@go-to-k/cdkd 0.314.0 → 0.316.0

package/dist/{provider-classes-ZqxIefLl.js → provider-classes-ushrO6ri.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
-import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-agWtoyga.js";
-import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
-import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as ECR_AUTO_DELETE_IMAGES_TAG, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ai as earliestDefined, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDualStackDomainName, Bi as DBPROXY_TAGS_WHAT, Bt as getNestedRevertRun, C as planContributorInsightsOp, Ca as isTerminationProtectionPropagationError, Cc as emrClusterInstancesReplaced, Ct as enclosingDeadlineRemainingMs, D as reverseMapTableContributorInsights, Do as passedParameterClassesOf, E as reverseMapIndexContributorInsights, Ea as reEnableInstanceApiTermination, Ec as sameLambdaFunctionAddress, F as resolveDynamoDbDeleteBudgetClock, Fd as resolveAssemblyPath, G as readbackVectorIndexes, Gc as redactForState, Gi as tagMapAsList, Gn as redactedDeleteAddressFields, H as relayedIndexBusyDelete, Ha as s3BucketWebsiteUrl, Hi as planTagDiff, I as resolveDynamoDbDeleteBudgetMs, J as isTtlAlreadyDisabled, Ji as stringifyIfAssigned, Jt as withNestedStackContext, K as vectorIndexesForCreate, Kc as recordReferenceProvenanceEntry, Ki as tagPlanWarning, Kn as redactedDeleteAddressSkip, Ks as withoutSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as isSettledInstanceState, Lr as awaitInFlightSibling, M as beginDeleteWait, Md as describeFileReadFailure, Mi as reserveStackCreateToken, N as compensateRemovedDeletionProtection, Nd as displayAssemblyPath, O as stripIndexContributorInsights, P as deleteBudgetKey, Pd as renderAssemblyPathEscape, Pi as acquireIdempotencyToken, Po as accountArgs, Q as sendTtlWaitingOutRateLimit, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketArn, Rc as passedNoEchoParametersOf, Ri as isRefusedByName, S as indexDeclaresContributorInsights, Sa as ec2InstanceProtectionSite, Sc as ecsServiceLaunchTypeSetOrChanged, St as enclosingDeadlineExpired, T as readContributorInsightsSpec, Ta as reDisableInstanceApiTermination, Tc as lambdaFunctionNameForMask, U as waitForIndexesSettled, Ui as readTagList, Un as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ut as revertNestedChildFromJournal, V as maskedLogger, Va as s3BucketRegionalDomainName, Vi as DBPROXY_TAG_OPTIONS, Vn as getCurrentProducerRegions, Vr as replacedDeleteFailureVerdict, Vs as withheldAccountClause, W as planVectorIndexUpdates, Wc as markSameGenerationBag, Wi as refuseMalformedDesiredTags, Wn as isRedactedRecordedValue, Ws as findSilentDropProperties, X as planTimeToLive, Xc as hasMaskableValues, Y as isTtlRateLimited, Z as readTtlSpec, _ as streamMemberRefusals, _a as deleteSkipReason, _i as secretNamedAttributeNamesOf, ac as toFiniteNumber, an as isAccessDeniedError, b as CONTRIBUTOR_INSIGHTS_KEY, ba as markWaitAbandoned, bc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, bl as physicalNameCopiesOf, c as DynamoDBGlobalTableProvider, cc as configBooleanRefusal, cu as timePhase, d as declaredStreamPolicyMember, da as onlySecretReferencesDiffer, dc as readConfigString, du as stringifyValue, ea as waitForLambdaFunctionActive, et as S3_AUTO_DELETE_OBJECTS_TAG, f as declaredStreamTagsMember, fa as unchangedBehindSecretReference, fc as replayWarn, fl as dynamicReferenceTokens, g as streamDeclaresTags, gt as renderNestedTemplateTreeDefect, gu as rewriteTemplateAssetReferences, h as streamDeclaresPolicy, hc as requireConfigString, hd as decodeListingKey, ht as listNestedTemplateRows, ia as getCurrentResourceSecrets, ic as toCfnInteger, in as chunks, it as markRefusedBeforeApplying, j as DYNAMODB_DELETE_POLL_COST_MS, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ka as isUsableAttemptedName, ks as refuseMalformedResourcesForDestroy, l as STREAM_POLICY_KEY, lc as configIntegerRefusal, ls as refuseMalformedNestedChildOutputs, m as reverseMapStreamPolicy, mc as requireConfigObject, mt as isAbsoluteAssetPath, nc as coerceWarmThroughput$1, nt as isTruthyCfnBoolean, oc as coerceCfnBoolean, on as lookupEachName, p as planStreamMemberOps, pc as requireConfigArray, po as getAccountInfo, pt as findNestedTemplateTreeDefect, q as vectorIndexesSettled, qa as outputReferenceProvenanceOf, qc as snapshotPassProvenance, qi as definedAttributes, qt as getCurrentNestedStackContext, rc as isWarmThroughputDecrease, rt as getPriorAttempts, sc as coerceCfnInteger, sn as withApiLimit, t as DeployEngine, tc as WARM_THROUGHPUT_MEMBERS, tt as hasCdkAutoDeleteTag, u as STREAM_TAGS_KEY, ua as slowCcOperationTimeoutMs, uc as configStringRefusal, ul as withoutPhysicalNameCopies, v as streamPolicyMatchesDeclared, va as withIndeterminateGuard, vd as canonicalizeRegion, w as planIndexContributorInsightsOps, wa as observeThenDisableInstanceApiTermination, wc as canonicalLambdaFunctionName, wl as carriesSecretMask, wo as parseWebACLArn, x as contributorInsightsRefusals, xl as recordAttributeIdCopy, y as streamTagsMatchDeclared, ya as isWaitAbandonedError, yc as withRetry, yd as derivePartitionAndUrlSuffix, yl as recoverMaskedOutput, z as TABLE_INDEX_NOUN, za as s3BucketDomainName, zi as markDeleteStarted, zr as getStackRecords } from "./deploy-engine-ClIUqDQL.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DJep3uns.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Du6jOw1-.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-By0_BFNO.js";
-import { RDSProvider } from "./rds-provider-C2fHUNSE.js";
-import { NeptuneProvider } from "./neptune-provider-CGZ_G4Vz.js";
-import { ASGProvider } from "./asg-provider-_nun2Jda.js";
+import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-CGZAQ1gS.js";
+import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
+import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, X as isProceedDbStatus, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-B9OCHRr_.js";
+import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine-NYjdxQWe.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Ddo7WwEs.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DSq5150i.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DQTozL4b.js";
+import { RDSProvider } from "./rds-provider-VigGKsxO.js";
+import { NeptuneProvider } from "./neptune-provider-CuZbMn9R.js";
+import { ASGProvider } from "./asg-provider-DOLuhiky.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -65,7 +65,7 @@ import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand a
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3VectorsClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableBucketMetricsConfigurationCommand, DeleteTableBucketReplicationCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableBucketEncryptionCommand, GetTableBucketMaintenanceConfigurationCommand, GetTableBucketMetricsConfigurationCommand, GetTableBucketReplicationCommand, GetTableBucketStorageClassCommand, GetTableCommand as GetTableCommand$1, GetTableMaintenanceConfigurationCommand, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, PutTableBucketEncryptionCommand, PutTableBucketMaintenanceConfigurationCommand, PutTableBucketMetricsConfigurationCommand, PutTableBucketReplicationCommand, PutTableBucketStorageClassCommand, PutTableMaintenanceConfigurationCommand, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
-//#region src/provisioning/providers/iam-policy-provider.ts
+// src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
 const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no delete issued";
 const POLICY_MALFORMED_TARGET_SKIP_REASON = "malformed Roles/Groups/Users in state — no delete issued";
@@ -590,8 +590,7 @@ var IAMPolicyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/iam-managed-policy-provider.ts
+// src/provisioning/providers/iam-managed-policy-provider.ts
 const principalsOf = (bag) => readPrincipalLists({
 	Groups: bag["Groups"],
 	Roles: bag["Roles"],
@@ -1217,8 +1216,7 @@ function recordedNonRootPath(arn) {
 	return path === "/" ? void 0 : path;
 }
 
-//#endregion
-//#region src/provisioning/providers/iam-instance-profile-provider.ts
+// src/provisioning/providers/iam-instance-profile-provider.ts
 const INSTANCE_PROFILE_TYPE = "AWS::IAM::InstanceProfile";
 function isInstanceProfileName(id) {
 	return /^[\w+=,.@-]{1,128}$/.test(id);
@@ -1485,8 +1483,7 @@ var IAMInstanceProfileProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/iam-access-key-provider.ts
+// src/provisioning/providers/iam-access-key-provider.ts
 const ACCESS_KEY_ID_PATTERN = /^AKIA[A-Z0-9]{16}$/;
 const CREATE_DATE_SKEW_MARGIN_MS = 5e3;
 var IAMAccessKeyProvider = class {
@@ -1796,8 +1793,7 @@ var IAMAccessKeyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/iam-user-group-provider.ts
+// src/provisioning/providers/iam-user-group-provider.ts
 function isUserOrGroupName(resourceType, id) {
 	return resourceType === "AWS::IAM::User" ? /^[\w+=,.@-]{1,64}$/.test(id) : /^[\w+=,.@-]{1,128}$/.test(id);
 }
@@ -2938,15 +2934,13 @@ var IAMUserGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/utils/cfn-timestamp.ts
+// src/utils/cfn-timestamp.ts
 const OFFSETLESS_DATE_TIME = /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/;
 function parseCfnTimestamp(value) {
 	return new Date(OFFSETLESS_DATE_TIME.test(value) ? `${value}Z` : value);
 }
 
