...names].sort();
 		const ignorePaths = provider.getDriftUnknownPaths?.(args.resourceType) ?? [];
 		const unorderedPaths = provider.getDriftUnorderedPaths?.(args.resourceType) ?? [];
+		const canonical = (bag) => provider.canonicalizeUnsettledProperties?.(args.resourceType, bag) ?? bag;
 		const kept = [];
 		for (const name of names) {
 			if (moving.has(name)) {
@@ -39814,7 +39810,7 @@ async function unsettledAfterUpdate(args) {
 				continue;
 			}
 			if (!Object.hasOwn(live, name) || desired[name] === void 0) continue;
-			if (calculateResourceDrift({ [name]: desired[name] }, { [name]: live[name] }, {
+			if (calculateResourceDrift(canonical({ [name]: desired[name] }), canonical({ [name]: live[name] }), {
 				ignorePaths,
 				unorderedPaths
 			}).length > 0) kept.push(name);
@@ -43264,6 +43260,7 @@ function keptUnderGeneratedName(resource) {
 	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
 	const property = explicitNamePropertyFor(resource.resourceType);
 	const properties = resource.properties;
+	if (alternateNamePropertiesFor(resource.resourceType).some((p) => properties?.[p])) return false;
 	return property === void 0 || !properties?.[property];
 }
 function keptForRetainedRecord(resource) {
@@ -43666,7 +43663,7 @@ function templateStillDeclares(template, record, nameProperties) {
 	if (!declared) return false;
 	if (declared.Type !== record.state.resourceType) return false;
 	const properties = declared.Properties ?? {};
-	return !nameProperties.some((p) => properties[p] !== void 0 && properties[p] !== null);
+	return ![...nameProperties, ...alternateNamePropertiesFor(declared.Type)].some((p) => properties[p] !== void 0 && properties[p] !== null);
 }
 const ADOPTION_REFUSED_TYPES = /* @__PURE__ */ new Set(["AWS::Lambda::LayerVersion", "AWS::ECS::TaskDefinition"]);
 async function planOrphanAdoption(params) {
@@ -47279,6 +47276,125 @@ async function sendTtlWaitingOutRateLimit(send, options) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-vector-indexes.ts
+function vectorIndexesByName(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return out;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") out.set(name, entry);
+	}
+	return out;
+}
+function vectorIndexesShapeDetail(value) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) return `VectorIndexes must be a list, got ${value === null ? "null" : typeof value}`;
+	return value.every((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && typeof entry["IndexName"] === "string") ? void 0 : `every VectorIndexes entry must carry a string IndexName`;
+}
+function vectorIndexForSend(entry) {
+	const out = {};
+	for (const key of [
+		"IndexName",
+		"VectorAttribute",
+		"Projection",
+		"DistanceFunction"
+	]) if (entry[key] !== void 0) out[key] = entry[key];
+	if (entry["Dimensions"] !== void 0) out["Dimensions"] = coerceCfnInteger(entry["Dimensions"]) ?? entry["Dimensions"];
+	if (entry["SearchSchema"] !== void 0) out["SearchSchema"] = entry["SearchSchema"];
+	return out;
+}
+function vectorIndexesForCreate(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Array.isArray(value)) return value;
+	return value.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? vectorIndexForSend(entry) : entry);
+}
+function sortedByJson(list) {
+	if (!Array.isArray(list)) return list;
+	return [...list].sort((a, b) => {
+		const x = JSON.stringify(a) ?? "";
+		const y = JSON.stringify(b) ?? "";
+		return x < y ? -1 : x > y ? 1 : 0;
+	});
+}
+function vectorIndexKey(entry) {
+	const e = entry;
+	const projection = e["Projection"];
+	const normalizedProjection = typeof projection === "object" && projection !== null && !Array.isArray(projection) ? {
+		ProjectionType: projection["ProjectionType"],
+		NonKeyAttributes: sortedByJson(nonEmpty(projection["NonKeyAttributes"]))
+	} : projection;
+	const attribute = e["VectorAttribute"];
+	return JSON.stringify([
+		e["IndexName"],
+		typeof attribute === "object" && attribute !== null ? attribute["AttributeName"] : attribute,
+		coerceCfnInteger(e["Dimensions"]) ?? e["Dimensions"],
+		e["DistanceFunction"],
+		normalizedProjection,
+		sortedByJson(Array.isArray(e["SearchSchema"]) && e["SearchSchema"].length > 0 ? e["SearchSchema"].map((s) => typeof s === "object" && s !== null ? {
+			AttributeName: s["AttributeName"],
+			SearchSchemaElementType: s["SearchSchemaElementType"]
+		} : s) : nonEmpty(e["SearchSchema"]))
+	]);
+}
+function nonEmpty(value) {
+	return Array.isArray(value) && value.length === 0 ? void 0 : value;
+}
+function planVectorIndexUpdates(previous, desired, live) {
+	const prevByName = vectorIndexesByName(previous);
+	const desiredByName = vectorIndexesByName(desired);
+	const liveByName = live === void 0 ? void 0 : new Map(live.filter((d) => typeof d.IndexName === "string").map((d) => [d.IndexName, d]));
+	const plan = {
+		ops: [],
+		changed: [],
+		adopted: [],
+		alreadyGone: []
+	};
+	const liveHolds = (name, entry) => {
+		const l = liveByName?.get(name);
+		return l !== void 0 && l.IndexStatus !== "DELETING" && vectorIndexKey(l) === vectorIndexKey(entry);
+	};
+	for (const name of prevByName.keys()) {
+		if (desiredByName.has(name)) continue;
+		const l = liveByName?.get(name);
+		if (liveByName !== void 0 && (l === void 0 || l.IndexStatus === "DELETING")) {
+			plan.alreadyGone.push(name);
+			continue;
+		}
+		plan.ops.push({ Delete: { IndexName: name } });
+	}
+	for (const [name, entry] of desiredByName) {
+		const before = prevByName.get(name);
+		if (before === void 0) {
+			const l = liveByName?.get(name);
+			if (l === void 0 || l.IndexStatus === "DELETING") plan.ops.push({ Create: vectorIndexForSend(entry) });
+			else if (liveHolds(name, entry)) plan.adopted.push(name);
+			else plan.changed.push(name);
+			continue;
+		}
+		if (vectorIndexKey(before) === vectorIndexKey(entry)) continue;
+		if (!liveHolds(name, entry)) plan.changed.push(name);
+	}
+	return plan;
+}
+function readbackVectorIndexes(live) {
+	if (live === void 0 || live.length === 0) return void 0;
+	return live.map((d) => {
+		const out = {};
+		if (d.IndexName !== void 0) out["IndexName"] = d.IndexName;
+		if (d.VectorAttribute !== void 0) out["VectorAttribute"] = d.VectorAttribute;
+		if (d.Dimensions !== void 0) out["Dimensions"] = d.Dimensions;
+		if (d.DistanceFunction !== void 0) out["DistanceFunction"] = d.DistanceFunction;
+		if (d.Projection !== void 0) out["Projection"] = d.Projection;
+		if (d.SearchSchema !== void 0 && d.SearchSchema.length > 0) out["SearchSchema"] = d.SearchSchema;
+		return out;
+	});
+}
+function vectorIndexesSettled(live) {
+	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
@@ -48519,7 +48635,12 @@ var DynamoDBGlobalTableProvider = class {
 		"TimeToLiveSpecification",
 		"WriteProvisionedThroughputSettings",
 		"WriteOnDemandThroughputSettings",
-		"DeletionProtectionEnabled"
+		"DeletionProtectionEnabled",
+		"ReadOnDemandThroughputSettings",
+		"ReadProvisionedThroughputSettings",
+		"TableType",
+		"VectorIndexes",
+		"WarmThroughput"
 	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -48578,12 +48699,12 @@ var DynamoDBGlobalTableProvider = class {
 	operationSinks(context, pairs) {
 		return withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), pairs);
 	}
-	wrapMaskedError(log, error, build) {
+	wrapMaskedError(log, error, build, indexNoun) {
 		const failure = describeAwsFailure(error);
 		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
 		log.debug(build(log.mask(failure.detail)).message);
 		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
-		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail)}` + relayedEncryptionChangeLimit(failure.detail));
+		const wrapped = build(`${log.mask(failure.summary)}${relay}${relayedIndexBusyDelete(failure.detail, indexNoun)}` + relayedEncryptionChangeLimit(failure.detail));
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	cleanupFailureText(log, head, error) {
@@ -48592,8 +48713,8 @@ var DynamoDBGlobalTableProvider = class {
 		log.debug(`${head}${log.mask(failure.detail)}`);
 		return log.mask(failure.summary);
 	}
-	wrapDeleteError(log, error, build) {
-		const thrown = this.wrapMaskedError(log, error, build);
+	wrapDeleteError(log, error, build, indexNoun) {
+		const thrown = this.wrapMaskedError(log, error, build, indexNoun);
 		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 	}
 	async create(logicalId, resourceType, properties, context) {
@@ -48719,6 +48840,12 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
+		const createVectorIndexes = vectorIndexesForCreate(properties["VectorIndexes"]);
+		if (createVectorIndexes !== void 0) createParams.VectorIndexes = createVectorIndexes;
+		const warmCoercion = coerceWarmThroughput(properties["WarmThroughput"]);
+		if (warmCoercion.spec) createParams.WarmThroughput = warmCoercion.spec;
+		const warmDiagnostic = warmThroughputDiagnostic(properties["WarmThroughput"], warmCoercion, void 0);
+		if (warmDiagnostic) diagnostics.push(warmDiagnostic);
 		const createMode = readReplicationMode(properties);
 		if (createMode.kind === "usable") createParams.GlobalTableSettingsReplicationMode = createMode.mode;
 		const sseEnabledRefusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
@@ -48765,6 +48892,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			const tableInfo = await this.waitForTableActive(tableName, logicalId, void 0, maskSecrets);
+			if (createVectorIndexes !== void 0) await this.waitForVectorIndexesSettled(tableName, logicalId, maskSecrets);
 			for (const replica of wiringReplicas) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
@@ -48830,7 +48958,8 @@ var DynamoDBGlobalTableProvider = class {
 						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup: failed to drop replica ${region} on ${tableName}: `, replicaCleanupErr)} Run: ${pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName='${region}'}' --region ${currentRegion}`.render()}`);
