@go-to-k/cdkd 0.314.0 → 0.315.0

package/dist/{provider-classes-ZqxIefLl.js → provider-classes-B8kkAZqJ.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-agWtoyga.js";
-import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
+import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, X as isProceedDbStatus, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as ECR_AUTO_DELETE_IMAGES_TAG, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ai as earliestDefined, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDualStackDomainName, Bi as DBPROXY_TAGS_WHAT, Bt as getNestedRevertRun, C as planContributorInsightsOp, Ca as isTerminationProtectionPropagationError, Cc as emrClusterInstancesReplaced, Ct as enclosingDeadlineRemainingMs, D as reverseMapTableContributorInsights, Do as passedParameterClassesOf, E as reverseMapIndexContributorInsights, Ea as reEnableInstanceApiTermination, Ec as sameLambdaFunctionAddress, F as resolveDynamoDbDeleteBudgetClock, Fd as resolveAssemblyPath, G as readbackVectorIndexes, Gc as redactForState, Gi as tagMapAsList, Gn as redactedDeleteAddressFields, H as relayedIndexBusyDelete, Ha as s3BucketWebsiteUrl, Hi as planTagDiff, I as resolveDynamoDbDeleteBudgetMs, J as isTtlAlreadyDisabled, Ji as stringifyIfAssigned, Jt as withNestedStackContext, K as vectorIndexesForCreate, Kc as recordReferenceProvenanceEntry, Ki as tagPlanWarning, Kn as redactedDeleteAddressSkip, Ks as withoutSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as isSettledInstanceState, Lr as awaitInFlightSibling, M as beginDeleteWait, Md as describeFileReadFailure, Mi as reserveStackCreateToken, N as compensateRemovedDeletionProtection, Nd as displayAssemblyPath, O as stripIndexContributorInsights, P as deleteBudgetKey, Pd as renderAssemblyPathEscape, Pi as acquireIdempotencyToken, Po as accountArgs, Q as sendTtlWaitingOutRateLimit, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketArn, Rc as passedNoEchoParametersOf, Ri as isRefusedByName, S as indexDeclaresContributorInsights, Sa as ec2InstanceProtectionSite, Sc as ecsServiceLaunchTypeSetOrChanged, St as enclosingDeadlineExpired, T as readContributorInsightsSpec, Ta as reDisableInstanceApiTermination, Tc as lambdaFunctionNameForMask, U as waitForIndexesSettled, Ui as readTagList, Un as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ut as revertNestedChildFromJournal, V as maskedLogger, Va as s3BucketRegionalDomainName, Vi as DBPROXY_TAG_OPTIONS, Vn as getCurrentProducerRegions, Vr as replacedDeleteFailureVerdict, Vs as withheldAccountClause, W as planVectorIndexUpdates, Wc as markSameGenerationBag, Wi as refuseMalformedDesiredTags, Wn as isRedactedRecordedValue, Ws as findSilentDropProperties, X as planTimeToLive, Xc as hasMaskableValues, Y as isTtlRateLimited, Z as readTtlSpec, _ as streamMemberRefusals, _a as deleteSkipReason, _i as secretNamedAttributeNamesOf, ac as toFiniteNumber, an as isAccessDeniedError, b as CONTRIBUTOR_INSIGHTS_KEY, ba as markWaitAbandoned, bc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, bl as physicalNameCopiesOf, c as DynamoDBGlobalTableProvider, cc as configBooleanRefusal, cu as timePhase, d as declaredStreamPolicyMember, da as onlySecretReferencesDiffer, dc as readConfigString, du as stringifyValue, ea as waitForLambdaFunctionActive, et as S3_AUTO_DELETE_OBJECTS_TAG, f as declaredStreamTagsMember, fa as unchangedBehindSecretReference, fc as replayWarn, fl as dynamicReferenceTokens, g as streamDeclaresTags, gt as renderNestedTemplateTreeDefect, gu as rewriteTemplateAssetReferences, h as streamDeclaresPolicy, hc as requireConfigString, hd as decodeListingKey, ht as listNestedTemplateRows, ia as getCurrentResourceSecrets, ic as toCfnInteger, in as chunks, it as markRefusedBeforeApplying, j as DYNAMODB_DELETE_POLL_COST_MS, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ka as isUsableAttemptedName, ks as refuseMalformedResourcesForDestroy, l as STREAM_POLICY_KEY, lc as configIntegerRefusal, ls as refuseMalformedNestedChildOutputs, m as reverseMapStreamPolicy, mc as requireConfigObject, mt as isAbsoluteAssetPath, nc as coerceWarmThroughput$1, nt as isTruthyCfnBoolean, oc as coerceCfnBoolean, on as lookupEachName, p as planStreamMemberOps, pc as requireConfigArray, po as getAccountInfo, pt as findNestedTemplateTreeDefect, q as vectorIndexesSettled, qa as outputReferenceProvenanceOf, qc as snapshotPassProvenance, qi as definedAttributes, qt as getCurrentNestedStackContext, rc as isWarmThroughputDecrease, rt as getPriorAttempts, sc as coerceCfnInteger, sn as withApiLimit, t as DeployEngine, tc as WARM_THROUGHPUT_MEMBERS, tt as hasCdkAutoDeleteTag, u as STREAM_TAGS_KEY, ua as slowCcOperationTimeoutMs, uc as configStringRefusal, ul as withoutPhysicalNameCopies, v as streamPolicyMatchesDeclared, va as withIndeterminateGuard, vd as canonicalizeRegion, w as planIndexContributorInsightsOps, wa as observeThenDisableInstanceApiTermination, wc as canonicalLambdaFunctionName, wl as carriesSecretMask, wo as parseWebACLArn, x as contributorInsightsRefusals, xl as recordAttributeIdCopy, y as streamTagsMatchDeclared, ya as isWaitAbandonedError, yc as withRetry, yd as derivePartitionAndUrlSuffix, yl as recoverMaskedOutput, z as TABLE_INDEX_NOUN, za as s3BucketDomainName, zi as markDeleteStarted, zr as getStackRecords } from "./deploy-engine-ClIUqDQL.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DJep3uns.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Du6jOw1-.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-By0_BFNO.js";