-//#endregion
-//#region src/provisioning/providers/s3-bucket-provider.ts
+// src/provisioning/providers/s3-bucket-provider.ts
 function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
 	const command = renderDisableCommand({
 		before: "aws s3api delete-bucket --bucket",
@@ -6059,8 +6053,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-bucket-policy-provider.ts
+// src/provisioning/providers/s3-bucket-policy-provider.ts
 const OAI_USER_ARN_RE = /^arn:aws[a-z-]*:iam::cloudfront:user\/CloudFront Origin Access Identity ([A-Z0-9]+)$/;
 const IAM_UNIQUE_ID_RE = /^A[A-Z0-9]{15,}$/;
 const oaiCanonicalUserIdCache = /* @__PURE__ */ new Map();
@@ -6262,8 +6255,7 @@ function isS3BucketName(value) {
 	return true;
 }
 
-//#endregion
-//#region src/provisioning/providers/sqs-queue-provider.ts
+// src/provisioning/providers/sqs-queue-provider.ts
 function serializeRedrivePolicy(value) {
 	if (value === null || value === void 0) return "";
 	if (typeof value === "object" && Object.keys(value).length === 0) return "";
@@ -6591,8 +6583,7 @@ var SQSQueueProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/policy-document-content.ts
+// src/provisioning/policy-document-content.ts
 const MASK = "***";
 const PERMANENT_CDKD_CODES = /* @__PURE__ */ new Set(["ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH"]);
 const MARKED_PERMANENT_CODE_PREFIXES = ["INTRINSIC_RESOLUTION_REFUSAL", "ROLLBACK_SECRET_REGION_AMBIGUOUS"];
@@ -6723,8 +6714,7 @@ function policyContentKey(document) {
 	return canonicalJson$3(value);
 }
 
-//#endregion
-//#region src/provisioning/providers/sqs-queue-policy-provider.ts
+// src/provisioning/providers/sqs-queue-policy-provider.ts
 const QUEUE_POLICY_UNREADABLE_SKIP_REASON = "the policy of a queue it wrote could not be read, so whether that queue still carries it is unknown";
 const QUEUE_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON = "the policy document it attempted could not be resolved right now to compare its queues with";
 const QUEUE_POLICY_MISMATCH_LEFT_REASON = "a queue it wrote carries a policy that does not match the document it attempted, so that queue was not cleared";
@@ -7026,8 +7016,7 @@ function splitQueueUrls(physicalId) {
 	return physicalId.split(",").filter((url) => url.length > 0);
 }
 
-//#endregion
-//#region src/provisioning/providers/create-ownership.ts
+// src/provisioning/providers/create-ownership.ts
 async function nameHeldBefore(lookup, isAbsent) {
 	try {
 		return await lookup() ? "held" : "free";
@@ -7044,8 +7033,7 @@ function skippedCleanupText(heldBefore, what, command) {
 	return heldBefore === "held" ? `${what} already existed before this create attempt (it may be an earlier attempt of this same deploy, an earlier failed deploy, or another stack's or someone else's resource), and the create handed it back, so cdkd did not delete it after the wiring failure; this deploy may have changed its configuration. A resource under a cdkd-generated name is adopted by the next deploy if its create-time settings are unchanged, so it needs no action if it is this stack's. Delete it only after confirming from its tags and creation time that no one else uses it: ${command}` : `cdkd could not tell whether this create made ${what} (the lookup before the create did not answer), so it was not deleted after the wiring failure. If this deploy created it, delete it before the next deploy: ${command}`;
 }
 
-//#endregion
-//#region src/provisioning/providers/sns-topic-provider.ts
+// src/provisioning/providers/sns-topic-provider.ts
 const SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT = "262144";
 function snsTopicAttributes(topicArn) {
 	return {
@@ -7601,8 +7589,7 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/providers/sns-subscription-provider.ts
+// src/provisioning/providers/sns-subscription-provider.ts
 const SNS_SUBSCRIPTION_DELETE_THREW_REASON = "the Unsubscribe call did not complete, so the old subscription is unproven";
 const MUTABLE_ATTRIBUTES = [
 	"RawMessageDelivery",
@@ -7865,8 +7852,7 @@ function isPendingConfirmationError(error) {
 	return error instanceof InvalidParameterException && error.message.toLowerCase().includes("pending confirmation");
 }
 
-//#endregion
-//#region src/provisioning/providers/sns-topic-policy-provider.ts
+// src/provisioning/providers/sns-topic-policy-provider.ts
 const TOPIC_POLICY_UNREADABLE_SKIP_REASON = "the policy of a topic it wrote could not be read, so whether that topic still carries it is unknown";
 const TOPIC_POLICY_UNRESOLVED_DOCUMENT_SKIP_REASON = "the policy document it attempted could not be resolved right now to compare its topics with";
 const TOPIC_POLICY_MISMATCH_LEFT_REASON = "a topic it wrote carries a policy that does not match the document it attempted, so that topic was not reset";
@@ -8182,8 +8168,7 @@ function canonicalPolicy(text) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-create-client.ts
+// src/provisioning/providers/lambda-create-client.ts
 var LambdaCreateClientCache = class {
 	client;
 	shared;
@@ -8204,8 +8189,7 @@ var LambdaCreateClientCache = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-function-provider.ts
+// src/provisioning/providers/lambda-function-provider.ts
 function isFunctionName(id) {
 	return /^[A-Za-z0-9_-]{1,64}$/.test(id);
 }
@@ -9236,8 +9220,7 @@ var LambdaFunctionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-permission-provider.ts
+// src/provisioning/providers/lambda-permission-provider.ts
 const PERMISSION_FUNCTION_NAME_SKIP_REASON = "FunctionName missing from state — no delete issued";
 const PERMISSION_STATEMENT_ID_SKIP_REASON = "empty StatementId in state physicalId — no delete issued";
 const DEPLOY_SKIP_CAVEAT$1 = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the resource by hand.";
@@ -9468,8 +9451,7 @@ function permissionStatementId(logicalId) {
 	return statementId;
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-url-provider.ts
+// src/provisioning/providers/lambda-url-provider.ts
 var LambdaUrlProvider = class {
 	lambdaClient;
 	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
@@ -9678,8 +9660,7 @@ var LambdaUrlProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/orphan-report.ts
+// src/provisioning/providers/orphan-report.ts
 async function orphanCommandRegionArg(client, aws) {
 	let region;
 	try {
@@ -9744,8 +9725,7 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	log.warn(`${lead} (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${afterward} Inspect each before deleting anything: ${inspect}.${incomplete}`);
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-eventsource-provider.ts
+// src/provisioning/providers/lambda-eventsource-provider.ts
 const createEventSourceMappingLatch = new AmbiguousCreateLatch("lambda:CreateEventSourceMapping");
 const mappingsCreatedByThisProcess = new RecentIdSet();
 const ARN_SERVICE_RE = /^arn:aws[a-z0-9-]*:([^:]+):/;
@@ -10364,8 +10344,7 @@ var LambdaEventSourceMappingProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-layer-provider.ts
+// src/provisioning/providers/lambda-layer-provider.ts
 const publishLayerVersionLatch = new AmbiguousCreateLatch("lambda:PublishLayerVersion");
 const versionsPublishedByThisProcess = new RecentIdSet();
 function parseLayerCreatedDate(value) {
@@ -10556,8 +10535,7 @@ var LambdaLayerVersionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
+// src/provisioning/providers/lambda-event-invoke-config-provider.ts
 function stringOrUndefined(value) {
 	return typeof value === "string" ? value : void 0;
 }
@@ -10795,8 +10773,7 @@ var LambdaEventInvokeConfigProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/lambda-microvm-image-provider.ts
+// src/provisioning/providers/lambda-microvm-image-provider.ts
 var LambdaMicrovmImageProvider = class {
 	client;
 	logger = getLogger().child("LambdaMicrovmImageProvider");
@@ -11165,8 +11142,7 @@ function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-web-function-arns.ts
+// src/provisioning/providers/lambda-web-function-arns.ts
 const CHILD_ARN = /^(arn:[^:]+:lambda:[^:]+:\d{12}:web-function\/[^/]+)\/(revision|endpoint)\/([^/]+)$/;
 function parseWebFunctionChildArn(arn, kind) {
 	const match = CHILD_ARN.exec(arn);
@@ -11200,8 +11176,7 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-web-function-revision-provider.ts
+// src/provisioning/providers/lambda-web-function-revision-provider.ts
 const createRevisionLatch = new AmbiguousCreateLatch("lambda-web:CreateWebFunctionRevision");
 const revisionsCreatedByThisProcess = new RecentIdSet();
 var LambdaWebFunctionRevisionProvider = class {
@@ -11561,8 +11536,7 @@ function serviceConfigToCfn(config) {
 	return out;
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-web-function-endpoint-provider.ts
+// src/provisioning/providers/lambda-web-function-endpoint-provider.ts
 var LambdaWebFunctionEndpointProvider = class {
 	client;
 	logger = getLogger().child("LambdaWebFunctionEndpointProvider");
@@ -11924,8 +11898,7 @@ function buildAttributes$1(resp) {
 	return attributes;
 }
 