 					}
 				}
-				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+				if (createVectorIndexes !== void 0) await this.rollBackCreatedVectorTable(logicalId, tableName, maskSecrets);
+				else await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 				retractCreatedResource(logicalId, resourceType, tableName);
 			} catch (cleanupErr) {
 				tableLeftBehind = true;
@@ -48843,6 +48972,32 @@ var DynamoDBGlobalTableProvider = class {
 			throw thrown;
 		}
 	}
+	async rollBackCreatedVectorTable(logicalId, tableName, maskSecrets) {
+		const logger = maskedLogger(this.logger, maskSecrets, tableName);
+		const allowanceMs = Math.min(resolveDynamoDbDeleteBudgetMs(), enclosingDeadlineRemainingMs() - DYNAMODB_DELETE_DEADLINE_MARGIN_MS);
+		const budget = allowanceMs > 0 ? new ElapsedBudget(allowanceMs, resolveDynamoDbDeleteBudgetClock()) : void 0;
+		await deleteTableWithIndexBusyRetry({
+			logicalId,
+			physicalId: tableName,
+			typeLabel: "GlobalTable",
+			indexNoun: TABLE_INDEX_NOUN,
+			maxRetries: 8,
+			logger,
+			deleteTable: async () => {
+				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+			},
+			reArm: () => this.waitForIndexesActive(tableName, logicalId, {
+				maxAttempts: 900,
+				shortCapUnlessVectorBusy: 60,
+				proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
+				...budget !== void 0 && { budget },
+				maskSecrets
+			}),
+			shouldKeepRetrying: () => budget !== void 0 && !budget.isExhausted(),
+			retryWarning: () => `DynamoDB GlobalTable ${logicalId}: AWS refused the DeleteTable rolling back the partially-created table ${tableName} because ${TABLE_INDEX_NOUN} is still being created, updated or deleted. Waiting for the indexes to settle and retrying (up to ${8} retries in all, within ~${Math.max(1, Math.round((budget?.totalMs ?? 0) / 6e4))} minutes).`,
+			sleepSeam: deleteTableRetryDelays
+		});
+	}
 	reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const seen = /* @__PURE__ */ new Set();
@@ -48861,6 +49016,47 @@ var DynamoDBGlobalTableProvider = class {
 		const format = (spec) => WARM_THROUGHPUT_MEMBERS.filter((m) => spec?.[m] !== void 0).map((m) => `${m}=${spec?.[m]}`).join(", ");
 		warn(`DynamoDB GlobalTable ${logicalId}: GSI '${maskSecrets(indexName)}' on ${physicalId}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease ("decreasing WarmThroughput is not supported"). Warm throughput only rises with a table's traffic, so a template below the live value can never be applied; raise it to at least the live value, or remove it. Every other change to this index is applied normally.`);
 	}
+	tableWarmThroughputForSend(desired, live, logicalId, physicalId, maskSecrets) {
+		if (!desired) return void 0;
+		const declared = WARM_THROUGHPUT_MEMBERS.filter((m) => desired[m] !== void 0);
+		if (declared.every((m) => desired[m] === live?.[m])) return void 0;
+		if (!isWarmThroughputDecrease(desired, live)) return desired;
+		const format = (spec) => declared.map((m) => `${m}=${spec?.[m]}`).join(", ");
+		this.logger.warn(maskSecrets(`DynamoDB GlobalTable ${logicalId}: table ${maskSecrets(physicalId)}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease. Raise it to at least the live value, or remove it. Every other change to this table is applied normally.`));
+	}
+	async applyVectorIndexUpdates(physicalId, logicalId, plan, desiredAttributeDefinitions, maskSecrets) {
+		const scope = (name) => `vector index ${typeof name === "string" ? maskSecrets(name) : "<unnamed>"} on DynamoDB GlobalTable ${maskSecrets(physicalId)}`;
+		for (const name of plan.alreadyGone) this.logger.debug(maskSecrets(`${scope(name)} is recorded but not live; skipping its Delete`));
+		for (const name of plan.adopted) this.logger.warn(maskSecrets(`${scope(name)} already exists in AWS with the declared definition but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`));
+		if (plan.ops.length === 0) return;
+		await this.waitForVectorIndexesSettled(physicalId, logicalId, maskSecrets);
+		markUnsettled("VectorIndexes");
+		for (const op of plan.ops) {
+			const input = {
+				TableName: physicalId,
+				VectorIndexUpdates: [op]
+			};
+			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			if (op.Create?.IndexName !== void 0) markAttemptedItems("VectorIndexes", [op.Create.IndexName]);
+			await this.waitForVectorIndexesSettled(physicalId, logicalId, maskSecrets);
+			this.logger.debug(maskSecrets(`${op.Create ? "created" : "deleted"} ` + scope(op.Create?.IndexName ?? op.Delete?.IndexName)));
+		}
+	}
+	async waitForVectorIndexesSettled(tableName, logicalId, maskSecrets) {
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB vector indexes on ${maskSecrets(tableName)}`));
+		try {
+			for (let attempt = 1; attempt <= VECTOR_INDEX_SETTLE_ATTEMPTS; attempt++) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
+				if (table?.TableStatus === "ACTIVE" && vectorIndexesSettled(table.VectorIndexes)) return;
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+		} finally {
+			watch.dispose();
+		}
+		throw new Error(maskSecrets(`DynamoDB GlobalTable ${logicalId}: table ${maskSecrets(tableName)} and its vector indexes did not settle within ${VECTOR_INDEX_SETTLE_ATTEMPTS} polls`));
+	}
 	async addReplica(tableName, replica, region, logicalId, billingMode, diagnostics, maskSecrets = (text) => text) {
 		const create = { RegionName: region };
 		const kmsMasterKeyId = readReplicaKmsMasterKeyId(replica);
@@ -49666,6 +49862,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (refusal === void 0 && !deepEqual(properties["StreamSpecification"], previousProperties["StreamSpecification"])) refusal = configStringRefusal(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
 			if (refusal === void 0 && (changed("SSESpecification") || !deepEqual(replicaKeyBlocks(properties), replicaKeyBlocks(previousProperties)))) refusal = configBooleanRefusal(properties["SSESpecification"], "SSEEnabled", "AWS::DynamoDB::GlobalTable SSESpecification");
 			if (refusal === void 0 && changed("GlobalSecondaryIndexes")) refusal = globalSecondaryIndexesShapeDetail(properties["GlobalSecondaryIndexes"], maskSecrets);
+			if (refusal === void 0 && changed("VectorIndexes")) refusal = vectorIndexesShapeDetail(properties["VectorIndexes"]);
 			if (refusal === void 0) refusal = replicaSettingsRefusal(properties, previousProperties);
 			if (refusal !== void 0) refuse(refusal);
 		} else {
@@ -49678,6 +49875,15 @@ var DynamoDBGlobalTableProvider = class {
 			await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
+			const vectorIndexesChanged = !deepEqual(properties["VectorIndexes"], previousProperties["VectorIndexes"]);
+			const vectorIndexShape = vectorIndexesShapeDetail(properties["VectorIndexes"]);
+			if (vectorIndexShape !== void 0 && vectorIndexesChanged) warn(`${vectorIndexShape}; the VectorIndexes change was not applied`);
+			const vectorIndexPlan = vectorIndexShape === void 0 && vectorIndexesChanged ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], describeResp.Table === void 0 ? void 0 : describeResp.Table.VectorIndexes ?? []) : void 0;
+			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
+				const vectorMessage = `AWS::DynamoDB::GlobalTable ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((name) => maskSecrets(name)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
+				warn(`${vectorMessage}; that change was not applied`);
+			}
 			const extractLocalTags = (props) => {
 				return localReplicaEntry(props, currentRegion)?.["Tags"];
 			};
@@ -49711,6 +49917,10 @@ var DynamoDBGlobalTableProvider = class {
 			const newBilling = billingUnusable ? oldBilling : requestedBilling;
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
 			const diagnostics = [];
+			if (!deepEqual(properties["WarmThroughput"], previousProperties["WarmThroughput"])) {
+				const warmUpdateDiagnostic = warmThroughputDiagnostic(properties["WarmThroughput"], coerceWarmThroughput(properties["WarmThroughput"]), void 0);
+				if (warmUpdateDiagnostic) diagnostics.push(warmUpdateDiagnostic);
+			}
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
 			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics, maskSecrets);
@@ -49828,7 +50038,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (flatChanged) {
 				if (flatUpdate.DeletionProtectionEnabled !== void 0) markUnsettled("Replicas");
 				if (flatUpdate.StreamSpecification !== void 0) markUnsettled("StreamSpecification");
-				if (flatUpdate.OnDemandThroughput !== void 0) markUnsettled("WriteOnDemandThroughputSettings");
+				if (flatUpdate.OnDemandThroughput !== void 0) markUnsettled("WriteOnDemandThroughputSettings", "ReadOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand(flatUpdate));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
@@ -49884,7 +50094,7 @@ var DynamoDBGlobalTableProvider = class {
 					}
 					if (indexUpdates.length > 0) billingUpdate.GlobalSecondaryIndexUpdates = indexUpdates;
 				}
-				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings");
+				markUnsettled("BillingMode", "WriteProvisionedThroughputSettings", TABLE_READ_PROVISIONED_KEY);
 				if (billingUpdate.GlobalSecondaryIndexUpdates !== void 0) {
 					markUnsettled("GlobalSecondaryIndexes");
 					for (const indexUpdate of billingUpdate.GlobalSecondaryIndexUpdates) debug(`Sending UpdateTable GlobalSecondaryIndexUpdates Update for index ${maskSecrets(indexUpdate.Update?.IndexName ?? "")} on ${physicalId} (with the billing mode change)`);
@@ -49893,13 +50103,29 @@ var DynamoDBGlobalTableProvider = class {
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			if (deferCeilingsPastFlip) {
-				markUnsettled("WriteOnDemandThroughputSettings");
+				markUnsettled("WriteOnDemandThroughputSettings", "ReadOnDemandThroughputSettings");
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
 					OnDemandThroughput: onDemandPayload
