@go-to-k/cdkd 0.314.0 → 0.316.0

package/dist/{deploy-engine-ClIUqDQL.js → deploy-engine-NYjdxQWe.js}

@@ -1,8 +1,8 @@
-import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
-import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-agWtoyga.js";
-import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-QECX8C-Z.js";
-import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-B2PvJ12r.js";
+import { c as __exportAll, r as getAwsClients } from "./aws-clients-CGZAQ1gS.js";
+import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-DiHodi76.js";
+import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-B9OCHRr_.js";
+import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BLXFsfMa.js";
+import { t as getCdkdVersion } from "./version-9_dvIw-h.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -40,7 +40,7 @@ import { DescribeDomainCommand, OpenSearchClient } from "@aws-sdk/client-opensea
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 
-//#region src/utils/aws-region-resolver.ts
+// src/utils/aws-region-resolver.ts
 const cache = /* @__PURE__ */ new Map();
 async function readClientRegion(client) {
 	try {
@@ -106,8 +106,7 @@ async function resolveCrossAccountStateBucket(accountId, credentials) {
 	};
 }
 
-//#endregion
-//#region src/utils/injected-aws-region.ts
+// src/utils/injected-aws-region.ts
 let injected;
 function injectAwsRegion(region) {
 	injected ??= {
@@ -132,8 +131,7 @@ function injectedAwsRegionOverride() {
 	return { AWS_REGION: injected.original };
 }
 
-//#endregion
-//#region src/synthesis/app-executor.ts
+// src/synthesis/app-executor.ts
 const CDK_ASM_VERSION = "38.0.0";
 const CONTEXT_OVERFLOW_LIMIT = 32768;
 function stripSurroundingQuotes(token) {
@@ -228,8 +226,7 @@ var AppExecutor = class {
 	}
 };
 
-//#endregion
-//#region src/types/assembly.ts
+// src/types/assembly.ts
 const ASSEMBLY_REGION_PREFIX = /^[a-z0-9-]+/;
 const CDK_ENVIRONMENT_PATTERN = /aws:\/\/([a-zA-Z0-9@._-]+)\/([a-z0-9-]+)/;
 const CANONICAL_ASSEMBLY_REGION = /^[a-z0-9-]+$/;
@@ -262,8 +259,7 @@ function unparsableRegionMessage(region, stackName) {
 	return `${head}\nIf an earlier cdkd version deployed this stack from such an assembly, it recorded the stack's state under that raw region spelling, and a deploy using the canonical spelling will not find that state: it starts the stack from no state at all. 'cdkd state show' and 'cdkd state orphan' still reach that record when '--stack-region' is given the exact raw spelling; 'state orphan' removes the record and leaves its AWS resources in place, unmanaged by cdkd.`;
 }
 
-//#endregion
-//#region src/utils/assembly-path.ts
+// src/utils/assembly-path.ts
 function isInside(base, candidate) {
 	const rel = path.relative(base, candidate);
 	if (rel === "" || rel === "..") return false;
@@ -408,8 +404,7 @@ function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverri
 	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
 }
 
-//#endregion
-//#region src/utils/own-keys.ts
+// src/utils/own-keys.ts
 function hasOwnKey(target, key) {
 	return Object.prototype.hasOwnProperty.call(target, key);
 }
@@ -432,8 +427,7 @@ function nullPrototypeRecord() {
 	return Object.create(null);
 }
 
-//#endregion
-//#region src/utils/json-parse-failure.ts
+// src/utils/json-parse-failure.ts
 function describeJsonParseFailure(err, bytes) {
 	const raw = describeAwsFailure(err).detail;
 	const at = / (?:in|after) JSON at position (\d+)(?: \(line \d+ column \d+\))?$/.exec(raw);
@@ -457,8 +451,7 @@ function parseJsonNamingNoBody(body, subject, debug) {
 	}
 }
 
-//#endregion
-//#region src/synthesis/stack-messages.ts
+// src/synthesis/stack-messages.ts
 const MESSAGE_ENTRY_TYPES = {
 	"aws:cdk:error": "error",
 	"aws:cdk:warning": "warning",
@@ -518,8 +511,7 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
-//#endregion
-//#region src/synthesis/failed-stages.ts
+// src/synthesis/failed-stages.ts
 var StageLoadError = class StageLoadError extends SynthesisError {
 	constructor(message) {
 		super(message);
@@ -557,8 +549,7 @@ function renderStagePath(stagePath) {
 	return displayIdent(stagePath, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 }
 
-//#endregion
-//#region src/synthesis/assembly-reader.ts
+// src/synthesis/assembly-reader.ts
 function manifestReadFailureText(error) {
 	const cause = error instanceof CdkdError ? error.cause : error;
 	const code = cause?.code;
@@ -716,8 +707,7 @@ var AssemblyReader = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-store.ts
+// src/synthesis/context-store.ts
 const CDK_CONTEXT_FILE = "cdk.context.json";
 var ContextStore = class {
 	logger = getLogger().child("ContextStore");
@@ -762,8 +752,7 @@ var ContextStore = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/az-provider.ts
+// src/synthesis/context-providers/az-provider.ts
 var AZContextProvider = class {
 	logger = getLogger().child("AZContextProvider");
 	awsConfig;
@@ -787,8 +776,7 @@ var AZContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/ssm-provider.ts
+// src/synthesis/context-providers/ssm-provider.ts
 var SSMContextProvider = class {
 	logger = getLogger().child("SSMContextProvider");
 	awsConfig;
@@ -821,8 +809,7 @@ var SSMContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/hosted-zone-provider.ts
+// src/synthesis/context-providers/hosted-zone-provider.ts
 var HostedZoneContextProvider = class {
 	logger = getLogger().child("HostedZoneContextProvider");
 	awsConfig;
@@ -869,8 +856,7 @@ var HostedZoneContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/vpc-provider.ts
+// src/synthesis/context-providers/vpc-provider.ts
 var VpcContextProvider = class {
 	logger = getLogger().child("VpcContextProvider");
 	awsConfig;
@@ -1017,8 +1003,7 @@ var VpcContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/cc-api-provider.ts
+// src/synthesis/context-providers/cc-api-provider.ts
 function parseResourceModel(body, typeName) {
 	try {
 		return JSON.parse(body);
@@ -1134,8 +1119,7 @@ var CcApiContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/ami-provider.ts
+// src/synthesis/context-providers/ami-provider.ts
 var AmiContextProvider = class {
 	logger = getLogger().child("AmiContextProvider");
 	awsConfig;
@@ -1170,8 +1154,7 @@ var AmiContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/security-group-provider.ts
+// src/synthesis/context-providers/security-group-provider.ts
 var SecurityGroupContextProvider = class {
 	logger = getLogger().child("SecurityGroupContextProvider");
 	awsConfig;
@@ -1219,8 +1202,7 @@ var SecurityGroupContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/load-balancer-provider.ts
+// src/synthesis/context-providers/load-balancer-provider.ts
 var LoadBalancerContextProvider = class {
 	logger = getLogger().child("LoadBalancerContextProvider");
 	awsConfig;
@@ -1293,8 +1275,7 @@ var LoadBalancerListenerContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/key-provider.ts
+// src/synthesis/context-providers/key-provider.ts
 var KeyContextProvider = class {
 	logger = getLogger().child("KeyContextProvider");
 	awsConfig;
@@ -1330,8 +1311,7 @@ var KeyContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/index.ts
+// src/synthesis/context-providers/index.ts
 const PROVIDER_ERROR_KEY = "$providerError";
 const TRANSIENT_CONTEXT_KEY = "$dontSaveContext";
 var ContextProviderRegistry = class {
@@ -1384,8 +1364,7 @@ var ContextProviderRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/macro-detector.ts
+// src/synthesis/macro-detector.ts
 function containsMacro(template) {
 	if (!template || typeof template !== "object" || Array.isArray(template)) return false;
 	const t = template;
@@ -1474,8 +1453,7 @@ function collectFnTransformNames(value, seen, out) {
 	}
 }
 
-//#endregion
-//#region src/utils/aws-partition.ts
+// src/utils/aws-partition.ts
 const PARTITION_TABLE = [
 	{
 		prefix: "cn-",
@@ -1531,8 +1509,7 @@ function derivePartitionAndUrlSuffix(region) {
 	};
 }
 
-//#endregion
-//#region src/utils/expected-bucket-owner.ts
+// src/utils/expected-bucket-owner.ts
 var expected_bucket_owner_exports = /* @__PURE__ */ __exportAll({
 	expectedOwnerParam: () => expectedOwnerParam,
 	recordResolvedAccountId: () => recordResolvedAccountId,
@@ -1614,8 +1591,7 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
-//#endregion
-//#region src/utils/s3-listing-keys.ts
+// src/utils/s3-listing-keys.ts
 function decodeListingKey(value) {
 	if (value === void 0) return void 0;
 	try {
@@ -1625,8 +1601,7 @@ function decodeListingKey(value) {
 	}
 }
 
-//#endregion
-//#region src/state/s3-replication-purge-gap.ts
+// src/state/s3-replication-purge-gap.ts
 const DEFAULT_PURGED_OBJECT_DESCRIPTION = "the body of an object cdkd has just reported as removed";
 const replicationProbeCache = /* @__PURE__ */ new Map();
 const warnedWarnings = /* @__PURE__ */ new Set();
@@ -1758,8 +1733,7 @@ async function warnIfPurgeIsReplicated(s3Client, bucket, keys, options = {}) {
 	} catch {}
 }
 
-//#endregion
-//#region src/state/s3-noncurrent-version-purge.ts
+// src/state/s3-noncurrent-version-purge.ts
 const CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION = "a custom-resource response object, which is the handler's full cfn-response body including `Data`";
 const DELETE_BATCH_SIZE = 1e3;
 const MAX_NAMED_FAILURES = 5;
@@ -1933,8 +1907,7 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, scope, requestFields,
 	} while (keyMarker !== void 0);
 }
 
-//#endregion
-//#region src/cli/upload-cfn-template.ts
+// src/cli/upload-cfn-template.ts
 const CFN_TEMPLATE_BODY_LIMIT = 51200;
 const CFN_TEMPLATE_URL_LIMIT = 1048576;
 const MIGRATE_TMP_PREFIX = "cdkd-migrate-tmp";
@@ -2020,8 +1993,7 @@ function findLargeInlineResources(template, threshold = LARGE_INLINE_RESOURCE_TH
 	return result;
 }
 
-//#endregion
-//#region src/utils/parameter-types.ts
+// src/utils/parameter-types.ts
 function isListParameterType(type) {
 	if (type === "CommaDelimitedList") return true;
 	return type.length > 6 && type.startsWith("List<") && type.endsWith(">");
@@ -2033,8 +2005,7 @@ function ssmResolvedValueType(type) {
 	return inner.length > 0 ? inner : void 0;
 }
 
-//#endregion
-//#region src/synthesis/macro-expander.ts
+// src/synthesis/macro-expander.ts
 function displaySafeTransforms(names) {
 	return names.map((name) => displaySafe(name)).join(", ");
 }
@@ -2259,8 +2230,7 @@ function formatErr(err) {
 	return displayAwsMessage(describeAwsFailure(err).detail);
 }
 
-//#endregion
-//#region src/cli/config-loader.ts
+// src/cli/config-loader.ts
 function loadJsonConfig(filePath) {
 	const logger = getLogger();
 	if (!existsSync(filePath)) return null;
@@ -2360,7 +2330,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-Bu9EMILF.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-CGZAQ1gS.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -2471,8 +2441,7 @@ async function probeBucket(client, bucketName, deps) {
 	}
 }
 
-//#endregion
-//#region src/synthesis/synthesizer.ts
+// src/synthesis/synthesizer.ts
 function isPreSynthesizedAssembly(app) {
 	const appPath = resolve(app);
 	return existsSync(appPath) && statSync(appPath).isDirectory();
@@ -2634,8 +2603,7 @@ function setsEqual(a, b) {
 	return true;
 }
 
-//#endregion
-//#region src/assets/absolute-asset-path-warning.ts
+// src/assets/absolute-asset-path-warning.ts
 function warnWholeAssemblyAsSource(w) {
 	getLogger().child("assets").warn(`${w.subject} has ${w.field} naming the output directory ITSELF: ${displayAssemblyPath(w.outdir)}. cdkd will ${w.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`);
 }
@@ -2643,8 +2611,7 @@ function warnAbsoluteAssetPath(w) {
 	getLogger().child("assets").warn(`${w.subject} has an absolute ${w.field} pointing outside the assembly: ${displayAssemblyPath(w.absolute)}` + (w.escape.escape === "symlink" ? ` (through a symbolic link to ${displayAssemblyPath(w.escape.realPath)})` : "") + `. cdkd will ${w.sink}. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted: an absolute source path is honoured as written, so nothing but this line stands between it and that step.`);
 }
 
-//#endregion
-//#region src/assets/asset-manifest-loader.ts
+// src/assets/asset-manifest-loader.ts
 function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 	const { assetOutdir, sink } = opts;
 	if (isAbsolute$1(asset.source.path)) {
@@ -2758,8 +2725,7 @@ function extractHashFromImageUri(imageUri) {
 	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
 }
 
-//#endregion
-//#region src/assets/file-asset-publisher.ts
+// src/assets/file-asset-publisher.ts
 var FileAssetPublisher = class {
 	logger = getLogger().child("FileAssetPublisher");
 	async publish(assetHash, asset, cdkOutputDir, accountId, region, assetOutdir) {
@@ -2838,8 +2804,7 @@ var FileAssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/docker-cmd.ts
+// src/utils/docker-cmd.ts
 function getDockerCmd() {
 	const override = process.env["CDK_DOCKER"];
 	return override && override.length > 0 ? override : "docker";
@@ -3477,16 +3442,14 @@ function describeDockerCapturedOutput(error, args, fallback) {
 	return redactDockerArgvInText(capturedStreamText(error, "stderr") || capturedStreamText(error, "stdout") || fallback, args);
 }
 
-//#endregion
-//#region src/assets/docker-cache-option.ts
+// src/assets/docker-cache-option.ts
 function cacheOptionToFlag(option) {
 	let flag = `type=${option.type}`;
 	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
 	return flag;
 }
 
-//#endregion
-//#region src/assets/manifest-passthrough-warnings.ts
+// src/assets/manifest-passthrough-warnings.ts
 function candidateHostPaths(value, opts) {
 	const out = [];
 	for (const part of value.split(",")) {
@@ -3599,8 +3562,7 @@ function warnUnrecognizedAssetDestination(opts) {
 	getLogger().child("assets").warn(`Asset destination ${opts.kind} ${displayIdent(opts.name)} is not a CDK-bootstrap or cdkd-managed name, so cdkd uploads there exactly as this asset manifest wrote it, with your credentials. That is what a custom bootstrap looks like and is expected for one; if you did not configure it, the manifest chose where your assets go.`);
 }
 
-//#endregion
-//#region src/assets/docker-build.ts
+// src/assets/docker-build.ts
 function resolveDockerContextDirectory(opts) {
 	const { manifestDir, directory, wrapError, assetOutdir, sink, assetId } = opts;
 	if (isAbsolute$1(directory)) {
@@ -3722,8 +3684,7 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 	return args;
 }
 
-//#endregion
-//#region src/assets/docker-asset-publisher.ts
+// src/assets/docker-asset-publisher.ts
 function ecrUrlSuffix(region) {
 	return derivePartitionAndUrlSuffix(region).urlSuffix;
 }
@@ -3881,8 +3842,7 @@ var DockerAssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/deny-external-access-policy.ts
+// src/utils/deny-external-access-policy.ts
 function buildDenyExternalAccessPolicy(bucketName, accountId, region) {
 	const { partition } = derivePartitionAndUrlSuffix(region);
 	return {
@@ -3898,8 +3858,7 @@ function buildDenyExternalAccessPolicy(bucketName, accountId, region) {
 	};
 }
 
-//#endregion
-//#region src/assets/asset-storage.ts
+// src/assets/asset-storage.ts
 const ASSET_SUPPORT_VERSION = 1;
 const BOOTSTRAP_MARKER_PREFIX = "cdkd-bootstrap/";
 function getCdkdAssetBucketName(accountId, region) {
@@ -4325,8 +4284,7 @@ var AssetModeResolver = class {
 	}
 };
 
-//#endregion
-//#region src/assets/asset-redirect.ts
+// src/assets/asset-redirect.ts
 function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
 	return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
 }
@@ -4596,8 +4554,7 @@ function createAssetRedirectResolver(opts) {
 	};
 }
 
-//#endregion
-//#region src/deployment/work-graph.ts
+// src/deployment/work-graph.ts
 var WorkGraph = class {
 	nodes = /* @__PURE__ */ new Map();
 	logger = getLogger().child("WorkGraph");
@@ -4688,8 +4645,7 @@ var WorkGraph = class {
 	}
 };
 
-//#endregion
-//#region src/utils/stringify.ts
+// src/utils/stringify.ts
 const SENSITIVE_ATTRIBUTE_NAME = /secret|password|credential/i;
 const NON_SENSITIVE_SUFFIX = /(arn|id|name|url|alias|status)$/i;
 function isSensitiveAttributeName(attributeName) {
@@ -4718,8 +4674,7 @@ function stringifyValue(value) {
 	}
 }
 