-//#endregion
-//#region src/provisioning/providers/lambda-network-connector-provider.ts
+// src/provisioning/providers/lambda-network-connector-provider.ts
 const POLL_INTERVAL_MS$2 = 1e3;
 const MAX_POLL_ATTEMPTS = 1200;
 var LambdaNetworkConnectorProvider = class {
@@ -12228,8 +12201,7 @@ function versionOfArn(arn) {
 	return match ? Number(match[1]) : void 0;
 }
 
-//#endregion
-//#region src/provisioning/delete-gone-wait.ts
+// src/provisioning/delete-gone-wait.ts
 async function waitForGoneAfterDelete(opts) {
 	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
 	const now = opts.now ?? Date.now;
@@ -12280,8 +12252,7 @@ async function waitForGoneAfterDelete(opts) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/dynamodb-table-provider.ts
+// src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
 	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
 }
@@ -12528,12 +12499,15 @@ function sentWarmThroughputMembers(value) {
 function wasSentWarmThroughput(value) {
 	return sentWarmThroughputMembers(value).size > 0;
 }
-function readbackWarmThroughput(live, members) {
+function readbackWarmThroughput(live, members, declared) {
+	const moving = live.Status === "UPDATING" ? coerceWarmThroughput(declared)?.spec : void 0;
 	const out = {};
 	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (live[member] === void 0) continue;
+		const value = live[member];
+		if (value === void 0) continue;
 		if (members !== void 0 && !members.has(member)) continue;
-		out[member] = live[member];
+		const target = moving?.[member];
+		out[member] = target === void 0 ? value : Math.max(value, target);
 	}
 	return Object.keys(out).length > 0 ? out : void 0;
 }
@@ -12595,7 +12569,7 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 		if (Object.keys(odt).length > 0) out["OnDemandThroughput"] = odt;
 	}
 	if ("WarmThroughput" in live && indexDeclares(desired, "WarmThroughput", bagInformative) && live.WarmThroughput) {
-		const wt = readbackWarmThroughput(live.WarmThroughput, bagInformative ? sentWarmThroughputMembers(desired?.["WarmThroughput"]) : void 0);
+		const wt = readbackWarmThroughput(live.WarmThroughput, bagInformative ? sentWarmThroughputMembers(desired?.["WarmThroughput"]) : void 0, bagInformative ? desired?.["WarmThroughput"] : void 0);
 		if (wt !== void 0) out["WarmThroughput"] = wt;
 	}
 	return out;
@@ -12953,7 +12927,14 @@ var DynamoDBTableProvider = class {
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${lsiMessage}. Nothing was applied to the table; revert the LocalSecondaryIndexes change, or create a new table under a new logical ID (a new table starts empty)`, resourceType, logicalId, physicalId);
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
-			const vectorIndexPlan = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]) ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
+			const vectorIndexesChanged = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]);
+			const vectorIndexShape = vectorIndexesChanged ? vectorIndexesShapeDetail(properties["VectorIndexes"]) : void 0;
+			if (vectorIndexShape !== void 0) {
+				const shapeMessage = `AWS::DynamoDB::Table ${logicalId}: ${vectorIndexShape}`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(shapeMessage)}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
+				warn(`${shapeMessage}; the VectorIndexes change was not applied`);
+			}
+			const vectorIndexPlan = vectorIndexesChanged && vectorIndexShape === void 0 ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
 			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
 				const vectorMessage = `AWS::DynamoDB::Table ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((n) => maskSecrets(n)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
@@ -14274,7 +14255,8 @@ var DynamoDBTableProvider = class {
 				if (Object.keys(odt).length > 0) result["OnDemandThroughput"] = odt;
 			}
 			if (table.WarmThroughput && declaresWarmThroughput(properties)) {
-				const wt = readbackWarmThroughput(table.WarmThroughput, properties !== void 0 && desiredBagIsInformative(properties) ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0);
+				const informative = properties !== void 0 && desiredBagIsInformative(properties);
+				const wt = readbackWarmThroughput(table.WarmThroughput, informative ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0, informative ? properties["WarmThroughput"] : void 0);
 				if (wt !== void 0) result["WarmThroughput"] = wt;
 			}
 			let streamMembersRead = Promise.resolve();
@@ -14540,8 +14522,7 @@ function projectIndexesOnto(live, recorded, desired, attempted = /* @__PURE__ */
 	return kept.length > 0 ? kept : void 0;
 }
 
-//#endregion
-//#region src/provisioning/providers/logs-loggroup-provider.ts
+// src/provisioning/providers/logs-loggroup-provider.ts
 const LOG_GROUP_TYPE = "AWS::Logs::LogGroup";
 function isLogGroupName(id) {
 	return /^[A-Za-z0-9._/#-]{1,512}$/.test(id);
@@ -15040,8 +15021,7 @@ var LogsLogGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudwatch-alarm-provider.ts
+// src/provisioning/providers/cloudwatch-alarm-provider.ts
 function isDefaultEvaluationWindow(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -15409,8 +15389,7 @@ var CloudWatchAlarmProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudwatch-anomaly-detector-provider.ts
+// src/provisioning/providers/cloudwatch-anomaly-detector-provider.ts
 const ID_ATTRIBUTES = ["AnomalyDetectorId", "Id"];
 var CloudWatchAnomalyDetectorProvider = class {
 	cloudWatchClient;
@@ -15579,8 +15558,7 @@ function hasDescriptor(params) {
 	return params.SingleMetricAnomalyDetector !== void 0 || params.MetricMathAnomalyDetector !== void 0 || params.Namespace !== void 0 || params.MetricName !== void 0;
 }
 
-//#endregion
-//#region src/provisioning/providers/secretsmanager-secret-provider.ts
+// src/provisioning/providers/secretsmanager-secret-provider.ts
 function asJson(value) {
 	return value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
 }
@@ -16019,8 +15997,7 @@ var SecretsManagerSecretProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ssm-parameter-provider.ts
+// src/provisioning/providers/ssm-parameter-provider.ts
 var SSMParameterProvider = class SSMParameterProvider {
 	ssmClient;
 	createClient;
@@ -16310,8 +16287,7 @@ function ssmPoliciesParameter(policies) {
 	return JSON.stringify(policies);
 }
 
-//#endregion
-//#region src/provisioning/providers/eventbridge-rule-provider.ts
+// src/provisioning/providers/eventbridge-rule-provider.ts
 var EventBridgeRuleProvider = class {
 	eventBridgeClient;
 	logger = getLogger().child("EventBridgeRuleProvider");
@@ -16752,8 +16728,7 @@ var EventBridgeRuleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/eventbridge-bus-provider.ts
+// src/provisioning/providers/eventbridge-bus-provider.ts
 function sanitizeDeadLetterConfig(value) {
 	if (value === null || value === void 0) return void 0;
 	if (typeof value !== "object") return void 0;
@@ -17039,8 +17014,7 @@ var EventBridgeBusProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ec2-provider.ts
+// src/provisioning/providers/ec2-provider.ts
 const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
 	label: "VPCGatewayAttachment",
 	segments: ["gatewayId", "vpcId"]
@@ -21756,8 +21730,7 @@ function isDefaultEgressRule(rule) {
 	return true;
 }
 
-//#endregion
-//#region src/provisioning/providers/apigateway-provider.ts
+// src/provisioning/providers/apigateway-provider.ts
 const createAuthorizerLatch$1 = new AmbiguousCreateLatch("apigateway:CreateAuthorizer");
 const createDeploymentLatch = new AmbiguousCreateLatch("apigateway:CreateDeployment");
 const authorizersCreatedByThisProcess$1 = new RecentIdSet();
@@ -23355,8 +23328,7 @@ function methodChildCalls(ids, desired, previous) {
 	return calls;
 }
 
-//#endregion
-//#region src/provisioning/providers/apigatewayv2-provider.ts
+// src/provisioning/providers/apigatewayv2-provider.ts
 const createApiLatch = new AmbiguousCreateLatch("apigatewayv2:CreateApi");
 const createIntegrationLatch = new AmbiguousCreateLatch("apigatewayv2:CreateIntegration");
 const createAuthorizerLatch = new AmbiguousCreateLatch("apigatewayv2:CreateAuthorizer");
@@ -24825,8 +24797,7 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudfront-oai-provider.ts
+// src/provisioning/providers/cloudfront-oai-provider.ts
 var CloudFrontOAIProvider = class {
 	cloudFrontClient;
 	logger = getLogger().child("CloudFrontOAIProvider");
@@ -24975,8 +24946,7 @@ var CloudFrontOAIProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudfront-oac-provider.ts
+// src/provisioning/providers/cloudfront-oac-provider.ts
 var CloudFrontOACProvider = class {
 	cloudFrontClient;
 	createClient;
@@ -25141,8 +25111,7 @@ var CloudFrontOACProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cloudfront-distribution-provider.ts
+// src/provisioning/providers/cloudfront-distribution-provider.ts
 function shownId(id) {
 	return isPlainImportValue(id) ? id : VALUE_NOT_SHOWN;
 }
@@ -25820,8 +25789,7 @@ var CloudFrontDistributionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-case-convert.ts
+// src/provisioning/providers/agentcore-case-convert.ts
 function pascalToCamelCaseKeys(value, preserveKeys) {
 	if (value === null || value === void 0) return value;
 	if (Array.isArray(value)) return value.map((item) => pascalToCamelCaseKeys(item, preserveKeys));
@@ -25849,8 +25817,7 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 	return value;
 }
 
