@go-to-k/cdkd 0.314.0 → 0.315.0

package/dist/{neptune-provider-CGZ_G4Vz.js → neptune-provider-BNxotnbp.js}

@@ -1,10 +1,11 @@
 import { $ as safeMsg, E as generatedNameFor, n as describeAwsFailure, s as getLogger } from "./aws-failure-text-agWtoyga.js";
-import { A as withoutServerErrorRetries, Ar as markNonRetryable, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, J as deleteWithProtectionCompensation, Mn as ProvisioningError, Mr as wrapMaskedAwsError, N as markNotGone, P as assertRegionMatch, Pt as maskerOrIdentity, U as resolveExplicitPhysicalId, Z as isTerminalDbWaitStatus, dn as ambientClientDefaults, et as observeThenDisableProtection, h as clearOnUpdateRemoval, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, mr as relayedNameCollision, nt as rdsFamilyProtectionSite, q as deleteAfterProtectionFlipWithFinalSnapshot, tt as protectionFlipKey, v as removedTemplateKeys, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
+import { A as withoutServerErrorRetries, Ar as markNonRetryable, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, J as deleteWithProtectionCompensation, Mn as ProvisioningError, Mr as wrapMaskedAwsError, N as markNotGone, P as assertRegionMatch, Pt as maskerOrIdentity, U as resolveExplicitPhysicalId, Wt as markAuxiliaryFailure, X as isProceedDbStatus, Z as isTerminalDbWaitStatus, dn as ambientClientDefaults, et as observeThenDisableProtection, h as clearOnUpdateRemoval, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, mr as relayedNameCollision, nt as rdsFamilyProtectionSite, q as deleteAfterProtectionFlipWithFinalSnapshot, tt as protectionFlipKey, v as removedTemplateKeys, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { Ct as enclosingDeadlineRemainingMs, Hi as planTagDiff, Ji as stringifyIfAssigned, Ki as tagPlanWarning, Wi as refuseMalformedDesiredTags, qi as definedAttributes } from "./deploy-engine-ClIUqDQL.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-By0_BFNO.js";
+import { Aa as isUsableAttemptedName, Gi as refuseMalformedDesiredTags, Ji as definedAttributes, Ui as planTagDiff, Yi as stringifyIfAssigned, lc as configBooleanRefusal, qi as tagPlanWarning, sc as coerceCfnBoolean, wt as enclosingDeadlineRemainingMs } from "./deploy-engine--bCIMkkk.js";
+import { n as modifyDbInstanceWhenAvailable, t as isModifyNotAvailableRefusal } from "./db-instance-modify-retry-B1NRKBSQ.js";
 import { DescribeSecurityGroupsCommand, EC2Client } from "@aws-sdk/client-ec2";
-import { AddTagsToResourceCommand, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBSubnetGroupCommand, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBSubnetGroupCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBSubnetGroupCommand, NeptuneClient, RemoveTagsFromResourceCommand } from "@aws-sdk/client-neptune";
+import { isDeepStrictEqual } from "node:util";
+import { AddRoleToDBClusterCommand, AddTagsToResourceCommand, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBSubnetGroupCommand, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBSubnetGroupCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBSubnetGroupCommand, NeptuneClient, RemoveRoleFromDBClusterCommand, RemoveTagsFromResourceCommand } from "@aws-sdk/client-neptune";
 
 //#region src/provisioning/providers/neptune-provider.ts
 function clusterAttributes(cluster) {
@@ -39,13 +40,113 @@ const CLUSTER_KEPT_ON_REMOVAL = [
 	"IamAuthEnabled",
 	"BackupRetentionPeriod",
 	"DBPort",
-	"Port"
+	"Port",
+	"CopyTagsToSnapshot"
 ];
 const INSTANCE_KEPT_ON_REMOVAL = [
 	"DBParameterGroupName",
 	"PreferredMaintenanceWindow",
 	"AutoMinorVersionUpgrade"
 ];
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clusterRoleKey(role) {
+	return `${role.RoleArn ?? ""}\n${role.FeatureName ?? ""}`;
+}
+function clusterRoleList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	const roles = /* @__PURE__ */ new Map();
+	for (const entry of value) {
+		if (!isPlainObject(entry)) return void 0;
+		const { RoleArn: roleArn, FeatureName: featureName } = entry;
+		if (typeof roleArn !== "string" || roleArn === "") return void 0;