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			const readBlockOf = (bag) => localReplicaEntry(bag, currentRegion)?.[TABLE_READ_PROVISIONED_KEY] ?? bag[TABLE_READ_PROVISIONED_KEY];
+			if (oldBilling === "PROVISIONED" && newBilling === "PROVISIONED" && liveBillingMode === "PROVISIONED" && (properties[TABLE_READ_PROVISIONED_KEY] !== void 0 || previousProperties[TABLE_READ_PROVISIONED_KEY] !== void 0) && !deepEqual(readBlockOf(properties), readBlockOf(previousProperties))) {
+				const wantRead = coerceCfnInteger(asRecord(readBlockOf(properties))?.["ReadCapacityUnits"]);
+				const liveThroughput = describeResp.Table?.ProvisionedThroughput;
+				if (wantRead !== void 0 && liveThroughput?.WriteCapacityUnits !== void 0 && wantRead !== liveThroughput.ReadCapacityUnits) {
+					markUnsettled(TABLE_READ_PROVISIONED_KEY);
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						ProvisionedThroughput: {
+							ReadCapacityUnits: wantRead,
+							WriteCapacityUnits: liveThroughput.WriteCapacityUnits
+						}
+					}));
+					await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
+				}
+			}
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
@@ -50106,6 +50332,19 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
+			if (vectorIndexPlan !== void 0) await this.applyVectorIndexUpdates(physicalId, logicalId, vectorIndexPlan, properties["AttributeDefinitions"], maskSecrets);
+			if (!deepEqual(properties["WarmThroughput"], previousProperties["WarmThroughput"])) {
+				const warmCoercion = coerceWarmThroughput(properties["WarmThroughput"]);
+				const warmToSend = this.tableWarmThroughputForSend(warmCoercion.spec, describeResp.Table?.WarmThroughput, logicalId, physicalId, maskSecrets);
+				if (warmToSend) {
+					markUnsettled("WarmThroughput");
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						WarmThroughput: warmToSend
+					}));
+					await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
+				}
+			}
 			const skipAutoScalingForUnusableGsi = desiredGsiUnusable && newBilling !== "PAY_PER_REQUEST";
 			const autoScalingMeaningfulForIndexes = (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !skipAutoScalingForUnusableGsi;
 			if (skipAutoScalingForUnusableGsi && oldBilling === "PROVISIONED") warn(`AWS::DynamoDB::GlobalTable ${logicalId}: skipping the auto-scaling target reconcile because the GlobalSecondaryIndexes block is unusable — the per-index targets are derived from it, so reconciling would deregister the live indexes' scalable targets. Existing targets are left untouched.`);
@@ -50516,11 +50755,13 @@ var DynamoDBGlobalTableProvider = class {
 			const cause = regionErr instanceof Error ? regionErr : void 0;
 			throw new ProvisioningError(`Could not resolve client region for DynamoDB GlobalTable ${logicalId} delete — would risk dropping the local replica`, resourceType, logicalId, physicalId, cause);
 		}
-		let preDeleteIndexes;
+		let preDeleteTable;
+		let indexNoun;
 		try {
 			const describe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const replicas = describe.Table?.Replicas ?? [];
-			preDeleteIndexes = describe.Table?.GlobalSecondaryIndexes;
+			preDeleteTable = describe.Table;
+			if ((describe.Table?.VectorIndexes ?? []).length > 0) indexNoun = TABLE_INDEX_NOUN;
 			const tableIndexNames = (describe.Table?.GlobalSecondaryIndexes ?? []).map((gsi) => gsi.IndexName).filter((name) => typeof name === "string");
 			for (const replica of replicas) {
 				const region = replica.RegionName;
@@ -50556,8 +50797,8 @@ var DynamoDBGlobalTableProvider = class {
 			}
 		}
 		try {
-			if (hasTransitionalIndex(preDeleteIndexes)) {
-				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
+			if (hasTransitionalTableIndex(preDeleteTable)) {
+				deleteLog.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
 				await this.waitForIndexesActive(physicalId, logicalId, {
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget,
@@ -50568,6 +50809,7 @@ var DynamoDBGlobalTableProvider = class {
 				logicalId,
 				physicalId,
 				typeLabel: "GlobalTable",
+				...indexNoun !== void 0 && { indexNoun },
 				maxRetries: 8,
 				logger: loopLogger,
 				deleteTable: async () => {
@@ -50575,7 +50817,8 @@ var DynamoDBGlobalTableProvider = class {
 					flip.deleteAccepted = true;
 				},
 				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
-					maxAttempts: 60,
+					maxAttempts: 900,
+					shortCapUnlessVectorBusy: 60,
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget,
 					...context?.maskSecrets && { maskSecrets: context.maskSecrets }
@@ -50602,7 +50845,7 @@ var DynamoDBGlobalTableProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapDeleteError(deleteLog, error, (text) => new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapDeleteError(deleteLog, error, (text) => new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause), indexNoun);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -50671,7 +50914,7 @@ var DynamoDBGlobalTableProvider = class {
 			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed, attemptedItems);
 		}
 		for (const entry of unnamed.filter((e) => e.ambiguous === true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS has entries cdkd cannot key by an identity, so convergence keeps the recorded ${entry.path} rather than risk removing an entry neither the record nor the template declares. Check it with 'cdkd drift'.`);
-		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete).`);
+		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete; for a vector index: --vector-index-updates Delete).`);
 		return out;
 	}
 	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
@@ -50688,6 +50931,8 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			if (names.has("Replicas") && (table?.Replicas ?? []).some((replica) => replica.ReplicaStatus !== void 0 && MOVING.has(replica.ReplicaStatus))) moving.add("Replicas");
 			if (names.has("GlobalSecondaryIndexes") && (table?.GlobalSecondaryIndexes ?? []).some((index) => index.IndexStatus !== void 0 && MOVING.has(index.IndexStatus))) moving.add("GlobalSecondaryIndexes");
+			if (names.has("VectorIndexes") && (table?.VectorIndexes ?? []).some((index) => index.IndexStatus !== void 0 && MOVING.has(index.IndexStatus))) moving.add("VectorIndexes");
+			if (names.has("WarmThroughput") && table?.WarmThroughput?.Status === "UPDATING") moving.add("WarmThroughput");
 			const sse = table?.SSEDescription?.Status;
 			if (names.has("SSESpecification") && (sse === "ENABLING" || sse === "DISABLING" || sse === "UPDATING")) moving.add("SSESpecification");
 			if (names.has("TimeToLiveSpecification")) {
@@ -50823,6 +51068,21 @@ var DynamoDBGlobalTableProvider = class {
 					else result["WriteProvisionedThroughputSettings"] = {};
 				}
 			} else result["WriteProvisionedThroughputSettings"] = {};
+			const liveVectorIndexes = readbackVectorIndexes(table.VectorIndexes);
+			if (liveVectorIndexes !== void 0) result["VectorIndexes"] = liveVectorIndexes;
+			const declaredWarm = coerceWarmThroughput(properties?.["WarmThroughput"]).spec;
+			if (declaredWarm && table.WarmThroughput) {
+				const warm = {};
+				for (const member of WARM_THROUGHPUT_MEMBERS) {
+					const value = table.WarmThroughput[member];
+					const declared = declaredWarm[member];
+					if (declared === void 0 || value === void 0) continue;
+					warm[member] = table.WarmThroughput.Status === "UPDATING" ? Math.max(value, declared) : value;
+				}
+				if (Object.keys(warm).length > 0) result["WarmThroughput"] = warm;
+			}
+			if (properties?.[TABLE_READ_ON_DEMAND_KEY] !== void 0 && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) result[TABLE_READ_ON_DEMAND_KEY] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
+			if (properties?.[TABLE_READ_PROVISIONED_KEY] !== void 0 && billingMode !== "PAY_PER_REQUEST" && table.ProvisionedThroughput?.ReadCapacityUnits !== void 0) result[TABLE_READ_PROVISIONED_KEY] = { ReadCapacityUnits: table.ProvisionedThroughput.ReadCapacityUnits };
 			try {
 				const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableNameForSubs }))).TimeToLiveDescription;
 				const ttlStatus = ttlDesc?.TimeToLiveStatus;
@@ -50959,11 +51219,19 @@ var DynamoDBGlobalTableProvider = class {
 			return null;
 		}
 	}
-	getDriftUnknownPaths(_resourceType) {
-		return [];
+	getDriftUnknownPaths(_resourceType, properties) {
+		const paths = ["TableType"];
+		if (properties === void 0 || Object.keys(properties).length === 0) return paths;
+		if (properties["BillingMode"] !== "PROVISIONED") paths.push(TABLE_READ_PROVISIONED_KEY);
+		if (!coerceWarmThroughput(properties["WarmThroughput"]).spec) paths.push("WarmThroughput");
+		return paths;
 	}
 	getDriftUnorderedPaths(_resourceType) {
-		return ["AttributeDefinitions", "Replicas[]"];
+		return [
+			"AttributeDefinitions",
+			"Replicas[]",
+			"VectorIndexes"
+		];
 	}
 	canonicalizeDriftProperties(resourceType, properties) {
 		if (resourceType !== "AWS::DynamoDB::GlobalTable") return properties;
@@ -51059,7 +51327,7 @@ var DynamoDBGlobalTableProvider = class {
 			const response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
 			if (response.Table?.TableStatus === "ACTIVE") {
 				tableReachedActive = true;
-				if (!hasTransitionalIndex(response.Table?.GlobalSecondaryIndexes)) return;
+				if (!hasTransitionalTableIndex(response.Table)) return;
 			}
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
@@ -51078,6 +51346,7 @@ var DynamoDBGlobalTableProvider = class {
 			logger: maskedLogger(this.logger, opts?.maskSecrets, tableName),
 			describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName })),
 			maxAttempts: gateWait.grantedPolls,
+			...opts?.shortCapUnlessVectorBusy !== void 0 && { shortCapUnlessVectorBusy: opts.shortCapUnlessVectorBusy },
 			budgetWait: gateWait,
 			proceedNote: opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it."