-//#endregion
-//#region src/assets/asset-publisher.ts
+// src/assets/asset-publisher.ts
 var AssetPublisher = class {
 	logger = getLogger().child("AssetPublisher");
 	filePublisher = new FileAssetPublisher();
@@ -4865,8 +4820,7 @@ var AssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/phase-timings.ts
+// src/utils/phase-timings.ts
 const now = () => globalThis.performance.now();
 const PHASE_TIMINGS_ENV = "CDKD_PHASE_TIMINGS";
 function phaseTimingsEnabled() {
@@ -4971,8 +4925,7 @@ function renderPhaseTimings() {
 	return lines;
 }
 
-//#endregion
-//#region src/types/state.ts
+// src/types/state.ts
 const STATE_SCHEMA_VERSIONS_READABLE = [
 	1,
 	2,
@@ -5059,8 +5012,7 @@ function orphansAfterRollback(previous, newlyOrphaned) {
 	return { orphans: [...byLogicalId.values()] };
 }
 
-//#endregion
-//#region src/types/rollback-journal.ts
+// src/types/rollback-journal.ts
 const ROLLBACK_JOURNAL_VERSION = 1;
 function splitImportedOps(ops, segment, except = /* @__PURE__ */ new Set()) {
 	const marks = segment.importedResources ?? [];
@@ -5242,8 +5194,7 @@ function parseRollbackJournal(bodyString, stackName) {
 	};
 }
 
-//#endregion
-//#region src/state/create-token-ledger.ts
+// src/state/create-token-ledger.ts
 const CREATE_TOKEN_LEDGER_VERSION = 1;
 function emptyCreateTokenLedger(nonce) {
 	return {
@@ -5294,8 +5245,7 @@ async function notifyStateSaved(stackName, region) {
 	await stateSavedObserver.getStore()?.(stackName, region);
 }
 
-//#endregion
-//#region src/state/stack-instance-id.ts
+// src/state/stack-instance-id.ts
 const STACK_INSTANCE_SIBLING_VERSION = 1;
 const STACK_INSTANCE_SIBLING_FILE = "stack-instance.json";
 const STACK_INSTANCE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
@@ -5341,8 +5291,7 @@ function withStackInstanceIdWithheld(state) {
 	};
 }
 
-//#endregion
-//#region src/state/cross-prefix-stack-scan.ts
+// src/state/cross-prefix-stack-scan.ts
 function journalCanOwnResources(journal) {
 	return recordCanOwnResources({ resources: {} }, journal);
 }
@@ -5704,8 +5653,7 @@ function applyCrossPrefixScan(result, s, action, warn, info) {
 	}
 }
 
-//#endregion
-//#region src/state/earlier-state-versions.ts
+// src/state/earlier-state-versions.ts
 async function readEarlierStateResources(s3, bucket, owner, key, max) {
 	const versions = ((await s3.send(new ListObjectVersionsCommand({
 		Bucket: bucket,
@@ -5775,8 +5723,7 @@ async function listVersionedSubdirectories(s3, bucket, owner, prefix) {
 	}
 }
 
-//#endregion
-//#region src/state/retained-time.ts
+// src/state/retained-time.ts
 var RetainedTimeUnconfirmedError = class extends Error {
 	cause;
 	constructor(cause) {
@@ -5786,8 +5733,7 @@ var RetainedTimeUnconfirmedError = class extends Error {
 	}
 };
 
-//#endregion
-//#region src/utils/bucket-region-client.ts
+// src/utils/bucket-region-client.ts
 async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	const config = client.config;
 	if (!config || typeof config.region !== "function") {
@@ -5825,8 +5771,7 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	return replacement;
 }
 
-//#endregion
-//#region src/state/token-free-state.ts
+// src/state/token-free-state.ts
 const tokenFreeStates = /* @__PURE__ */ new WeakSet();
 function bodyMayCarryReferences(body) {
 	return body.includes("{{resolve:") || body.includes("\"referenceProvenance\"") || body.includes("\"outputReferenceProvenance\"");
@@ -5838,8 +5783,7 @@ function isKnownTokenFreeState(state) {
 	return state !== void 0 && tokenFreeStates.has(state);
 }
 
-//#endregion
-//#region src/state/s3-state-backend.ts
+// src/state/s3-state-backend.ts
 function errorDetail$2(error) {
 	return displaySafe(error instanceof Error ? error.message : error, { asciiOnly: true }) || "<unrenderable>";
 }
@@ -7240,8 +7184,7 @@ function addSupersededIds(segment, ids) {
 	if (merged.size > 0) segment.supersededLogicalIds = [...merged];
 }
 
-//#endregion
-//#region src/state/lock-manager.ts
+// src/state/lock-manager.ts
 const MAX_RENEWAL_INTERVAL_MS = 12e4;
 const RENEWAL_TTL_FRACTION = 4;
 const MIN_RENEWAL_INTERVAL_MS = 1e3;
@@ -7755,8 +7698,7 @@ function nanIfUncoercible(value) {
 	}
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/rules.ts
+// src/deployment/secret-redaction/rules.ts
 const MIN_NEEDLE_LENGTH = 4;
 function printingNeedles(values) {
 	const out = /* @__PURE__ */ new Set();
@@ -7851,8 +7793,7 @@ function isPlainObject$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/mask-only.ts
+// src/deployment/secret-redaction/mask-only.ts
 const recordedSecretExpressions = /* @__PURE__ */ new Set();
 const secretVerdictScopes = /* @__PURE__ */ new Map();
 function pinScopedSecretVerdict(scope, expression, secret) {
@@ -8076,8 +8017,7 @@ function isSecretExpressionByVerdictOrSpelling(expression) {
 	return expression.startsWith("{{resolve:secretsmanager:") || expression.startsWith("{{resolve:ssm-secure:") || isRecordedSecretExpression(expression);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/cross-stack.ts
+// src/deployment/secret-redaction/cross-stack.ts
 const crossStackAssociations = /* @__PURE__ */ new WeakMap();
 const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
 const CROSS_STACK_KEY_SEPARATOR = "\0";
@@ -8195,8 +8135,7 @@ function storeAssociation(associations, key, expression, plaintext) {
 	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/certified-positions.ts
+// src/deployment/secret-redaction/certified-positions.ts
 function plaintextIndexOf(secrets) {
 	const plaintextOf = /* @__PURE__ */ new Map();
 	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING_PLAINTEXT : plaintext);
@@ -8233,8 +8172,7 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/resolver-outcomes.ts
+// src/deployment/secret-redaction/resolver-outcomes.ts
 const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
 const takenBranches = /* @__PURE__ */ new WeakMap();
 function recordTakenIfBranch(secrets, source, tookTrueBranch) {
@@ -8267,8 +8205,7 @@ function droppedArrayElementsOf(secrets, source) {
 	return dropped === CONFLICTING ? void 0 : dropped;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/physical-name-copies.ts
+// src/deployment/secret-redaction/physical-name-copies.ts
 const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
 function recordPhysicalNameCopy(secrets, physicalId) {
 	if (physicalId === "") return;
@@ -8289,8 +8226,7 @@ function physicalNameSpans(names, value) {
 	return spans;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/fresh-noecho.ts
+// src/deployment/secret-redaction/fresh-noecho.ts
 function embedsFreshNoEchoValue(text, secrets, freshClass) {
 	const fresh = freshNoEchoValuesOf.get(secrets);
 	if (fresh === void 0) return false;
@@ -8434,8 +8370,7 @@ function recoverMaskedOutput(identity, stackName, region, outputKey) {
 	return recoverableMaskedOutputs.get(maskedOutputKey(identity, stackName, region, outputKey));
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/nested-stack.ts
+// src/deployment/secret-redaction/nested-stack.ts
 const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
@@ -9056,8 +8991,7 @@ function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
 	return visit(value);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/placeholder-positions.ts
+// src/deployment/secret-redaction/placeholder-positions.ts
 function keyedPart(source) {
 	const key = crossStackSourceKey(source);
 	return key === void 0 ? UNKNOWN_PART : { key };
@@ -9263,8 +9197,7 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/identity-keys.ts
+// src/deployment/secret-redaction/identity-keys.ts
 const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
 function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
@@ -9287,8 +9220,7 @@ function positionListByCrossStackSource(bag, source, secrets) {
 	return certifiedListForLeaf(secrets, association, bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/redact-path.ts
+// src/deployment/secret-redaction/redact-path.ts
 const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 	"Fn::Join",
 	"Fn::Sub",
@@ -9740,8 +9672,7 @@ function deepEqualJsonValue(a, b) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/readback-certification.ts
+// src/deployment/secret-redaction/readback-certification.ts
 function renderedDefinitionLiterals(source) {
 	const keep = /* @__PURE__ */ new Set();
 	const scalarKeep = /* @__PURE__ */ new Set();
@@ -9912,8 +9843,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 	return refuseAgainstSource(bag, source, failClosed, mark);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/anchors.ts
+// src/deployment/secret-redaction/anchors.ts
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
@@ -10063,8 +9993,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/redact-state.ts
+// src/deployment/secret-redaction/redact-state.ts
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
 	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
 }
@@ -10418,8 +10347,7 @@ function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
 	return stored;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/mask-errors.ts
+// src/deployment/secret-redaction/mask-errors.ts
 function maskSecretsInText(text, secrets) {
 	const logOnly = logOnlyValuesOf.get(secrets);
 	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
@@ -10620,8 +10548,7 @@ function createSecretMasker(secrets) {
 	return (text) => maskSecretsInText(text, secrets);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/log-only.ts
+// src/deployment/secret-redaction/log-only.ts
 const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
 function recordLogOnlyValue(secrets, plaintext) {
 	if (plaintext === "") return;
@@ -10810,8 +10737,7 @@ function hasMaskableValues(secrets) {
 	return logOnly !== void 0 && logOnly.size > 0;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/reference-provenance.ts
+// src/deployment/secret-redaction/reference-provenance.ts
 const passProvenanceOf = /* @__PURE__ */ new WeakMap();
 const MAX_REFERENCE_VERSIONS = 8;
 function provenanceTableFor(secrets) {
@@ -10911,8 +10837,7 @@ function snapshotPassProvenance(secrets) {
 	return out;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/recording.ts
+// src/deployment/secret-redaction/recording.ts
 const scopeMaps = /* @__PURE__ */ new WeakSet();
 var WriteThroughSecrets = class extends Map {
 	pass;
@@ -10974,8 +10899,7 @@ function recordSecretResolution(secrets, expression, plaintext, options) {
 	if (options.pairEvidence) recordResolvedPair(secrets, expression, plaintext);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/context.ts
+// src/deployment/secret-redaction/context.ts
 const RULES_BY_PROVENANCE = {
 	"template-derived": TEMPLATE_DERIVED_RULES,
 	"template-sourced": TEMPLATE_SOURCED_RULES,
@@ -11010,8 +10934,7 @@ function shallowCopy(bag) {
 	return Array.isArray(bag) ? [...bag] : { ...bag };
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/positions.ts
+// src/deployment/secret-redaction/positions.ts
 const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
 const MAX_SKELETON_WILDCARDS = 3;
 const MAX_SKELETON_CANDIDATE_LENGTH = 512;
@@ -11303,8 +11226,7 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	}, bagIsSameGeneration);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/pairs.ts
+// src/deployment/secret-redaction/pairs.ts
 const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
 const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
 function pairsFor(secrets) {
@@ -11435,8 +11357,7 @@ function carryRedactionMarks(from, to) {
 	return to;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/unresolved-token-frame.ts
+// src/deployment/secret-redaction/unresolved-token-frame.ts
 function liveMatchesUnresolvedTokenFrame(send, live, unresolvedTokens, secrets) {
 	const wildcards = dynamicReferenceSpans(send).filter((span) => unresolvedTokens.has(send.slice(span.start, span.end)));
 	if (wildcards.length === 0) return false;
@@ -11473,8 +11394,7 @@ function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/noecho-leaves.ts
+// src/deployment/secret-redaction/noecho-leaves.ts
 const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
 function intrinsicKeyOf(node) {
 	const keys = Object.keys(node);
@@ -12004,8 +11924,7 @@ function passedNoEchoParametersOf(bag) {
 	return bag === void 0 ? void 0 : passedNoEchoParameters.get(bag);
 }
 
-//#endregion
-//#region src/analyzer/template-parser.ts
+// src/analyzer/template-parser.ts
 var TemplateParser = class {
 	logger = getLogger().child("TemplateParser");
 	getResourceIds(template) {
@@ -12179,8 +12098,7 @@ var TemplateParser = class {
 	}
 };
 
-//#endregion
-//#region src/analyzer/lambda-vpc-deps.ts
+// src/analyzer/lambda-vpc-deps.ts
 function extractLambdaVpcDeleteDeps(resources) {
 	const edges = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -12227,8 +12145,7 @@ function collectRefIds(value, out) {
 	}
 }
 
-//#endregion
-//#region src/analyzer/cdk-defensive-deps.ts
+// src/analyzer/cdk-defensive-deps.ts
 const DEFENSIVE_DEPENDS_ON_TYPE_PAIRS = [
 	{
 		fromType: "AWS::IAM::Role",
@@ -12287,8 +12204,7 @@ function defensiveDependsOnToSkip(resource, template) {
 	return skip;
 }
 
-//#endregion
-//#region src/analyzer/dag-builder.ts
+// src/analyzer/dag-builder.ts
 const { Graph, alg } = graphlib;
 const IAM_ROLE_POLICY_TYPES = /* @__PURE__ */ new Set([
 	"AWS::IAM::Policy",
@@ -12531,8 +12447,7 @@ var DagBuilder = class {
 	}
 };
 
-//#endregion
-//#region src/utils/lambda-function-name.ts
+// src/utils/lambda-function-name.ts
 function parseLambdaFunctionAddress(value) {
 	const full = /^arn:([^:]+):lambda:([^:]+):(\d{12}):function:([^:]+)$/.exec(value);
 	if (full) return {
@@ -12562,8 +12477,7 @@ function lambdaFunctionNameForMask(value) {
 	return /^(?:arn:[^:]+:lambda:[^:]+:\d{12}:function:|\d{12}:function:)?([A-Za-z0-9_-]+)(?::[^:]+)?$/.exec(value)?.[1] ?? canonicalLambdaFunctionName(value);
 }
 
-//#endregion
-//#region src/analyzer/replacement-rules.ts
+// src/analyzer/replacement-rules.ts
 function vpcInstanceTenancyChangeReplaces(oldValue, newValue) {
 	const tenancyOf = (v) => v == null ? "default" : String(v);
 	return tenancyOf(newValue) !== "default" && tenancyOf(newValue) !== tenancyOf(oldValue);
@@ -13156,8 +13070,7 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/retry.ts
+// src/deployment/retry.ts
 const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
 const IAM_PROPAGATION_MAX_DELAY_MS = 2e3;
 const IAM_PROPAGATION_MAX_RETRIES = 26;
@@ -13253,8 +13166,7 @@ function retryErrorClass(error) {
 	return parts.length > 0 ? `${name} (${parts.join(", ")})` : name;
 }
 
-//#endregion
-//#region src/utils/concurrency-limiter.ts
+// src/utils/concurrency-limiter.ts
 var BackgroundTaskCancelledError = class extends Error {
 	constructor() {
 		super("Background task cancelled");
@@ -13378,8 +13290,7 @@ function createConcurrencyLimiter(limit) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/describe-type.ts
+// src/provisioning/describe-type.ts
 const describeTypeRetryDelays = {};
 const MAX_THROTTLE_RETRIES = 4;
 const DESCRIBE_TYPE_MAX_IN_FLIGHT = 20;
@@ -13436,8 +13347,7 @@ function hasNoRegistrySchema(resourceType) {
 	return resourceType === "AWS::CDK::Metadata" || resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
 }
 
-//#endregion
-//#region src/provisioning/create-only-paths.ts
+// src/provisioning/create-only-paths.ts
 function parseCreateOnlyPropertyPointers(createOnly) {
 	const result = [];
 	if (!Array.isArray(createOnly)) return result;
@@ -13453,8 +13363,7 @@ function unescapeJsonPointerSegment$2(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
-//#endregion
-//#region src/provisioning/create-only-snapshot.generated.ts
+// src/provisioning/create-only-snapshot.generated.ts
 const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Account", []],
 	["AWS::ApiGateway::Authorizer", [["RestApiId"]]],
@@ -14047,8 +13956,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::WAFv2::WebACL", [["Name"], ["Scope"]]]
 ]);
 