-//#endregion
-//#region src/provisioning/providers/agentcore-runtime-provider.ts
+// src/provisioning/providers/agentcore-runtime-provider.ts
 const CFN_MAP_KEYS = /* @__PURE__ */ new Set(["Tags", "AdvertisedScopeMapping"]);
 const SDK_MAP_KEYS = /* @__PURE__ */ new Set(["tags", "advertisedScopeMapping"]);
 const RUNTIME_TAGS_WHAT = "a map of tag keys to scalar values or a list of tags with a non-empty string Key and a scalar Value";
@@ -26144,8 +26111,7 @@ var AgentCoreRuntimeProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-browser-provider.ts
+// src/provisioning/providers/agentcore-browser-provider.ts
 const DEFAULT_BROWSER_ID = "aws.browser.v1";
 var AgentCoreBrowserProvider = class {
 	client;
@@ -26219,8 +26185,7 @@ var AgentCoreBrowserProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-code-interpreter-provider.ts
+// src/provisioning/providers/agentcore-code-interpreter-provider.ts
 const DEFAULT_CODE_INTERPRETER_ID = "aws.codeinterpreter.v1";
 var AgentCoreCodeInterpreterProvider = class {
 	client;
@@ -26289,8 +26254,7 @@ var AgentCoreCodeInterpreterProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/agentcore-evaluator-provider.ts
+// src/provisioning/providers/agentcore-evaluator-provider.ts
 const CFN_PRESERVE_KEYS = /* @__PURE__ */ new Set(["AdditionalModelRequestFields"]);
 const SDK_PRESERVE_KEYS = /* @__PURE__ */ new Set(["additionalModelRequestFields"]);
 function evaluatorIdFromArn(arnOrId) {
@@ -26484,8 +26448,7 @@ var AgentCoreEvaluatorProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/stepfunctions-provider.ts
+// src/provisioning/providers/stepfunctions-provider.ts
 function stateMachineRevisionId(described) {
 	return described.revisionId ?? "INITIAL";
 }
@@ -26893,8 +26856,7 @@ function wasMeaningfullyConfigured(value, discriminatorKey) {
 	return value[discriminatorKey] !== void 0;
 }
 
-//#endregion
-//#region src/provisioning/providers/ecs-provider.ts
+// src/provisioning/providers/ecs-provider.ts
 const registerTaskDefinitionLatch = new AmbiguousCreateLatch("ecs:RegisterTaskDefinition");
 const taskDefinitionsRegisteredByThisProcess = new RecentIdSet();
 function familyOfTaskDefinitionArn(arn) {
@@ -28511,8 +28473,7 @@ var ECSProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/elbv2-provider.ts
+// src/provisioning/providers/elbv2-provider.ts
 function loadBalancerNameFromArn(arn) {
 	return nameFromElbv2Arn(arn, ":loadbalancer/", 3);
 }
@@ -30022,8 +29983,7 @@ var ELBv2Provider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/rds-dbproxy-provider.ts
+// src/provisioning/providers/rds-dbproxy-provider.ts
 const POLL_INTERVAL_MS$1 = 5e3;
 const POLL_TIMEOUT_MS$1 = 18e5;
 const RETAINED_ON_REMOVAL = [
@@ -30402,8 +30362,7 @@ var RDSDBProxyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/rds-dbproxy-endpoint-provider.ts
+// src/provisioning/providers/rds-dbproxy-endpoint-provider.ts
 const POLL_INTERVAL_MS = 5e3;
 const POLL_TIMEOUT_MS = 18e5;
 var RDSDBProxyEndpointProvider = class {
@@ -30705,8 +30664,7 @@ var RDSDBProxyEndpointProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/rds-dbproxy-targetgroup-provider.ts
+// src/provisioning/providers/rds-dbproxy-targetgroup-provider.ts
 const RDS_TARGET_IDENTIFIER = /^[A-Za-z][A-Za-z0-9-]{0,62}$/;
 function readTargetLists(values) {
 	const lists = {
@@ -31220,8 +31178,7 @@ function withoutKey(bag, key) {
 	return rest;
 }
 