 		});
@@ -51295,6 +51564,8 @@ const REPLICA_SETTING_MEMBERS = [
 	"GlobalSecondaryIndexes"
 ];
 const REPLICATION_MODE_KEY = "GlobalTableSettingsReplicationMode";
+const TABLE_READ_ON_DEMAND_KEY = "ReadOnDemandThroughputSettings";
+const TABLE_READ_PROVISIONED_KEY = "ReadProvisionedThroughputSettings";
 function readReplicationMode(properties) {
 	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const declared = replicas.map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY]).filter((value) => value !== void 0 && value !== null);
@@ -51330,9 +51601,35 @@ function replicationModeCorrection(properties, previousProperties, liveMode) {
 	if (replicationModeUpdate(properties, previousProperties) !== void 0) return void 0;
 	return (liveMode ?? "DISABLED") === want.mode ? void 0 : want.mode;
 }
+function tableLevelSettingsRefusal(properties) {
+	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
+	if (properties["TableType"] === "Regional" && replicas.length > 1) return "TableType Regional cannot be declared with more than one replica, as CloudFormation refuses it; declare TableType GlobalTableReplica or omit TableType";
+	const mode = readReplicationMode(properties);
+	for (const key of [TABLE_READ_ON_DEMAND_KEY, TABLE_READ_PROVISIONED_KEY]) {
+		if (properties[key] === void 0 || properties[key] === null) continue;
+		if (mode.kind !== "usable" || mode.mode !== "ENABLED") return `${key} at the table level needs Replicas[].${REPLICATION_MODE_KEY} ENABLED, as CloudFormation refuses it otherwise; enable it on the replica, or move the block to the replica`;
+		if (replicas.some((entry) => asRecord(entry)?.[key] !== void 0)) return `${key} cannot be declared at both the table level and a replica, as CloudFormation refuses it; keep one`;
+	}
+	if (properties[TABLE_READ_ON_DEMAND_KEY] !== void 0 && properties[TABLE_READ_ON_DEMAND_KEY] !== null && properties["BillingMode"] === "PROVISIONED") return `${TABLE_READ_ON_DEMAND_KEY} cannot be declared on a PROVISIONED table, as CloudFormation refuses it; remove it, or set BillingMode to PAY_PER_REQUEST`;
+}
+function replicaReadBlockShape(properties) {
+	return (Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).map((entry) => [asRecord(entry)?.[TABLE_READ_ON_DEMAND_KEY], asRecord(entry)?.[TABLE_READ_PROVISIONED_KEY]]);
+}
+const TABLE_LEVEL_SETTING_INPUTS = [
+	"TableType",
+	"BillingMode",
+	TABLE_READ_ON_DEMAND_KEY,
+	TABLE_READ_PROVISIONED_KEY
+];
 function replicaSettingsRefusal(properties, previousProperties, currentRegion) {
 	const mode = readReplicationMode(properties);
-	if (mode.kind === "unusable" && (previousProperties === void 0 || !deepEqual(replicationModeShape(properties), replicationModeShape(previousProperties)))) return mode.reason;
+	const modeShapeChanged = previousProperties === void 0 || !deepEqual(replicationModeShape(properties), replicationModeShape(previousProperties));
+	if (mode.kind === "unusable" && modeShapeChanged) return mode.reason;
+	if (modeShapeChanged || previousProperties === void 0 || !deepEqual(replicaReadBlockShape(properties), replicaReadBlockShape(previousProperties)) || TABLE_LEVEL_SETTING_INPUTS.some((key) => !deepEqual(properties[key], previousProperties?.[key]))) {
+		const tableLevelRefusal = tableLevelSettingsRefusal(properties);
+		if (tableLevelRefusal !== void 0) return tableLevelRefusal;
+	}
+	if (previousProperties?.[TABLE_READ_PROVISIONED_KEY] != null && properties[TABLE_READ_PROVISIONED_KEY] == null && properties["BillingMode"] === "PROVISIONED" && !(Array.isArray(properties["Replicas"]) ? properties["Replicas"] : []).some((entry) => asRecord(entry)?.[TABLE_READ_PROVISIONED_KEY] != null)) return `${TABLE_READ_PROVISIONED_KEY} cannot be removed from a PROVISIONED table with no replica declaring its own, as CloudFormation refuses it; keep it, declare it on the replica, or set BillingMode to PAY_PER_REQUEST`;
 	const desired = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const crossRegionCreate = previousProperties === void 0 && desired.some((entry) => {
 		const region = asRecord(entry)?.["Region"];
@@ -51403,11 +51700,12 @@ function extractLocalTableClass(props, region) {
 }
 function derivePerCallProvisionedThroughput(properties, region, source = "min", diagnostics, maskSecrets = (text) => text) {
 	const rawReplicas = properties["Replicas"];
-	const rawRead = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region)?.["ReadProvisionedThroughputSettings"];
+	const localReplica = (Array.isArray(rawReplicas) ? rawReplicas : []).find((r) => asRecord(r)?.["Region"] === region);
+	const rawRead = localReplica?.["ReadProvisionedThroughputSettings"] ?? properties[TABLE_READ_PROVISIONED_KEY];
 	const rawWrite = properties["WriteProvisionedThroughputSettings"];
 	const read = deriveReadCapacityUnits(asRecord(rawRead), source);
 	const write = deriveWriteCapacityUnits(asRecord(rawWrite), source);
-	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "Replicas[local].ReadProvisionedThroughputSettings" }, maskSecrets);
+	if (read === void 0) reportUnresolvedProvisionedCapacity(rawRead, "Read", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: localReplica?.["ReadProvisionedThroughputSettings"] !== void 0 ? "Replicas[local].ReadProvisionedThroughputSettings" : TABLE_READ_PROVISIONED_KEY }, maskSecrets);
 	if (write === void 0) reportUnresolvedProvisionedCapacity(rawWrite, "Write", source, { appliedUnits: DEFAULT_CAPACITY_UNITS }, diagnostics, { blockName: "WriteProvisionedThroughputSettings" }, maskSecrets);
 	return {
 		ReadCapacityUnits: read ?? DEFAULT_CAPACITY_UNITS,
@@ -51433,6 +51731,7 @@ function autoScalingResourceId(tableName, indexName) {
 const autoScalingRetryDelays = {};
 const REPLICA_GONE_WAIT_ATTEMPTS = 600;
 const GLOBAL_TABLE_ACTIVE_WAIT_ATTEMPTS = 600;
+const VECTOR_INDEX_SETTLE_ATTEMPTS = 1800;
 const TABLE_GONE_WAIT_ATTEMPTS = 600;
 const deleteTableRetryDelays = {};
 const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
@@ -51554,6 +51853,8 @@ function collectDesiredKeyAttributeNames(properties, options) {
 		if (!Array.isArray(indexes)) continue;
 		for (const index of indexes) addKeySchema(asRecord(index)?.["KeySchema"]);
 	}
+	const vectorIndexes = properties["VectorIndexes"];
+	if (Array.isArray(vectorIndexes)) for (const index of vectorIndexes) addKeySchema(asRecord(index)?.["SearchSchema"]);
 	return names;
 }
 function asRecord(value) {
@@ -51798,6 +52099,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 function stripProvisionedCapacityKeys(properties) {
 	const result = { ...properties };
 	delete result["WriteProvisionedThroughputSettings"];
+	delete result[TABLE_READ_PROVISIONED_KEY];
 	const indexes = result["GlobalSecondaryIndexes"];
 	if (Array.isArray(indexes)) result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
 		const gsi = asRecord(entry);
@@ -51837,7 +52139,7 @@ function stripProvisionedCapacityKeys(properties) {
 	return result;
 }
 const PROVISIONED_ONLY_CAPACITY_KEYS = {
-	table: ["WriteProvisionedThroughputSettings"],
+	table: ["WriteProvisionedThroughputSettings", "ReadProvisionedThroughputSettings"],
 	index: [
 		"WriteProvisionedThroughputSettings",
 		"ReadProvisionedThroughputSettings",
@@ -51847,7 +52149,7 @@ const PROVISIONED_ONLY_CAPACITY_KEYS = {
 	replicaIndex: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"]
 };
 const ON_DEMAND_ONLY_CAPACITY_KEYS = {
-	table: ["WriteOnDemandThroughputSettings"],
+	table: ["WriteOnDemandThroughputSettings", "ReadOnDemandThroughputSettings"],
 	index: [
 		"WriteOnDemandThroughputSettings",
 		"ReadOnDemandThroughputSettings",
@@ -52074,11 +52376,12 @@ function toSdkReplicaThroughputOverrides(cfn, billingMode, diagnostics, context,
 function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecrets = (text) => text) {
 	const writeBlock = properties["WriteOnDemandThroughputSettings"];
 	const replicas = properties["Replicas"];
-	const readBlock = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["ReadOnDemandThroughputSettings"];
+	const replicaReadBlock = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["ReadOnDemandThroughputSettings"];
+	const readBlock = replicaReadBlock ?? properties[TABLE_READ_ON_DEMAND_KEY];
 	const rawRead = asRecord(readBlock)?.["MaxReadRequestUnits"];
 	const rawWrite = asRecord(writeBlock)?.["MaxWriteRequestUnits"];
 	reportUnresolvedRawMember(rawRead, diagnostics, {
-		blockName: "Replicas[local].ReadOnDemandThroughputSettings",
+		blockName: replicaReadBlock !== void 0 ? "Replicas[local].ReadOnDemandThroughputSettings" : TABLE_READ_ON_DEMAND_KEY,
 		member: "MaxReadRequestUnits"
 	}, maskSecrets);
 	reportUnresolvedRawMember(rawWrite, diagnostics, {