-import { RDSProvider } from "./rds-provider-C2fHUNSE.js";
-import { NeptuneProvider } from "./neptune-provider-CGZ_G4Vz.js";
-import { ASGProvider } from "./asg-provider-_nun2Jda.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine--bCIMkkk.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-s5--ZmBZ.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CMtAmRyw.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-B1NRKBSQ.js";
+import { RDSProvider } from "./rds-provider-Cm3dsmFW.js";
+import { NeptuneProvider } from "./neptune-provider-BNxotnbp.js";
+import { ASGProvider } from "./asg-provider-DpNkEibf.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -12528,12 +12528,15 @@ function sentWarmThroughputMembers(value) {
 function wasSentWarmThroughput(value) {
 	return sentWarmThroughputMembers(value).size > 0;
 }
-function readbackWarmThroughput(live, members) {
+function readbackWarmThroughput(live, members, declared) {
+	const moving = live.Status === "UPDATING" ? coerceWarmThroughput(declared)?.spec : void 0;
 	const out = {};
 	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (live[member] === void 0) continue;
+		const value = live[member];
+		if (value === void 0) continue;
 		if (members !== void 0 && !members.has(member)) continue;
-		out[member] = live[member];
+		const target = moving?.[member];
+		out[member] = target === void 0 ? value : Math.max(value, target);
 	}
 	return Object.keys(out).length > 0 ? out : void 0;
 }
@@ -12595,7 +12598,7 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 		if (Object.keys(odt).length > 0) out["OnDemandThroughput"] = odt;
 	}
 	if ("WarmThroughput" in live && indexDeclares(desired, "WarmThroughput", bagInformative) && live.WarmThroughput) {
-		const wt = readbackWarmThroughput(live.WarmThroughput, bagInformative ? sentWarmThroughputMembers(desired?.["WarmThroughput"]) : void 0);
+		const wt = readbackWarmThroughput(live.WarmThroughput, bagInformative ? sentWarmThroughputMembers(desired?.["WarmThroughput"]) : void 0, bagInformative ? desired?.["WarmThroughput"] : void 0);
 		if (wt !== void 0) out["WarmThroughput"] = wt;
 	}
 	return out;
@@ -12953,7 +12956,14 @@ var DynamoDBTableProvider = class {
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${lsiMessage}. Nothing was applied to the table; revert the LocalSecondaryIndexes change, or create a new table under a new logical ID (a new table starts empty)`, resourceType, logicalId, physicalId);
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
-			const vectorIndexPlan = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]) ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
+			const vectorIndexesChanged = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]);
+			const vectorIndexShape = vectorIndexesChanged ? vectorIndexesShapeDetail(properties["VectorIndexes"]) : void 0;
+			if (vectorIndexShape !== void 0) {
+				const shapeMessage = `AWS::DynamoDB::Table ${logicalId}: ${vectorIndexShape}`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(shapeMessage)}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
+				warn(`${shapeMessage}; the VectorIndexes change was not applied`);
+			}
+			const vectorIndexPlan = vectorIndexesChanged && vectorIndexShape === void 0 ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
 			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
 				const vectorMessage = `AWS::DynamoDB::Table ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((n) => maskSecrets(n)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
@@ -14274,7 +14284,8 @@ var DynamoDBTableProvider = class {
 				if (Object.keys(odt).length > 0) result["OnDemandThroughput"] = odt;
 			}
 			if (table.WarmThroughput && declaresWarmThroughput(properties)) {
-				const wt = readbackWarmThroughput(table.WarmThroughput, properties !== void 0 && desiredBagIsInformative(properties) ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0);
+				const informative = properties !== void 0 && desiredBagIsInformative(properties);
+				const wt = readbackWarmThroughput(table.WarmThroughput, informative ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0, informative ? properties["WarmThroughput"] : void 0);
 				if (wt !== void 0) result["WarmThroughput"] = wt;
 			}
 			let streamMembersRead = Promise.resolve();
@@ -31230,6 +31241,41 @@ function wrapDocDBFailure(logger, mask, error, build) {
 	const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