-//#endregion
-//#region src/provisioning/create-only-properties.ts
+// src/provisioning/create-only-properties.ts
 const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 const inFlightLookups = /* @__PURE__ */ new Map();
 function getCreateOnlyPropertyPaths(resourceType) {
@@ -14168,8 +14076,7 @@ function parseCreateOnlyResponse(resourceType, schema) {
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/write-only-properties.ts
+// src/provisioning/write-only-properties.ts
 const writeOnlyPropertiesCache = /* @__PURE__ */ new Map();
 const settledWriteOnlyProperties = /* @__PURE__ */ new Map();
 const settledUnreadableCreateOnlyPaths = /* @__PURE__ */ new Map();
@@ -14248,8 +14155,7 @@ function parseRegistrySchema(resourceType, schema) {
 	return parseJsonNamingNoBody(schema, "the DescribeType schema", (line) => getLogger().child("WriteOnlyProperties").debug(safeMsg`${resourceType}: ${line}`));
 }
 
-//#endregion
-//#region src/deployment/replacement-name-holder/name-keys.ts
+// src/deployment/replacement-name-holder/name-keys.ts
 const flat = (property) => ({ name: [[property]] });
 function ownEntry$1(table, key) {
 	return Object.hasOwn(table, key) ? table[key] : void 0;
@@ -14446,8 +14352,7 @@ const SENT_NAME_REWRITTEN = {
 	}
 };
 
-//#endregion
-//#region src/deployment/replacement-name-holder/holder-probe.ts
+// src/deployment/replacement-name-holder/holder-probe.ts
 const SHARED_NAME_SPACES = [
 	/* @__PURE__ */ new Set(["AWS::DynamoDB::Table", "AWS::DynamoDB::GlobalTable"]),
 	/* @__PURE__ */ new Set([
@@ -14585,8 +14490,7 @@ const DERIVED_GENERATED_NAMES = {
 	"AWS::SSM::Parameter": derivedEntry("AWS::SSM::Parameter", "ssm-parameter-provider.ts")
 };
 
-//#endregion
-//#region src/deployment/replacement-name-holder/rewritten.ts
+// src/deployment/replacement-name-holder/rewritten.ts
 function replayPrefixChoice(input) {
 	const rewrite = ownEntry$1(SENT_NAME_REWRITTEN, input.resourceType);
 	if (rewrite === void 0 || input.via === "cc-api") return { kind: "not-applicable" };
@@ -14739,8 +14643,7 @@ function reverseReplacementTrustsGeneratedName(resourceType) {
 	return GENERATED_NAME_VERBATIM.has(resourceType);
 }
 
-//#endregion
-//#region src/deployment/replacement-name-holder/holder.ts
+// src/deployment/replacement-name-holder/holder.ts
 function recordSetHolds(requested, recorded, observed, newPhysicalId, r, v) {
 	const newRecord = `${v.holderRecord} (${r.shown(newPhysicalId)})`;
 	const wantName = valueAt(requested, ["Name"]);
@@ -14879,8 +14782,7 @@ function isPlainName(value) {
 	return !/\s/.test(value) && displayIdent(value, { maxCodePoints: 1152 }) === value;
 }
 
-//#endregion
-//#region src/deployment/replacement-name-holder/deploy-name.ts
+// src/deployment/replacement-name-holder/deploy-name.ts
 function nameValue(bag, property) {
 	const value = bag?.[property];
 	if (typeof value !== "string" || value === "" || value === "***") return void 0;
@@ -15028,8 +14930,7 @@ function probeFoundSameId(resourceType, a, b) {
 	return pa !== void 0 && pa === path(b);
 }
 
-//#endregion
-//#region src/provisioning/config-shape.ts
+// src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
 	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) {
@@ -15162,8 +15063,7 @@ function describe(value) {
 	return typeof value === "object" ? "an object" : `a ${typeof value}`;
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-warm-throughput.ts
+// src/provisioning/dynamodb-warm-throughput.ts
 const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
 function toFiniteNumber(value) {
 	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
@@ -15209,8 +15109,7 @@ function isWarmThroughputDecrease(desired, live) {
 	return sawDecrease;
 }
 
-//#endregion
-//#region src/provisioning/stateful-types.ts
+// src/provisioning/stateful-types.ts
 const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBCluster",
@@ -15372,8 +15271,7 @@ function renderStatefulReason(reason) {
 	}
 }
 
-//#endregion
-//#region src/deployment/recreate-target-readers.ts
+// src/deployment/recreate-target-readers.ts
 async function findReplacedReadersOfRecreateTargets(input) {
 	const conditions = input.conditions;
 	const resources = Object.create(null);
@@ -15584,8 +15482,7 @@ function readsOnlyId(value, id) {
 	return !other && ids > 0;
 }
 
-//#endregion
-//#region src/deployment/child-of-recreated-parent.ts
+// src/deployment/child-of-recreated-parent.ts
 const LAMBDA_FUNCTION = "AWS::Lambda::Function";
 const IAM_ROLE = "AWS::IAM::Role";
 const IAM_USER = "AWS::IAM::User";
@@ -15910,8 +15807,7 @@ function withRecreatedAttachmentsDropped(input) {
 	} : void 0;
 }
 
-//#endregion
-//#region src/provisioning/property-coverage.generated.ts
+// src/provisioning/property-coverage.generated.ts
 const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Account", {
 		handled: /* @__PURE__ */ new Set(["CloudWatchRoleArn"]),
@@ -16630,44 +16526,40 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::DocDB::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
+			"AvailabilityZones",
 			"BackupRetentionPeriod",
+			"CopyTagsToSnapshot",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
 			"DBSubnetGroupName",
 			"DeletionProtection",
+			"EnableCloudwatchLogsExports",
 			"EngineVersion",
 			"KmsKeyId",
+			"ManageMasterUserPassword",
 			"MasterUsername",
 			"MasterUserPassword",
+			"MasterUserSecretKmsKeyId",
+			"NetworkType",
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"RotateMasterUserPassword",
+			"ServerlessV2ScalingConfiguration",
 			"StorageEncrypted",
+			"StorageType",
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["AvailabilityZones", "not yet implemented by cdkd"],
-			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
-			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
 			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
-			["ManageMasterUserPassword", "not yet implemented by cdkd"],
-			["MasterUserSecretKmsKeyId", "not yet implemented by cdkd"],
-			["NetworkType", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
-			["RotateMasterUserPassword", "not yet implemented by cdkd"],
-			["ServerlessV2ScalingConfiguration", "not yet implemented by cdkd"],
 			["SnapshotIdentifier", "not yet implemented by cdkd"],
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
-			["StorageType", "not yet implemented by cdkd"],
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
-			"SnapshotIdentifier",
-			"SourceDBClusterIdentifier"
-		]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotIdentifier", "SourceDBClusterIdentifier"]),
 		readOnly: /* @__PURE__ */ new Set([
 			"ClusterResourceId",
 			"Endpoint",
@@ -16681,17 +16573,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set([
 			"AutoMinorVersionUpgrade",
 			"AvailabilityZone",
+			"CACertificateIdentifier",
+			"CertificateRotationRestart",
 			"DBClusterIdentifier",
 			"DBInstanceClass",
 			"DBInstanceIdentifier",
+			"EnablePerformanceInsights",
 			"PreferredMaintenanceWindow",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["CACertificateIdentifier", "not yet implemented by cdkd"],
-			["CertificateRotationRestart", "not yet implemented by cdkd"],
-			["EnablePerformanceInsights", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Endpoint",
@@ -17747,6 +17638,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DeliveryStreamEncryptionConfigurationInput",
 			"DeliveryStreamName",
 			"DeliveryStreamType",
+			"DirectPutSourceConfiguration",
 			"ElasticsearchDestinationConfiguration",
 			"ExtendedS3DestinationConfiguration",
 			"HttpEndpointDestinationConfiguration",
@@ -17758,16 +17650,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["DatabaseSourceConfiguration", "not yet implemented by cdkd"],
-			["DirectPutSourceConfiguration", "not yet implemented by cdkd"],
 			["IcebergDestinationConfiguration", "not yet implemented by cdkd"],
 			["MSKSourceConfiguration", "not yet implemented by cdkd"],
 			["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"DatabaseSourceConfiguration",
-			"DirectPutSourceConfiguration",
-			"MSKSourceConfiguration"
-		]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["DatabaseSourceConfiguration", "MSKSourceConfiguration"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
 	}],
@@ -18044,39 +17931,38 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Neptune::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
+			"AssociatedRoles",
+			"AvailabilityZones",
 			"BackupRetentionPeriod",
+			"CopyTagsToSnapshot",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
+			"DBInstanceParameterGroupName",
 			"DBPort",
 			"DBSubnetGroupName",
 			"DeletionProtection",
+			"EnableCloudwatchLogsExports",
 			"EngineVersion",
 			"IamAuthEnabled",
 			"KmsKeyId",
+			"NetworkType",
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"ServerlessScalingConfiguration",
 			"StorageEncrypted",
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["AssociatedRoles", "not yet implemented by cdkd"],
-			["AvailabilityZones", "not yet implemented by cdkd"],
-			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
-			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
-			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
-			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
-			["NetworkType", "not yet implemented by cdkd"],
+			["GlobalClusterIdentifier", "Cloud Control owns a global-cluster member: NeptuneProvider has no detach, and a member cannot be deleted while attached (deletesThroughSdkProvider keeps its delete there too)"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
-			["ServerlessScalingConfiguration", "not yet implemented by cdkd"],
 			["SnapshotIdentifier", "not yet implemented by cdkd"],
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
 			"GlobalClusterIdentifier",
 			"RestoreToTime",
 			"RestoreType",
@@ -18094,6 +17980,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Neptune::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
+			"AllowMajorVersionUpgrade",
 			"AutoMinorVersionUpgrade",
 			"AvailabilityZone",
 			"DBClusterIdentifier",
@@ -18103,13 +17990,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DBSubnetGroupName",
 			"DeletionProtection",
 			"PreferredMaintenanceWindow",
+			"PubliclyAccessible",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["AllowMajorVersionUpgrade", "not yet implemented by cdkd"],
-			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
-			["PubliclyAccessible", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map([["DBSnapshotIdentifier", "The CloudFormation schema documents it as not supported, and CreateDBInstance has no such member: a Neptune instance is not restored from a snapshot, its cluster is"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["DBSnapshotIdentifier"]),
 		readOnly: /* @__PURE__ */ new Set(["Endpoint", "Port"]),
 		ccRouteUnavailable: false
@@ -18156,8 +18040,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::RDS::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
 			"BackupRetentionPeriod",
+			"CopyTagsToSnapshot",
 			"DatabaseName",
 			"DBClusterIdentifier",
+			"DBClusterParameterGroupName",
 			"DBSubnetGroupName",
 			"DeletionProtection",
 			"EnableIAMDatabaseAuthentication",
@@ -18171,9 +18057,12 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"MonitoringInterval",
 			"MonitoringRoleArn",
 			"Port",
+			"PreferredBackupWindow",
+			"PreferredMaintenanceWindow",
 			"PubliclyAccessible",
 			"ServerlessV2ScalingConfiguration",
 			"StorageEncrypted",
+			"StorageType",
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
@@ -18184,10 +18073,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AvailabilityZones", "not yet implemented by cdkd"],
 			["BacktrackWindow", "not yet implemented by cdkd"],
 			["ClusterScalabilityType", "not yet implemented by cdkd"],
-			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
 			["DatabaseInsightsMode", "not yet implemented by cdkd"],
 			["DBClusterInstanceClass", "not yet implemented by cdkd"],
-			["DBClusterParameterGroupName", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
 			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
@@ -18206,8 +18093,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["PerformanceInsightsEnabled", "not yet implemented by cdkd"],
 			["PerformanceInsightsKmsKeyId", "not yet implemented by cdkd"],
 			["PerformanceInsightsRetentionPeriod", "not yet implemented by cdkd"],
-			["PreferredBackupWindow", "not yet implemented by cdkd"],
-			["PreferredMaintenanceWindow", "not yet implemented by cdkd"],
 			["ReplicationSourceIdentifier", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
@@ -18216,7 +18101,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
 			["SourceDbClusterResourceId", "not yet implemented by cdkd"],
 			["SourceRegion", "not yet implemented by cdkd"],
-			["StorageType", "not yet implemented by cdkd"],
 			["UseLatestRestorableTime", "not yet implemented by cdkd"],
 			["WithExpressConfiguration", "not yet implemented by cdkd"]
 		]),
@@ -18246,14 +18130,18 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::RDS::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
 			"AllocatedStorage",
+			"AllowMajorVersionUpgrade",
 			"AutoMinorVersionUpgrade",
 			"BackupRetentionPeriod",
 			"CACertificateIdentifier",
+			"CertificateRotationRestart",
 			"CopyTagsToSnapshot",
+			"DatabaseInsightsMode",
 			"DBClusterIdentifier",
 			"DBInstanceClass",
 			"DBInstanceIdentifier",
 			"DBSubnetGroupName",
+			"DedicatedLogVolume",
 			"DeletionProtection",
 			"EnableIAMDatabaseAuthentication",
 			"EnablePerformanceInsights",
@@ -18261,6 +18149,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EngineVersion",
 			"Iops",
 			"KmsKeyId",
+			"LicenseModel",
 			"ManageMasterUserPassword",
 			"MasterUsername",
 			"MasterUserPassword",
@@ -18269,12 +18158,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"MonitoringInterval",
 			"MonitoringRoleArn",
 			"MultiAZ",
+			"NetworkType",
 			"OptionGroupName",
 			"PerformanceInsightsKMSKeyId",
 			"PerformanceInsightsRetentionPeriod",
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"PromotionTier",
 			"PubliclyAccessible",
 			"StorageEncrypted",
 			"StorageThroughput",
@@ -18284,7 +18175,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["AdditionalStorageVolumes", "not yet implemented by cdkd"],
-			["AllowMajorVersionUpgrade", "not yet implemented by cdkd"],
 			["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
 			["AssociatedRoles", "not yet implemented by cdkd"],
 			["AutomaticBackupReplicationKmsKeyId", "not yet implemented by cdkd"],
@@ -18292,17 +18182,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AutomaticBackupReplicationRetentionPeriod", "not yet implemented by cdkd"],
 			["AvailabilityZone", "not yet implemented by cdkd"],
 			["BackupTarget", "not yet implemented by cdkd"],
-			["CertificateRotationRestart", "not yet implemented by cdkd"],
 			["CharacterSetName", "not yet implemented by cdkd"],
 			["CustomIAMInstanceProfile", "not yet implemented by cdkd"],
-			["DatabaseInsightsMode", "not yet implemented by cdkd"],
 			["DBClusterSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBName", "not yet implemented by cdkd"],
 			["DBParameterGroupName", "not yet implemented by cdkd"],
 			["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
-			["DedicatedLogVolume", "not yet implemented by cdkd"],
 			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainAuthSecretArn", "not yet implemented by cdkd"],
@@ -18312,12 +18199,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DomainOu", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
 			["EngineLifecycleSupport", "not yet implemented by cdkd"],
-			["LicenseModel", "not yet implemented by cdkd"],
 			["MasterUserAuthenticationType", "not yet implemented by cdkd"],
 			["NcharCharacterSetName", "not yet implemented by cdkd"],
-			["NetworkType", "not yet implemented by cdkd"],
 			["ProcessorFeatures", "not yet implemented by cdkd"],
-			["PromotionTier", "not yet implemented by cdkd"],
 			["ReplicaMode", "not yet implemented by cdkd"],
 			["RestoreTime", "not yet implemented by cdkd"],
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
@@ -18836,8 +18720,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}]
 ]);
 
-//#endregion
-//#region src/provisioning/unsupported-types.generated.ts
+// src/provisioning/unsupported-types.generated.ts
 const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"Alexa::ASK::Skill",
 	"AWS::AmazonMQ::ConfigurationAssociation",
@@ -19170,8 +19053,7 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::WorkSpaces::WorkspaceImage"
 ]);
 
-//#endregion
-//#region src/provisioning/unsupported-types.ts
+// src/provisioning/unsupported-types.ts
 function isNonProvisionable(resourceType) {
 	return NON_PROVISIONABLE_TYPES.has(resourceType);
 }
@@ -19204,8 +19086,7 @@ function unsupportedTypeIssueUrl(resourceType) {
 	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support resource type ${resourceType}`)}&labels=resource-support`;
 }
 
-//#endregion
-//#region src/provisioning/property-coverage.ts
+// src/provisioning/property-coverage.ts
 function getPropertyCoverage(resourceType) {
 	return PROPERTY_COVERAGE_BY_TYPE.get(resourceType);
 }
@@ -19347,8 +19228,7 @@ function findUnrecognizedProperties(resourceType, templateProperties) {
 	return unrecognized.sort((a, b) => a.localeCompare(b));
 }
 
-//#endregion
-//#region src/state/malformed-resources-bag.ts
+// src/state/malformed-resources-bag.ts
 const UNREADABLE_RESOURCES_MAP_ROW = "(resources map)";
 const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
 function hasReadableResources(state) {
@@ -20157,8 +20037,7 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
-//#endregion
-//#region src/deployment/assumed-conditions.ts
+// src/deployment/assumed-conditions.ts
 const assumedConditionNames = /* @__PURE__ */ new WeakMap();
 function recordAssumedConditions(conditions, assumed) {
 	assumedConditionNames.set(conditions, assumed);
@@ -20167,8 +20046,7 @@ function conditionsAssumedFalse(conditions) {
 	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
 }
 