@@ -55592,5 +55895,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { getPriorAttempts as $, applyCallerIdentityCredentials as $a, unionOfSecretBags as $c, isCustomResourceType as $i, orphansCarriedFrom as $l, namesAnyDeclaredParameter as $n, malformedResourcePropertiesWarning as $o, withoutSuperseded as $r, isWarmThroughputDecrease as $s, formatResourceLine as $t, resolveStateBucketWithDefault as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, withoutUnsettledProperties as Aa, maskedLeafCoordinatesOf as Ac, renderAssemblyPathEscape as Ad, acquireIdempotencyToken as Ai, LockManager as Al, recheckFailedPlan as An, accountArgs as Ao, mappingPairs as Ar, repairMalformedOutputsForReadOnly as As, keptForRetainedRecord as At, finchSecretArgvRefusal as Au, deleteTableWithIndexBusyRetry as B, producerLookupOver as Ba, markSameGenerationBag as Bc, refuseMalformedDesiredTags as Bi, stackInstanceIdOf as Bl, isRedactedRecordedValue as Bn, malformedExportSourceWarning as Bo, gray as Br, findSilentDropProperties as Bs, revertedNestedRowIds as Bt, runDockerStreaming as Bu, planContributorInsightsOp as C, DiffCalculator as Ca, DagBuilder as Cc, hasOwnKey as Cd, isFinalSnapshotError as Ci, recordMaskOnlyValuesIn as Cl, equalModuloMask as Cn, passedParameterClassesOf as Co, findRefactorHints as Cr, refuseMalformedResourcePropertiesForOrphan as Cs, keptWholeReasonText as Ct, buildDenyExternalAccessPolicy as Cu, reverseMapTableContributorInsights as D, unsettledItemsOf as Da, maskAtCoordinates as Dc, absoluteAssemblyPathEscape as Dd, ledgerForStack as Di, wholeStringLeavesOf as Dl, isReplacementOrphan as Dn, STATE_RESOURCES_MALFORMED as Do, withMovedTo as Dr, refuseMalformedState as Ds, planOrphanAdoption as Dt, describeDockerExecFailure as Du, reverseMapIndexContributorInsights as E, unsettledItemsField as Ea, isMarkedCoordinate as Ec, ownValue as Ed, earliestDefined as Ei, recordProvenPublicExpression as El, isJournaledOrphan as En, STATE_REGION_DIVERGED as Eo, rollbackOrphanIds as Er, refuseMalformedResourcesForExport as Es, makeSiblingClaimReader as Et, describeDockerCapturedOutput as Eu, resolveDynamoDbDeleteBudgetClock as F, s3BucketDomainName as Fa, readbackPathFor as Fc, resolveBucketRegion as Fd, markDeleteStarted as Fi, CrossPrefixScanCache as Fl, orphanNeedsIdentity as Fn, hasReadableResources as Fo, getStackRecords as Fr, unreadableOrphanRecords as Fs, dropSettledNestedJournals as Ft, partitionSensitiveEnv as Fu, isTtlRateLimited as G, recordedReferenceRegions as Ga, createUnionSecretMasker as Gc, CC_BROKEN_REASON as Gi, exportNamesCarriedFrom as Gl, nameGenerationCarriedFrom as Gn, malformedOrphanRecordsWarning as Go, deleteSupersededEntry as Gr, findReplacedReadersOfRecreateTargets as Gs, deleteJournaledOrphans as Gt, synthesisStatusMessage as Gu, relayedIndexBusyDelete as H, keepHeldTokenProvenance as Ha, recordReferenceProvenanceEntry as Hc, tagPlanWarning as Hi, splitImportedOps as Hl, redactedDeleteAddressSkip as Hn, malformedLocalResourceEntriesWarning as Ho, red as Hr, withoutSilentDropProperties as Hs, collectNestedChildUnaddressed as Ht, AssetManifestLoader as Hu, resolveDynamoDbDeleteBudgetMs as I, s3BucketDualStackDomainName as Ia, readsNoEchoSource as Ic, DBPROXY_TAGS_WHAT as Ii, applyCrossPrefixScan as Il, findNestedStackTypeChanges as In, isReadableOrphanRecord as Io, withStackRecords as Ir, unreadableResourceEntries as Is, getNestedRevertRun as It, redactDockerArgvValues as Iu, sendTtlWaitingOutRateLimit as J, assertSendableRoleArn as Ja, logOnlyValueCount as Jc, isCustomResource as Ji, hasUnverifiableParameterRefusal as Jl, retiredAfterRollback as Jn, malformedOrphansWarning as Jo, removeSuperseded as Jr, isStatefulRecreateTargetForReplace as Js, isHandledOrphan as Jt, loadCdkJson as Ju, planTimeToLive as K, applyRoleArnIfSet as Ka, hasMaskableValues as Kc, ProviderRegistry as Ki, hasReadableExportSet as Kl, nameGenerationHighWaterOf as Kn, malformedOrphanRowsKeptWarning as Ko, holdsSupersededResources as Kr, shownType as Ks, dropFailedCommands as Kt, getDefaultStateBucketName as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, s3BucketRegionalDomainName as La, recordedNoEchoValuesOf as Lc, DBPROXY_TAG_OPTIONS as Li, crossPrefixDeniedWarning as Ll, getCurrentProducerRegions as Ln, isReadableResourceEntry as Lo, replacedDeleteFailureVerdict as Lr, withheldAccountClause as Ls, nestedChildStackName as Lt, redactedCause as Lu, beginDeleteWait as M, poisonRenderedSpellingsCollidingIn as Ma, noEchoLeavesOf as Mc, injectAwsRegion as Md, DeploymentEventsStore as Mi, S3StateBackend as Ml, replacementNeverSwapped as Mn, displayLogicalId as Mo, proposeRenames as Mr, repairMalformedResourcePropertiesForReadOnly as Ms, NESTED_PENDING_PARENT_REASON as Mt, getDockerCmd as Mu, compensateRemovedDeletionProtection as N, isSettledInstanceState as Na, noEchoOutputsComparison as Nc, injectedAwsRegionValue as Nd, extractDeploymentEventError as Ni, rebuildClientForBucketRegion as Nl, resolveReplacementOldType as Nn, hasReadableOrphans as No, awaitInFlightSibling as Nr, repairMalformedResourcesForReadOnly as Ns, displacedOpClause as Nt, isDockerClientEnvKey as Nu, stripIndexContributorInsights as O, unsettledPropertiesOf as Oa, maskReadbackAtCoordinates as Oc, describeFileReadFailure as Od, reserveStackCreateToken as Oi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ol, planFailedOps as On, UNREADABLE_ORPHANS_CONTAINER_ROW as Oo, isPairableType as Or, repairMalformedOrphanRecordsForReadOnly as Os, pendingRequestCount as Ot, describeDockerFailure as Ou, deleteBudgetKey as P, s3BucketArn as Pa, passedNoEchoParametersOf as Pc, clearBucketRegionCache as Pd, isRefusedByName as Pi, CrossPrefixReadError as Pl, seedsDeleteFirstGuard as Pn, hasReadableOutputs as Po, destroyStackRecordsView as Pr, unpreviewableOrphanRecords as Ps, displacedPhysicalIdShown as Pt, isMalformedEnvKey as Pu, isTruthyCfnBoolean as Q, AWS_CREDENTIAL_ENV_KEYS as Qa, shareLogOnlyValues as Qc, readsNoEchoDeleteValues as Qi, orphansAfterRollback as Ql, computeParameterTaint as Qn, malformedResourceEntriesWarning as Qo, supersededResourcesOf as Qr, coerceWarmThroughput as Qs, sameJournaledOrphans as Qt, resolveSkipPrefix as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, s3BucketWebsiteUrl as Ra, valueAtCoordinate as Rc, planTagDiff as Ri, isAccessDenied$1 as Rl, inheritProducerRegions as Rn, malformedDriftResourcePropertiesWarning as Ro, bold as Rr, findActionableSilentDrops as Rs, recordDisplacedSkips as Rt, redactedDockerCause as Ru, indexDeclaresContributorInsights as S, reEnableInstanceApiTermination as Sa, sameLambdaFunctionAddress as Sc, defineOwnKey as Sd, effectiveDeletionPolicy as Si, recordMaskOnlyValue as Sl, equalModuloMarkedMask as Sn, parameterInputsFor as So, formatDestructiveChange as Sr, refuseMalformedResourcePropertiesForExport as Ss, isSecretBearingReferenceString as St, validateContainerRepoName as Su, readContributorInsightsSpec as T, isUsableAttemptedName as Ta, canonicalCoordinates as Tc, nullPrototypeRecord as Td, unsupportedFinalSnapshotError as Ti, recordNoEchoParameterFreshValue as Tl, demoteSupersededOrphans as Tn, JSON_LISTING_HOLE_VALUE as To, movedToHint as Tr, refuseMalformedResourcesForDestroy as Ts, makeCanonicalizePropertiesFn as Tt, resolveDockerContextDirectory as Tu, waitForIndexesSettled as U, outputReferenceProvenanceOf as Ua, snapshotPassProvenance as Uc, definedAttributes as Ui, acceptedCreateOnlyDropsOf as Ul, updatePartialMessage as Un, malformedLocalResourcesWarning as Uo, yellow as Ur, NO_CC_HANDLERS_REASON as Us, getCurrentNestedStackContext as Ut, getDockerImageBySourceHash as Uu, maskedLogger as V, refuseUnreadableCdkCrossAccountRefs as Va, redactForState as Vc, tagMapAsList as Vi, withStackInstanceIdWithheld as Vl, redactedDeleteAddressFields as Vn, malformedLocalOutputsWarning as Vo, green as Vr, unwrittenCreateOnlyReplacement as Vs, withNestedRevertRun as Vt, warnFinchArgvExposure as Vu, isTtlAlreadyDisabled as W, recordedOutputReferenceRegions as Wa, carryLogOnlyValues as Wc, stringifyIfAssigned as Wi, describeRegionValueKind as Wl, updatePartialReason as Wn, malformedOrphanRecordsRefusalMessage as Wo, addSuperseded as Wr, hasNoCloudControlHandlers as Ws, withNestedStackContext as Wt, Synthesizer as Wu, S3_AUTO_DELETE_OBJECTS_TAG as X, isIamRoleArn as Xa, recordLogOnlyParameterValue as Xc, waitForLambdaFunctionActive as Xi, importableOutputs as Xl, retiredNameGenerationsLeaving as Xn, malformedOutputsWarning as Xo, supersededHeldByOtherTypeWarning as Xr, renderStatefulReason as Xs, loadJournaledOrphans as Xt, resolveAutoAssetStorage as Xu, ECR_AUTO_DELETE_IMAGES_TAG as Y, explicitRoleArnOrThrow as Ya, printingCorpusOf as Yc, wouldReturnToSdkProvider as Yi, importableOutputKeys as Yl, retiredNameGenerationsAfter as Yn, malformedOutputsRefusalMessage as Yo, supersededAfterRollback as Yr, isStatefulRecreateTargetSync as Ys, journaledOrphanLines as Yt, resolveApp as Yu, hasCdkAutoDeleteTag as Z, sendableAssumeRoleCommand as Za, recordLogOnlyValue as Zc, TemplateNoEchoReresolver as Zi, isReadableBag as Zl, withNameGenerationReached as Zn, malformedRenderedContainersWarning as Zo, supersededHolderOf as Zr, WARM_THROUGHPUT_MEMBERS as Zs, makeForeignHolderScan as Zt, resolveCaptureObservedState as Zu, streamMemberRefusals as _, disableInstanceApiTermination as _a, dbInstanceEngineChangeIsInPlace as _c, StageLoadError as _d, ATOMIC_FINAL_SNAPSHOT_TYPES as _i, recordAttributeIdCopy as _l, removeProtectionTypeList as _n, isStalePlaceholderArnAttribute as _o, DEFAULT_RESOURCE_TIMEOUT_MS as _r, refuseMalformedResourceEntriesForImport as _s, readRecordedConditionVerdicts as _t, getBootstrapMarkerKey as _u, isProtectionValueActive as a, CloudControlProvider as aa, configIntegerRefusal as ac, CFN_TEMPLATE_BODY_LIMIT as ad, createReadOnlyAttributeHealerFactory as ai, withPhysicalNameCopies as al, readRefactorMarkerOnce as an, regionLessSecretName as ao, secretBearing as ar, refuseMalformedNestedChildOutputs as as, deferredServiceTokenWarning as at, AssetPublisher as au, CONTRIBUTOR_INSIGHTS_KEY as b, observeThenDisableInstanceApiTermination as ba, canonicalLambdaFunctionName as bc, parseFailureDebugDetail as bd, ccRoutedFinalSnapshotError as bi, carriesSecretMask as bl, withUnprovenUnsettled as bn, parseWebACLArn as