+		if (featureName != null && typeof featureName !== "string") return void 0;
+		const role = {
+			RoleArn: roleArn,
+			...featureName ? { FeatureName: featureName } : {}
+		};
+		roles.set(clusterRoleKey(role), role);
+	}
+	return [...roles.values()];
+}
+function stringList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	return value.every((item) => typeof item === "string") ? value : void 0;
+}
+function logExportChange(desired, previous) {
+	const enable = desired.filter((type) => !previous.includes(type));
+	const disable = previous.filter((type) => !desired.includes(type));
+	if (enable.length === 0 && disable.length === 0) return void 0;
+	return {
+		...enable.length > 0 && { EnableLogTypes: enable },
+		...disable.length > 0 && { DisableLogTypes: disable }
+	};
+}
+function serverlessScalingToSend(value) {
+	if (value == null) return void 0;
+	if (!isPlainObject(value)) return null;
+	const min = cfnCapacity(value["MinCapacity"]);
+	const max = cfnCapacity(value["MaxCapacity"]);
+	if (min === void 0 || max === void 0) return null;
+	return {
+		MinCapacity: min,
+		MaxCapacity: max
+	};
+}
+function cfnCapacity(value) {
+	const capacity = typeof value === "number" || typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	return Number.isFinite(capacity) ? capacity : void 0;
+}
+function isMajorEngineChange(previous, desired) {
+	if (typeof previous !== "string" || typeof desired !== "string") return false;
+	const major = (version) => version.split(".").slice(0, 2).join(".");
+	return major(previous) !== major(desired);
+}
+function holdsPendingValue(value) {
+	if (value === void 0 || value === null) return false;
+	if (typeof value === "object") return Object.values(value).some(holdsPendingValue);
+	return true;
+}
+function isUnmovingDbStatus(status) {
+	return isProceedDbStatus(status) || status === "backing-up";
+}
+function isRoleCallNotAvailableRefusal(error) {
+	return error instanceof Error && error.name === "InvalidDBClusterStateFault" && /is not available for IAM role association, disassociation, or updates/i.test(error.message);
+}
+const SETTLE_MAX_WAIT_MS = 3e5;
+const ROLE_AVAILABLE_MAX_WAIT_MS = 18e5;
+const DEADLINE_MARGIN_MS = 3e4;
+const CLUSTER_MODIFY_KEYS = [
+	"EngineVersion",
+	"DeletionProtection",
+	"BackupRetentionPeriod",
+	"PreferredBackupWindow",
+	"PreferredMaintenanceWindow",
+	"DBClusterParameterGroupName",
+	"IamAuthEnabled",
+	"VpcSecurityGroupIds",
+	"DBPort",
+	"Port",
+	"CopyTagsToSnapshot",
+	"NetworkType",
+	"ServerlessScalingConfiguration",
+	"EnableCloudwatchLogsExports"
+];
+const INSTANCE_MODIFY_KEYS = [
+	"DBInstanceClass",
+	"DBParameterGroupName",
+	"PreferredMaintenanceWindow",
+	"AutoMinorVersionUpgrade",
+	"DeletionProtection",
+	"PubliclyAccessible"
+];
+function markChangedUnsettled(keys, properties, previousProperties, context) {
+	for (const key of keys) if (!isDeepStrictEqual(properties[key], previousProperties[key])) context?.markUnsettled?.(key);
+}
+const CLUSTER_UNMEASURED_ON_REMOVAL = ["NetworkType", "ServerlessScalingConfiguration"];
 var NeptuneProvider = class {
 	neptuneClient;
 	createClient;
@@ -75,7 +176,14 @@ var NeptuneProvider = class {
 			"DBClusterParameterGroupName",
 			"IamAuthEnabled",
 			"DeletionProtection",
-			"Tags"
+			"Tags",
+			"AssociatedRoles",
+			"AvailabilityZones",
+			"CopyTagsToSnapshot",
+			"DBInstanceParameterGroupName",
+			"EnableCloudwatchLogsExports",
+			"NetworkType",
+			"ServerlessScalingConfiguration"
 		])],
 		["AWS::Neptune::DBInstance", /* @__PURE__ */ new Set([
 			"DBInstanceIdentifier",
@@ -87,17 +195,25 @@ var NeptuneProvider = class {
 			"PreferredMaintenanceWindow",
 			"AutoMinorVersionUpgrade",
 			"DeletionProtection",
-			"Tags"
+			"Tags",
+			"AllowMajorVersionUpgrade",
+			"PubliclyAccessible"
 		])]