-//#endregion
-//#region src/provisioning/providers/docdb-shared.ts
+// src/provisioning/providers/docdb-shared.ts
 function wrapDocDBFailure(logger, mask, error, build) {
 	const m = maskerOrIdentity(mask);
 	const failure = describeAwsFailure(error);
@@ -31230,6 +31187,41 @@ function wrapDocDBFailure(logger, mask, error, build) {
 	const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
 	return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 }
+function docdbStringList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	return value.every((item) => typeof item === "string") ? value : void 0;
+}
+function docdbLogExportChange(desired, previous) {
+	const enable = [...new Set(desired)].filter((type) => !previous.includes(type));
+	const disable = [...new Set(previous)].filter((type) => !desired.includes(type));
+	if (enable.length === 0 && disable.length === 0) return void 0;
+	return {
+		...enable.length > 0 && { EnableLogTypes: enable },
+		...disable.length > 0 && { DisableLogTypes: disable }
+	};
+}
+function cfnCapacity(value) {
+	const capacity = typeof value === "number" || typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	return Number.isFinite(capacity) ? capacity : void 0;
+}
+function docdbServerlessScaling(value) {
+	if (value == null) return void 0;
+	if (typeof value !== "object" || Array.isArray(value)) return null;
+	const { MinCapacity, MaxCapacity } = value;
+	const min = cfnCapacity(MinCapacity);
+	const max = cfnCapacity(MaxCapacity);
+	if (min === void 0 || max === void 0) return null;
+	return {
+		MinCapacity: min,
+		MaxCapacity: max
+	};
+}
+function holdsDocDBPendingValue(value) {
+	if (value === void 0 || value === null) return false;
+	if (typeof value === "object") return Object.values(value).some(holdsDocDBPendingValue);
+	return true;
+}
 function isDocDBNotFoundError(error, faultName) {
 	if (!(error instanceof Error)) return false;
 	const name = error.name ?? "";
@@ -31269,8 +31261,7 @@ async function attachDocDBTags(client, logger, result, arn) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/docdb-provider.ts
+// src/provisioning/providers/docdb-provider.ts
 function masterUserPasswordToSend(properties, previousProperties, context) {
 	const desired = properties["MasterUserPassword"];
 	if (desired === void 0 || desired === null) return void 0;
@@ -31280,6 +31271,20 @@ function masterUserPasswordToSend(properties, previousProperties, context) {
 	return typeof desired === "string" && typeof recorded === "string" && recorded === desired && dynamicReferenceTokens(recorded).length === 0 && recorded !== "***" ? void 0 : desired;
 }
 const DOCDB_DEFAULT_PORT = 27017;
+const DOCDB_DEFAULT_STORAGE_TYPE = "standard";
+function rotateMasterUserPassword(properties, previousProperties, context) {
+	if (context?.replayingState === true || context?.desiredFromAwsReadback === true) return false;
+	return coerceCfnBoolean(properties["RotateMasterUserPassword"]) === true && coerceCfnBoolean(previousProperties["RotateMasterUserPassword"]) !== true;
+}
+function kmsKeyText(key) {
+	return key.replace(/^arn:[^:]*:kms:[^:]*:[^:]*:/, "").replace(/^key\//, "");
+}
+function sameKmsKey(a, b) {
+	return b !== void 0 && kmsKeyText(a) === kmsKeyText(b);
+}
+function declaredChange(desired, recorded, live) {
+	return desired != null && String(desired) !== String(recorded ?? live);
+}
 const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
 	"DeletionProtection",
 	"BackupRetentionPeriod",
@@ -31287,17 +31292,38 @@ const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
 	"EngineVersion",
 	"PreferredBackupWindow",
 	"PreferredMaintenanceWindow",
-	"DBClusterParameterGroupName"
+	"DBClusterParameterGroupName",
+	"CopyTagsToSnapshot",
+	"EnableCloudwatchLogsExports",
+	"StorageType",
+	"ServerlessV2ScalingConfiguration",
+	"MasterUserSecretKmsKeyId"
+];
+const DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL = ["NetworkType", "ManageMasterUserPassword"];
+const DOCDB_INSTANCE_KEPT_ON_REMOVAL = [
+	"PreferredMaintenanceWindow",
+	"CACertificateIdentifier",
+	"EnablePerformanceInsights"
+];
+const CLUSTER_MODIFY_UNSETTLED_KEYS = [
+	"CopyTagsToSnapshot",
+	"EnableCloudwatchLogsExports",
+	"NetworkType",
+	"ServerlessV2ScalingConfiguration",
+	"StorageType"
 ];
-const DOCDB_INSTANCE_KEPT_ON_REMOVAL = ["PreferredMaintenanceWindow"];
-function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType) {
+const INSTANCE_MODIFY_UNSETTLED_KEYS = ["CACertificateIdentifier", "EnablePerformanceInsights"];
+const SETTLE_MAX_WAIT_MS = 3e5;
+const STORAGE_SETTLE_MAX_WAIT_MS = 18e5;
+const DEADLINE_MARGIN_MS = 3e4;
+function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType, measured = true) {
 	const removedSet = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
 	const removed = keys.filter((key) => removedSet.has(key));
 	if (removed.length === 0) return void 0;
 	const one = removed.length === 1;
 	const names = `${one ? "property" : "properties"} ${removed.join(", ")}`;
 	const modify = resourceType === "AWS::DocDB::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
-	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place, as CloudFormation does. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
+	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place${measured ? ", as CloudFormation does" : ""}. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
 }
 const SECURITY_GROUP_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying"]);
 const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "rebooting"]);
@@ -31341,6 +31367,7 @@ var DocDBProvider = class {
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
 	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
+		"AvailabilityZones",
 		"DBClusterIdentifier",
 		"DBSubnetGroupName",
 		"KmsKeyId",
@@ -31349,7 +31376,9 @@ var DocDBProvider = class {
 		"Port",
 		"Tags",
 		"MasterUserPassword",
-		...DOCDB_CLUSTER_KEPT_ON_REMOVAL
+		"RotateMasterUserPassword",
+		...DOCDB_CLUSTER_KEPT_ON_REMOVAL,
+		...DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBClusterIdentifier",
@@ -31357,6 +31386,7 @@ var DocDBProvider = class {
 		"DBInstanceClass",
 		"Tags",
 		"AutoMinorVersionUpgrade",
+		"CertificateRotationRestart",
 		...DOCDB_INSTANCE_KEPT_ON_REMOVAL
 	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
@@ -31374,7 +31404,16 @@ var DocDBProvider = class {
 		"PreferredMaintenanceWindow",
 		"DBClusterParameterGroupName",
 		"DeletionProtection",
-		"Tags"
+		"Tags",
+		"AvailabilityZones",
+		"CopyTagsToSnapshot",
+		"EnableCloudwatchLogsExports",
+		"ManageMasterUserPassword",
+		"MasterUserSecretKmsKeyId",
+		"NetworkType",
+		"RotateMasterUserPassword",
+		"ServerlessV2ScalingConfiguration",
+		"StorageType"
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBInstanceClass",
@@ -31382,7 +31421,10 @@ var DocDBProvider = class {
 		"AvailabilityZone",
 		"PreferredMaintenanceWindow",
 		"AutoMinorVersionUpgrade",
-		"Tags"
+		"Tags",
+		"CACertificateIdentifier",
+		"CertificateRotationRestart",
+		"EnablePerformanceInsights"
 	])]]);
 	getClient() {
 		if (!this.docdbClient) {
@@ -31404,8 +31446,8 @@ var DocDBProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const mask = context?.maskSecrets;
 		switch (resourceType) {
-			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask);
-			case "AWS::DocDB::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask);
+			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			case "AWS::DocDB::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask, context?.replayingState === true);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -31430,9 +31472,13 @@ var DocDBProvider = class {
 		const thrown = this.wrapCaughtError(mask, error, build);
 		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 	}
-	async createDBCluster(logicalId, resourceType, properties, mask) {
+	async createDBCluster(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating DocDB DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const origin = { stateBorne: replayingState };
+		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, true);
+		const managedPassword = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
+		const password = this.passwordBesideManaged(managedPassword, false, properties["MasterUserPassword"], resourceType, logicalId, origin);
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
@@ -31442,7 +31488,7 @@ var DocDBProvider = class {
 				Engine: "docdb",
 				EngineVersion: properties["EngineVersion"],
 				MasterUsername: properties["MasterUsername"],
-				MasterUserPassword: properties["MasterUserPassword"],
+				MasterUserPassword: password,
 				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
 				DBSubnetGroupName: properties["DBSubnetGroupName"],
@@ -31453,6 +31499,14 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				DeletionProtection: properties["DeletionProtection"],
+				AvailabilityZones: properties["AvailabilityZones"],
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				ManageMasterUserPassword: managedPassword,
+				MasterUserSecretKmsKeyId: properties["MasterUserSecretKmsKeyId"],
+				NetworkType: properties["NetworkType"],
+				StorageType: properties["StorageType"],
+				...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
+				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
@@ -31474,10 +31528,26 @@ var DocDBProvider = class {
 	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const origin = {
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		};
+		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, false);
+		const logExportConfig = logTypes === void 0 ? void 0 : docdbLogExportChange(logTypes, docdbStringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
 		try {
+			const credentials = await this.planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin);
 			const vpcSgIds = properties["VpcSecurityGroupIds"];
 			const sendVpcSgIds = vpcSgIds !== void 0 && vpcSgIds.length > 0;
 			const portToSend = clusterPortToSend(properties, previousProperties);
+			const unrecorded = (key) => properties[key] != null && previousProperties[key] == null;
+			const live = unrecorded("NetworkType") || unrecorded("StorageType") || logExportConfig?.EnableLogTypes !== void 0 ? await this.describeDBCluster(physicalId) : void 0;
+			const networkType = properties["NetworkType"];
+			const networkChange = declaredChange(networkType, previousProperties["NetworkType"], live?.NetworkType);
+			const storageType = properties["StorageType"];
+			const storageChange = declaredChange(storageType, previousProperties["StorageType"], live?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE);
+			const previousScaling = docdbServerlessScaling(previousProperties["ServerlessV2ScalingConfiguration"]);
+			const scalingChange = scaling != null && (scaling.MinCapacity !== previousScaling?.MinCapacity || scaling.MaxCapacity !== previousScaling?.MaxCapacity);
+			this.markChangedUnsettled(CLUSTER_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await this.getClient().send(new ModifyDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
@@ -31487,15 +31557,40 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				...sendVpcSgIds && { VpcSecurityGroupIds: vpcSgIds },
-				MasterUserPassword: masterUserPasswordToSend(properties, previousProperties, context),
+				MasterUserPassword: credentials.password,
 				Port: portToSend,
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				...rotateMasterUserPassword(properties, previousProperties, context) && { RotateMasterUserPassword: true },
+				...credentials.managed !== void 0 && { ManageMasterUserPassword: credentials.managed },
+				...credentials.secretKmsKey !== void 0 && { MasterUserSecretKmsKeyId: credentials.secretKmsKey },
+				...networkChange && { NetworkType: networkType },
+				...storageChange && { StorageType: storageType },
+				...scalingChange && { ServerlessV2ScalingConfiguration: scaling },
+				...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig },
 				ApplyImmediately: true
 			}));
+			const addedLogTypes = (logExportConfig?.EnableLogTypes ?? []).filter((type) => !live?.EnabledCloudwatchLogsExports?.includes(type));
+			if (addedLogTypes.length > 0) context?.markAttempted?.("EnableCloudwatchLogsExports", addedLogTypes);
 			this.logger.debug(`Successfully updated DocDB DBCluster ${logicalId}`);
 			const noWait = process.env["CDKD_NO_WAIT"] === "true";
 			const portChanged = portToSend !== void 0 && portToSend !== numberOrUndefined(previousProperties["Port"]);
 			if (!noWait && portChanged) await this.waitForClusterPortApplied(physicalId, logicalId, portToSend);
 			const described = await this.describeDBCluster(physicalId);
+			if (!noWait) {
+				const { EnableLogTypes: enabled = [], DisableLogTypes: disabled = [] } = logExportConfig ?? {};
+				const applied = /* @__PURE__ */ new Map();
+				if (logExportConfig !== void 0) applied.set("EnableCloudwatchLogsExports", (cluster) => {
+					const logs = cluster?.EnabledCloudwatchLogsExports;
+					return enabled.every((type) => logs?.includes(type)) && !disabled.some((type) => logs?.includes(type));
+				});
+				if (networkChange) applied.set("NetworkType", (cluster) => cluster?.NetworkType === networkType);
+				if (storageChange) applied.set("StorageType", (cluster) => (cluster?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE) === storageType);
+				if (scalingChange) applied.set("ServerlessV2ScalingConfiguration", (cluster) => {
+					const live = cluster?.ServerlessV2ScalingConfiguration;
+					return live?.MinCapacity === scaling?.MinCapacity && live?.MaxCapacity === scaling?.MaxCapacity;
+				});
+				await this.waitForApplied(logicalId, applied, () => this.describeDBCluster(physicalId), storageChange ? STORAGE_SETTLE_MAX_WAIT_MS : SETTLE_MAX_WAIT_MS);
+			}
 			if (!noWait && portChanged) {
 				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, PORT_CHANGE_MEMBER_STATUSES, "port");
 			}
@@ -31506,15 +31601,20 @@ var DocDBProvider = class {
 			if (described?.DBClusterArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const keptWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
 			if (keptWarning !== void 0) this.logger.warn(keptWarning);
+			const unmeasuredWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType, false);
+			if (unmeasuredWarning !== void 0) this.logger.warn(unmeasuredWarning);
+			if (credentials.heldWarning !== void 0) this.logger.warn(credentials.heldWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