bo, constructPathOf as br, refuseMalformedResourcePropertiesForDestroy as bs, withResourceDeadline as bt, readBootstrapMarkerBody as bu, DynamoDBGlobalTableProvider as c, unchangedBehindSecretReference as ca, replayWarn as cc, findLargeInlineResources as cd, maskEventTextWithBoundBags as ci, dynamicReferenceTokens as cl, refuseRefactorMarker as cn, parameterTypeMayLoseSecretIdentity as co, carriedExportAliasExposure as cr, refuseMalformedOrphans as cs, childTemplateLoader as ct, WorkGraph as cu, declaredStreamPolicyMember as d, deleteIndeterminateGuards as da, requireConfigString as dc, decodeListingKey as dd, secretNamePrintingBag as di, spelledKeysOf as dl, hasPendingMovesOut as dn, carriesDynamicReference as do, isWholeDynamicReferenceValue as dr, refuseMalformedOutputs as ds, listNestedTemplateRows as dt, loadPublishableAssetManifest as du, getCurrentResourceSecrets as ea, toCfnInteger as ec, resolveStateBucketWithDefaultAndSource as ed, noEchoAttributeNamesOf as ei, createSecretMasker as el, chunks as en, callerEnvCredentials as eo, reachableDivergentParameters as er, malformedResourcesWarning as es, markRefusedBeforeApplying as et, shouldRetainResource as eu, declaredStreamTagsMember as f, deleteLeftInPlace as fa, prefetchCreateOnlyPropertyPaths as fc, expectedOwnerParam as fd, secretNamePrintingBags as fi, identityKeyFor as fl, pendingMovesOutOf as fn, carriesFetchableDynamicReference as fo, noEchoParameterValueSeed as fr, refuseMalformedOutputsForDestroy as fs, renderNestedTemplateTreeDefect as ft, rewriteTemplateAssetReferences as fu, streamDeclaresTags as g, markWaitAbandoned as ga, blockDeviceMappingsDifferOnlyInDeleteOnTermination as gc, AssemblyReader as gd, storedSecretNameNeedles as gi, physicalNameCopiesOf as gl, replayRollback as gn, cfnRefValueFromPhysicalId as go, bindingSkippedOutputs as gr, refuseMalformedResourceEntriesForDestroy as gs, parentSuppliedValues as gt, ensureAssetStorage as gu, streamDeclaresPolicy as h, isWaitAbandonedError as ha, withRetry as hc, derivePartitionAndUrlSuffix as hd, stateSecretNameNeedles as hi, recoverMaskedOutput as hl, replayFailedOperations as hn, AWS_NO_VALUE as ho, isExportAliasCollision as hr, refuseMalformedResourceEntriesForDeploy as hs, conditionInputsFrom as ht, assertAssetBucketRegion as hu, PROTECTION_PROPERTY_BY_TYPE as i, customResourceResponseExpirationWarning as ia, configBooleanRefusal as ic, ssmResolvedValueType as id, withAttemptedItemsMasked as ii, scrubResourceRecord as il, readRefactorMarker as in, producerRegionsFromState as io, exportAliasCollisionScrubWarning as ir, refuseDivergentRecordRegionForDestroy as is, inheritedProvenanceForChildDiff as it, timePhase as iu, DYNAMODB_DELETE_POLL_COST_MS as j, IntrinsicFunctionResolver as ja, noEchoCoordinatesOf as jc, resolveAssemblyPath as jd, DeploymentEventsReader as ji, isLockInfoExpired as jl, recordUnderIdIsNotOwn as jn, deployRefusesOrphanRowsReason as jo, parseMappingFile as jr, repairMalformedResourceEntriesForReadOnly as js, recordRetainedForReadoption as jt, formatDockerLoginError as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, withUnsettledProperties as ka, maskWholeValue as kc, displayAssemblyPath as kd, withCreateTokenLedger as ki, isSingleDynamicReferenceToken as kl, planRollback as kn, UNREADABLE_RESOURCES_MAP_ROW as ko, looselyEqual as kr, repairMalformedOrphansForReadOnly as ks, resolvePendingCloudControlRequests as kt, dockerSpawnEnvWithSensitive as ku, STREAM_POLICY_KEY as l, RollbackInlinePolicyWriters as la, requireConfigArray as lc, uploadCfnTemplate as ld, namingSecretsWithRecordedNoEcho as li, isUncertifiedBaselineMaskPosition as ll, sameMove as ln, getAccountInfo as lo, exportNameNoEchoParameters as lr, refuseMalformedOrphansForDestroy as ls, findNestedTemplateTreeDefect as lt, buildAssetRedirectMap as lu, reverseMapStreamPolicy as m, withIndeterminateGuard as ma, describeTypeWithThrottleRetry as mc, canonicalizeRegion as md, secretNamedRecordNeedles as mi, recordNestedStackParameterExpressions as ml, refusePendingMovesOut as mn, keepsSecretReferenceToken as mo, collectPublishedOutputNames as mr, refuseMalformedResourceEntries as ms, conditionFingerprint as mt, BOOTSTRAP_MARKER_PREFIX as mu, recordedProtectionEvidence as n, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as na, coerceCfnBoolean as nc, stateBucketExistenceConfirmed as nd, noEchoExactEchoLeavesOf as ni, maskSecretsInError as nl, lookupEachName as nn, classifyRecordedSecretRegion as no, WITHHELD_NAME_DISPLAY as nr, malformedStateRefusalMessage as ns, computeImplicitDeleteEdges as nt, PhaseClock as nu, perType as o, slowCcOperationTimeoutMs as oa, configStringRefusal as oc, CFN_TEMPLATE_URL_LIMIT as od, completedReplayEntries as oi, withoutPhysicalNameCopies as ol, refactorMarkerMovesOf as on, coerceParameterTypedValue as oo, secretBearingStateKeyWarning as or, refuseMalformedOrphanRecords as os, findServiceTokenRefusals as ot, isSensitiveAttributeName as ou, planStreamMemberOps as p, deleteSkipReason as pa, templateResourceTypes as pc, PARTITION_TABLE as pd, secretNamedAttributeNamesOf as pi, inheritNestedStackParameterAssociations as pl, pendingMovesRefusalMessage as pn, isNamelessDynamicReferenceError as po, collectDeclaredOutputNames as pr, refuseMalformedResourceAttributesForOrphan as ps, templateIdentity as pt, AssetModeResolver as pu, readTtlSpec as q, assertFlagRoleArn as qa, literalSplitDelimitersOf as qc, ccBrokenReason as qi, hasReasonlessBaselineRefusal as ql, nameScopeOf as qn, malformedOrphansRefusalMessage as qo, isSupersededResourceRecord as qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as qs, dropFailedHint as qt, getLegacyStateBucketName as qu, recordedProtectionNote as r, applyCustomResourceResponseExpiration as ra, coerceCfnInteger as rc, warnDeprecatedNoPrefixCliFlag as rd, noEchoParameterNamesOf as ri, maskSecretsInText as rl, withApiLimit as rn, classifyReplaySecretRegion as ro, displayTextOrWithheld as rr, previewableOrphanRecords as rs, crossStackOutputProvenanceSource as rt, renderPhaseTimings as ru, readProtection as s, onlySecretReferencesDiffer as sa, readConfigString as sc, MIGRATE_TMP_PREFIX as sd, journaledOrphanPrintingBag as si, DYNAMIC_REFERENCE_TOKEN_SCAN as sl, refactorMarkerRefusalMessage as sn, isUnboundTemplateParameter as so, secretSafeKeyDisplay as sr, refuseMalformedOrphanRecordsForDestroy as ss, serviceTokenBlockingReason as st, stringifyValue as su, DeployEngine as t, withPrintingSecrets as ta, toFiniteNumber as tc, resolveUseCdkBootstrapAssets as td, noEchoComparisonForTemplate as ti, errorCauseChain as tl, isAccessDeniedError as tn, envCredentialsAreAssumedRole as to, resourcesNamingDeclaredParameter as tr, malformedScrubResourceEntriesRefusalMessage as ts, IMPLICIT_DELETE_DEPENDENCIES as tt, stackInstanceIdCarriedFrom as tu, STREAM_TAGS_KEY as u, UNSPECIFIED_SKIP_REASON as ua, requireConfigObject as uc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ud, orphanRecordsPrintingBag as ui, pathCrossesDottedKey as ul, updateRefactorMarker as un, isImpossibleEmptyStoredAttribute as uo, exportNameSecretExposure as ur, refuseMalformedOrphansForOrphan as us, isAbsoluteAssetPath as ut, createAssetRedirectResolver as uu, streamPolicyMatchesDeclared as v, ec2InstanceProtectionSite as va, ecsServiceLaunchTypeSetOrChanged as vc, processStackMessages as vd, PRE_DELETE_SNAPSHOT_TYPES as vi, recordPhysicalNameCopy as vl, recordAfterRollbackUpdate as vn, lacksRecordedTableArn as vo, DEFAULT_RESOURCE_WARN_AFTER_MS as vr, refuseMalformedResourceEntriesForImportSave as vs, enclosingDeadlineExpired as vt, isCrossRegionRedirect as vu, planIndexContributorInsightsOps as w, INTRINSIC_KEYS as wa, TemplateParser as wc, hasPlainPrototype$1 as wd, refusesFinalSnapshot as wi, recordNoEchoAttributeValues as wl, undeclaredEmptyObservedKeys as wn, declaresNoEcho as wo, hintSidesOf as wr, refuseMalformedResourcesForDeploy as ws, mergeNoChangeOutputs as wt, buildDockerImage as wu, contributorInsightsRefusals as x, reDisableInstanceApiTermination as xa, lambdaFunctionNameForMask as xc, utf8ByteLength as xd, createPreDeleteFinalSnapshot as xi, provenPublicValue as xl, calculateResourceDrift as xn, withSharedDrainBudget as xo, findDestructiveChanges as xr, refuseMalformedResourcePropertiesForDrift as xs, diffSecurity as xt, validateAssetBucketName as xu, streamTagsMatchDeclared as y, isTerminationProtectionPropagationError as ya, emrClusterInstancesReplaced as yc, describeJsonParseFailure as yd, buildFinalSnapshotIdentifier as yi, splitGetAttStringForm as yl, settleUnsettledPrevious as yn, refStateLookupFromResource as yo, maskingRetryLogger as yr, refuseMalformedResourceEntriesForOrphan as ys, enclosingDeadlineRemainingMs as yt, parseBootstrapMarker as yu, TABLE_INDEX_NOUN as z, resolveDynamicReferences as za, liveMatchesUnresolvedTokenFrame as zc, readTagList as zi, isNotImplemented as zl, REDACTED_DELETE_ADDRESS_SKIP_REASON as zn, malformedExportNamesWarning as zo, cyan as zr, findHandledUnwrittenCreateOnly as zs, revertNestedChildFromJournal as zt, runDockerForeground as zu };
-//# sourceMappingURL=deploy-engine-CwpnkMCZ.js.map