-//#endregion
-//#region src/deployment/noecho-declared.ts
+// src/deployment/noecho-declared.ts
 function isNoEchoDeclared(noEcho) {
 	return noEcho === true || noEcho === "true";
 }
@@ -20176,8 +20054,7 @@ function declaresNoEcho(definition) {
 	return definition !== null && typeof definition === "object" && isNoEchoDeclared(definition.NoEcho);
 }
 
-//#endregion
-//#region src/deployment/masked-property-fingerprints.ts
+// src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
 function canonicalJson$4(value) {
@@ -21090,8 +20967,7 @@ function backfillMaskedPropertyFingerprints(resources, template, noEchoParameter
 	return stamped;
 }
 
-//#endregion
-//#region src/deployment/drain-budget.ts
+// src/deployment/drain-budget.ts
 const drainDeadlines = new AsyncLocalStorage();
 async function withSharedDrainBudget(fn) {
 	if (drainDeadlines.getStore() !== void 0) return await fn();
@@ -21102,8 +20978,7 @@ async function withSharedDrainBudget(fn) {
 	}, fn);
 }
 
-//#endregion
-//#region src/provisioning/providers/wafv2-arn.ts
+// src/provisioning/providers/wafv2-arn.ts
 function parseWebACLArn(arn) {
 	const segments = arn.split(":").slice(5).join(":").split("/");
 	const scopeRaw = segments[0];
@@ -21115,8 +20990,7 @@ function parseWebACLArn(arn) {
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/ref-values.ts
+// src/deployment/intrinsic-resolver/ref-values.ts
 const AWS_NO_VALUE = Symbol("AWS::NoValue");
 const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Model",
@@ -21339,8 +21213,7 @@ function buildUnknownIntrinsicError(key) {
 	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function ${shown}: cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
 
-//#endregion
-//#region src/deployment/stale-attribute-heal.ts
+// src/deployment/stale-attribute-heal.ts
 var StaleAttributeMissSignal = class StaleAttributeMissSignal extends Error {
 	constructor() {
 		super("stale attribute miss (internal control flow — must not escape resolveGetAtt)");
@@ -21385,8 +21258,7 @@ function mergeHealedAttributes(recorded, healed, isStaleValue) {
 	return merged ?? recorded;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/context.ts
+// src/deployment/intrinsic-resolver/context.ts
 function withoutProducerRegions(context) {
 	if (context?.producerRegions === void 0) return context;
 	const { producerRegions: _stripped, ...rest } = context;
@@ -21485,8 +21357,7 @@ const cachedVpcDefaultSecurityGroups = Object.create(null);
 const cachedCloudFrontDomainNames = Object.create(null);
 const cachedSecurityGroupVpcIds = Object.create(null);
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/account-drain.ts
+// src/deployment/intrinsic-resolver/account-drain.ts
 function effectiveAccountInfoRegion(overrideRegion) {
 	return canonicalizeRegion(overrideRegion || process.env["AWS_REGION"]) || "us-east-1";
 }
@@ -21669,8 +21540,7 @@ function embedsAccountId(value, accountId) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/support.ts
+// src/deployment/intrinsic-resolver/support.ts
 function collectReferencedParameterNames(template) {
 	const parser = new TemplateParser();
 	const referenced = /* @__PURE__ */ new Set();
@@ -21756,8 +21626,7 @@ function quotedRender(rendered, quote, described = "(not shown: it is not a plai
 	return QUOTABLE_RENDER.test(rendered) ? `${quote}${rendered}${quote}` : described;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/masking.ts
+// src/deployment/intrinsic-resolver/masking.ts
 function maskSecretsRaw(resolver, text, context) {
 	const registered = registeredLogTwin(resolver, text, context);
 	const needled = maskNeedlesForLog(resolver, text, context);
@@ -21927,8 +21796,7 @@ function rememberLogTwin(resolver, context, result, twin) {
 	twins.set(result, existing === void 0 || existing === twin ? twin : "***");
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/masking-display.ts
+// src/deployment/intrinsic-resolver/masking-display.ts
 function maskValueLeaves(masker, value, context) {
 	const done = /* @__PURE__ */ new Map();
 	const walk = (node) => {
@@ -21972,8 +21840,7 @@ function displayLeaf(resolver, value, context) {
 	return displayMasked(resolver, logTextOfLeaf(resolver, value, context), context);
 }
 
-//#endregion
-//#region src/deployment/secret-region-classification.ts
+// src/deployment/secret-region-classification.ts
 const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
 	"secretsmanager",
 	"ssm",
@@ -22054,8 +21921,7 @@ function classifyRecordedSecretRegion(expression, consumerRegion, importedProduc
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/cfn-fallback.ts
+// src/deployment/intrinsic-resolver/cfn-fallback.ts
 var CfnFallbackCache = class {
 	cfnExportsPromises = /* @__PURE__ */ new Map();
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
@@ -22138,8 +22004,7 @@ function describeAvailableOutputs(masker, keys, context) {
 	return hidden > 0 ? `${rendered} (+${hidden} more)` : rendered;
 }
 
-//#endregion
-//#region src/utils/caller-credentials.ts
+// src/utils/caller-credentials.ts
 const AWS_CREDENTIAL_ENV_KEYS = [
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
@@ -22176,8 +22041,7 @@ function applyCallerIdentityCredentials(env) {
 	else delete env["AWS_SESSION_TOKEN"];
 }
 
-//#endregion
-//#region src/utils/role-arn.ts
+// src/utils/role-arn.ts
 const crossAccountCredentialsCache = /* @__PURE__ */ new Map();
 const CRED_EXPIRY_SAFETY_MS = 6e4;
 const IAM_ROLE_ARN_RE = /^arn:(aws[a-z0-9-]*):iam::(\d{12}):role\/[\w+=,.@-]+(?:\/[\w+=,.@-]+)*$/;
@@ -22310,8 +22174,7 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/stack-state.ts
+// src/deployment/intrinsic-resolver/stack-state.ts
 async function getSameAccountStackState(stackName, region, context) {
 	if (!context.stateBackend) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: state backend is required for cross-stack references"));
 	return context.stateBackend.getState(stackName, region);
@@ -22350,8 +22213,7 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 	}).getState(stackName, region);
 }
 
-//#endregion
-//#region src/deployment/reference-provenance-record.ts
+// src/deployment/reference-provenance-record.ts
 const SSM_VERSION = /^[0-9]{1,10}$/;
 const SECRETS_MANAGER_VERSION = /^[A-Za-z0-9_+=.@/-]{32,64}$/;
 function referenceTokensIn(value, into = /* @__PURE__ */ new Set()) {
@@ -22550,8 +22412,7 @@ function withReferenceProvenance(record, field) {
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/recorded-reference-routes.ts
+// src/deployment/intrinsic-resolver/recorded-reference-routes.ts
 function tokensOf(value) {
 	const out = /* @__PURE__ */ new Set();
 	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) out.add(token);
@@ -22699,8 +22560,7 @@ async function rebuildByToken(value, resolveToken) {
 	return value;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/cross-stack.ts
+// src/deployment/intrinsic-resolver/cross-stack.ts
 async function reresolveCrossStackValue(resolver, value, producerRegion, context, origin, sourceKey, producerOutput, producerRegionLogText) {
 	if (context.crossStackReads !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && sourceKey !== void 0) context.crossStackReads.set(sourceKey, {
 		stackName: producerOutput.stackName,
@@ -22938,8 +22798,7 @@ function physicalIdsOf(state) {
 	return ids;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
+// src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
 function producerLookupOver(stacks) {
 	return (stackName, account, region) => stacks.find((s) => s.stackName === stackName && s.account === account && sameRegion(s.region, region));
 }
@@ -23109,8 +22968,7 @@ function refuseUnreadableCdkCrossAccountRefs(refs, deployed, consumerOf, lookup)
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/stack-output.ts
+// src/deployment/intrinsic-resolver/stack-output.ts
 async function resolveGetStackOutput(resolver, arg, context) {
 	if (!arg || typeof arg !== "object" || Array.isArray(arg)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: argument must be an object with StackName/OutputName/Region/RoleArn, got ${arg === null ? "null" : Array.isArray(arg) ? "array" : typeof arg}`));
 	const args = arg;
@@ -23297,8 +23155,7 @@ function namedRequestMasks(resolver, pairs, context) {
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
+// src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
 async function resolveSecretsManagerReference(resolver, inner, context, nameLogText, versionOut, pinVersion) {
 	const afterService = inner.substring(15);
 	let secretId;
@@ -23407,8 +23264,7 @@ function withoutSsmSelector(parameterName) {
 	return selector < 0 ? parameterName : parameterName.slice(0, selector);
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/dynamic-refs.ts
+// src/deployment/intrinsic-resolver/dynamic-refs.ts
 var DynamicReferenceCache = class {
 	cachedDynamicReferences = /* @__PURE__ */ new Map();
 	warnedUnrecognizedSsmTypes = /* @__PURE__ */ new Set();
@@ -23608,8 +23464,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 	};
 }
 
-//#endregion
-//#region src/utils/s3-endpoints.ts
+// src/utils/s3-endpoints.ts
 const S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS = /* @__PURE__ */ new Set([
 	"ap-northeast-1",
 	"ap-southeast-1",
@@ -23641,8 +23496,7 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-heal.ts
+// src/deployment/intrinsic-resolver/getatt-heal.ts
 function staleRecordRemedy(resolver, outcome, context) {
 	const touch = "change any property of the resource so its next update re-records the attributes, or re-import it with 'cdkd import'";
 	if (outcome === void 0) return `Run 'cdkd deploy': it re-reads a stale record's attributes from AWS and heals the record. Otherwise ${touch}.`;
@@ -23773,8 +23627,7 @@ function healMaskedOwnIdAttribute(resolver, logicalId, resource, attributeName,
 	})();
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-refusals.ts
+// src/deployment/intrinsic-resolver/getatt-refusals.ts
 function refuseUnservedAttribute(resolver, site) {
 	const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
 	throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${displayMasked(resolver, logicalId, context)}, ${displayMasked(resolver, attributeName, context)}] for ${displayMasked(resolver, resourceType, context)}: ${observed}. The physical id ${quotedRender(displayMasked(resolver, physicalId, context), "\"")} is not a usable ${displayMasked(resolver, attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
@@ -23819,8 +23672,7 @@ function guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceT
 	return physicalId;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-construct-core.ts
+// src/deployment/intrinsic-resolver/getatt-construct-core.ts
 const NOT_CONSTRUCTED = Symbol("NOT_CONSTRUCTED");
 async function constructAttributeForCoreTypes(resolver, resource, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
 	if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
@@ -23973,8 +23825,7 @@ async function constructAttributeForCoreTypes(resolver, resource, attributeName,
 	return NOT_CONSTRUCTED;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-construct-app.ts
+// src/deployment/intrinsic-resolver/getatt-construct-app.ts
 async function constructAttributeForAppTypes(resolver, resource, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
 	if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 		case "Arn": {
@@ -24112,14 +23963,12 @@ async function constructAttributeForAppTypes(resolver, resource, attributeName,
 	return NOT_CONSTRUCTED;
 }
 
-//#endregion
-//#region src/provisioning/ec2-instance-state.ts
+// src/provisioning/ec2-instance-state.ts
 function isSettledInstanceState(stateName) {
 	return stateName !== void 0 && stateName !== "pending";
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-construct-compute.ts
+// src/deployment/intrinsic-resolver/getatt-construct-compute.ts
 async function constructAttributeForComputeTypes(resolver, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
 	if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 		case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
@@ -24389,8 +24238,7 @@ const natGatewayAttributeWait = {
 	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 };
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/functions.ts
+// src/deployment/intrinsic-resolver/functions.ts
 async function resolveIf(resolver, ifArgs, context, source) {
 	const [conditionName, valueIfTrue, valueIfFalse] = ifArgs;
 	const resolveBranch = async (branch) => {
@@ -24649,8 +24497,7 @@ function bigIntToIPv6(_resolver, n) {
 	return parts.join(":");
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
+// src/deployment/intrinsic-resolver/parameter-secrets.ts
 function recordInheritedParameterSecrets(resolver, parameterName, value, context) {
 	const inherited = context.inheritedSecrets;
 	const recorded = context.recordedSecretValues;
@@ -24929,8 +24776,7 @@ function refuseCoercedInheritedSecret(resolver, name, paramDef, userValue, inher
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/refs.ts
+// src/deployment/intrinsic-resolver/refs.ts
 function nameIsNeverAResource(_resolver, logicalId, context) {
 	if (logicalId.startsWith("AWS::")) return true;
 	const declared = context.template?.Parameters;
@@ -25006,8 +24852,7 @@ function noteRefStateMask(resolver, logicalId, key, context) {
 	});
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt.ts
+// src/deployment/intrinsic-resolver/getatt.ts
 function pushRedactedAttributeRead(_resolver, context, read) {
 	const bag = context.redactedAttributeReads;
 	if (bag === void 0) return;
@@ -25294,8 +25139,7 @@ async function constructAttribute(resolver, resource, attributeName, context, lo
 	return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/string-functions.ts
+// src/deployment/intrinsic-resolver/string-functions.ts
 function partParameterSpans(context, part, resolved) {
 	if (context.recordedSecretValues === void 0) return [];
 	if (typeof part !== "object" || part === null) return [];
@@ -25505,8 +25349,7 @@ async function resolveSplit(resolver, splitArgs, context) {
 	return result;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/params-conditions.ts
+// src/deployment/intrinsic-resolver/params-conditions.ts
 async function resolveParameters(resolver, template, userParameters, options) {
 	const inheritedSecrets = options?.inheritedSecrets;
 	if (inheritedSecrets && options?.recordPseudoParameters !== false) await recordInheritedPseudoParameterValues(resolver, inheritedSecrets, template);
@@ -25617,8 +25460,7 @@ async function resolveKeyUnit(resolver, key, val, context, abandoned) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/sub.ts
+// src/deployment/intrinsic-resolver/sub.ts
 function subPlaceholderWarning(_resolver, varName, error) {
 	return `Fn::Sub variable ${varName} could not be resolved (${describeAwsFailure(error).detail}), keeping placeholder`;
 }
@@ -25817,8 +25659,7 @@ async function resolveSub(resolver, subArgs, context, source) {
 	return result;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/clients.ts
+// src/deployment/intrinsic-resolver/clients.ts
 var ResolverClients = class {
 	regionScopedClients = /* @__PURE__ */ new Map();
 	serviceDiscoveryClients = /* @__PURE__ */ new Map();
@@ -25879,8 +25720,7 @@ var ResolverClients = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/intrinsic-function-resolver.ts
+// src/deployment/intrinsic-function-resolver.ts
 var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
@@ -26046,8 +25886,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	}
 };
 
-//#endregion
-//#region src/state/unsettled-properties.ts
+// src/state/unsettled-properties.ts
 function unsettledPropertiesOf(record) {
 	if (record === null || typeof record !== "object") return /* @__PURE__ */ new Set();
 	const value = record.unsettledProperties;
@@ -26142,8 +25981,7 @@ function unsettledContextOf(...records) {
 	};
 }
 
-//#endregion
-//#region src/analyzer/read-provenance-promotion.ts
+// src/analyzer/read-provenance-promotion.ts
 function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -26237,8 +26075,7 @@ async function readProvenancePromotions(args) {
 	return out;
 }
 
-//#endregion
-//#region src/analyzer/diff-calculator.ts
+// src/analyzer/diff-calculator.ts
 const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Ref",
 	"Fn::Sub",
@@ -26891,8 +26728,7 @@ var DiffCalculator = class DiffCalculator {
 	}
 };
 
-//#endregion
-//#region src/provisioning/ec2-termination-protection.ts
+// src/provisioning/ec2-termination-protection.ts
 async function disableInstanceApiTermination(client, instanceId, logger) {
 	try {
 		await client.send(new ModifyInstanceAttributeCommand({
@@ -26960,8 +26796,7 @@ function ec2InstanceProtectionSite(instanceId, region) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/wait-abandoned.ts
+// src/provisioning/wait-abandoned.ts
 const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
 const ABANDONED_REQUEST = Symbol.for("cdkd.waitAbandoned.request");
 const MAX_CAUSE_CHAIN_DEPTH = 5;
@@ -26998,8 +26833,7 @@ function abandonedRequestOf(error) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/ec2-volume-delete.ts
+// src/provisioning/ec2-volume-delete.ts
 async function deleteEc2VolumeDirect(client, volumeId, logicalId, opts) {
 	const now = opts.now ?? Date.now;
 	try {
@@ -27065,8 +26899,7 @@ function errorName(error) {
 	return typeof name === "string" ? name : "";
 }
 
-//#endregion
-//#region src/deployment/delete-outcome.ts
+// src/deployment/delete-outcome.ts
 function deleteSkipReason(result) {
 	if (!result || result.outcome !== "skipped") return void 0;
 	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
@@ -27121,8 +26954,7 @@ function deleteIndeterminateGuards(result) {
 	return out;
 }
 
-//#endregion
-//#region src/deployment/inline-policy-claims.ts
+// src/deployment/inline-policy-claims.ts
 function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
 	const { selfLogicalId, writers, changes, stateResources } = args;
 	for (const [lid, write] of writers) {
@@ -27626,8 +27458,7 @@ function ownPoliciesChange(change) {
 	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
 