 				attributes: clusterAttributes(noWait && portChanged && described !== void 0 ? {
 					...described,
 					Port: portToSend
-				} : described)
+				} : described),
+				...credentials.effectiveProperties !== void 0 && { effectiveProperties: credentials.effectiveProperties }
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -31596,9 +31696,10 @@ var DocDBProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createDBInstance(logicalId, resourceType, properties, mask) {
+	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating DocDB DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const insights = this.readBooleanProperty("EnablePerformanceInsights", properties, resourceType, logicalId, { stateBorne: replayingState });
 		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::DocDB::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
@@ -31611,6 +31712,8 @@ var DocDBProvider = class {
 				AvailabilityZone: properties["AvailabilityZone"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+				CACertificateIdentifier: properties["CACertificateIdentifier"],
+				EnablePerformanceInsights: insights,
 				...tags.length > 0 && { Tags: tags }
 			}));
 			instanceCreated = true;
@@ -31633,13 +31736,25 @@ var DocDBProvider = class {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
 		const mask = context?.maskSecrets;
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const insights = this.readBooleanProperty("EnablePerformanceInsights", properties, resourceType, logicalId, {
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		});
 		try {
+			const certificate = properties["CACertificateIdentifier"];
+			const live = certificate != null && previousProperties["CACertificateIdentifier"] == null || insights !== void 0 && previousProperties["EnablePerformanceInsights"] == null ? await this.describeDBInstance(physicalId) : void 0;
+			const certificateChange = declaredChange(certificate, previousProperties["CACertificateIdentifier"], live?.CACertificateIdentifier);
+			const insightsChange = declaredChange(insights, previousProperties["EnablePerformanceInsights"], live?.PerformanceInsightsEnabled ?? false);
+			this.markChangedUnsettled(INSTANCE_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await modifyDbInstanceWhenAvailable({
 				send: () => this.getClient().send(new ModifyDBInstanceCommand$1({
 					DBInstanceIdentifier: physicalId,
 					DBInstanceClass: properties["DBInstanceClass"],
 					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+					...certificateChange && { CACertificateIdentifier: certificate },
+					...certificateChange && properties["CertificateRotationRestart"] != null && { CertificateRotationRestart: properties["CertificateRotationRestart"] },
+					...insightsChange && { EnablePerformanceInsights: insights },
 					ApplyImmediately: true
 				})),
 				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
@@ -31650,6 +31765,12 @@ var DocDBProvider = class {
 				remainingMs: enclosingDeadlineRemainingMs()
 			});
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
+			if (process.env["CDKD_NO_WAIT"] !== "true") {
+				const applied = /* @__PURE__ */ new Map();
+				if (certificateChange) applied.set("CACertificateIdentifier", (instance) => instance?.CACertificateIdentifier === certificate);
+				if (insightsChange) applied.set("EnablePerformanceInsights", (instance) => instance?.PerformanceInsightsEnabled === insights);
+				await this.waitForApplied(logicalId, applied, () => this.describeDBInstance(physicalId));
+			}
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const keptWarning = keptOnRemovalWarning$1(DOCDB_INSTANCE_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
@@ -31682,6 +31803,106 @@ var DocDBProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	markChangedUnsettled(keys, properties, previousProperties, context) {
+		for (const key of keys) if (properties[key] != null && !isDeepStrictEqual(properties[key], previousProperties[key])) context?.markUnsettled?.(key);
+	}
+	refuseBlock(logicalId, resourceType, physicalId, text) {
+		throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType === "AWS::DocDB::DBInstance" ? "DocDB DBInstance" : "DocDB DBCluster"} ${logicalId}: ${text}; nothing was changed.`, resourceType, logicalId, physicalId));
+	}
+	readClusterBlocks(properties, resourceType, logicalId, origin, creating) {
+		const leaveOut = (key) => {
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+		};
+		const rawLogs = properties["EnableCloudwatchLogsExports"];
+		let logTypes = rawLogs == null ? void 0 : docdbStringList(rawLogs);
+		if (rawLogs != null && logTypes === void 0) {
+			if (!(creating && origin.stateBorne)) this.refuseBlock(logicalId, resourceType, origin.physicalId, "EnableCloudwatchLogsExports must be a list of strings");
+			leaveOut("EnableCloudwatchLogsExports");
+			logTypes = void 0;
+		}
+		const scaling = docdbServerlessScaling(properties["ServerlessV2ScalingConfiguration"]);
+		if (scaling === null) {
+			if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, "ServerlessV2ScalingConfiguration must be an object with both a numeric MinCapacity and a numeric MaxCapacity");
+			leaveOut("ServerlessV2ScalingConfiguration");
+		}
+		return {
+			logTypes,
+			scaling
+		};
+	}
+	async planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin) {
+		const managed = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
+		const changedPassword = masterUserPasswordToSend(properties, previousProperties, context);
+		const recordedFlag = coerceCfnBoolean(previousProperties["ManageMasterUserPassword"]);
+		const key = properties["MasterUserSecretKmsKeyId"];
+		const recordedKey = previousProperties["MasterUserSecretKmsKeyId"];
+		let managedSide = recordedFlag ?? false;
+		let keyChange = key != null && !sameKmsKey(key, recordedKey);
+		if (recordedFlag === void 0 && (changedPassword !== void 0 || managed !== void 0 || keyChange)) {
+			const secret = (await this.describeDBCluster(physicalId))?.MasterUserSecret;
+			managedSide = secret !== void 0;
+			if (recordedKey === void 0 && secret?.KmsKeyId !== void 0 && key != null) keyChange = !sameKmsKey(key, secret.KmsKeyId) && !kmsKeyText(key).startsWith("alias/");
+		}
+		const leaving = managed === false && managedSide;
+		const declared = properties["MasterUserPassword"];
+		const declaredUsable = typeof declared === "string" && declared !== "***" && dynamicReferenceTokens(declared).length === 0;
+		const password = leaving ? declaredUsable ? declared : void 0 : changedPassword;
+		const modeChange = managed !== void 0 && managed !== managedSide;
+		if (context?.desiredFromAwsReadback === true && modeChange) return {
+			managed: void 0,
+			secretKmsKey: void 0,
+			password: void 0,
+			heldWarning: safeMsg`${logicalId} (${resourceType}): cdkd drift --revert does not change ManageMasterUserPassword, so it is left as it is. Declare it in the template and deploy to change it.`
+		};
+		if (origin.stateBorne && leaving && password === void 0) return {
+			managed: void 0,
+			secretKmsKey: void 0,
+			password: void 0,
+			heldWarning: safeMsg`${logicalId} (${resourceType}): ManageMasterUserPassword stays true: turning it off needs a MasterUserPassword, which the restored state does not hold. Declare both in the template and deploy.`,
+			effectiveProperties: {
+				...properties,
+				ManageMasterUserPassword: true
+			}
+		};
+		const sendKey = key != null && (modeChange && managed === true || keyChange && (managed ?? managedSide));
+		return {
+			managed: modeChange || sendKey ? managed : void 0,
+			secretKmsKey: sendKey ? key : void 0,
+			password: this.passwordBesideManaged(managed, managed === void 0 && managedSide, password, resourceType, logicalId, origin),
+			heldWarning: void 0
+		};
+	}
+	readBooleanProperty(key, properties, resourceType, logicalId, origin) {
+		const value = properties[key];
+		if (value == null) return void 0;
+		const flag = coerceCfnBoolean(value);
+		if (flag !== void 0) return flag;
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, `${key} must be a boolean`);
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+	}
+	passwordBesideManaged(managed, removedFromManaged, password, resourceType, logicalId, origin) {
+		if (managed !== true && !removedFromManaged || password == null) return password;
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, removedFromManaged ? "MasterUserPassword cannot change while AWS manages the password; declare ManageMasterUserPassword: false beside it to leave managed mode" : "MasterUserPassword cannot be set while ManageMasterUserPassword is true, because AWS manages that password");
+		this.logger.warn(removedFromManaged ? safeMsg`${logicalId} (${resourceType}): the recorded MasterUserPassword is not sent: the cluster stays managed, because the recorded ManageMasterUserPassword is absent.` : safeMsg`${logicalId} (${resourceType}): the recorded MasterUserPassword is not sent, because ManageMasterUserPassword is true.`);
+	}
+	async waitForApplied(logicalId, applied, read, maxWaitMs = SETTLE_MAX_WAIT_MS) {
+		if (applied.size === 0) return;
+		const capMs = Math.min(maxWaitMs, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		const startTime = Date.now();
+		let delay = 2e3;
+		for (;;) {
+			const live = await read();
+			const pending = [...applied].filter(([, isApplied]) => !isApplied(live));
+			if (pending.length === 0) return;
+			if (Date.now() - startTime + delay >= capMs) {
+				const keys = pending.map(([key]) => key).join(", ");
+				this.logger.warn(safeMsg`${logicalId}: the new ${keys} did not read back when cdkd stopped waiting; AWS accepted the change, so cdkd drift may report the old value as the baseline. Once it applies, run cdkd drift --accept.`);
+				return;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+	}
 	async describeDBCluster(dbClusterIdentifier) {
 		return (await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: dbClusterIdentifier }))).DBClusters?.[0];
 	}
@@ -31870,6 +32091,60 @@ var DocDBProvider = class {
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::DocDB::DBCluster") return [
+			"AvailabilityZones",
+			"MasterUserSecretKmsKeyId",
+			"RotateMasterUserPassword"
+		];
+		if (resourceType === "AWS::DocDB::DBInstance") return ["CertificateRotationRestart"];
+		return [];
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::DocDB::DBCluster" ? ["EnableCloudwatchLogsExports"] : [];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::DocDB::DBCluster") return properties;
+		const out = { ...properties };
+		const logs = out["EnableCloudwatchLogsExports"];
+		if (Array.isArray(logs) && docdbStringList(logs) !== void 0) out["EnableCloudwatchLogsExports"] = [...new Set(logs)];
+		const scaling = docdbServerlessScaling(out["ServerlessV2ScalingConfiguration"]);
+		if (scaling != null) out["ServerlessV2ScalingConfiguration"] = scaling;
+		return out;
+	}
+	canonicalizeUnsettledProperties(resourceType, properties) {
+		return this.canonicalizeDriftProperties(resourceType, properties);
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (resourceType !== "AWS::DocDB::DBCluster") return live;
+		if (live === void 0 || live === RESOURCE_NOT_FOUND) return live;
+		if (!names.has("EnableCloudwatchLogsExports")) return live;
+		const key = "EnableCloudwatchLogsExports";
+		const named = /* @__PURE__ */ new Set([
+			...docdbStringList(recordedProperties?.[key]) ?? [],
+			...docdbStringList(desiredProperties?.[key]) ?? [],
+			...[...attemptedItems?.get(key) ?? []].filter(isUsableAttemptedName)
+		]);
+		return {
+			...live,
+			[key]: (live[key] ?? []).filter((type) => named.has(type))
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, resourceType, names, _recordedProperties, desiredProperties) {
+		if (desiredProperties !== void 0) return /* @__PURE__ */ new Set();
+		const unmoving = (status) => isProceedDbStatus(status) || status === "backing-up";
+		try {
+			if (resourceType === "AWS::DocDB::DBCluster") return unmoving((await this.describeDBCluster(physicalId))?.Status) ? /* @__PURE__ */ new Set() : names;
+			if (resourceType === "AWS::DocDB::DBInstance") {
+				const instance = await this.describeDBInstance(physicalId);
+				return unmoving(instance?.DBInstanceStatus) && !holdsDocDBPendingValue(instance?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			return /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::DocDB::DBInstance": return this.importDBInstance(input);
@@ -31901,6 +32176,8 @@ var DocDBProvider = class {
 		if (inst.AvailabilityZone !== void 0) result["AvailabilityZone"] = inst.AvailabilityZone;
 		if (inst.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = inst.PreferredMaintenanceWindow;
 		if (inst.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = inst.AutoMinorVersionUpgrade;
+		if (inst.CACertificateIdentifier !== void 0) result["CACertificateIdentifier"] = inst.CACertificateIdentifier;
+		result["EnablePerformanceInsights"] = inst.PerformanceInsightsEnabled ?? false;
 		if (inst.DBInstanceArn) await attachDocDBTags(this.getClient(), this.logger, result, inst.DBInstanceArn);
 		return result;
 	}
@@ -31928,6 +32205,16 @@ var DocDBProvider = class {
 		if (cluster.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = cluster.PreferredMaintenanceWindow;
 		if (cluster.DBClusterParameterGroup !== void 0) result["DBClusterParameterGroupName"] = cluster.DBClusterParameterGroup;
 		if (cluster.DeletionProtection !== void 0) result["DeletionProtection"] = cluster.DeletionProtection;
+		result["CopyTagsToSnapshot"] = cluster.CopyTagsToSnapshot ?? false;
+		result["ManageMasterUserPassword"] = cluster.MasterUserSecret !== void 0;
+		result["StorageType"] = cluster.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE;
+		result["EnableCloudwatchLogsExports"] = cluster.EnabledCloudwatchLogsExports ?? [];
+		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
+		const { MinCapacity: min, MaxCapacity: max } = cluster.ServerlessV2ScalingConfiguration ?? {};
+		if (min !== void 0 && max !== void 0) result["ServerlessV2ScalingConfiguration"] = {
+			MinCapacity: min,
+			MaxCapacity: max
+		};
 		if (cluster.DBClusterArn) await attachDocDBTags(this.getClient(), this.logger, result, cluster.DBClusterArn);
 		return result;
 	}
@@ -31965,8 +32252,7 @@ function securityGroupListChanged(sent, previous) {
 	return [...sent].sort().join(" ") !== [...before].sort().join(" ");
 }
 