 	]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Neptune::DBCluster", /* @__PURE__ */ new Map([["GlobalClusterIdentifier", "Cloud Control owns a global-cluster member: NeptuneProvider has no detach, and a member cannot be deleted while attached (deletesThroughSdkProvider keeps its delete there too)"]])], ["AWS::Neptune::DBInstance", /* @__PURE__ */ new Map([["DBSnapshotIdentifier", "The CloudFormation schema documents it as not supported, and CreateDBInstance has no such member: a Neptune instance is not restored from a snapshot, its cluster is"]])]]);
 	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::Neptune::DBCluster", /* @__PURE__ */ new Set([
 		"DBClusterIdentifier",
 		"DBSubnetGroupName",
 		"StorageEncrypted",
 		"KmsKeyId",
+		"AvailabilityZones",
 		"VpcSecurityGroupIds",
 		"Tags",
-		...CLUSTER_KEPT_ON_REMOVAL
+		"AssociatedRoles",
+		"EnableCloudwatchLogsExports",
+		"DBInstanceParameterGroupName",
+		...CLUSTER_KEPT_ON_REMOVAL,
+		...CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::Neptune::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBClusterIdentifier",
@@ -106,6 +222,8 @@ var NeptuneProvider = class {
 		"DBInstanceClass",
 		"DeletionProtection",
 		"Tags",
+		"AllowMajorVersionUpgrade",
+		"PubliclyAccessible",
 		...INSTANCE_KEPT_ON_REMOVAL
 	])]]);
 	constructor(options) {
@@ -139,8 +257,8 @@ var NeptuneProvider = class {
 		const mask = context?.maskSecrets;
 		switch (resourceType) {
 			case "AWS::Neptune::DBSubnetGroup": return this.createDBSubnetGroup(logicalId, resourceType, properties, mask);
-			case "AWS::Neptune::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask);
-			case "AWS::Neptune::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask);
+			case "AWS::Neptune::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			case "AWS::Neptune::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask, context?.replayingState === true);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -222,9 +340,13 @@ var NeptuneProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Neptune DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createDBCluster(logicalId, resourceType, properties, mask) {
+	async createDBCluster(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating Neptune DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const { roles, logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, {
+			creating: true,
+			stateBorne: replayingState
+		});
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::Neptune::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
@@ -244,6 +366,11 @@ var NeptuneProvider = class {
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				EnableIAMDatabaseAuthentication: properties["IamAuthEnabled"],
 				DeletionProtection: properties["DeletionProtection"],
+				AvailabilityZones: properties["AvailabilityZones"],
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				NetworkType: properties["NetworkType"],
+				...logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
+				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
@@ -252,6 +379,12 @@ var NeptuneProvider = class {
 			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created Neptune DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
+			try {
+				await this.applyClusterRoles(logicalId, dbClusterIdentifier, roles, [], [], mask, void 0);
+			} catch (error) {
+				markAuxiliaryFailure(error, logicalId);
+				throw error;
+			}
 			return {
 				physicalId: dbClusterIdentifier,
 				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
@@ -265,7 +398,19 @@ var NeptuneProvider = class {
 	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Neptune DBCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const { roles, logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, {
+			creating: false,
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		});
+		const logExportConfig = logExportChange(logTypes, stringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
 		try {
+			const unrecorded = (key) => properties[key] != null && previousProperties[key] == null;
+			const live = unrecorded("EngineVersion") || unrecorded("NetworkType") || logExportConfig?.EnableLogTypes !== void 0 ? await this.describeDBCluster(physicalId) : void 0;