-//#endregion
-//#region src/provisioning/json-patch-generator.ts
+// src/provisioning/json-patch-generator.ts
 var JsonPatchGenerator = class {
 	logger = getLogger().child("JsonPatchGenerator");
 	generatePatch(previousProperties, desiredProperties) {
@@ -27682,8 +27513,7 @@ var JsonPatchGenerator = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/guardduty-detector-patch.ts
+// src/provisioning/guardduty-detector-patch.ts
 const DETECTOR_TYPE = "AWS::GuardDuty::Detector";
 const READ_BACK_KEYS = ["Features", "DataSources"];
 function withGuardDutyDetectorReadBackOps(resourceType, patch, desired, readback) {
@@ -27738,8 +27568,7 @@ function featureName(entry) {
 	return typeof name === "string" ? name : void 0;
 }
 
-//#endregion
-//#region src/provisioning/apigwv2-body-import-patch.ts
+// src/provisioning/apigwv2-body-import-patch.ts
 const API_TYPE = "AWS::ApiGatewayV2::Api";
 const DEFINITION_KEYS = ["Body", "BodyS3Location"];
 const IMPORT_KEYS = [
@@ -27790,8 +27619,7 @@ function apiGatewayV2DefinitionObject(location) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/secret-reference-immutable.ts
+// src/provisioning/secret-reference-immutable.ts
 const IDENTITY = maskerOrIdentity(void 0);
 async function unchangedBehindSecretReference(evidence) {
 	const { resourceType, key, desired, previous, physicalName, maskSecrets } = evidence;
@@ -27851,8 +27679,7 @@ function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-//#endregion
-//#region src/provisioning/getatt-attributes.generated.ts
+// src/provisioning/getatt-attributes.generated.ts
 const WRITABLE_GETATT_ATTRIBUTES = {
 	"AWS::Amplify::Branch": ["BranchName"],
 	"AWS::Amplify::Domain": [
@@ -28006,8 +27833,7 @@ const SHAPE_MISMATCHED_GETATT_ATTRIBUTES = {
 	"AWS::MediaLive::Input": ["Destinations", "Sources"]
 };
 
-//#endregion
-//#region src/provisioning/read-only-properties.ts
+// src/provisioning/read-only-properties.ts
 function isDefinitiveRefusal(error) {
 	if (isThrottlingError(error)) return false;
 	let current = error;
@@ -28074,8 +27900,7 @@ function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
-//#endregion
-//#region src/provisioning/cc-import-identifier.ts
+// src/provisioning/cc-import-identifier.ts
 const primaryIdentifierCache = /* @__PURE__ */ new Map();
 function getPrimaryIdentifierFields(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
@@ -28136,8 +27961,7 @@ function toCloudControlIdentifier(input) {
 	return identifier;
 }
 
-//#endregion
-//#region src/provisioning/cc-protection-properties.ts
+// src/provisioning/cc-protection-properties.ts
 const CC_PROTECTION_PROPERTIES = {
 	"AWS::DSQL::Cluster": {
 		property: "DeletionProtectionEnabled",
@@ -28212,8 +28036,7 @@ function ccProtectionSite(resourceType, physicalId, entry, region) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/slow-cc-operation-timeouts.ts
+// src/provisioning/slow-cc-operation-timeouts.ts
 const MINUTE_MS = 6e4;
 const SLOW_CC_OPERATION_TIMEOUTS = {
 	"AWS::OpenSearchService::Domain": {
@@ -28264,8 +28087,7 @@ function slowCcOperationTimeoutMs(resourceType, operation) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/cloud-control-provider.ts
+// src/provisioning/cloud-control-provider.ts
 const JSON_STRING_PROPERTIES = { "AWS::Events::Rule": /* @__PURE__ */ new Set(["EventPattern"]) };
 function stringifyJsonProperties(resourceType, properties) {
 	const jsonProps = JSON_STRING_PROPERTIES[resourceType];
@@ -28797,7 +28619,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-_nun2Jda.js");
+			const { ASGProvider } = await import("./asg-provider-DOLuhiky.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28906,7 +28728,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-C2fHUNSE.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CGZ_G4Vz.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-VigGKsxO.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CuZbMn9R.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29843,8 +29665,7 @@ function maskLeavesDeep(value) {
 	return "***";
 }
 
-//#endregion
-//#region src/state/state-bucket-lifecycle.ts
+// src/state/state-bucket-lifecycle.ts
 const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID = "cdkd-custom-resource-responses-expiration";
 const CUSTOM_RESOURCE_RESPONSE_EXPIRATION_DAYS = 1;
 const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX = `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/cdkd-1`;
@@ -29961,8 +29782,7 @@ function ensureCustomResourceResponseExpirationOnce(s3, bucket, log) {
 	return run;
 }
 
-//#endregion
-//#region src/deployment/resource-secrets-scope.ts
+// src/deployment/resource-secrets-scope.ts
 const currentResourceSecretsStore = new AsyncLocalStorage();
 const boundSecretBagsStore = new AsyncLocalStorage();
 installLogLineMaskerSource(() => {
@@ -29982,8 +29802,7 @@ function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
 
-//#endregion
-//#region src/provisioning/custom-resource-secure-references.ts
+// src/provisioning/custom-resource-secure-references.ts
 function isCustomResourceType(resourceType) {
 	return resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
 }
@@ -30045,8 +29864,7 @@ function findResolvedSecretPaths(properties, secrets) {
 	return paths;
 }
 
-//#endregion
-//#region src/deployment/noecho-delete-reresolution.ts
+// src/deployment/noecho-delete-reresolution.ts
 function readsNoEchoDeleteValues(resourceType) {
 	return resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::Stack";
 }
@@ -30374,8 +30192,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/custom-resource-provider.ts
+// src/provisioning/providers/custom-resource-provider.ts
 function deletePathMasker(callerMask, noEchoMask) {
 	if (callerMask === void 0) return noEchoMask;
 	if (noEchoMask === void 0) return callerMask;
@@ -31418,8 +31235,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/mutually-exclusive-properties.ts
+// src/provisioning/mutually-exclusive-properties.ts
 const MUTUALLY_EXCLUSIVE_PROPERTIES = /* @__PURE__ */ new Map([["AWS::EC2::Route", [{
 	properties: [
 		"DestinationCidrBlock",
@@ -31465,8 +31281,7 @@ function buildMutuallyExclusiveMessage(logicalId, violation) {
 	return `  - ${logicalId} (${resourceType}) declares ${declared.join(" and ")}\n      ${rule.rationale}${winnerNote}\n      Declare at most one of: ${rule.properties.join(" / ")}`;
 }
 
-//#endregion
-//#region src/provisioning/nested-required.generated.ts
+// src/provisioning/nested-required.generated.ts
 const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageDescription.Tags", ["Key", "Value"]]])],
 	["AWS::ApiGateway::Method", /* @__PURE__ */ new Map([
@@ -32850,8 +32665,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 	])]
 ]);
 
-//#endregion
-//#region src/provisioning/nested-required.ts
+// src/provisioning/nested-required.ts
 const CFN_ENFORCED_TYPES = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Deployment",
 	"AWS::ApiGateway::Method",
@@ -32980,8 +32794,7 @@ function buildNestedRequiredMessage(logicalId, violation) {
 	return `  - ${logicalId} (${violation.resourceType}): ${violation.path} is missing required ${violation.missing.length === 1 ? "member" : "members"} ${violation.missing.join(", ")}`;
 }
 
-//#endregion
-//#region src/provisioning/property-shape.generated.ts
+// src/provisioning/property-shape.generated.ts
 const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Authorizer", "{\"ProviderARNs\":\"array\"}"],
 	["AWS::ApiGateway::Deployment", "{\"DeploymentCanarySettings\":\"object\",\"DeploymentCanarySettings.StageVariableOverrides\":\"object\",\"StageDescription\":\"object\",\"StageDescription.AccessLogSetting\":\"object\",\"StageDescription.CanarySetting\":\"object\",\"StageDescription.CanarySetting.StageVariableOverrides\":\"object\",\"StageDescription.MethodSettings\":\"array\",\"StageDescription.MethodSettings[]\":\"object\",\"StageDescription.Tags\":\"array\",\"StageDescription.Tags[]\":\"object\",\"StageDescription.Variables\":\"object\"}"],
@@ -33099,8 +32912,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::WAFv2::WebACL", "{\"ApplicationConfig\":\"object\",\"ApplicationConfig.Attributes\":\"array\",\"ApplicationConfig.Attributes[]\":\"object\",\"ApplicationConfig.Attributes[].Values\":\"array\",\"AssociationConfig\":\"object\",\"AssociationConfig.RequestBody\":\"object\",\"CaptchaConfig\":\"object\",\"CaptchaConfig.ImmunityTimeProperty\":\"object\",\"ChallengeConfig\":\"object\",\"ChallengeConfig.ImmunityTimeProperty\":\"object\",\"CustomResponseBodies\":\"object\",\"DataProtectionConfig\":\"object\",\"DataProtectionConfig.DataProtections\":\"array\",\"DataProtectionConfig.DataProtections[]\":\"object\",\"DataProtectionConfig.DataProtections[].Field\":\"object\",\"DataProtectionConfig.DataProtections[].Field.FieldKeys\":\"array\",\"DefaultAction\":\"object\",\"DefaultAction.Allow\":\"object\",\"DefaultAction.Allow.CustomRequestHandling\":\"object\",\"DefaultAction.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"DefaultAction.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"DefaultAction.Block\":\"object\",\"DefaultAction.Block.CustomResponse\":\"object\",\"DefaultAction.Block.CustomResponse.ResponseHeaders\":\"array\",\"DefaultAction.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"MonetizationConfig\":\"object\",\"MonetizationConfig.CryptoConfig\":\"object\",\"MonetizationConfig.CryptoConfig.PaymentNetworks\":\"array\",\"MonetizationConfig.CryptoConfig.PaymentNetworks[]\":\"object\",\"MonetizationConfig.CryptoConfig.PaymentNetworks[].Prices\":\"array\",\"MonetizationConfig.CryptoConfig.PaymentNetworks[].Prices[]\":\"object\",\"OnSourceDDoSProtectionConfig\":\"object\",\"Rules\":\"array\",\"Rules[]\":\"object\",\"Rules[].Action\":\"object\",\"Rules[].Action.Allow\":\"object\",\"Rules[].Action.Allow.CustomRequestHandling\":\"object\",\"Rules[].Action.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Block\":\"object\",\"Rules[].Action.Block.CustomResponse\":\"object\",\"Rules[].Action.Block.CustomResponse.ResponseHeaders\":\"array\",\"Rules[].Action.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"Rules[].Action.Captcha\":\"object\",\"Rules[].Action.Captcha.CustomRequestHandling\":\"object\",\"Rules[].Action.Captcha.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Captcha.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Challenge\":\"object\",\"Rules[].Action.Challenge.CustomRequestHandling\":\"object\",\"Rules[].Action.Challenge.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Challenge.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Count\":\"object\",\"Rules[].Action.Count.CustomRequestHandling\":\"object\",\"Rules[].Action.Count.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Count.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Monetize\":\"object\",\"Rules[].CaptchaConfig\":\"object\",\"Rules[].CaptchaConfig.ImmunityTimeProperty\":\"object\",\"Rules[].ChallengeConfig\":\"object\",\"Rules[].ChallengeConfig.ImmunityTimeProperty\":\"object\",\"Rules[].OverrideAction\":\"object\",\"Rules[].OverrideAction.Count\":\"object\",\"Rules[].OverrideAction.None\":\"object\",\"Rules[].RuleLabels\":\"array\",\"Rules[].RuleLabels[]\":\"object\",\"Rules[].Statement\":\"object\",\"Rules[].Statement.AndStatement\":\"object\",\"Rules[].Statement.AndStatement.Statements\":\"array\",\"Rules[].Statement.AsnMatchStatement\":\"object\",\"Rules[].Statement.AsnMatchStatement.AsnList\":\"array\",\"Rules[].Statement.AsnMatchStatement.ForwardedIPConfig\":\"object\",\"Rules[].Statement.ByteMatchStatement\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.ByteMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.ByteMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.ByteMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.ByteMatchStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.GeoMatchStatement\":\"object\",\"Rules[].Statement.GeoMatchStatement.CountryCodes\":\"array\",\"Rules[].Statement.GeoMatchStatement.ForwardedIPConfig\":\"object\",\"Rules[].Statement.IPSetReferenceStatement\":\"object\",\"Rules[].Statement.IPSetReferenceStatement.IPSetForwardedIPConfig\":\"object\",\"Rules[].Statement.LabelMatchStatement\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ExcludedRules\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ExcludedRules[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.AddressFields\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.AddressFields[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.EmailField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.PasswordField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.PhoneNumberFields\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.PhoneNumberFields[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.UsernameField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains.FailureStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains.SuccessStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Header\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Header.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Header.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Json\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Json.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Json.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode.FailureCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode.SuccessCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.RequestInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.RequestInspection.PasswordField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.RequestInspection.UsernameField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains.FailureStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains.SuccessStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Header\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Header.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Header.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Json\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Json.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Json.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode.FailureCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode.SuccessCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge.ExemptUriRegularExpressions\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge.ExemptUriRegularExpressions[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesBotControlRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].PasswordField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].UsernameField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Monetize\":\"object\",\"Rules[].Statement.NotStatement\":\"object\",\"Rules[].Statement.OrStatement\":\"object\",\"Rules[].Statement.OrStatement.Statements\":\"array\",\"Rules[].Statement.RateBasedStatement\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].ASN\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Cookie\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Cookie.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Cookie.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].ForwardedIP\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].HTTPMethod\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Header\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Header.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Header.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].IP\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].JA3Fingerprint\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].JA4Fingerprint\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].LabelNamespace\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryArgument\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryArgument.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryArgument.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryString\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryString.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryString.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].UriPath\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].UriPath.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].UriPath.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.ForwardedIPConfig\":\"object\",\"Rules[].Statement.RegexMatchStatement\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.RegexMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.RegexMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.RegexMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.RegexMatchStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.TextTransformations\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.ExcludedRules\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.ExcludedRules[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Monetize\":\"object\",\"Rules[].Statement.SizeConstraintStatement\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.SizeConstraintStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.SizeConstraintStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.SizeConstraintStatement.TextTransformations\":\"array\",\"Rules[].Statement.SizeConstraintStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.SqliMatchStatement\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.SqliMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.SqliMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.SqliMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.SqliMatchStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.XssMatchStatement\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.XssMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.XssMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.XssMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.XssMatchStatement.TextTransformations[]\":\"object\",\"Rules[].VisibilityConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TokenDomains\":\"array\",\"VisibilityConfig\":\"object\"}"]
 ]);
 
-//#endregion
-//#region src/provisioning/property-shape.ts
+// src/provisioning/property-shape.ts
 const treeCache = /* @__PURE__ */ new Map();
 function buildShapeTree(rows) {
 	const root = { props: /* @__PURE__ */ new Map() };
@@ -33194,8 +33006,7 @@ function validatePropertyShapes(resources) {
 	throw new Error("Properties validation failed: the following resources declare a property whose kind contradicts the resource type's schema:\n" + lines.join("\n") + "\n\nCloudFormation rejects these templates too. Give each property a list where its schema expects a list and an object where it expects an object.");
 }
 
-//#endregion
-//#region src/provisioning/provider-registry.ts
+// src/provisioning/provider-registry.ts
 const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 	["AWS::Scheduler::Schedule", {
 		mode: "cc-broken",
@@ -33535,8 +33346,7 @@ function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
+// src/provisioning/attribute-map.ts
 function definedAttributes(entries) {
 	const out = {};
 	for (const [key, value] of Object.entries(entries)) {
@@ -33550,8 +33360,7 @@ function stringifyIfAssigned(value) {
 	return String(value);
 }
 
-//#endregion
-//#region src/provisioning/tag-list.ts
+// src/provisioning/tag-list.ts
 function isScalar(value) {
 	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
 }
@@ -33645,8 +33454,7 @@ function recordedTagsUnreadableWarning(resourceType, id, applied) {
 	return safeMsg`The recorded Tags of ${resourceType} ${id} is not a list cdkd can read, so cdkd removed no tag and applied the ${applied} desired tag(s) only. Untag any key the template no longer names yourself.`;
 }
 
-//#endregion
-//#region src/provisioning/delete-started.ts
+// src/provisioning/delete-started.ts
 const DELETE_STARTED = Symbol.for("cdkd.deleteStarted");
 const MAX_DEPTH = 10;
 function markDeleteStarted(error) {
@@ -33697,8 +33505,7 @@ function isRefusedByName(error) {
 	return false;
 }
 
-//#endregion
-//#region src/types/deployment-events.ts
+// src/types/deployment-events.ts
 function extractDeploymentEventError(err) {
 	if (!(err instanceof Error)) return {
 		name: "UnknownError",
@@ -33721,8 +33528,7 @@ function extractDeploymentEventError(err) {
 	return result;
 }
 