+export { sendTtlWaitingOutRateLimit as $, assertSendableRoleArn as $a, logOnlyValueCount as $c, isCustomResource as $i, hasUnverifiableParameterRefusal as $l, retiredAfterRollback as $n, malformedOrphansWarning as $o, removeSuperseded as $r, isStatefulRecreateTargetForReplace as $s, isHandledOrphan as $t, loadCdkJson as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, isUsableAttemptedName as Aa, canonicalCoordinates as Ac, nullPrototypeRecord as Ad, unsupportedFinalSnapshotError as Ai, recordNoEchoParameterFreshValue as Al, demoteSupersededOrphans as An, JSON_LISTING_HOLE_VALUE as Ao, movedToHint as Ar, refuseMalformedResourcesForDestroy as As, makeCanonicalizePropertiesFn as At, resolveDockerContextDirectory as Au, deleteTableWithIndexBusyRetry as B, s3BucketDomainName as Ba, readbackPathFor as Bc, resolveBucketRegion as Bd, markDeleteStarted as Bi, CrossPrefixScanCache as Bl, orphanNeedsIdentity as Bn, hasReadableResources as Bo, getStackRecords as Br, unreadableOrphanRecords as Bs, dropSettledNestedJournals as Bt, partitionSensitiveEnv as Bu, planContributorInsightsOp as C, ec2InstanceProtectionSite as Ca, ecsServiceLaunchTypeSetOrChanged as Cc, processStackMessages as Cd, PRE_DELETE_SNAPSHOT_TYPES as Ci, recordPhysicalNameCopy as Cl, recordAfterRollbackUpdate as Cn, lacksRecordedTableArn as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImportSave as Cs, enclosingDeadlineExpired as Ct, isCrossRegionRedirect as Cu, reverseMapTableContributorInsights as D, reEnableInstanceApiTermination as Da, sameLambdaFunctionAddress as Dc, defineOwnKey as Dd, effectiveDeletionPolicy as Di, recordMaskOnlyValue as Dl, equalModuloMarkedMask as Dn, parameterInputsFor as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForExport as Ds, isSecretBearingReferenceString as Dt, validateContainerRepoName as Du, reverseMapIndexContributorInsights as E, reDisableInstanceApiTermination as Ea, lambdaFunctionNameForMask as Ec, utf8ByteLength as Ed, createPreDeleteFinalSnapshot as Ei, provenPublicValue as El, calculateResourceDrift as En, withSharedDrainBudget as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDrift as Es, diffSecurity as Et, validateAssetBucketName as Eu, resolveDynamoDbDeleteBudgetClock as F, withoutUnsettledProperties as Fa, maskedLeafCoordinatesOf as Fc, renderAssemblyPathEscape as Fd, acquireIdempotencyToken as Fi, LockManager as Fl, recheckFailedPlan as Fn, accountArgs as Fo, mappingPairs as Fr, repairMalformedOutputsForReadOnly as Fs, keptForRetainedRecord as Ft, finchSecretArgvRefusal as Fu, readbackVectorIndexes as G, producerLookupOver as Ga, markSameGenerationBag as Gc, refuseMalformedDesiredTags as Gi, stackInstanceIdOf as Gl, isRedactedRecordedValue as Gn, malformedExportSourceWarning as Go, gray as Gr, findSilentDropProperties as Gs, revertedNestedRowIds as Gt, runDockerStreaming as Gu, relayedIndexBusyDelete as H, s3BucketRegionalDomainName as Ha, recordedNoEchoValuesOf as Hc, DBPROXY_TAG_OPTIONS as Hi, crossPrefixDeniedWarning as Hl, getCurrentProducerRegions as Hn, isReadableResourceEntry as Ho, replacedDeleteFailureVerdict as Hr, withheldAccountClause as Hs, nestedChildStackName as Ht, redactedCause as Hu, resolveDynamoDbDeleteBudgetMs as I, IntrinsicFunctionResolver as Ia, noEchoCoordinatesOf as Ic, resolveAssemblyPath as Id, DeploymentEventsReader as Ii, isLockInfoExpired as Il, recordUnderIdIsNotOwn as In, deployRefusesOrphanRowsReason as Io, parseMappingFile as Ir, repairMalformedResourceEntriesForReadOnly as Is, recordRetainedForReadoption as It, formatDockerLoginError as Iu, vectorIndexesShapeDetail as J, outputReferenceProvenanceOf as Ja, snapshotPassProvenance as Jc, definedAttributes as Ji, acceptedCreateOnlyDropsOf as Jl, updatePartialMessage as Jn, malformedLocalResourcesWarning as Jo, yellow as Jr, NO_CC_HANDLERS_REASON as Js, getCurrentNestedStackContext as Jt, getDockerImageBySourceHash as Ju, vectorIndexesForCreate as K, refuseUnreadableCdkCrossAccountRefs as Ka, redactForState as Kc, tagMapAsList as Ki, withStackInstanceIdWithheld as Kl, redactedDeleteAddressFields as Kn, malformedLocalOutputsWarning as Ko, green as Kr, unwrittenCreateOnlyReplacement as Ks, withNestedRevertRun as Kt, warnFinchArgvExposure as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, poisonRenderedSpellingsCollidingIn as La, noEchoLeavesOf as Lc, injectAwsRegion as Ld, DeploymentEventsStore as Li, S3StateBackend as Ll, replacementNeverSwapped as Ln, displayLogicalId as Lo, proposeRenames as Lr, repairMalformedResourcePropertiesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, getDockerCmd as Lu, beginDeleteWait as M, unsettledItemsOf as Ma, maskAtCoordinates as Mc, absoluteAssemblyPathEscape as Md, ledgerForStack as Mi, wholeStringLeavesOf as Ml, isReplacementOrphan as Mn, STATE_RESOURCES_MALFORMED as Mo, withMovedTo as Mr, refuseMalformedState as Ms, planOrphanAdoption as Mt, describeDockerExecFailure as Mu, compensateRemovedDeletionProtection as N, unsettledPropertiesOf as Na, maskReadbackAtCoordinates as Nc, describeFileReadFailure as Nd, reserveStackCreateToken as Ni, WHOLE_DYNAMIC_REFERENCE_PATTERN as Nl, planFailedOps as Nn, UNREADABLE_ORPHANS_CONTAINER_ROW as No, isPairableType as Nr, repairMalformedOrphanRecordsForReadOnly as Ns, pendingRequestCount as Nt, describeDockerFailure as Nu, stripIndexContributorInsights as O, DiffCalculator as Oa, DagBuilder as Oc, hasOwnKey as Od, isFinalSnapshotError as Oi, recordMaskOnlyValuesIn as Ol, equalModuloMask as On, passedParameterClassesOf as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForOrphan as Os, keptWholeReasonText as Ot, buildDenyExternalAccessPolicy as Ou, deleteBudgetKey as P, withUnsettledProperties as Pa, maskWholeValue as Pc, displayAssemblyPath as Pd, withCreateTokenLedger as Pi, isSingleDynamicReferenceToken as Pl, planRollback as Pn, UNREADABLE_RESOURCES_MAP_ROW as Po, looselyEqual as Pr, repairMalformedOrphansForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, dockerSpawnEnvWithSensitive as Pu, readTtlSpec as Q, assertFlagRoleArn as Qa, literalSplitDelimitersOf as Qc, ccBrokenReason as Qi, hasReasonlessBaselineRefusal as Ql, nameScopeOf as Qn, malformedOrphansRefusalMessage as Qo, isSupersededResourceRecord as Qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qs, dropFailedHint as Qt, getLegacyStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, isSettledInstanceState as Ra, noEchoOutputsComparison as Rc, injectedAwsRegionValue as Rd, extractDeploymentEventError as Ri, rebuildClientForBucketRegion as Rl, resolveReplacementOldType as Rn, hasReadableOrphans as Ro, awaitInFlightSibling as Rr, repairMalformedResourcesForReadOnly as Rs, displacedOpClause as Rt, isDockerClientEnvKey as Ru, indexDeclaresContributorInsights as S, disableInstanceApiTermination as Sa, dbInstanceEngineChangeIsInPlace as Sc, StageLoadError as Sd, ATOMIC_FINAL_SNAPSHOT_TYPES as Si, recordAttributeIdCopy as Sl, removeProtectionTypeList as Sn, isStalePlaceholderArnAttribute as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForImport as Ss, readRecordedConditionVerdicts as St, getBootstrapMarkerKey as Su, readContributorInsightsSpec as T, observeThenDisableInstanceApiTermination as Ta, canonicalLambdaFunctionName as Tc, parseFailureDebugDetail as Td, ccRoutedFinalSnapshotError as Ti, carriesSecretMask as Tl, withUnprovenUnsettled as Tn, parseWebACLArn as To, constructPathOf as Tr, refuseMalformedResourcePropertiesForDestroy as Ts, withResourceDeadline as Tt, readBootstrapMarkerBody as Tu, waitForIndexesSettled as U, s3BucketWebsiteUrl as Ua, valueAtCoordinate as Uc, planTagDiff as Ui, isAccessDenied$1 as Ul, inheritProducerRegions as Un, malformedDriftResourcePropertiesWarning as Uo, bold as Ur, findActionableSilentDrops as Us, recordDisplacedSkips as Ut, redactedDockerCause as Uu, maskedLogger as V, s3BucketDualStackDomainName as Va, readsNoEchoSource as Vc, DBPROXY_TAGS_WHAT as Vi, applyCrossPrefixScan as Vl, findNestedStackTypeChanges as Vn, isReadableOrphanRecord as Vo, withStackRecords as Vr, unreadableResourceEntries as Vs, getNestedRevertRun as Vt, redactDockerArgvValues as Vu, planVectorIndexUpdates as W, resolveDynamicReferences as Wa, liveMatchesUnresolvedTokenFrame as Wc, readTagList as Wi, isNotImplemented as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedExportNamesWarning as Wo, cyan as Wr, findHandledUnwrittenCreateOnly as Ws, revertNestedChildFromJournal as Wt, runDockerForeground as Wu, isTtlRateLimited as X, recordedReferenceRegions as Xa, createUnionSecretMasker as Xc, CC_BROKEN_REASON as Xi, exportNamesCarriedFrom as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsWarning as Xo, deleteSupersededEntry as Xr, findReplacedReadersOfRecreateTargets as Xs, deleteJournaledOrphans as Xt, synthesisStatusMessage as Xu, isTtlAlreadyDisabled as Y, recordedOutputReferenceRegions as Ya, carryLogOnlyValues as Yc, stringifyIfAssigned as Yi, describeRegionValueKind as Yl, updatePartialReason as Yn, malformedOrphanRecordsRefusalMessage as Yo, addSuperseded as Yr, hasNoCloudControlHandlers as Ys, withNestedStackContext as Yt, Synthesizer as Yu, planTimeToLive as Z, applyRoleArnIfSet as Za, hasMaskableValues as Zc, ProviderRegistry as Zi, hasReadableExportSet as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRowsKeptWarning as Zo, holdsSupersededResources as Zr, shownType as Zs, dropFailedCommands as Zt, getDefaultStateBucketName as Zu, streamMemberRefusals as _, deleteLeftInPlace as _a, prefetchCreateOnlyPropertyPaths as _c, expectedOwnerParam as _d, secretNamePrintingBags as _i, identityKeyFor as _l, pendingMovesOutOf as _n, carriesFetchableDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputsForDestroy as _s, renderNestedTemplateTreeDefect as _t, rewriteTemplateAssetReferences as _u, isProtectionValueActive as a, getCurrentResourceSecrets as aa, toCfnInteger as