+			const majorUpgrade = isMajorEngineChange(previousProperties["EngineVersion"] ?? live?.EngineVersion, properties["EngineVersion"]);
+			const networkType = properties["NetworkType"];
+			const networkChange = networkType != null && networkType !== (previousProperties["NetworkType"] ?? live?.NetworkType);
+			markChangedUnsettled(CLUSTER_MODIFY_KEYS, properties, previousProperties, context);
 			const vpcSgIds = await this.dbClusterSecurityGroupsToSend(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			await this.getClient().send(new ModifyDBClusterCommand({
 				DBClusterIdentifier: physicalId,
@@ -278,16 +423,37 @@ var NeptuneProvider = class {
 				EnableIAMDatabaseAuthentication: properties["IamAuthEnabled"],
 				...vpcSgIds !== void 0 && { VpcSecurityGroupIds: vpcSgIds },
 				Port: properties["DBPort"] != null ? Number(properties["DBPort"]) : properties["Port"] != null ? Number(properties["Port"]) : void 0,
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				...networkChange && { NetworkType: networkType },
+				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
+				...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig },
+				...majorUpgrade && { AllowMajorVersionUpgrade: true },
+				...majorUpgrade && properties["DBInstanceParameterGroupName"] != null && { DBInstanceParameterGroupName: properties["DBInstanceParameterGroupName"] },
 				ApplyImmediately: true
 			}));
+			const addedLogTypes = (logExportConfig?.EnableLogTypes ?? []).filter((type) => !live?.EnabledCloudwatchLogsExports?.includes(type));
+			if (addedLogTypes.length > 0) context?.markAttempted?.("EnableCloudwatchLogsExports", addedLogTypes);
 			this.logger.debug(`Successfully updated Neptune DBCluster ${logicalId}`);
 			const described = await this.describeDBCluster(physicalId);
+			if (logExportConfig !== void 0 && process.env["CDKD_NO_WAIT"] !== "true") {
+				const { EnableLogTypes: enabled = [], DisableLogTypes: disabled = [] } = logExportConfig;
+				await this.waitForApplied(logicalId, "EnableCloudwatchLogsExports", async () => {
+					const live = (await this.describeDBCluster(physicalId))?.EnabledCloudwatchLogsExports;
+					return enabled.every((type) => live?.includes(type)) && !disabled.some((type) => live?.includes(type));
+				});
+			}
+			if (networkChange && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForApplied(logicalId, "NetworkType", async () => (await this.describeDBCluster(physicalId))?.NetworkType === networkType);
+			await this.applyClusterRoles(logicalId, physicalId, roles, clusterRoleList(previousProperties["AssociatedRoles"]) ?? [], described?.AssociatedRoles ?? [], context?.maskSecrets, context);
 			if (process.env["CDKD_NO_WAIT"] !== "true" && securityGroupListChanged(vpcSgIds, previousProperties["VpcSecurityGroupIds"])) {
 				await this.waitForSecurityGroupsApplied(physicalId, logicalId, vpcSgIds ?? []);
 				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterSecurityGroupChange(member.DBInstanceIdentifier, logicalId);
 			}
-			if (described?.DBClusterArn) await this.applyTagDiff(described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			if (described?.DBClusterArn) {
+				markChangedUnsettled(["Tags"], properties, previousProperties, context);
+				await this.applyTagDiff(described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			}
 			this.warnKeptRemovals(logicalId, resourceType, properties, previousProperties, CLUSTER_KEPT_ON_REMOVAL, context);
+			this.warnKeptRemovals(logicalId, resourceType, properties, previousProperties, CLUSTER_UNMEASURED_ON_REMOVAL, context, false);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -376,9 +542,10 @@ var NeptuneProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Neptune DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createDBInstance(logicalId, resourceType, properties, mask) {
+	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating Neptune DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const publiclyAccessible = this.readPublicAccess(properties, resourceType, logicalId, void 0, replayingState);