 	return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 }
+function docdbStringList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	return value.every((item) => typeof item === "string") ? value : void 0;
+}
+function docdbLogExportChange(desired, previous) {
+	const enable = [...new Set(desired)].filter((type) => !previous.includes(type));
+	const disable = [...new Set(previous)].filter((type) => !desired.includes(type));
+	if (enable.length === 0 && disable.length === 0) return void 0;
+	return {
+		...enable.length > 0 && { EnableLogTypes: enable },
+		...disable.length > 0 && { DisableLogTypes: disable }
+	};
+}
+function cfnCapacity(value) {
+	const capacity = typeof value === "number" || typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	return Number.isFinite(capacity) ? capacity : void 0;
+}
+function docdbServerlessScaling(value) {
+	if (value == null) return void 0;
+	if (typeof value !== "object" || Array.isArray(value)) return null;
+	const { MinCapacity, MaxCapacity } = value;
+	const min = cfnCapacity(MinCapacity);
+	const max = cfnCapacity(MaxCapacity);
+	if (min === void 0 || max === void 0) return null;
+	return {
+		MinCapacity: min,
+		MaxCapacity: max
+	};
+}
+function holdsDocDBPendingValue(value) {
+	if (value === void 0 || value === null) return false;
+	if (typeof value === "object") return Object.values(value).some(holdsDocDBPendingValue);
+	return true;
+}
 function isDocDBNotFoundError(error, faultName) {
 	if (!(error instanceof Error)) return false;
 	const name = error.name ?? "";
@@ -31280,6 +31326,20 @@ function masterUserPasswordToSend(properties, previousProperties, context) {
 	return typeof desired === "string" && typeof recorded === "string" && recorded === desired && dynamicReferenceTokens(recorded).length === 0 && recorded !== "***" ? void 0 : desired;
 }
 const DOCDB_DEFAULT_PORT = 27017;
+const DOCDB_DEFAULT_STORAGE_TYPE = "standard";
+function rotateMasterUserPassword(properties, previousProperties, context) {
+	if (context?.replayingState === true || context?.desiredFromAwsReadback === true) return false;
+	return coerceCfnBoolean(properties["RotateMasterUserPassword"]) === true && coerceCfnBoolean(previousProperties["RotateMasterUserPassword"]) !== true;
+}
+function kmsKeyText(key) {
+	return key.replace(/^arn:[^:]*:kms:[^:]*:[^:]*:/, "").replace(/^key\//, "");
+}
+function sameKmsKey(a, b) {
+	return b !== void 0 && kmsKeyText(a) === kmsKeyText(b);
+}
+function declaredChange(desired, recorded, live) {
+	return desired != null && String(desired) !== String(recorded ?? live);
+}
 const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
 	"DeletionProtection",
 	"BackupRetentionPeriod",
@@ -31287,17 +31347,38 @@ const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
 	"EngineVersion",
 	"PreferredBackupWindow",
 	"PreferredMaintenanceWindow",
-	"DBClusterParameterGroupName"
+	"DBClusterParameterGroupName",
+	"CopyTagsToSnapshot",
+	"EnableCloudwatchLogsExports",
+	"StorageType",
+	"ServerlessV2ScalingConfiguration",
+	"MasterUserSecretKmsKeyId"
+];
+const DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL = ["NetworkType", "ManageMasterUserPassword"];
+const DOCDB_INSTANCE_KEPT_ON_REMOVAL = [
+	"PreferredMaintenanceWindow",
+	"CACertificateIdentifier",
+	"EnablePerformanceInsights"
+];
+const CLUSTER_MODIFY_UNSETTLED_KEYS = [
+	"CopyTagsToSnapshot",
+	"EnableCloudwatchLogsExports",
+	"NetworkType",
+	"ServerlessV2ScalingConfiguration",
+	"StorageType"
 ];
-const DOCDB_INSTANCE_KEPT_ON_REMOVAL = ["PreferredMaintenanceWindow"];
-function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType) {
+const INSTANCE_MODIFY_UNSETTLED_KEYS = ["CACertificateIdentifier", "EnablePerformanceInsights"];
+const SETTLE_MAX_WAIT_MS = 3e5;
+const STORAGE_SETTLE_MAX_WAIT_MS = 18e5;
+const DEADLINE_MARGIN_MS = 3e4;
+function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType, measured = true) {
 	const removedSet = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
 	const removed = keys.filter((key) => removedSet.has(key));
 	if (removed.length === 0) return void 0;
 	const one = removed.length === 1;
 	const names = `${one ? "property" : "properties"} ${removed.join(", ")}`;
 	const modify = resourceType === "AWS::DocDB::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
-	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place, as CloudFormation does. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
+	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place${measured ? ", as CloudFormation does" : ""}. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
 }
 const SECURITY_GROUP_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying"]);
 const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "rebooting"]);
@@ -31341,6 +31422,7 @@ var DocDBProvider = class {
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
 	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