-//#endregion
-//#region src/provisioning/providers/docdb-subnet-group-provider.ts
+// src/provisioning/providers/docdb-subnet-group-provider.ts
 var DocDBSubnetGroupProvider = class {
 	docdbClient;
 	createClient;
@@ -32103,8 +32389,7 @@ var DocDBSubnetGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/route53-provider.ts
+// src/provisioning/providers/route53-provider.ts
 function isZoneDisabledForMutationError(error) {
 	return error instanceof Error && error.message.includes("is marked disabled for mutation");
 }
@@ -33259,8 +33544,7 @@ var Route53Provider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/wafv2-provider.ts
+// src/provisioning/providers/wafv2-provider.ts
 function sanitizeDescription(value) {
 	if (value === void 0 || value === null) return void 0;
 	if (typeof value === "string" && value.length === 0) return void 0;
@@ -33726,8 +34010,7 @@ var WAFv2WebACLProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/cognito-provider.ts
+// src/provisioning/providers/cognito-provider.ts
 const USER_POOL_ECHO_MEMBERS = [
 	"LambdaConfig",
 	"UserPoolAddOns",
@@ -34874,8 +35157,7 @@ var CognitoUserPoolProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/elasticache-provider.ts
+// src/provisioning/providers/elasticache-provider.ts
 const CACHE_DELETE_WAIT_MS = Math.max(6e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "DELETE"));
 const NODE_TYPE_MODIFY_WAIT_MS = Math.max(36e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "UPDATE"));
 const MODIFY_DROPPED_AFTER_MS = 12e4;
@@ -35521,8 +35803,7 @@ var ElastiCacheProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/servicediscovery-provider.ts
+// src/provisioning/providers/servicediscovery-provider.ts
 const PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL = 60;
 const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
 const CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES = 9;
@@ -36455,8 +36736,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/appsync-provider.ts
+// src/provisioning/providers/appsync-provider.ts
 const createGraphqlApiLatch = new AmbiguousCreateLatch("CreateGraphqlApi");
 const graphqlApisCreatedByThisProcess = new RecentIdSet();
 const MAX_GRAPHQL_API_LIST_PAGES = 40;
@@ -38118,8 +38398,7 @@ var AppSyncProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/glue-provider.ts
+// src/provisioning/providers/glue-provider.ts
 const GLUE_TABLE_ID_FORMAT = {
 	label: "Glue Table",
 	segments: ["databaseName", "tableName"]
@@ -40460,8 +40739,7 @@ var GlueTriggerProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/kms-provider.ts
+// src/provisioning/providers/kms-provider.ts
 const createKeyLatch = new AmbiguousCreateLatch("CreateKey");
 const keysCreatedByThisProcess = new RecentIdSet();
 const pendingKeys = /* @__PURE__ */ new Map();
@@ -41092,8 +41370,7 @@ function templateBool(value) {
 	return Boolean(value);
 }
 