 		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::Neptune::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
@@ -394,6 +561,7 @@ var NeptuneProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				DeletionProtection: properties["DeletionProtection"],
+				PubliclyAccessible: publiclyAccessible,
 				...tags.length > 0 && { Tags: tags }
 			}));
 			instanceCreated = true;
@@ -416,7 +584,9 @@ var NeptuneProvider = class {
 		const mask = context?.maskSecrets;
 		this.logger.debug(`Updating Neptune DBInstance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const publiclyAccessible = this.readPublicAccess(properties, resourceType, logicalId, physicalId, context?.replayingState === true || context?.desiredFromAwsReadback === true);
 		try {
+			markChangedUnsettled(INSTANCE_MODIFY_KEYS, properties, previousProperties, context);
 			await modifyDbInstanceWhenAvailable({
 				send: () => this.getClient().send(new ModifyDBInstanceCommand({
 					DBInstanceIdentifier: physicalId,
@@ -425,6 +595,8 @@ var NeptuneProvider = class {
 					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 					DeletionProtection: properties["DeletionProtection"],
+					PubliclyAccessible: publiclyAccessible,
+					AllowMajorVersionUpgrade: properties["AllowMajorVersionUpgrade"],
 					ApplyImmediately: true
 				})),
 				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
@@ -435,9 +607,14 @@ var NeptuneProvider = class {
 				remainingMs: enclosingDeadlineRemainingMs()
 			});
 			this.logger.debug(`Successfully updated Neptune DBInstance ${logicalId}`);
+			if (publiclyAccessible !== void 0 && publiclyAccessible !== coerceCfnBoolean(previousProperties["PubliclyAccessible"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForApplied(logicalId, "PubliclyAccessible", async () => (await this.describeDBInstance(physicalId))?.PubliclyAccessible === publiclyAccessible);
 			const described = await this.describeDBInstance(physicalId);
-			if (described?.DBInstanceArn) await this.applyTagDiff(described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			if (described?.DBInstanceArn) {
+				markChangedUnsettled(["Tags"], properties, previousProperties, context);
+				await this.applyTagDiff(described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			}
 			this.warnKeptRemovals(logicalId, resourceType, properties, previousProperties, INSTANCE_KEPT_ON_REMOVAL, context);
+			this.warnPublicAccessKept(logicalId, resourceType, properties, previousProperties, context);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -609,10 +786,100 @@ var NeptuneProvider = class {
 		if (typeof found.resourceId !== "string" || found.resourceId === "") throw new Error(`${api} returned no resource id`);
 		return found.resourceId;
 	}
+	readClusterBlocks(properties, resourceType, logicalId, origin) {
+		const refuse = (key, expected) => {
+			throw markNonRetryable(new ProvisioningError(safeMsg`Neptune DBCluster ${logicalId}: ${key} must be ${expected}; nothing was changed.`, resourceType, logicalId, origin.physicalId));
+		};
+		const leaveOut = (key) => {
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+		};
+		const unusableList = (key, expected) => {
+			if (!(origin.creating && origin.stateBorne)) return refuse(key, expected);
+			leaveOut(key);
+			return [];
+		};
+		const roles = clusterRoleList(properties["AssociatedRoles"]) ?? unusableList("AssociatedRoles", "a list of objects with a RoleArn");
+		const logTypes = stringList(properties["EnableCloudwatchLogsExports"]) ?? unusableList("EnableCloudwatchLogsExports", "a list of strings");
+		const scaling = serverlessScalingToSend(properties["ServerlessScalingConfiguration"]);
+		if (scaling === null) {
+			if (!origin.stateBorne) return refuse("ServerlessScalingConfiguration", "an object with both a numeric MinCapacity and a numeric MaxCapacity");
+			leaveOut("ServerlessScalingConfiguration");
+		}
+		return {
+			roles,
+			logTypes,
+			scaling
+		};
+	}
+	async applyClusterRoles(logicalId, physicalId, desired, previous, live, mask, marks) {
+		const liveKeys = new Set(live.map(clusterRoleKey));