+		"AvailabilityZones",
 		"DBClusterIdentifier",
 		"DBSubnetGroupName",
 		"KmsKeyId",
@@ -31349,7 +31431,9 @@ var DocDBProvider = class {
 		"Port",
 		"Tags",
 		"MasterUserPassword",
-		...DOCDB_CLUSTER_KEPT_ON_REMOVAL
+		"RotateMasterUserPassword",
+		...DOCDB_CLUSTER_KEPT_ON_REMOVAL,
+		...DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBClusterIdentifier",
@@ -31357,6 +31441,7 @@ var DocDBProvider = class {
 		"DBInstanceClass",
 		"Tags",
 		"AutoMinorVersionUpgrade",
+		"CertificateRotationRestart",
 		...DOCDB_INSTANCE_KEPT_ON_REMOVAL
 	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
@@ -31374,7 +31459,16 @@ var DocDBProvider = class {
 		"PreferredMaintenanceWindow",
 		"DBClusterParameterGroupName",
 		"DeletionProtection",
-		"Tags"
+		"Tags",
+		"AvailabilityZones",
+		"CopyTagsToSnapshot",
+		"EnableCloudwatchLogsExports",
+		"ManageMasterUserPassword",
+		"MasterUserSecretKmsKeyId",
+		"NetworkType",
+		"RotateMasterUserPassword",
+		"ServerlessV2ScalingConfiguration",
+		"StorageType"
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBInstanceClass",
@@ -31382,7 +31476,10 @@ var DocDBProvider = class {
 		"AvailabilityZone",
 		"PreferredMaintenanceWindow",
 		"AutoMinorVersionUpgrade",
-		"Tags"
+		"Tags",
+		"CACertificateIdentifier",
+		"CertificateRotationRestart",
+		"EnablePerformanceInsights"
 	])]]);
 	getClient() {
 		if (!this.docdbClient) {
@@ -31404,8 +31501,8 @@ var DocDBProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const mask = context?.maskSecrets;
 		switch (resourceType) {
-			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask);
-			case "AWS::DocDB::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask);
+			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			case "AWS::DocDB::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask, context?.replayingState === true);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -31430,9 +31527,13 @@ var DocDBProvider = class {
 		const thrown = this.wrapCaughtError(mask, error, build);
 		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 	}
-	async createDBCluster(logicalId, resourceType, properties, mask) {
+	async createDBCluster(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating DocDB DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const origin = { stateBorne: replayingState };
+		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, true);
+		const managedPassword = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
+		const password = this.passwordBesideManaged(managedPassword, false, properties["MasterUserPassword"], resourceType, logicalId, origin);
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
@@ -31442,7 +31543,7 @@ var DocDBProvider = class {
 				Engine: "docdb",
 				EngineVersion: properties["EngineVersion"],
 				MasterUsername: properties["MasterUsername"],
-				MasterUserPassword: properties["MasterUserPassword"],
+				MasterUserPassword: password,
 				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
 				DBSubnetGroupName: properties["DBSubnetGroupName"],
@@ -31453,6 +31554,14 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				DeletionProtection: properties["DeletionProtection"],
+				AvailabilityZones: properties["AvailabilityZones"],
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				ManageMasterUserPassword: managedPassword,
+				MasterUserSecretKmsKeyId: properties["MasterUserSecretKmsKeyId"],
+				NetworkType: properties["NetworkType"],
+				StorageType: properties["StorageType"],
+				...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
+				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
@@ -31474,10 +31583,26 @@ var DocDBProvider = class {
 	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const origin = {
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		};
+		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, false);
+		const logExportConfig = logTypes === void 0 ? void 0 : docdbLogExportChange(logTypes, docdbStringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
 		try {
+			const credentials = await this.planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin);
 			const vpcSgIds = properties["VpcSecurityGroupIds"];
 			const sendVpcSgIds = vpcSgIds !== void 0 && vpcSgIds.length > 0;
 			const portToSend = clusterPortToSend(properties, previousProperties);
+			const unrecorded = (key) => properties[key] != null && previousProperties[key] == null;
+			const live = unrecorded("NetworkType") || unrecorded("StorageType") || logExportConfig?.EnableLogTypes !== void 0 ? await this.describeDBCluster(physicalId) : void 0;
+			const networkType = properties["NetworkType"];
+			const networkChange = declaredChange(networkType, previousProperties["NetworkType"], live?.NetworkType);
+			const storageType = properties["StorageType"];
+			const storageChange = declaredChange(storageType, previousProperties["StorageType"], live?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE);