-//#endregion
-//#region src/state/deployment-events-store.ts
+// src/state/deployment-events-store.ts
 const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
 const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
@@ -34060,8 +33866,7 @@ var DeploymentEventsReader = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/kept-in-history.ts
+// src/deployment/kept-in-history.ts
 function keptInEarlierRecords(records) {
 	const out = [];
 	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
@@ -34134,8 +33939,7 @@ async function loadRollbackRetainedCopies(sources, stackName, region) {
 	return rollbackRetainedInEventHistory(await readRecentRuns(sources, stackName, region), stackName);
 }
 
-//#endregion
-//#region src/provisioning/providers/idempotency-token.ts
+// src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
 const inFlight$1 = /* @__PURE__ */ new Map();
 const generations = /* @__PURE__ */ new Map();
@@ -34176,8 +33980,7 @@ function stackScopedCreateToken(options) {
 	return `cdkd-${logicalId.slice(0, prefixLength)}-${digest}`;
 }
 
-//#endregion
-//#region src/provisioning/providers/create-token-ledger.ts
+// src/provisioning/providers/create-token-ledger.ts
 var CreateTokenLedger = class {
 	doc;
 	loadedAbsent = false;
@@ -34506,8 +34309,7 @@ async function reserveStackCreateToken(options) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-value-equality.ts
+// src/deployment/deploy-value-equality.ts
 function isReplacementCeiling(pc) {
 	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
 }
@@ -34561,8 +34363,7 @@ function deepEqualValue(a, b) {
 	return true;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/provenance-capture.ts
+// src/deployment/deploy-engine/provenance-capture.ts
 var ProvenanceCapture = class {
 	tasks = /* @__PURE__ */ new Map();
 	deps;
@@ -34668,8 +34469,7 @@ function provenanceBaselineOf(state, tokenFree) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/final-snapshot.ts
+// src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBCluster",
@@ -35020,13 +34820,11 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/types.ts
+// src/deployment/rollback-executor/types.ts
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
-//#endregion
-//#region src/deployment/rollback-executor/messages.ts
+// src/deployment/rollback-executor/messages.ts
 function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause, guardScope) {
 	recordRollbackDeleteGuards(result, logicalId, physicalId, guardScope);
 	const reason = deleteSkipReason(result);
@@ -35221,8 +35019,7 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/names.ts
+// src/deployment/rollback-executor/names.ts
 function replayPrefixScope(input, logger, mask, restoring) {
 	const generation = input.nameGeneration;
 	const inGeneration = (fn) => generation === void 0 ? fn() : withNameGeneration({
@@ -35388,8 +35185,7 @@ async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask)
 	}
 }
 
-//#endregion
-//#region src/deployment/secret-name-needles.ts
+// src/deployment/secret-name-needles.ts
 function secretNameNeedlesOf(logicalId, record, secrets, options) {
 	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
 	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
@@ -35659,8 +35455,7 @@ function maskEventTextWithBoundBags(event) {
 	return masked;
 }
 
-//#endregion
-//#region src/deployment/read-only-attribute-healer.ts
+// src/deployment/read-only-attribute-healer.ts
 async function readRecordAttributes(input) {
 	const { provider, logicalId, resource, stackName, region } = input;
 	if (!provider.import) return { kind: "not-attempted" };
@@ -35721,8 +35516,7 @@ function createReadOnlyAttributeHealerFactory(options) {
 	return (stackName, region) => Object.assign((logicalId, resource) => readOnce(stackName, region, logicalId, resource), { readOnly: true });
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/noecho.ts
+// src/deployment/deploy-engine/noecho.ts
 var NoEchoRunState = class {
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
 	persistedNoEchoAttributes = /* @__PURE__ */ new Map();
@@ -36103,8 +35897,7 @@ function noEchoComparisonForTemplate(template, knownConditions, values, resource
 	return (input) => compare(input);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/masking.ts
+// src/deployment/deploy-engine/masking.ts
 var SecretsRunState = class {
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	secretNameNeedles = /* @__PURE__ */ new Map();
@@ -36390,8 +36183,7 @@ function maskedRecordRemedyFor(reads, resources, causeScoped = false) {
 	return [parts.join(" "), ...commandLines].join("\n");
 }
 
-//#endregion
-//#region src/deployment/delete-guard-scope.ts
+// src/deployment/delete-guard-scope.ts
 const storage$1 = new AsyncLocalStorage();
 function collectDeleteGuards(sink, fn) {
 	return storage$1.run(sink, fn);
@@ -36408,8 +36200,7 @@ function reportDeleteGuards(result, target) {
 	});
 }
 
-//#endregion
-//#region src/deployment/superseded-resources.ts
+// src/deployment/superseded-resources.ts
 function supersededResourcesOf(state) {
 	const rows = state?.supersededResources;
 	if (!Array.isArray(rows)) return [];
@@ -36533,8 +36324,7 @@ function holdsSupersededResources(record) {
 	return rows !== void 0 && (!Array.isArray(rows) || rows.length > 0);
 }
 
-//#endregion
-//#region src/utils/colors.ts
+// src/utils/colors.ts
 const codes = {
 	reset: "\x1B[0m",
 	bright: "\x1B[1m",
@@ -36553,8 +36343,7 @@ const cyan = (s) => `${codes.cyan}${s}${codes.reset}`;
 const gray = (s) => `${codes.gray}${s}${codes.reset}`;
 const bold = (s) => `${codes.bright}${s}${codes.reset}`;
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-scope.ts
+// src/deployment/rollback-executor/replay-scope.ts
 function withReplayDeletePrinting(scope, fn) {
 	const deployBag = scope.ctx.logOnlyNeedlesFor?.(scope.op.logicalId);
 	return withPrintingSecrets(scope.secrets, () => deployBag === void 0 ? fn() : withPrintingSecrets(deployBag, fn));
@@ -36570,8 +36359,7 @@ function noteRolledBackCreate(scope, op, record) {
 	scope.onRolledBackCreate?.(create);
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replaced-survivor.ts
+// src/deployment/rollback-executor/replaced-survivor.ts
 function replacedDeleteFailureVerdict(error) {
 	if (isDeleteStarted(error)) return "unconfirmed";
 	return isRefusedByName(error) ? "kept" : "unconfirmed";
@@ -36618,8 +36406,7 @@ async function readSurvivor(s, oldType) {
 	}
 }
 
-//#endregion
-//#region src/deployment/stack-records-scope.ts
+// src/deployment/stack-records-scope.ts
 async function awaitInFlightSibling(view, self, sibling) {
 	const waiting = view.waiting;
 	if (waiting === void 0 || waiting.has(sibling.logicalId)) return void 0;
@@ -36662,8 +36449,7 @@ function replayStackRecordsView(records, orphanLogicalIds = /* @__PURE__ */ new
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/name-collision.ts
+// src/deployment/deploy-engine/name-collision.ts
 function replacementNameOrigin(logicalId, physicalId) {
 	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName(), getCurrentStackInstanceId())) return {
 		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
@@ -36741,8 +36527,7 @@ function isReplacementNameRefusal(error, logicalId) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/replacement.ts
+// src/deployment/deploy-engine/replacement.ts
 var ReplacementRunState = class {
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	deferredReplacedDeletes = void 0;
@@ -37097,8 +36882,7 @@ function warnUnretriedReplacedDeletes(run, deps, why) {
 	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(secretNameBagFor(deps.secretsRun(), logicalId), () => deps.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${noteFor(logicalId)})`));
 }
 
-//#endregion
-//#region src/analyzer/refactor-pairing.ts
+// src/analyzer/refactor-pairing.ts
 const UNPAIRABLE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata", "AWS::CloudFormation::Stack"]);
 function isPairableType(resourceType) {
 	return !UNPAIRABLE_TYPES.has(resourceType);
@@ -37268,8 +37052,7 @@ function splitLocation(location) {
 	};
 }
 
-//#endregion
-//#region src/analyzer/refactor-hints.ts
+// src/analyzer/refactor-hints.ts
 function findRefactorHints(stacks) {
 	const hints = /* @__PURE__ */ new Map();
 	for (const env of new Set(stacks.map((s) => s.env))) {
@@ -37344,8 +37127,7 @@ function withMovedTo(changes, hints) {
 	});
 }
 
-//#endregion
-//#region src/analyzer/destructive-changes.ts
+// src/analyzer/destructive-changes.ts
 const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
 const PATH_METADATA_KEY = "aws:cdk:path";
 function findDestructiveChanges(stackName, changes, records, template, recreateTargets = /* @__PURE__ */ new Set()) {
@@ -37420,8 +37202,7 @@ function withConstructPath(record, path) {
 	};
 }
 
-//#endregion
-//#region src/deployment/masking-retry-logger.ts
+// src/deployment/masking-retry-logger.ts
 function maskingRetryLogger(logger, secrets) {
 	return {
 		debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)),
@@ -37429,8 +37210,7 @@ function maskingRetryLogger(logger, secrets) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/options.ts
+// src/deployment/deploy-engine/options.ts
 const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 const DEFAULT_UNSETTLED_REVERT_WAIT = {
@@ -37438,8 +37218,7 @@ const DEFAULT_UNSETTLED_REVERT_WAIT = {
 	pollMs: 1e4
 };
 
-//#endregion
-//#region src/analyzer/skipped-outputs.ts
+// src/analyzer/skipped-outputs.ts
 function canonicalJson$3(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
@@ -37553,8 +37332,7 @@ function skippedOutputsEqual(a, b) {
 	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
 }
 
-//#endregion
-//#region src/deployment/outputs-export-alias/names.ts
+// src/deployment/outputs-export-alias/names.ts
 function isOutputSuppressedByCondition(output, conditions) {
 	return output.Condition !== void 0 && conditions?.[output.Condition] === false;
 }
@@ -37570,8 +37348,7 @@ function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
 	return exportName !== outputKey && ownedOutputNames.has(exportName);
 }
 
-//#endregion
-//#region src/deployment/outputs-export-alias/secret-scan.ts
+// src/deployment/outputs-export-alias/secret-scan.ts
 const MIN_SECRET_NEEDLE = 4;
 const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
 const SECRET_DETECTION_ONLY = /\p{Mn}/gu;
@@ -37690,8 +37467,7 @@ function maskEveryOccurrence(text, exposure) {
 	return maskMatchSpans(text, Array.from(exposure.keys()).filter((value) => value !== ""), "***");
 }
 
-//#endregion
-//#region src/deployment/outputs-export-alias/warnings.ts
+// src/deployment/outputs-export-alias/warnings.ts
 function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets, noEchoOnly = false) {
 	const corpus = printingCorpusOf(secrets ?? exposure);
 	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
@@ -37769,8 +37545,7 @@ function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
 	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/outputs.ts
+// src/deployment/deploy-engine/outputs.ts
 var OutputsRunState = class {
 	outputSecrets = /* @__PURE__ */ new Map();
 	outputsPassSecretMaps = [];
@@ -37937,8 +37712,7 @@ function seedOnlyAliasRefusal(seed) {
 	};
 }
 
-//#endregion
-//#region src/analyzer/parameter-dependence.ts
+// src/analyzer/parameter-dependence.ts
 const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
 	"Fn::GetAtt",
 	"Fn::Join",
@@ -38125,8 +37899,7 @@ function resourcesNamingDeclaredParameter(template) {
 	}
 }
 
-//#endregion
-//#region src/deployment/masked-baseline-recapture.ts
+// src/deployment/masked-baseline-recapture.ts
 function isMaskedBaselineRecaptureCandidate(record) {
 	if (record.observedBaselineRefused === true) return false;
 	const observed = record.observedProperties;
@@ -38242,8 +38015,7 @@ function recaptureMaskedBaseline(args) {
 	return changed ? result : void 0;
 }
 
-//#endregion
-//#region src/state/name-generation.ts
+// src/state/name-generation.ts
 var MalformedNameGenerationError = class extends Error {
 	constructor(where, reason = "malformed") {
 		super(`The state record holds a name generation for ${displayIdent(where)} that is ` + (reason === "exhausted" ? "too large to derive the next one from (the next is not a safe integer). " : "not a non-negative integer. ") + "cdkd does not guess which name the resource was given, since the next replacement's name derives from it; restore the field from an earlier version of state.json.");
@@ -38372,8 +38144,7 @@ function retiredNameGenerationsLeaving(state, remaining) {
 	}
 }
 
-//#endregion
-//#region src/deployment/update-outcome.ts
+// src/deployment/update-outcome.ts
 function updatePartialReason(result) {
 	if (!result || result.outcome !== "partial") return void 0;
 	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
@@ -38385,8 +38156,7 @@ function updatePartialMessage(reason) {
 	return `partial (${reason})`;
 }
 
-//#endregion
-//#region src/provisioning/redacted-delete-address.ts
+// src/provisioning/redacted-delete-address.ts
 function isRedactedRecordedValue(value) {
 	if (carriesSecretMask(value)) return true;
 	let text;
@@ -38410,8 +38180,7 @@ function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, cont
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
+// src/deployment/rollback-executor/replay-inline-policy-restore.ts
 async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
 	for (const removal of writers.takeHeldRemovals(stateResources)) await restoreOne(removal, stateResources, stackName, ctx, result, options.refuseAll === true);
 }
@@ -38490,8 +38259,7 @@ function serializedDocument(document) {
 	return isRedactedRecordedValue(document) ? void 0 : JSON.stringify(document);
 }
 
-//#endregion
-//#region src/deployment/producer-regions-scope.ts
+// src/deployment/producer-regions-scope.ts
 const producerRegionsStore = new AsyncLocalStorage();
 function withProducerRegions(evidence, fn) {
 	return producerRegionsStore.run(evidence, fn);
@@ -38514,8 +38282,7 @@ function inheritProducerRegions(own, inherited) {
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-secrets.ts
+// src/deployment/rollback-executor/replay-secrets.ts
 function replayProducerRegionEvidence(ctx) {
 	return {
 		regions: ctx.importedProducerRegions ?? [],
@@ -38629,8 +38396,7 @@ function isPlainRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype$1(value);
 }
 
-//#endregion
-//#region src/deployment/type-change-guard.ts
+// src/deployment/type-change-guard.ts
 function equalIdNamesDifferentResources(input) {
 	if (input.resourceType === "AWS::Lambda::Permission") return permissionsOnDifferentFunctions(input.oldProperties, input.newProperties);
 	if (input.resourceType !== "AWS::Glue::Table" || input.physicalId === void 0) return false;
@@ -38688,8 +38454,7 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place.\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/orphan-identity.ts
+// src/deployment/rollback-executor/orphan-identity.ts
 const UNIQUE_PHYSICAL_ID_TYPES = /* @__PURE__ */ new Set([
 	"AWS::EC2::VPC",
 	"AWS::EC2::Subnet",
@@ -38779,8 +38544,7 @@ async function askForeignHolder(foreignHolder, op) {
 	}
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/plan.ts
+// src/deployment/rollback-executor/plan.ts
 function journaledOldTypes(op) {
 	return {
 		stamped: nonEmptyString(op.previousResourceType) ? op.previousResourceType : void 0,
@@ -39202,8 +38966,7 @@ function someStringLeaf(value, test, depth = 0) {
 	return (Array.isArray(value) ? value : Object.values(value)).some((child) => someStringLeaf(child, test, depth + 1));
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-noecho.ts
+// src/deployment/rollback-executor/replay-noecho.ts
 const NOECHO_REPLAY_READBACK_TIMEOUT_MS = 3e4;
 const NESTED_STACK_TYPE$3 = "AWS::CloudFormation::Stack";
 function coordinatePath(coordinate) {
@@ -39367,8 +39130,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-props.ts
+// src/deployment/rollback-executor/replay-props.ts
 async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId, record) {
 	if (props === void 0) return void 0;
 	const recordedRegions = recordedReferenceRegions(record);
@@ -39468,8 +39230,7 @@ function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are five ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. (5) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: restore the property with a 'cdkd deploy' that changes this resource, which sends it the value again. Every rollback to such a baseline refuses while the two values still overlap there, so to end this, change the property (or rotate one of the secrets) so that they no longer overlap. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
-//#endregion
-//#region src/analyzer/drift-normalize.ts
+// src/analyzer/drift-normalize.ts
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
 		const mapped = v.map(canonicalizeTagListsDeep);
@@ -39556,8 +39317,7 @@ function walkUnordered(v, path, paths) {
 	return v;
 }
 
-//#endregion
-//#region src/analyzer/drift-calculator.ts
+// src/analyzer/drift-calculator.ts
 function calculateResourceDrift(stateProperties, awsProperties, options) {
 	const drifts = [];
 	const ignore = options?.ignorePaths ?? [];
@@ -39706,8 +39466,7 @@ function isPlainObject$5(value) {
 	return typeof value === "object" && value !== null;
 }
 