+		const desiredKeys = new Set(desired.map(clusterRoleKey));
+		const toAdd = desired.filter((role) => !liveKeys.has(clusterRoleKey(role)));
+		const toRemove = previous.filter((role) => {
+			const key = clusterRoleKey(role);
+			return !desiredKeys.has(key) && liveKeys.has(key);
+		});
+		if (toAdd.length === 0 && toRemove.length === 0) return;
+		const waitBudgetMs = Math.min(ROLE_AVAILABLE_MAX_WAIT_MS, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		if (waitBudgetMs <= 0) throw new Error("the resource timeout leaves no more time to change the roles of the cluster; re-run the deploy, or with a longer --resource-timeout");
+		await this.waitForClusterAvailable(logicalId, physicalId, "changing its roles", waitBudgetMs);
+		marks?.markUnsettled?.("AssociatedRoles");
+		const whenAvailable = (send) => modifyDbInstanceWhenAvailable({
+			send,
+			readStatus: async () => (await this.describeDBCluster(physicalId))?.Status,
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			label: "Neptune DBCluster",
+			subject: "cluster",
+			isRefusal: (error) => isRoleCallNotAvailableRefusal(error) || isModifyNotAvailableRefusal(error),
+			logicalId,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+		for (const role of toRemove) await whenAvailable(() => this.getClient().send(new RemoveRoleFromDBClusterCommand({
+			DBClusterIdentifier: physicalId,
+			...role
+		})));
+		for (const role of toAdd) {
+			await whenAvailable(() => this.getClient().send(new AddRoleToDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				...role
+			})));
+			marks?.markAttempted?.("AssociatedRoles", [clusterRoleKey(role)]);
+		}
+		if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterRolesSettled(logicalId, physicalId, new Set(toAdd.map(clusterRoleKey)), new Set(toRemove.map(clusterRoleKey)), mask);
+	}
+	async waitForClusterRolesSettled(logicalId, physicalId, attached, detached, mask) {
+		const shown = (keys) => maskerOrIdentity(mask)(keys.map((key) => key.split("\n")[0] ?? "").join(", "));
+		let unsettled = [];
+		if (!await this.pollUntilSettled(async () => {
+			const roles = (await this.describeDBCluster(physicalId))?.AssociatedRoles ?? [];
+			const byKey = new Map(roles.map((role) => [clusterRoleKey(role), role]));
+			unsettled = [...[...attached].filter((key) => (byKey.get(key)?.Status ?? "PENDING") === "PENDING"), ...[...detached].filter((key) => byKey.has(key))];
+			if (unsettled.length > 0) return false;
+			const invalid = [...attached].filter((key) => byKey.get(key)?.Status === "INVALID");
+			if (invalid.length > 0) this.logger.warn(safeMsg`${logicalId}: Neptune reports ${shown(invalid)} as INVALID: the role is attached, but the cluster cannot assume it. Check the role's trust policy.`);
+			return true;
+		})) this.logger.warn(safeMsg`${logicalId}: the IAM roles of the Neptune cluster had not settled when cdkd stopped waiting (${shown(unsettled)}).`);
+	}
+	async waitForApplied(logicalId, what, applied) {
+		if (await this.pollUntilSettled(applied)) return;
+		this.logger.warn(safeMsg`${logicalId}: the new ${what} did not read back when cdkd stopped waiting; AWS accepted it, so a drift check may report it until it applies.`);
+	}
+	async pollUntilSettled(settled) {
+		const capMs = Math.min(SETTLE_MAX_WAIT_MS, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		const startTime = Date.now();
+		let delay = 2e3;
+		for (;;) {
+			if (await settled()) return true;
+			if (Date.now() - startTime + delay >= capMs) return false;
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+	}
 	async describeDBCluster(dbClusterIdentifier) {
 		return (await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: dbClusterIdentifier }))).DBClusters?.[0];
 	}
-	warnKeptRemovals(logicalId, resourceType, properties, previousProperties, kept, context) {
+	warnKeptRemovals(logicalId, resourceType, properties, previousProperties, kept, context, measured = true) {
 		if (context?.desiredFromAwsReadback === true) return;
 		const removed = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
 		const portStays = properties["DBPort"] != null || properties["Port"] != null;