+			const previousScaling = docdbServerlessScaling(previousProperties["ServerlessV2ScalingConfiguration"]);
+			const scalingChange = scaling != null && (scaling.MinCapacity !== previousScaling?.MinCapacity || scaling.MaxCapacity !== previousScaling?.MaxCapacity);
+			this.markChangedUnsettled(CLUSTER_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await this.getClient().send(new ModifyDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
@@ -31487,15 +31612,40 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				...sendVpcSgIds && { VpcSecurityGroupIds: vpcSgIds },
-				MasterUserPassword: masterUserPasswordToSend(properties, previousProperties, context),
+				MasterUserPassword: credentials.password,
 				Port: portToSend,
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				...rotateMasterUserPassword(properties, previousProperties, context) && { RotateMasterUserPassword: true },
+				...credentials.managed !== void 0 && { ManageMasterUserPassword: credentials.managed },
+				...credentials.secretKmsKey !== void 0 && { MasterUserSecretKmsKeyId: credentials.secretKmsKey },
+				...networkChange && { NetworkType: networkType },
+				...storageChange && { StorageType: storageType },
+				...scalingChange && { ServerlessV2ScalingConfiguration: scaling },
+				...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig },
 				ApplyImmediately: true
 			}));
+			const addedLogTypes = (logExportConfig?.EnableLogTypes ?? []).filter((type) => !live?.EnabledCloudwatchLogsExports?.includes(type));
+			if (addedLogTypes.length > 0) context?.markAttempted?.("EnableCloudwatchLogsExports", addedLogTypes);
 			this.logger.debug(`Successfully updated DocDB DBCluster ${logicalId}`);
 			const noWait = process.env["CDKD_NO_WAIT"] === "true";
 			const portChanged = portToSend !== void 0 && portToSend !== numberOrUndefined(previousProperties["Port"]);
 			if (!noWait && portChanged) await this.waitForClusterPortApplied(physicalId, logicalId, portToSend);
 			const described = await this.describeDBCluster(physicalId);
+			if (!noWait) {
+				const { EnableLogTypes: enabled = [], DisableLogTypes: disabled = [] } = logExportConfig ?? {};
+				const applied = /* @__PURE__ */ new Map();
+				if (logExportConfig !== void 0) applied.set("EnableCloudwatchLogsExports", (cluster) => {
+					const logs = cluster?.EnabledCloudwatchLogsExports;
+					return enabled.every((type) => logs?.includes(type)) && !disabled.some((type) => logs?.includes(type));
+				});
+				if (networkChange) applied.set("NetworkType", (cluster) => cluster?.NetworkType === networkType);
+				if (storageChange) applied.set("StorageType", (cluster) => (cluster?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE) === storageType);
+				if (scalingChange) applied.set("ServerlessV2ScalingConfiguration", (cluster) => {
+					const live = cluster?.ServerlessV2ScalingConfiguration;
+					return live?.MinCapacity === scaling?.MinCapacity && live?.MaxCapacity === scaling?.MaxCapacity;
+				});
+				await this.waitForApplied(logicalId, applied, () => this.describeDBCluster(physicalId), storageChange ? STORAGE_SETTLE_MAX_WAIT_MS : SETTLE_MAX_WAIT_MS);
+			}
 			if (!noWait && portChanged) {
 				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, PORT_CHANGE_MEMBER_STATUSES, "port");
 			}
@@ -31506,15 +31656,20 @@ var DocDBProvider = class {
 			if (described?.DBClusterArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const keptWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
 			if (keptWarning !== void 0) this.logger.warn(keptWarning);
+			const unmeasuredWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType, false);
+			if (unmeasuredWarning !== void 0) this.logger.warn(unmeasuredWarning);
+			if (credentials.heldWarning !== void 0) this.logger.warn(credentials.heldWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
 				attributes: clusterAttributes(noWait && portChanged && described !== void 0 ? {
 					...described,
 					Port: portToSend
-				} : described)
+				} : described),
+				...credentials.effectiveProperties !== void 0 && { effectiveProperties: credentials.effectiveProperties }
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -31596,9 +31751,10 @@ var DocDBProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createDBInstance(logicalId, resourceType, properties, mask) {
+	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating DocDB DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const insights = this.readBooleanProperty("EnablePerformanceInsights", properties, resourceType, logicalId, { stateBorne: replayingState });
 		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::DocDB::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
@@ -31611,6 +31767,8 @@ var DocDBProvider = class {
 				AvailabilityZone: properties["AvailabilityZone"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+				CACertificateIdentifier: properties["CACertificateIdentifier"],
+				EnablePerformanceInsights: insights,