-//#endregion
-//#region src/deployment/unsettled-convergence.ts
+// src/deployment/unsettled-convergence.ts
 const MERGE_SEMANTICS_KEYS = /* @__PURE__ */ new Set(["Tags"]);
 async function readLive(args, names) {
 	const { provider, physicalId, logicalId, resourceType, recordedProperties } = args;
@@ -39804,12 +39563,13 @@ async function unsettledAfterUpdate(args) {
 	const { names, desired, provider } = args;
 	if (names.size === 0) return [];
 	try {
-		const moving = provider.unsettledInTransition === void 0 ? /* @__PURE__ */ new Set() : await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties);
+		const moving = provider.unsettledInTransition === void 0 ? /* @__PURE__ */ new Set() : await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties, desired);
 		const live = await readLive(args, names);
 		if (live === void 0) return [...moving].sort();
 		if (live === "unreadable") return [...names].sort();
 		const ignorePaths = provider.getDriftUnknownPaths?.(args.resourceType) ?? [];
 		const unorderedPaths = provider.getDriftUnorderedPaths?.(args.resourceType) ?? [];
+		const canonical = (bag) => provider.canonicalizeUnsettledProperties?.(args.resourceType, bag) ?? bag;
 		const kept = [];
 		for (const name of names) {
 			if (moving.has(name)) {
@@ -39821,7 +39581,7 @@ async function unsettledAfterUpdate(args) {
 				continue;
 			}
 			if (!Object.hasOwn(live, name) || desired[name] === void 0) continue;
-			if (calculateResourceDrift({ [name]: desired[name] }, { [name]: live[name] }, {
+			if (calculateResourceDrift(canonical({ [name]: desired[name] }), canonical({ [name]: live[name] }), {
 				ignorePaths,
 				unorderedPaths
 			}).length > 0) kept.push(name);
@@ -39884,8 +39644,7 @@ function addedByFailedUpdateWarning(logicalId, resourceType, names) {
 	return safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} set on the resource but in no template: an earlier failed update applied ${one ? "it" : "them"}. cdkd has no default to reset ${one ? "it" : "them"} to, so the value stays; remove it by hand if it should not be there.`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-retry.ts
+// src/deployment/rollback-executor/replay-retry.ts
 const RECREATE_RETRY_SCHEDULE = {
 	maxRetries: 8,
 	initialDelayMs: 2e3,
@@ -39979,8 +39738,7 @@ function copyClaimingProviderBag(properties) {
 	return isSameGenerationBag(properties) ? markSameGenerationBag(copy) : copy;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-orphan-delete.ts
+// src/deployment/rollback-executor/replay-orphan-delete.ts
 async function replayOrphanFlag(s) {
 	const { op, stateResources, stackName, ctx, afterOp, logger, mask } = s;
 	if (op.changeType === "CREATE") {
@@ -40098,8 +39856,7 @@ async function replayDelete(s) {
 	});
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-revert.ts
+// src/deployment/rollback-executor/replay-revert.ts
 async function replayReadopt(s, survivor) {
 	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, logger, mask } = s;
 	const oldKind = survivor === void 0 ? "retained" : "surviving";
@@ -40278,8 +40035,7 @@ async function replayRevert(s) {
 	});
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-reverse-replacement.ts
+// src/deployment/rollback-executor/replay-reverse-replacement.ts
 function refuseSameIdParentReversal(s) {
 	const { op, stateResources, ctx, createdInSegment, orphanLogicalIds } = s;
 	const children = Object.entries(stateResources).filter(([logicalId, record]) => logicalId !== op.logicalId && !createdInSegment.has(logicalId) && !orphanLogicalIds.has(logicalId) && mayBeStoredIn(record.resourceType, op.resourceType) && (!Array.isArray(record.dependencies) || record.dependencies.includes(op.logicalId))).map(([logicalId]) => logicalId).sort();
@@ -40677,8 +40433,7 @@ function survivorUnprovenRefusal(s, oldType, verdict) {
 	return ownRemedyError(markNonRetryable(new CdkdError(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(oldType)}): the deploy did not confirm that it deleted the old resource (${oldShown}), so it may still exist, and ${why}. Nothing was sent and the journal is kept.` + (remedy.offered ? " To keep the new resource in its place instead, re-run with the command below, then delete the old resource by hand if it still exists." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown)}` + remedy.line, "REPLACED_SURVIVOR_UNPROVEN")));
 }
 
-//#endregion
-//#region src/provisioning/remove-protection-types.ts
+// src/provisioning/remove-protection-types.ts
 const SDK_REMOVE_PROTECTION_TYPES = [
 	"AWS::Logs::LogGroup",
 	"AWS::RDS::DBInstance",
@@ -40703,8 +40458,7 @@ function removeProtectionTypeList() {
 	return `${types.slice(0, -1).join(", ")}, and ${types[types.length - 1]}`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor.ts
+// src/deployment/rollback-executor.ts
 function nonEmptyOrUndefined(items) {
 	return items.length > 0 ? items : void 0;
 }
@@ -41292,8 +41046,7 @@ async function replayFailedOperations(...args) {
 	return await withProducerRegions(() => replayProducerRegionEvidence(args[3]), () => withStackRecords(replayStackRecordsView(args[1]), () => replayFailedOperationsUnbound(...args)));
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/observed-capture.ts
+// src/deployment/deploy-engine/observed-capture.ts
 var ObservedCapture = class {
 	observedCaptureTasks = /* @__PURE__ */ new Map();
 	recapturedBaselines = /* @__PURE__ */ new WeakMap();
@@ -41519,8 +41272,7 @@ function stampReasonlessParameterRefusals(logger, stateResources, template) {
 	if (stamped > 0) logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/attribute-healer.ts
+// src/deployment/deploy-engine/attribute-healer.ts
 var AttributeHealer = class {
 	heals = /* @__PURE__ */ new Map();
 	healed = /* @__PURE__ */ new Map();
@@ -41606,8 +41358,7 @@ function healPrintingBag(baseline, logicalId, resource, namingSecrets) {
 	return hit.judge(logicalId);
 }
 
-//#endregion
-//#region src/state/pending-moves.ts
+// src/state/pending-moves.ts
 function pendingMovesOutOf(state) {
 	const raw = state.pendingMovesOut;
 	if (raw === void 0) return {
@@ -41641,8 +41392,7 @@ function refusePendingMovesOut(state, stackName, region, command) {
 	throw markNonRetryable(new CdkdError(pendingMovesRefusalMessage(state, stackName, region, command), "REFACTOR_UNFINISHED"));
 }
 
-//#endregion
-//#region src/state/refactor-marker.ts
+// src/state/refactor-marker.ts
 function refactorMarkerMovesOf(body) {
 	const raw = body?.moves;
 	if (body === null || typeof body !== "object" || !Array.isArray(raw)) return {
@@ -41736,8 +41486,7 @@ function sameMove(a, b) {
 	return a.fromStack === b.fromStack && a.fromRegion === b.fromRegion && a.from === b.from;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/superseded-retry.ts
+// src/deployment/deploy-engine/superseded-retry.ts
 async function retryCarriedSupersededResources(engine, host, carried, resources, options = {}) {
 	let changed = false;
 	if (carried.length === 0) return changed;
@@ -41799,8 +41548,7 @@ async function retryCarriedSupersededResources(engine, host, carried, resources,
 	return changed;
 }
 
-//#endregion
-//#region src/provisioning/name-lookup.ts
+// src/provisioning/name-lookup.ts
 const inFlight = /* @__PURE__ */ new Map();
 const waiting = /* @__PURE__ */ new Map();
 async function withApiLimit(api, max, fn) {
@@ -41837,8 +41585,7 @@ function isAccessDeniedError(error) {
 	return name === "AccessDenied" || name === "AccessDeniedException" || name === "AuthorizationError" || name === "UnauthorizedOperation" || status === 403;
 }
 
-//#endregion
-//#region src/deployment/generated-name-guard.ts
+// src/deployment/generated-name-guard.ts
 const GROUP_WINDOW_MS = 15;
 const DEFAULT_TIMING = {
 	now: () => Date.now(),
@@ -42454,8 +42201,7 @@ async function lookupType(input, resourceType, group) {
 	});
 }
 
-//#endregion
-//#region src/utils/resource-line.ts
+// src/utils/resource-line.ts
 function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	const body = `${bold(displaySafe(logicalId))} ${gray(`(${displaySafe(resourceType)})`)}`;
 	const verb = verbOverride === void 0 ? void 0 : displaySafe(verbOverride);
@@ -42467,8 +42213,7 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/journaled-orphans.ts
+// src/deployment/rollback-executor/journaled-orphans.ts
 const NONE = {
 	segments: [],
 	count: 0
@@ -42918,8 +42663,7 @@ function sameJournaledOrphans(a, b) {
 	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
 }
 
-//#endregion
-//#region src/provisioning/nested-stack-context.ts
+// src/provisioning/nested-stack-context.ts
 const storage = new AsyncLocalStorage();
 function withNestedStackContext(ctx, fn) {
 	return storage.run(ctx, fn);
@@ -42943,8 +42687,7 @@ async function collectNestedChildUnaddressed(fn) {
 	};
 }
 
-//#endregion
-//#region src/deployment/nested-child-journal.ts
+// src/deployment/nested-child-journal.ts
 const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
 const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
 const MAX_NESTED_WALK_DEPTH = 32;
@@ -43265,8 +43008,7 @@ async function revertNestedChildFromJournal(args) {
 	}
 }
 
-//#endregion
-//#region src/deployment/retained-readoption.ts
+// src/deployment/retained-readoption.ts
 function keptUnderGeneratedName(resource) {
 	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
 	const property = explicitNamePropertyFor(resource.resourceType);
@@ -43342,8 +43084,7 @@ var KeptForReadoption = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/deploy-engine/delete.ts
+// src/deployment/deploy-engine/delete.ts
 const keptByEngine = /* @__PURE__ */ new WeakMap();
 async function flushKeptForReadoption(engine) {
 	await keptByEngine.get(engine)?.flush();
@@ -43503,8 +43244,7 @@ Drop the record with: ${dropCommand}`);
 	deps.logger.info(safeMsg`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
 }
 
-//#endregion
-//#region src/deployment/cc-pending-requests.ts
+// src/deployment/cc-pending-requests.ts
 function hasPendingCloudControlRequest(op) {
 	return op.pendingCloudControlRequest !== void 0;
 }
@@ -43667,8 +43407,7 @@ function withoutPendingRequest(op) {
 	return rest;
 }
 
-//#endregion
-//#region src/deployment/orphan-adoption.ts
+// src/deployment/orphan-adoption.ts
 function templateStillDeclares(template, record, nameProperties) {
 	const declared = template.Resources?.[record.logicalId];
 	if (!declared) return false;
@@ -43816,8 +43555,7 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/rollback.ts
+// src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(deps, operations) {
 	return operations.map((op) => {
 		const secrets = deps.secretsRun().perResourceSecrets.get(op.logicalId);
@@ -44362,8 +44100,7 @@ async function orphanUntakenResumes(deps, stackName, finalResources) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/canonicalize-properties.ts
+// src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
 	const logger = getLogger().child("canonicalize-properties");
 	return (resourceType, properties) => {
@@ -44377,8 +44114,7 @@ function makeCanonicalizePropertiesFn(registry) {
 	};
 }
 
-//#endregion
-//#region src/deployment/no-change-outputs-merge.ts
+// src/deployment/no-change-outputs-merge.ts
 function isSecretBearingReferenceString(value) {
 	if (typeof value !== "string") return false;
 	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
@@ -44452,8 +44188,7 @@ function keptWholeReasonText(reason) {
 	}
 }
 
-//#endregion
-//#region src/deployment/output-value-preflight.ts
+// src/deployment/output-value-preflight.ts
 function selectsNoValue(value, conditions, assumed, depth = 0) {
 	if (depth > 64 || value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -44474,8 +44209,7 @@ function refuseNoValueOutputs(outputs, conditions) {
 	throw markNonRetryable(/* @__PURE__ */ new Error(`Output ${offending.join(", ")} evaluates to AWS::NoValue, and CloudFormation rejects the template for it ("The Value field of every Outputs member must evaluate to a String") before creating anything. To publish an Output only sometimes, give it a Condition instead of selecting AWS::NoValue in its Value.`));
 }
 
-//#endregion
-//#region src/analyzer/security-changes.ts
+// src/analyzer/security-changes.ts
 const RESOURCE_SCRUTINY = {
 	"AWS::Bedrock::KnowledgeBasePolicy": "ResourcePolicyResource",
 	"AWS::Bedrock::ResourcePolicy": "ResourcePolicyResource",
@@ -45449,8 +45183,7 @@ function stdoutSupportsColor(env = process.env, argv = process.argv, isTTY = pro
 	return min > 0;
 }
 
-//#endregion
-//#region src/analyzer/security-diff.ts
+// src/analyzer/security-diff.ts
 function isSyntheticChange(pc) {
 	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true || pc.unsettled === true;
 }
@@ -45608,8 +45341,7 @@ function logicalIdToPath(records, template) {
 	return map;
 }
 
-//#endregion
-//#region src/deployment/resource-deadline.ts
+// src/deployment/resource-deadline.ts
 var InvalidResourceDeadlineError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -45709,8 +45441,7 @@ function enclosingDeadlineRemainingMs() {
 	return deadlineScope.getStore()?.remainingMs() ?? Number.POSITIVE_INFINITY;
 }
 
-//#endregion
-//#region src/deployment/deployment-approval.ts
+// src/deployment/deployment-approval.ts
 const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 async function requireDeploymentApproval(args) {
 	const level = args.options.requireApproval ?? "never";
@@ -45816,8 +45547,7 @@ function isNoEchoPromotionOnly(change) {
 	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
 }
 
-//#endregion
-//#region src/deployment/condition-verdicts.ts
+// src/deployment/condition-verdicts.ts
 function conditionInputsFrom(args) {
 	return (parameter) => {
 		if (args.unavailable?.has(parameter)) return void 0;
@@ -46034,8 +45764,7 @@ function conditionVerdictRecordsEqual(a, b) {
 	return names.every((name) => Object.hasOwn(right, name) && left[name].verdict === right[name].verdict && left[name].fingerprint === right[name].fingerprint);
 }
 
-//#endregion
-//#region src/utils/nested-template-cycle.ts
+// src/utils/nested-template-cycle.ts
 const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
 function isAbsoluteAssetPath(p) {
 	return path.isAbsolute(p) || p.startsWith("/");
@@ -46175,8 +45904,7 @@ function renderNestedTemplateTreeDefect(defect, stackName, action) {
 	return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
 }
 
-//#endregion
-//#region src/deployment/nested-output-templates.ts
+// src/deployment/nested-output-templates.ts
 function childTemplateLoader(nestedTemplates) {
 	if (nestedTemplates === void 0) return void 0;
 	const read = /* @__PURE__ */ new Map();
@@ -46212,8 +45940,7 @@ function childIndex(template, templatePath) {
 	return index;
 }
 
-//#endregion
-//#region src/deployment/recreate-target-promotion.ts
+// src/deployment/recreate-target-promotion.ts
 function recreateTargetIdsFor(recreateTargets, stackName) {
 	if (recreateTargets === void 0 || recreateTargets.stackName !== stackName) return void 0;
 	const ids = /* @__PURE__ */ new Set([...recreateTargets.viaCcApi, ...recreateTargets.viaSdkProvider]);
@@ -46245,8 +45972,7 @@ function promoteRecreateTargets(changes, recreateTargets, stackName) {
 	};
 }
 
-//#endregion
-//#region src/deployment/custom-resource-service-token.ts
+// src/deployment/custom-resource-service-token.ts
 const SERVICE_TOKEN_CHANGE_REFUSED = "CUSTOM_RESOURCE_SERVICE_TOKEN_CHANGED";
 function uncomparableToken(value) {
 	if (value === void 0 || value === null || value === "") return "absent";
@@ -46354,8 +46080,7 @@ function deferredServiceTokenWarning(row) {
 	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back. A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
 }
 
-//#endregion
-//#region src/deployment/read-provenance-sources.ts
+// src/deployment/read-provenance-sources.ts
 function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -46415,8 +46140,7 @@ function inheritedProvenanceForChildDiff(args) {
 	return out.size === 0 ? void 0 : out;
 }
 
-//#endregion
-//#region src/deployment/dag-executor.ts
+// src/deployment/dag-executor.ts
 var DagExecutor = class {
 	nodes = /* @__PURE__ */ new Map();
 	logger = getLogger().child("DagExecutor");
@@ -46542,8 +46266,7 @@ var DagExecutor = class {
 	}
 };
 
-//#endregion
-//#region src/analyzer/implicit-delete-deps.ts
+// src/analyzer/implicit-delete-deps.ts
 const IMPLICIT_DELETE_DEPENDENCIES = {
 	"AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment", "AWS::EC2::NatGateway"],
 	"AWS::EC2::VPCGatewayAttachment": ["AWS::EC2::NatGateway"],
@@ -46607,8 +46330,7 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/dependencies.ts
+// src/deployment/deploy-engine/dependencies.ts
 function hasPending(executor) {
 	for (const node of executor.values()) if (node.state === "pending") return true;
 	return false;
@@ -46667,8 +46389,7 @@ function addImplicitDeleteDependencies(deleteIds, state, dependedBy, logger) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/record-shape.ts
+// src/deployment/deploy-engine/record-shape.ts
 function auditResolvedAssetReferences(options, logicalId, resourceType, resolvedProps) {
 	const redirect = options.assetRedirect;
 	if (!redirect) return;
@@ -46712,8 +46433,7 @@ function secretNamedAttributesField(result, previous) {
 	return names.length > 0 ? { secretNamedAttributes: names } : {};
 }
 