-//#endregion
-//#region src/provisioning/providers/budgets-budget-provider.ts
+// src/provisioning/providers/budgets-budget-provider.ts
 const BUDGET_LIST_WHAT = {
 	NotificationsWithSubscribers: "entries with a Notification (NotificationType, ComparisonOperator, numeric Threshold) and Subscribers (SubscriptionType, Address)",
 	ResourceTags: "tags with a string Key"
@@ -41828,8 +42105,7 @@ var BudgetsBudgetProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/kinesis-provider.ts
+// src/provisioning/providers/kinesis-provider.ts
 function isKmsEncryption(value) {
 	if (!value) return false;
 	return value["EncryptionType"] === "KMS";
@@ -42489,8 +42765,7 @@ var KinesisStreamProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/kinesis-streamconsumer-provider.ts
+// src/provisioning/providers/kinesis-streamconsumer-provider.ts
 function consumerArnParts(consumerArn) {
 	const at = consumerArn.lastIndexOf("/consumer/");
 	if (at <= 0) return void 0;
@@ -42711,8 +42986,7 @@ function tagListToMap(tags) {
 	return Object.fromEntries(tags.map((t) => [t.Key, t.Value]));
 }
 
-//#endregion
-//#region src/provisioning/providers/scheduler-schedule-provider.ts
+// src/provisioning/providers/scheduler-schedule-provider.ts
 const RECORDED_CREATION_DATE_KEY = "cdkd:CreationDate";
 function recordedCreationDate(attributes) {
 	const value = attributes?.[RECORDED_CREATION_DATE_KEY];
@@ -43148,8 +43422,7 @@ var SchedulerScheduleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/pipes-provider.ts
+// src/provisioning/providers/pipes-provider.ts
 const PIPE_TYPE = "AWS::Pipes::Pipe";
 function isPipeName(id) {
 	return /^[.\-_A-Za-z0-9]{1,64}$/.test(id);
@@ -43783,8 +44056,7 @@ var PipesPipeProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/server-clock.ts
+// src/provisioning/providers/server-clock.ts
 const SERVER_CLOCK_MARGIN_MS = 5e3;
 const CLOCK_FALLBACK_MARGIN_MS = 3e5;
 const readings = /* @__PURE__ */ new WeakMap();
@@ -43821,8 +44093,7 @@ function earliestOwnCreationTime(firstSentLocalMs, reading) {
 	return firstSentLocalMs + (reading.serverDateMs - reading.receivedAtMs) - SERVER_CLOCK_MARGIN_MS;
 }
 
-//#endregion
-//#region src/provisioning/providers/efs-provider.ts
+// src/provisioning/providers/efs-provider.ts
 function samePosixUser(requested, described) {
 	if (requested == null || described == null) return requested == null && described == null;
 	const gids = (user) => JSON.stringify([...new Set(user.SecondaryGids ?? [])].sort((a, b) => a - b));
@@ -44664,8 +44935,7 @@ var EFSProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/fsx-filesystem-provider.ts
+// src/provisioning/providers/fsx-filesystem-provider.ts
 const DEFAULT_MAX_WAIT_MS$3 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
 const FILE_SYSTEM_ID_PATTERN = /^fs-[0-9a-f]+$/;
@@ -45895,8 +46165,7 @@ var FSxFileSystemProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/emr-configuration.ts
+// src/provisioning/emr-configuration.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -45943,8 +46212,7 @@ function toSdkInstanceTypeConfigs(value) {
 	});
 }
 
-//#endregion
-//#region src/provisioning/providers/emr-instance-group-config-provider.ts
+// src/provisioning/providers/emr-instance-group-config-provider.ts
 const DEFAULT_MAX_WAIT_MS$2 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$2 = 15e3;
 const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -46318,8 +46586,7 @@ var EMRInstanceGroupConfigProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/emr-instance-fleet-config-provider.ts
+// src/provisioning/providers/emr-instance-fleet-config-provider.ts
 const DEFAULT_MAX_WAIT_MS$1 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -46667,8 +46934,7 @@ var EMRInstanceFleetConfigProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/emr-cluster-provider.ts
+// src/provisioning/providers/emr-cluster-provider.ts
 const DEFAULT_MAX_WAIT_MS = 36e5;
 const DEFAULT_POLL_INTERVAL_MS = 15e3;
 const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
@@ -47670,8 +47936,7 @@ var EMRClusterProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/firehose-provider.ts
+// src/provisioning/providers/firehose-provider.ts
 const ENCRYPTION_KEY = "DeliveryStreamEncryptionConfigurationInput";
 function readEncryptionInput(value, emptyIsAbsent) {
 	if (value === void 0 || value === null) return { kind: "absent" };
@@ -47756,6 +48021,7 @@ var FirehoseProvider = class {
 		"S3DestinationConfiguration",
 		"ExtendedS3DestinationConfiguration",
 		"KinesisStreamSourceConfiguration",
+		"DirectPutSourceConfiguration",
 		"Tags",
 		"HttpEndpointDestinationConfiguration",
 		"RedshiftDestinationConfiguration",
@@ -47808,6 +48074,7 @@ var FirehoseProvider = class {
 					RoleARN: kinesisConfig["RoleArn"] || kinesisConfig["RoleARN"]
 				};
 			}
+			if (properties["DirectPutSourceConfiguration"] !== void 0) input.DirectPutSourceConfiguration = { ThroughputHintInMBs: properties["DirectPutSourceConfiguration"]["ThroughputHintInMBs"] };
 			if (properties["HttpEndpointDestinationConfiguration"]) {
 				const httpConfig = properties["HttpEndpointDestinationConfiguration"];
 				const endpointConfig = httpConfig["EndpointConfiguration"];
@@ -48594,6 +48861,8 @@ var FirehoseProvider = class {
 			if (src.RoleARN !== void 0) srcOut["RoleARN"] = src.RoleARN;
 			if (Object.keys(srcOut).length > 0) result["KinesisStreamSourceConfiguration"] = srcOut;
 		}
+		const directPut = desc.Source?.DirectPutSourceDescription;
+		if (directPut?.ThroughputHintInMBs !== void 0) result["DirectPutSourceConfiguration"] = { ThroughputHintInMBs: directPut.ThroughputHintInMBs };
 		const dest = desc.Destinations?.[0];
 		if (dest?.ExtendedS3DestinationDescription) result["ExtendedS3DestinationConfiguration"] = mapExtendedS3DescriptionToCfn(dest.ExtendedS3DestinationDescription);
 		else if (dest?.S3DestinationDescription) result["S3DestinationConfiguration"] = mapS3DescriptionToCfn(dest.S3DestinationDescription);
@@ -48779,8 +49048,7 @@ function mapHttpEndpointDescriptionToCfn(desc) {
 	return out;
 }
 
-//#endregion
-//#region src/provisioning/providers/cloudtrail-provider.ts
+// src/provisioning/providers/cloudtrail-provider.ts
 const DEFAULT_EVENT_SELECTORS = Object.freeze([Object.freeze({
 	ReadWriteType: "All",
 	IncludeManagementEvents: true
@@ -49335,8 +49603,7 @@ var CloudTrailProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/codebuild-provider.ts
+// src/provisioning/providers/codebuild-provider.ts
 const DEFAULT_PROJECT_VISIBILITY = "PRIVATE";
 const DEFAULT_ENCRYPTION_KEY = "alias/aws/s3";
 function readVisibility(properties, mask) {
@@ -49860,8 +50127,7 @@ var CodeBuildProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/codecommit-repository-provider.ts
+// src/provisioning/providers/codecommit-repository-provider.ts
 function toSdkTagMap(tags) {
 	if (!tags || tags.length === 0) return void 0;
 	const out = {};
@@ -50396,8 +50662,7 @@ var CodeCommitRepositoryProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+// src/provisioning/providers/dlm-lifecycle-policy-provider.ts
 const KEPT_ON_REMOVAL = [
 	"Description",
 	"ExecutionRoleArn",
@@ -50684,8 +50949,7 @@ var DLMLifecyclePolicyProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-vectors-provider.ts
+// src/provisioning/providers/s3-vectors-provider.ts
 var S3VectorsProvider = class {
 	client;
 	createClient;
@@ -50905,8 +51169,7 @@ var S3VectorsProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-directory-bucket-provider.ts
+// src/provisioning/providers/s3-directory-bucket-provider.ts
 function notEmptyRefusalMessage(bucketName, maskSecrets) {
 	const mask = maskerOrIdentity(maskSecrets);
 	const secretDerived = mask(bucketName) !== bucketName;
@@ -51731,8 +51994,7 @@ var S3DirectoryBucketProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/s3-tables-provider.ts
+// src/provisioning/providers/s3-tables-provider.ts
 const S3_TABLES_NAMESPACE_ID_FORMAT = {
 	label: "S3 Tables Namespace",
 	segments: ["tableBucketARN", "namespace"]
@@ -52949,8 +53211,7 @@ var S3TablesProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/ecr-provider.ts
+// src/provisioning/providers/ecr-provider.ts
 var ECRProvider = class {
 	client;
 	createClient;
@@ -53243,8 +53504,7 @@ var ECRProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/nested-stack-messages.ts
+// src/provisioning/nested-stack-messages.ts
 function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted, inspectCommand, holeNote = "") {
 	const extra = [];
 	if (alsoSkippedCount > 0) extra.push(`${alsoSkippedCount} resource(s) were also skipped`);
@@ -53252,8 +53512,7 @@ function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedC
 	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + ". The child's state is PRESERVED and still lists them — inspect it, resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable." + holeNote + `\nInspect it with: ${inspectCommand}`;
 }
 
-//#endregion
-//#region src/provisioning/providers/nested-stack-provider.ts
+// src/provisioning/providers/nested-stack-provider.ts
 function isAbsoluteCrossPlatform(p) {
 	return isAbsoluteAssetPath(p);
 }
@@ -53622,8 +53881,7 @@ function inheritedPhysicalNameCopiesOf(bag) {
 	return copies === void 0 || copies.size === 0 ? void 0 : new Set(copies);
 }
 
-//#endregion
-//#region src/provisioning/providers/wait-condition-handle-provider.ts
+// src/provisioning/providers/wait-condition-handle-provider.ts
 var WaitConditionHandleProvider = class {
 	logger = getLogger().child("WaitConditionHandleProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFormation::WaitConditionHandle", /* @__PURE__ */ new Set([])]]);
@@ -53660,8 +53918,7 @@ var WaitConditionHandleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/acm-certificate-provider.ts
+// src/provisioning/providers/acm-certificate-provider.ts
 function certificateInUseByName(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
@@ -54059,6 +54316,5 @@ var ACMCertificateProvider = class {
 	}
 };
 
-//#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-ZqxIefLl.js.map
+//# sourceMappingURL=provider-classes-ushrO6ri.js.map