 				...tags.length > 0 && { Tags: tags }
 			}));
 			instanceCreated = true;
@@ -31633,13 +31791,25 @@ var DocDBProvider = class {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
 		const mask = context?.maskSecrets;
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const insights = this.readBooleanProperty("EnablePerformanceInsights", properties, resourceType, logicalId, {
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		});
 		try {
+			const certificate = properties["CACertificateIdentifier"];
+			const live = certificate != null && previousProperties["CACertificateIdentifier"] == null || insights !== void 0 && previousProperties["EnablePerformanceInsights"] == null ? await this.describeDBInstance(physicalId) : void 0;
+			const certificateChange = declaredChange(certificate, previousProperties["CACertificateIdentifier"], live?.CACertificateIdentifier);
+			const insightsChange = declaredChange(insights, previousProperties["EnablePerformanceInsights"], live?.PerformanceInsightsEnabled ?? false);
+			this.markChangedUnsettled(INSTANCE_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await modifyDbInstanceWhenAvailable({
 				send: () => this.getClient().send(new ModifyDBInstanceCommand$1({
 					DBInstanceIdentifier: physicalId,
 					DBInstanceClass: properties["DBInstanceClass"],
 					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+					...certificateChange && { CACertificateIdentifier: certificate },
+					...certificateChange && properties["CertificateRotationRestart"] != null && { CertificateRotationRestart: properties["CertificateRotationRestart"] },
+					...insightsChange && { EnablePerformanceInsights: insights },
 					ApplyImmediately: true
 				})),
 				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
@@ -31650,6 +31820,12 @@ var DocDBProvider = class {
 				remainingMs: enclosingDeadlineRemainingMs()
 			});
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
+			if (process.env["CDKD_NO_WAIT"] !== "true") {
+				const applied = /* @__PURE__ */ new Map();
+				if (certificateChange) applied.set("CACertificateIdentifier", (instance) => instance?.CACertificateIdentifier === certificate);
+				if (insightsChange) applied.set("EnablePerformanceInsights", (instance) => instance?.PerformanceInsightsEnabled === insights);
+				await this.waitForApplied(logicalId, applied, () => this.describeDBInstance(physicalId));
+			}
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const keptWarning = keptOnRemovalWarning$1(DOCDB_INSTANCE_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
@@ -31682,6 +31858,106 @@ var DocDBProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	markChangedUnsettled(keys, properties, previousProperties, context) {
+		for (const key of keys) if (properties[key] != null && !isDeepStrictEqual(properties[key], previousProperties[key])) context?.markUnsettled?.(key);
+	}
+	refuseBlock(logicalId, resourceType, physicalId, text) {
+		throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType === "AWS::DocDB::DBInstance" ? "DocDB DBInstance" : "DocDB DBCluster"} ${logicalId}: ${text}; nothing was changed.`, resourceType, logicalId, physicalId));
+	}
+	readClusterBlocks(properties, resourceType, logicalId, origin, creating) {
+		const leaveOut = (key) => {
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+		};
+		const rawLogs = properties["EnableCloudwatchLogsExports"];
+		let logTypes = rawLogs == null ? void 0 : docdbStringList(rawLogs);
+		if (rawLogs != null && logTypes === void 0) {
+			if (!(creating && origin.stateBorne)) this.refuseBlock(logicalId, resourceType, origin.physicalId, "EnableCloudwatchLogsExports must be a list of strings");
+			leaveOut("EnableCloudwatchLogsExports");
+			logTypes = void 0;
+		}
+		const scaling = docdbServerlessScaling(properties["ServerlessV2ScalingConfiguration"]);
+		if (scaling === null) {
+			if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, "ServerlessV2ScalingConfiguration must be an object with both a numeric MinCapacity and a numeric MaxCapacity");
+			leaveOut("ServerlessV2ScalingConfiguration");
+		}
+		return {
+			logTypes,
+			scaling
+		};
+	}
+	async planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin) {
+		const managed = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
+		const changedPassword = masterUserPasswordToSend(properties, previousProperties, context);
+		const recordedFlag = coerceCfnBoolean(previousProperties["ManageMasterUserPassword"]);
+		const key = properties["MasterUserSecretKmsKeyId"];
+		const recordedKey = previousProperties["MasterUserSecretKmsKeyId"];
+		let managedSide = recordedFlag ?? false;
+		let keyChange = key != null && !sameKmsKey(key, recordedKey);
+		if (recordedFlag === void 0 && (changedPassword !== void 0 || managed !== void 0 || keyChange)) {
+			const secret = (await this.describeDBCluster(physicalId))?.MasterUserSecret;
+			managedSide = secret !== void 0;