@@ -620,7 +887,19 @@ var NeptuneProvider = class {
 		if (names.length === 0) return;
 		const one = names.length === 1;
 		const modify = resourceType === "AWS::Neptune::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
-		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place, as CloudFormation does. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`);
+		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place${measured ? ", as CloudFormation does" : ""}. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`);
+	}
+	readPublicAccess(properties, resourceType, logicalId, physicalId, stateBorne) {
+		const refusal = configBooleanRefusal(properties, "PubliclyAccessible", logicalId);
+		if (refusal === void 0) return coerceCfnBoolean(properties["PubliclyAccessible"]);
+		if (!stateBorne) throw markNonRetryable(new ProvisioningError(safeMsg`Neptune DBInstance ${refusal}; nothing was changed.`, resourceType, logicalId, physicalId));
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded PubliclyAccessible is unusable, so it is not sent.`);
+	}
+	warnPublicAccessKept(logicalId, resourceType, properties, previousProperties, context) {
+		if (context?.desiredFromAwsReadback === true) return;
+		if (!(context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties))).has("PubliclyAccessible")) return;
+		if (coerceCfnBoolean(previousProperties["PubliclyAccessible"]) !== true) return;
+		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): PubliclyAccessible is absent from the state being restored, and ModifyDBInstance keeps a setting it is not sent, so the instance stays publicly accessible after this rollback, as CloudFormation leaves it. Set PubliclyAccessible: false to close it.` : safeMsg`${logicalId} (${resourceType}): PubliclyAccessible was removed from the template; the instance stays publicly accessible, as CloudFormation leaves it. Set PubliclyAccessible: false to close it.`);
 	}
 	async dbClusterSecurityGroupsToSend(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const desired = properties["VpcSecurityGroupIds"];
@@ -720,14 +999,14 @@ var NeptuneProvider = class {
 			remainingMs: enclosingDeadlineRemainingMs()
 		});
 	}
-	async waitForClusterAvailable(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
+	async waitForClusterAvailable(logicalId, dbClusterIdentifier, during = "being created", maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 5e3;
 		while (Date.now() - startTime < maxWaitMs) {
 			const status = (await this.describeDBCluster(dbClusterIdentifier))?.Status;
 			this.logger.debug(`Neptune DBCluster ${dbClusterIdentifier} status: ${status}`);
 			if (status === "available") return;
-			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`Neptune DBCluster ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`Neptune DBCluster ${logicalId} entered status ${status ?? ""} while ${during}, which it does not leave on its own`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -785,6 +1064,69 @@ var NeptuneProvider = class {
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::Neptune::DBCluster") return ["AvailabilityZones", "DBInstanceParameterGroupName"];
+		if (resourceType === "AWS::Neptune::DBInstance") return ["AllowMajorVersionUpgrade"];
+		return [];
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::Neptune::DBCluster" ? [
+			"AssociatedRoles",
+			"EnableCloudwatchLogsExports",
+			"VpcSecurityGroupIds"
+		] : [];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::Neptune::DBCluster") return properties;
+		const out = { ...properties };
+		if (Array.isArray(out["AssociatedRoles"])) out["AssociatedRoles"] = clusterRoleList(out["AssociatedRoles"]) ?? out["AssociatedRoles"];
+		const logs = out["EnableCloudwatchLogsExports"];
+		if (Array.isArray(logs) && stringList(logs) !== void 0) out["EnableCloudwatchLogsExports"] = [...new Set(logs)];
+		return out;
+	}
+	canonicalizeUnsettledProperties(resourceType, properties) {
+		return this.canonicalizeDriftProperties(resourceType, properties);