ac, resolveStateBucketWithDefaultAndSource as ad, noEchoAttributeNamesOf as ai, createSecretMasker as al, chunks as an, callerEnvCredentials as ao, reachableDivergentParameters as ar, malformedResourcesWarning as as, markRefusedBeforeApplying as at, shouldRetainResource as au, CONTRIBUTOR_INSIGHTS_KEY as b, isWaitAbandonedError as ba, withRetry as bc, derivePartitionAndUrlSuffix as bd, stateSecretNameNeedles as bi, recoverMaskedOutput as bl, replayFailedOperations as bn, AWS_NO_VALUE as bo, isExportAliasCollision as br, refuseMalformedResourceEntriesForDeploy as bs, conditionInputsFrom as bt, assertAssetBucketRegion as bu, DynamoDBGlobalTableProvider as c, applyCustomResourceResponseExpiration as ca, coerceCfnInteger as cc, warnDeprecatedNoPrefixCliFlag as cd, noEchoParameterNamesOf as ci, maskSecretsInText as cl, withApiLimit as cn, classifyReplaySecretRegion as co, displayTextOrWithheld as cr, previewableOrphanRecords as cs, crossStackOutputProvenanceSource as ct, renderPhaseTimings as cu, declaredStreamPolicyMember as d, slowCcOperationTimeoutMs as da, configStringRefusal as dc, CFN_TEMPLATE_URL_LIMIT as dd, completedReplayEntries as di, withoutPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, coerceParameterTypedValue as do, secretBearingStateKeyWarning as dr, refuseMalformedOrphanRecords as ds, findServiceTokenRefusals as dt, isSensitiveAttributeName as du, wouldReturnToSdkProvider as ea, isStatefulRecreateTargetSync as ec, resolveApp as ed, supersededAfterRollback as ei, printingCorpusOf as el, journaledOrphanLines as en, explicitRoleArnOrThrow as eo, retiredNameGenerationsAfter as er, malformedOutputsRefusalMessage as es, ECR_AUTO_DELETE_IMAGES_TAG as et, importableOutputKeys as eu, declaredStreamTagsMember as f, onlySecretReferencesDiffer as fa, readConfigString as fc, MIGRATE_TMP_PREFIX as fd, journaledOrphanPrintingBag as fi, DYNAMIC_REFERENCE_TOKEN_SCAN as fl, refactorMarkerRefusalMessage as fn, isUnboundTemplateParameter as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecordsForDestroy as fs, serviceTokenBlockingReason as ft, stringifyValue as fu, streamDeclaresTags as g, deleteIndeterminateGuards as ga, requireConfigString as gc, decodeListingKey as gd, secretNamePrintingBag as gi, spelledKeysOf as gl, hasPendingMovesOut as gn, carriesDynamicReference as go, isWholeDynamicReferenceValue as gr, refuseMalformedOutputs as gs, listNestedTemplateRows as gt, loadPublishableAssetManifest as gu, streamDeclaresPolicy as h, UNSPECIFIED_SKIP_REASON as ha, requireConfigObject as hc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hd, orphanRecordsPrintingBag as hi, pathCrossesDottedKey as hl, updateRefactorMarker as hn, isImpossibleEmptyStoredAttribute as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForOrphan as hs, isAbsoluteAssetPath as ht, createAssetRedirectResolver as hu, PROTECTION_PROPERTY_BY_TYPE as i, isCustomResourceType as ia, isWarmThroughputDecrease as ic, resolveStateBucketWithDefault as id, withoutSuperseded as ii, unionOfSecretBags as il, formatResourceLine as in, applyCallerIdentityCredentials as io, namesAnyDeclaredParameter as ir, malformedResourcePropertiesWarning as is, getPriorAttempts as it, orphansCarriedFrom as iu, DYNAMODB_DELETE_POLL_COST_MS as j, unsettledItemsField as ja, isMarkedCoordinate as jc, ownValue as jd, earliestDefined as ji, recordProvenPublicExpression as jl, isJournaledOrphan as jn, STATE_REGION_DIVERGED as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForExport as js, makeSiblingClaimReader as jt, describeDockerCapturedOutput as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, INTRINSIC_KEYS as ka, TemplateParser as kc, hasPlainPrototype$1 as kd, refusesFinalSnapshot as ki, recordNoEchoAttributeValues as kl, undeclaredEmptyObservedKeys as kn, declaresNoEcho as ko, hintSidesOf as kr, refuseMalformedResourcesForDeploy as ks, mergeNoChangeOutputs as kt, buildDockerImage as ku, STREAM_POLICY_KEY as l, customResourceResponseExpirationWarning as la, configBooleanRefusal as lc, ssmResolvedValueType as ld, withAttemptedItemsMasked as li, scrubResourceRecord as ll, readRefactorMarker as ln, producerRegionsFromState as lo, exportAliasCollisionScrubWarning as lr, refuseDivergentRecordRegionForDestroy as ls, inheritedProvenanceForChildDiff as lt, timePhase as lu, reverseMapStreamPolicy as m, RollbackInlinePolicyWriters as ma, requireConfigArray as mc, uploadCfnTemplate as md, namingSecretsWithRecordedNoEcho as mi, isUncertifiedBaselineMaskPosition as ml, sameMove as mn, getAccountInfo as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphansForDestroy as ms, findNestedTemplateTreeDefect as mt, buildAssetRedirectMap as mu, recordedProtectionEvidence as n, TemplateNoEchoReresolver as na, WARM_THROUGHPUT_MEMBERS as nc, resolveCaptureObservedState as nd, supersededHolderOf as ni, recordLogOnlyValue as nl, makeForeignHolderScan as nn, sendableAssumeRoleCommand as no, withNameGenerationReached as nr, malformedRenderedContainersWarning as ns, hasCdkAutoDeleteTag as nt, isReadableBag as nu, perType as o, withPrintingSecrets as oa, toFiniteNumber as oc, resolveUseCdkBootstrapAssets as od, noEchoComparisonForTemplate as oi, errorCauseChain as ol, isAccessDeniedError as on, envCredentialsAreAssumedRole as oo, resourcesNamingDeclaredParameter as or, malformedScrubResourceEntriesRefusalMessage as os, IMPLICIT_DELETE_DEPENDENCIES as ot, stackInstanceIdCarriedFrom as ou, planStreamMemberOps as p, unchangedBehindSecretReference as pa, replayWarn as pc, findLargeInlineResources as pd, maskEventTextWithBoundBags as pi, dynamicReferenceTokens as pl, refuseRefactorMarker as pn, parameterTypeMayLoseSecretIdentity as po, carriedExportAliasExposure as pr, refuseMalformedOrphans as ps, childTemplateLoader as pt, WorkGraph as pu, vectorIndexesSettled as q, keepHeldTokenProvenance as qa, recordReferenceProvenanceEntry as qc, tagPlanWarning as qi, splitImportedOps as ql, redactedDeleteAddressSkip as qn, malformedLocalResourceEntriesWarning as qo, red as qr, withoutSilentDropProperties as qs, collectNestedChildUnaddressed as qt, AssetManifestLoader as qu, recordedProtectionNote as r, readsNoEchoDeleteValues as ra, coerceWarmThroughput as rc, resolveSkipPrefix as rd, supersededResourcesOf as ri, shareLogOnlyValues as rl, sameJournaledOrphans as rn, AWS_CREDENTIAL_ENV_KEYS as ro, computeParameterTaint as rr, malformedResourceEntriesWarning as rs, isTruthyCfnBoolean as rt, orphansAfterRollback as ru, readProtection as s, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as sa, coerceCfnBoolean as sc, stateBucketExistenceConfirmed as sd, noEchoExactEchoLeavesOf as si, maskSecretsInError as sl, lookupEachName as sn, classifyRecordedSecretRegion as so, WITHHELD_NAME_DISPLAY as sr, malformedStateRefusalMessage as ss, computeImplicitDeleteEdges as st, PhaseClock as su, DeployEngine as t, waitForLambdaFunctionActive as ta, renderStatefulReason as tc, resolveAutoAssetStorage as td, supersededHeldByOtherTypeWarning as ti, recordLogOnlyParameterValue as tl, loadJournaledOrphans as tn, isIamRoleArn as to, retiredNameGenerationsLeaving as tr, malformedOutputsWarning as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputs as tu, STREAM_TAGS_KEY as u, CloudControlProvider as ua, configIntegerRefusal as uc, CFN_TEMPLATE_BODY_LIMIT as ud, createReadOnlyAttributeHealerFactory as ui, withPhysicalNameCopies as ul, readRefactorMarkerOnce as un, regionLessSecretName as uo, secretBearing as ur, refuseMalformedNestedChildOutputs as us, deferredServiceTokenWarning as ut, AssetPublisher as uu, streamPolicyMatchesDeclared as v, deleteSkipReason as va, templateResourceTypes as vc, PARTITION_TABLE as vd, secretNamedAttributeNamesOf as vi, inheritNestedStackParameterAssociations as vl, pendingMovesRefusalMessage as vn, isNamelessDynamicReferenceError as vo, collectDeclaredOutputNames as vr, refuseMalformedResourceAttributesForOrphan as vs, templateIdentity as vt, AssetModeResolver as vu, planIndexContributorInsightsOps as w, isTerminationProtectionPropagationError as wa, emrClusterInstancesReplaced as wc, describeJsonParseFailure as wd, buildFinalSnapshotIdentifier as wi, splitGetAttStringForm as wl, settleUnsettledPrevious as wn, refStateLookupFromResource as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForOrphan as ws, enclosingDeadlineRemainingMs as wt, parseBootstrapMarker as wu, contributorInsightsRefusals as x, markWaitAbandoned as xa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as xc, AssemblyReader as xd, storedSecretNameNeedles as xi, physicalNameCopiesOf as xl, replayRollback as xn, cfnRefValueFromPhysicalId as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDestroy as xs, parentSuppliedValues as xt, ensureAssetStorage as xu, streamTagsMatchDeclared as y, withIndeterminateGuard as ya, describeTypeWithThrottleRetry as yc, canonicalizeRegion as yd, secretNamedRecordNeedles as yi, recordNestedStackParameterExpressions as yl, refusePendingMovesOut as yn, keepsSecretReferenceToken as yo, collectPublishedOutputNames as yr, refuseMalformedResourceEntries as ys, conditionFingerprint as yt, BOOTSTRAP_MARKER_PREFIX as yu, TABLE_INDEX_NOUN as z, s3BucketArn as za, passedNoEchoParametersOf as zc, clearBucketRegionCache as zd, isRefusedByName as zi, CrossPrefixReadError as zl, seedsDeleteFirstGuard as zn, hasReadableOutputs as zo, destroyStackRecordsView as zr, unpreviewableOrphanRecords as zs, displacedPhysicalIdShown as zt, isMalformedEnvKey as zu };
+//# sourceMappingURL=deploy-engine--bCIMkkk.js.map