+			if (recordedKey === void 0 && secret?.KmsKeyId !== void 0 && key != null) keyChange = !sameKmsKey(key, secret.KmsKeyId) && !kmsKeyText(key).startsWith("alias/");
+		}
+		const leaving = managed === false && managedSide;
+		const declared = properties["MasterUserPassword"];
+		const declaredUsable = typeof declared === "string" && declared !== "***" && dynamicReferenceTokens(declared).length === 0;
+		const password = leaving ? declaredUsable ? declared : void 0 : changedPassword;
+		const modeChange = managed !== void 0 && managed !== managedSide;
+		if (context?.desiredFromAwsReadback === true && modeChange) return {
+			managed: void 0,
+			secretKmsKey: void 0,
+			password: void 0,
+			heldWarning: safeMsg`${logicalId} (${resourceType}): cdkd drift --revert does not change ManageMasterUserPassword, so it is left as it is. Declare it in the template and deploy to change it.`
+		};
+		if (origin.stateBorne && leaving && password === void 0) return {
+			managed: void 0,
+			secretKmsKey: void 0,
+			password: void 0,
+			heldWarning: safeMsg`${logicalId} (${resourceType}): ManageMasterUserPassword stays true: turning it off needs a MasterUserPassword, which the restored state does not hold. Declare both in the template and deploy.`,
+			effectiveProperties: {
+				...properties,
+				ManageMasterUserPassword: true
+			}
+		};
+		const sendKey = key != null && (modeChange && managed === true || keyChange && (managed ?? managedSide));
+		return {
+			managed: modeChange || sendKey ? managed : void 0,
+			secretKmsKey: sendKey ? key : void 0,
+			password: this.passwordBesideManaged(managed, managed === void 0 && managedSide, password, resourceType, logicalId, origin),
+			heldWarning: void 0
+		};
+	}
+	readBooleanProperty(key, properties, resourceType, logicalId, origin) {
+		const value = properties[key];
+		if (value == null) return void 0;
+		const flag = coerceCfnBoolean(value);
+		if (flag !== void 0) return flag;
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, `${key} must be a boolean`);
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+	}
+	passwordBesideManaged(managed, removedFromManaged, password, resourceType, logicalId, origin) {
+		if (managed !== true && !removedFromManaged || password == null) return password;
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, removedFromManaged ? "MasterUserPassword cannot change while AWS manages the password; declare ManageMasterUserPassword: false beside it to leave managed mode" : "MasterUserPassword cannot be set while ManageMasterUserPassword is true, because AWS manages that password");
+		this.logger.warn(removedFromManaged ? safeMsg`${logicalId} (${resourceType}): the recorded MasterUserPassword is not sent: the cluster stays managed, because the recorded ManageMasterUserPassword is absent.` : safeMsg`${logicalId} (${resourceType}): the recorded MasterUserPassword is not sent, because ManageMasterUserPassword is true.`);
+	}
+	async waitForApplied(logicalId, applied, read, maxWaitMs = SETTLE_MAX_WAIT_MS) {
+		if (applied.size === 0) return;
+		const capMs = Math.min(maxWaitMs, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		const startTime = Date.now();
+		let delay = 2e3;
+		for (;;) {
+			const live = await read();
+			const pending = [...applied].filter(([, isApplied]) => !isApplied(live));
+			if (pending.length === 0) return;
+			if (Date.now() - startTime + delay >= capMs) {
+				const keys = pending.map(([key]) => key).join(", ");
+				this.logger.warn(safeMsg`${logicalId}: the new ${keys} did not read back when cdkd stopped waiting; AWS accepted the change, so cdkd drift may report the old value as the baseline. Once it applies, run cdkd drift --accept.`);
+				return;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+	}
 	async describeDBCluster(dbClusterIdentifier) {
 		return (await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: dbClusterIdentifier }))).DBClusters?.[0];
 	}
@@ -31870,6 +32146,60 @@ var DocDBProvider = class {
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::DocDB::DBCluster") return [
+			"AvailabilityZones",
+			"MasterUserSecretKmsKeyId",
+			"RotateMasterUserPassword"
+		];
+		if (resourceType === "AWS::DocDB::DBInstance") return ["CertificateRotationRestart"];
+		return [];
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::DocDB::DBCluster" ? ["EnableCloudwatchLogsExports"] : [];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::DocDB::DBCluster") return properties;
+		const out = { ...properties };
+		const logs = out["EnableCloudwatchLogsExports"];
+		if (Array.isArray(logs) && docdbStringList(logs) !== void 0) out["EnableCloudwatchLogsExports"] = [...new Set(logs)];
+		const scaling = docdbServerlessScaling(out["ServerlessV2ScalingConfiguration"]);
+		if (scaling != null) out["ServerlessV2ScalingConfiguration"] = scaling;
+		return out;
+	}
+	canonicalizeUnsettledProperties(resourceType, properties) {
+		return this.canonicalizeDriftProperties(resourceType, properties);