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (resourceType !== "AWS::Neptune::DBCluster") return live;
+		if (live === void 0 || live === RESOURCE_NOT_FOUND) return live;
+		const attempted = (key) => [...attemptedItems?.get(key) ?? []].filter(isUsableAttemptedName);
+		const out = { ...live };
+		if (names.has("AssociatedRoles")) {
+			const named = /* @__PURE__ */ new Set([
+				...(clusterRoleList(recordedProperties?.["AssociatedRoles"]) ?? []).map(clusterRoleKey),
+				...(clusterRoleList(desiredProperties?.["AssociatedRoles"]) ?? []).map(clusterRoleKey),
+				...attempted("AssociatedRoles")
+			]);
+			out["AssociatedRoles"] = (live["AssociatedRoles"] ?? []).filter((role) => named.has(clusterRoleKey(role)));
+		}
+		if (names.has("EnableCloudwatchLogsExports")) {
+			const named = /* @__PURE__ */ new Set([
+				...stringList(recordedProperties?.["EnableCloudwatchLogsExports"]) ?? [],
+				...stringList(desiredProperties?.["EnableCloudwatchLogsExports"]) ?? [],
+				...attempted("EnableCloudwatchLogsExports")
+			]);
+			out["EnableCloudwatchLogsExports"] = (live["EnableCloudwatchLogsExports"] ?? []).filter((type) => named.has(type));
+		}
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, resourceType, names, _recordedProperties, desiredProperties) {
+		if (desiredProperties !== void 0) return /* @__PURE__ */ new Set();
+		try {
+			if (resourceType === "AWS::Neptune::DBCluster") {
+				const cluster = await this.describeDBCluster(physicalId);
+				return isUnmovingDbStatus(cluster?.Status) && !holdsPendingValue(cluster?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			if (resourceType === "AWS::Neptune::DBInstance") {
+				const instance = await this.describeDBInstance(physicalId);
+				return isUnmovingDbStatus(instance?.DBInstanceStatus) && !holdsPendingValue(instance?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			return /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::Neptune::DBInstance": return this.importDBInstance(input);
@@ -820,6 +1162,7 @@ var NeptuneProvider = class {
 		if (inst.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = inst.PreferredMaintenanceWindow;
 		if (inst.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = inst.AutoMinorVersionUpgrade;
 		if (inst.DeletionProtection !== void 0) result["DeletionProtection"] = inst.DeletionProtection;
+		if (inst.PubliclyAccessible !== void 0) result["PubliclyAccessible"] = inst.PubliclyAccessible;
 		const pg = inst.DBParameterGroups?.[0]?.DBParameterGroupName;
 		if (pg !== void 0) result["DBParameterGroupName"] = pg;
 		if (inst.DBInstanceArn) await this.attachTags(result, inst.DBInstanceArn);
@@ -852,6 +1195,18 @@ var NeptuneProvider = class {
 		if (cluster.DBClusterParameterGroup !== void 0) result["DBClusterParameterGroupName"] = cluster.DBClusterParameterGroup;
 		if (cluster.IAMDatabaseAuthenticationEnabled !== void 0) result["IamAuthEnabled"] = cluster.IAMDatabaseAuthenticationEnabled;
 		if (cluster.DeletionProtection !== void 0) result["DeletionProtection"] = cluster.DeletionProtection;
+		if (cluster.CopyTagsToSnapshot !== void 0) result["CopyTagsToSnapshot"] = cluster.CopyTagsToSnapshot;
+		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
+		const { MinCapacity: min, MaxCapacity: max } = cluster.ServerlessV2ScalingConfiguration ?? {};
+		if (min !== void 0 || max !== void 0) result["ServerlessScalingConfiguration"] = {
+			...min !== void 0 && { MinCapacity: min },
+			...max !== void 0 && { MaxCapacity: max }
+		};
+		result["EnableCloudwatchLogsExports"] = cluster.EnabledCloudwatchLogsExports ?? [];
+		result["AssociatedRoles"] = (cluster.AssociatedRoles ?? []).map((role) => ({
+			RoleArn: role.RoleArn,
+			...role.FeatureName ? { FeatureName: role.FeatureName } : {}
+		}));
 		if (cluster.DBClusterArn) await this.attachTags(result, cluster.DBClusterArn);
 		return result;
 	}
@@ -931,4 +1286,4 @@ function securityGroupListChanged(sent, previous) {
 
 //#endregion
 export { NeptuneProvider };
-//# sourceMappingURL=neptune-provider-CGZ_G4Vz.js.map
+//# sourceMappingURL=neptune-provider-BNxotnbp.js.map