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (resourceType !== "AWS::DocDB::DBCluster") return live;
+		if (live === void 0 || live === RESOURCE_NOT_FOUND) return live;
+		if (!names.has("EnableCloudwatchLogsExports")) return live;
+		const key = "EnableCloudwatchLogsExports";
+		const named = /* @__PURE__ */ new Set([
+			...docdbStringList(recordedProperties?.[key]) ?? [],
+			...docdbStringList(desiredProperties?.[key]) ?? [],
+			...[...attemptedItems?.get(key) ?? []].filter(isUsableAttemptedName)
+		]);
+		return {
+			...live,
+			[key]: (live[key] ?? []).filter((type) => named.has(type))
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, resourceType, names, _recordedProperties, desiredProperties) {
+		if (desiredProperties !== void 0) return /* @__PURE__ */ new Set();
+		const unmoving = (status) => isProceedDbStatus(status) || status === "backing-up";
+		try {
+			if (resourceType === "AWS::DocDB::DBCluster") return unmoving((await this.describeDBCluster(physicalId))?.Status) ? /* @__PURE__ */ new Set() : names;
+			if (resourceType === "AWS::DocDB::DBInstance") {
+				const instance = await this.describeDBInstance(physicalId);
+				return unmoving(instance?.DBInstanceStatus) && !holdsDocDBPendingValue(instance?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			return /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::DocDB::DBInstance": return this.importDBInstance(input);
@@ -31901,6 +32231,8 @@ var DocDBProvider = class {
 		if (inst.AvailabilityZone !== void 0) result["AvailabilityZone"] = inst.AvailabilityZone;
 		if (inst.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = inst.PreferredMaintenanceWindow;
 		if (inst.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = inst.AutoMinorVersionUpgrade;
+		if (inst.CACertificateIdentifier !== void 0) result["CACertificateIdentifier"] = inst.CACertificateIdentifier;
+		result["EnablePerformanceInsights"] = inst.PerformanceInsightsEnabled ?? false;
 		if (inst.DBInstanceArn) await attachDocDBTags(this.getClient(), this.logger, result, inst.DBInstanceArn);
 		return result;
 	}
@@ -31928,6 +32260,16 @@ var DocDBProvider = class {
 		if (cluster.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = cluster.PreferredMaintenanceWindow;
 		if (cluster.DBClusterParameterGroup !== void 0) result["DBClusterParameterGroupName"] = cluster.DBClusterParameterGroup;
 		if (cluster.DeletionProtection !== void 0) result["DeletionProtection"] = cluster.DeletionProtection;
+		result["CopyTagsToSnapshot"] = cluster.CopyTagsToSnapshot ?? false;
+		result["ManageMasterUserPassword"] = cluster.MasterUserSecret !== void 0;
+		result["StorageType"] = cluster.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE;
+		result["EnableCloudwatchLogsExports"] = cluster.EnabledCloudwatchLogsExports ?? [];
+		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
+		const { MinCapacity: min, MaxCapacity: max } = cluster.ServerlessV2ScalingConfiguration ?? {};
+		if (min !== void 0 && max !== void 0) result["ServerlessV2ScalingConfiguration"] = {
+			MinCapacity: min,
+			MaxCapacity: max
+		};
 		if (cluster.DBClusterArn) await attachDocDBTags(this.getClient(), this.logger, result, cluster.DBClusterArn);
 		return result;
 	}
@@ -47756,6 +48098,7 @@ var FirehoseProvider = class {
 		"S3DestinationConfiguration",
 		"ExtendedS3DestinationConfiguration",
 		"KinesisStreamSourceConfiguration",
+		"DirectPutSourceConfiguration",
 		"Tags",
 		"HttpEndpointDestinationConfiguration",
 		"RedshiftDestinationConfiguration",
@@ -47808,6 +48151,7 @@ var FirehoseProvider = class {
 					RoleARN: kinesisConfig["RoleArn"] || kinesisConfig["RoleARN"]
 				};
 			}
+			if (properties["DirectPutSourceConfiguration"] !== void 0) input.DirectPutSourceConfiguration = { ThroughputHintInMBs: properties["DirectPutSourceConfiguration"]["ThroughputHintInMBs"] };
 			if (properties["HttpEndpointDestinationConfiguration"]) {
 				const httpConfig = properties["HttpEndpointDestinationConfiguration"];
 				const endpointConfig = httpConfig["EndpointConfiguration"];
@@ -48594,6 +48938,8 @@ var FirehoseProvider = class {
 			if (src.RoleARN !== void 0) srcOut["RoleARN"] = src.RoleARN;
 			if (Object.keys(srcOut).length > 0) result["KinesisStreamSourceConfiguration"] = srcOut;
 		}
+		const directPut = desc.Source?.DirectPutSourceDescription;
+		if (directPut?.ThroughputHintInMBs !== void 0) result["DirectPutSourceConfiguration"] = { ThroughputHintInMBs: directPut.ThroughputHintInMBs };
 		const dest = desc.Destinations?.[0];
 		if (dest?.ExtendedS3DestinationDescription) result["ExtendedS3DestinationConfiguration"] = mapExtendedS3DescriptionToCfn(dest.ExtendedS3DestinationDescription);
 		else if (dest?.S3DestinationDescription) result["S3DestinationConfiguration"] = mapS3DescriptionToCfn(dest.S3DestinationDescription);
@@ -54061,4 +54407,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-ZqxIefLl.js.map
+//# sourceMappingURL=provider-classes-B8kkAZqJ.js.map