-//#endregion
-//#region src/deployment/prior-attempt-scope.ts
+// src/deployment/prior-attempt-scope.ts
 const priorAttemptStore = new AsyncLocalStorage();
 function withPriorAttempts(lookup, fn) {
 	return priorAttemptStore.run(lookup, fn);
@@ -46796,8 +46516,7 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/label-routing.ts
+// src/deployment/label-routing.ts
 function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
 	try {
 		if (change.changeType === "DELETE") return existingState?.provisionedBy;
@@ -46813,8 +46532,7 @@ function deriveLabelRouting(change, existingState, registry, forceCcApi = false)
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/routing.ts
+// src/deployment/deploy-engine/routing.ts
 function isPinnedToCcApi(options, stackName, logicalId) {
 	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
 }
@@ -46840,8 +46558,7 @@ function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps
 	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/resolver-context.ts
+// src/deployment/deploy-engine/resolver-context.ts
 function buildResolverContext(deps, base, stackName) {
 	const recordedSecretValues = /* @__PURE__ */ new Map();
 	if (deps.options.inheritedSecrets && deps.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, deps.options.inheritedSecrets);
@@ -46924,8 +46641,7 @@ function maskedInputSources(deps, template, resources, conditions, stackName) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/create.ts
+// src/deployment/deploy-engine/create.ts
 async function provisionCreate(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
 	const renderer = getLiveRenderer();
@@ -47203,8 +46919,7 @@ async function resumeAbandonedCreate(engine, args) {
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/data-delete-intent.ts
+// src/provisioning/data-delete-intent.ts
 const S3_AUTO_DELETE_OBJECTS_TAG = "aws-cdk:auto-delete-objects";
 const ECR_AUTO_DELETE_IMAGES_TAG = "aws-cdk:auto-delete-images";
 function hasCdkAutoDeleteTag(properties, tagKey) {
@@ -47220,8 +46935,7 @@ function isTruthyCfnBoolean(value) {
 	return value === true || value === "true";
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-ttl.ts
+// src/provisioning/dynamodb-ttl.ts
 function readTtlSpec(spec) {
 	if (spec === void 0 || spec === null) return {
 		enabled: false,
@@ -47287,8 +47001,7 @@ async function sendTtlWaitingOutRateLimit(send, options) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-vector-indexes.ts
+// src/provisioning/dynamodb-vector-indexes.ts
 function vectorIndexesByName(value) {
 	const out = /* @__PURE__ */ new Map();
 	if (!Array.isArray(value)) return out;
@@ -47301,7 +47014,7 @@ function vectorIndexesByName(value) {
 }
 function vectorIndexesShapeDetail(value) {
 	if (value === void 0) return void 0;
-	if (!Array.isArray(value)) return `VectorIndexes must be a list, got ${typeof value}`;
+	if (!Array.isArray(value)) return `VectorIndexes must be a list, got ${value === null ? "null" : typeof value}`;
 	return value.every((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && typeof entry["IndexName"] === "string") ? void 0 : `every VectorIndexes entry must carry a string IndexName`;
 }
 function vectorIndexForSend(entry) {
@@ -47406,8 +47119,7 @@ function vectorIndexesSettled(live) {
 	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-index-busy-delete.ts
+// src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
 	if (maskSecrets === void 0) return logger;
 	const maskedName = name === void 0 || name === "" ? name : maskSecrets(name);
@@ -47540,8 +47252,7 @@ async function deleteTableWithIndexBusyRetry(opts) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/dynamodb-delete-budget.ts
+// src/provisioning/providers/dynamodb-delete-budget.ts
 const DYNAMODB_DELETE_POLL_RTT_MS = 200;
 const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
 const DYNAMODB_DELETE_BUDGET_MS = 156e4;
@@ -47654,8 +47365,7 @@ function isResourceNotFoundError(error) {
 	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-contributor-insights.ts
+// src/provisioning/dynamodb-contributor-insights.ts
 const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
 function readContributorInsightsSpec(value, path) {
 	if (value === void 0 || value === null) return { kind: "absent" };
@@ -47759,8 +47469,7 @@ function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
 	return block;
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-replica-settings.ts
+// src/provisioning/dynamodb-replica-settings.ts
 const PITR_KEY = "PointInTimeRecoverySpecification";
 const KINESIS_KEY = "KinesisStreamSpecification";
 const TABLE_POLICY_KEY = "ResourcePolicy";
@@ -48289,8 +47998,7 @@ function keepUnreadReplicaMembers(desired, previous) {
 	} : desired;
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-stream-members.ts
+// src/provisioning/dynamodb-stream-members.ts
 const STREAM_SPECIFICATION_KEY$1 = "StreamSpecification";
 const STREAM_POLICY_KEY = "ResourcePolicy";
 const STREAM_TAGS_KEY = "Tags";
@@ -48487,8 +48195,7 @@ function canonicalJson(value) {
 	return JSON.stringify(value) ?? "null";
 }
 
-//#endregion
-//#region src/provisioning/providers/dynamodb-globaltable-provider.ts
+// src/provisioning/providers/dynamodb-globaltable-provider.ts
 function isTableName(id) {
 	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
 }
@@ -49094,6 +48801,19 @@ var DynamoDBGlobalTableProvider = class {
 			await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
 		}
 		await this.waitForReplicaActive(tableName, region, logicalId, void 0, maskSecrets);
+		const provisionedIndexes = replicaIndexes?.filter((i) => i.ProvisionedThroughputOverride);
+		if (create.ProvisionedThroughputOverride || provisionedIndexes?.length) {
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+			await this.dynamoDBClient.send(new UpdateTableCommand({
+				TableName: tableName,
+				ReplicaUpdates: [{ Update: {
+					RegionName: region,
+					...create.ProvisionedThroughputOverride && { ProvisionedThroughputOverride: create.ProvisionedThroughputOverride },
+					...provisionedIndexes?.length && { GlobalSecondaryIndexes: provisionedIndexes }
+				} }]
+			}));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		}
 		if (readReplicaDeletionProtection(replica, region, (message) => this.logger.warn(maskSecrets(message))) === true) await this.setReplicaDeletionProtection(tableName, region, true, logicalId, maskSecrets);
 	}
 	async setReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, budget) {
@@ -49886,6 +49606,17 @@ var DynamoDBGlobalTableProvider = class {
 			await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
+			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
+			const declaredRegions = declaredCrossRegions(properties, currentRegion);
+			const staysReplicated = liveHasCrossRegionReplica && declaredRegions.length > 0;
+			const literalWriteMoves = staysReplicated && literalWriteSideMoves(properties, previousProperties, currentRegion, describeResp.Table);
+			const statePath = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+			const addsRegionToLiteral = !statePath && properties["BillingMode"] === "PROVISIONED" && !writeSideScaled(properties) && declaredRegions.some((region) => !describeResp.Table?.Replicas?.some((r) => r.RegionName === region));
+			if (literalWriteMoves || addsRegionToLiteral) {
+				const refusal = `AWS::DynamoDB::GlobalTable ${logicalId}: a table with a cross-region replica needs an auto-scaled write side, and this update declares none: CloudFormation refuses a literal WriteCapacityUnits, and DynamoDB refuses every replica update without auto-scaling`;
+				if (statePath) warn(`${refusal}${refusal}. No capacity beyond what a billing flip carries was sent.`);
+				else throw new ProvisioningError(maskSecrets(`${refusal}. Nothing was applied to the table; declare WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings`), resourceType, logicalId, physicalId);
+			}
 			const vectorIndexesChanged = !deepEqual(properties["VectorIndexes"], previousProperties["VectorIndexes"]);
 			const vectorIndexShape = vectorIndexesShapeDetail(properties["VectorIndexes"]);
 			if (vectorIndexShape !== void 0 && vectorIndexesChanged) warn(`${vectorIndexShape}; the VectorIndexes change was not applied`);
@@ -49935,6 +49666,7 @@ var DynamoDBGlobalTableProvider = class {
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
 			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics, maskSecrets);
+			const tableCapacityChange = !literalWriteMoves && oldBilling === "PROVISIONED" && newBilling === "PROVISIONED" && liveBillingMode === "PROVISIONED" ? readTableCapacityChange(properties, previousProperties, currentRegion, diagnostics, maskSecrets) : void 0;
 			let desiredGsiUnusable = false;
 			const onUnusableGsiBlock = (message) => {
 				desiredGsiUnusable = true;
@@ -50057,7 +49789,6 @@ var DynamoDBGlobalTableProvider = class {
 				TableName: physicalId,
 				TableClass: tableClassUpdate
 			}, tableClassFromTemplate, "TableClass", physicalId, logicalId, maskSecrets);
-			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
 			if (sseUpdate?.KMSMasterKeyId !== void 0 && liveHasCrossRegionReplica) {
 				deferredSseUpdate = sseUpdate;
 				deferredSseFromTemplate = sseFromTemplate;
@@ -50121,33 +49852,47 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
-			const readBlockOf = (bag) => localReplicaEntry(bag, currentRegion)?.[TABLE_READ_PROVISIONED_KEY] ?? bag[TABLE_READ_PROVISIONED_KEY];
-			if (oldBilling === "PROVISIONED" && newBilling === "PROVISIONED" && liveBillingMode === "PROVISIONED" && (properties[TABLE_READ_PROVISIONED_KEY] !== void 0 || previousProperties[TABLE_READ_PROVISIONED_KEY] !== void 0) && !deepEqual(readBlockOf(properties), readBlockOf(previousProperties))) {
-				const wantRead = coerceCfnInteger(asRecord(readBlockOf(properties))?.["ReadCapacityUnits"]);
-				const liveThroughput = describeResp.Table?.ProvisionedThroughput;
-				if (wantRead !== void 0 && liveThroughput?.WriteCapacityUnits !== void 0 && wantRead !== liveThroughput.ReadCapacityUnits) {
-					markUnsettled(TABLE_READ_PROVISIONED_KEY);
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						ProvisionedThroughput: {
-							ReadCapacityUnits: wantRead,
-							WriteCapacityUnits: liveThroughput.WriteCapacityUnits
-						}
-					}));
-					await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
-				}
-			}
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
 			const autoScalingApplied = /* @__PURE__ */ new Set();
-			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual(writeAutoScalingOld, effectiveNewAutoScaling)) {
+			const autoScalingMeaningful = newBilling === "PROVISIONED" || oldBilling === "PROVISIONED";
+			if (literalWriteMoves) autoScalingApplied.add(autoScalingTargetKey({
+				dimension: "dynamodb:table:WriteCapacityUnits",
+				region: currentRegion
+			}));
+			if (autoScalingMeaningful && !literalWriteMoves && !deepEqual(writeAutoScalingOld, effectiveNewAutoScaling)) {
 				await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling, void 0, void 0, void 0, maskSecrets);
 				autoScalingApplied.add(autoScalingTargetKey({
 					dimension: "dynamodb:table:WriteCapacityUnits",
 					region: currentRegion
 				}));
 			}
+			if (tableCapacityChange) {
+				const liveThroughput = describeResp.Table?.ProvisionedThroughput;
+				const sendRead = tableCapacityChange.read ?? liveThroughput?.ReadCapacityUnits;
+				const sendWrite = tableCapacityChange.write ?? liveThroughput?.WriteCapacityUnits;
+				const readMoves = sendRead !== liveThroughput?.ReadCapacityUnits;
+				const writeMoves = sendWrite !== liveThroughput?.WriteCapacityUnits;
+				if (sendRead !== void 0 && sendWrite !== void 0 && (readMoves || writeMoves)) {
+					markUnsettled(...readMoves ? tableCapacityChange.readKeys : [], ...writeMoves ? [TABLE_WRITE_PROVISIONED_KEY] : []);
+					await this.dynamoDBClient.send(new UpdateTableCommand(staysReplicated ? {
+						TableName: physicalId,
+						ReplicaUpdates: [{ Update: {
+							RegionName: currentRegion,
+							ProvisionedThroughputOverride: { ReadCapacityUnits: sendRead }
+						} }]
+					} : {
+						TableName: physicalId,
+						ProvisionedThroughput: {
+							ReadCapacityUnits: sendRead,
+							WriteCapacityUnits: sendWrite
+						}
+					}));
+					if (liveHasCrossRegionReplica) await this.waitForGlobalTableSettled(physicalId, logicalId, maskSecrets);
+					else await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
+				}
+			}
 			const modeUpdate = replicationModeUpdate(properties, previousProperties);
 			if (modeUpdate === "DISABLED" && readReplicationMode(properties).kind === "absent") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
 			const replicaDiff = diffReplicas(previousProperties["Replicas"] ?? [], properties["Replicas"] ?? []);
@@ -50229,7 +49974,7 @@ var DynamoDBGlobalTableProvider = class {
 					TableName: physicalId,
 					ReplicaUpdates: [{ Update: updateAction }]
 				}));
-				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
+				await this.waitForGlobalTableSettled(physicalId, logicalId, maskSecrets, { region });
 			}
 			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
 			if (modeUpdate !== void 0 && readReplicationMode(properties).kind === "usable") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
@@ -50994,12 +50739,15 @@ var DynamoDBGlobalTableProvider = class {
 				let protection;
 				let disassociationProtection;
 				let streamArn;
+				let regionalRead;
 				if (isLocal) {
+					regionalRead = table.ProvisionedThroughput?.ReadCapacityUnits;
 					protection = table.DeletionProtectionEnabled;
 					disassociationProtection = table.DisassociationProtectionEnabled;
 					streamArn = table.LatestStreamArn;
 				} else try {
 					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
+					regionalRead = regional.Table?.ProvisionedThroughput?.ReadCapacityUnits;
 					protection = regional.Table?.DeletionProtectionEnabled;
 					disassociationProtection = regional.Table?.DisassociationProtectionEnabled;
 					streamArn = regional.Table?.LatestStreamArn;
@@ -51030,6 +50778,7 @@ var DynamoDBGlobalTableProvider = class {
 					const replicaAutoScalingClient = isLocal ? void 0 : this.getRegionalAutoScalingClient(regionLabel);
 					const readAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:table:ReadCapacityUnits", replicaAutoScalingClient);
 					if (readAutoScaling) entry["ReadProvisionedThroughputSettings"] = { ReadCapacityAutoScalingSettings: readAutoScaling };
+					else if (strictFor("Replicas") && regionalRead !== void 0) entry["ReadProvisionedThroughputSettings"] = { ReadCapacityUnits: regionalRead };
 				}
 				return entry;
 			})));
@@ -51577,6 +51326,7 @@ const REPLICA_SETTING_MEMBERS = [
 const REPLICATION_MODE_KEY = "GlobalTableSettingsReplicationMode";
 const TABLE_READ_ON_DEMAND_KEY = "ReadOnDemandThroughputSettings";
 const TABLE_READ_PROVISIONED_KEY = "ReadProvisionedThroughputSettings";
+const TABLE_WRITE_PROVISIONED_KEY = "WriteProvisionedThroughputSettings";
 function readReplicationMode(properties) {
 	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const declared = replicas.map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY]).filter((value) => value !== void 0 && value !== null);
@@ -51723,6 +51473,41 @@ function derivePerCallProvisionedThroughput(properties, region, source = "min",
 		WriteCapacityUnits: write ?? DEFAULT_CAPACITY_UNITS
 	};
 }
+function declaredCrossRegions(properties, region) {
+	const replicas = properties["Replicas"];
+	return (Array.isArray(replicas) ? replicas : []).map((replica) => asRecord(replica)?.["Region"]).filter((name) => typeof name === "string" && name !== region);
+}
+function writeSideScaled(bag) {
+	return asRecord(bag[TABLE_WRITE_PROVISIONED_KEY])?.["WriteCapacityAutoScalingSettings"] !== void 0;
+}
+function literalWriteSideMoves(properties, previousProperties, region, live) {
+	if (properties["BillingMode"] !== "PROVISIONED" || writeSideScaled(properties)) return false;
+	if (writeSideScaled(previousProperties)) return true;
+	if (live?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST") return true;
+	const change = readTableCapacityChange(properties, previousProperties, region, [], (t) => t);
+	return change.write !== void 0 && change.write !== live?.ProvisionedThroughput?.WriteCapacityUnits || change.read !== void 0 && change.read !== live?.ProvisionedThroughput?.ReadCapacityUnits;
+}
+function readTableCapacityChange(properties, previousProperties, region, diagnostics, maskSecrets) {
+	const localBlockOf = (bag) => localReplicaEntry(bag, region)?.[TABLE_READ_PROVISIONED_KEY];
+	const readBlockOf = (bag) => localBlockOf(bag) ?? bag[TABLE_READ_PROVISIONED_KEY];
+	const literal = (block, previousBlock, side, blockName) => {
+		if (deepEqual(block, previousBlock)) return void 0;
+		const settings = asRecord(block);
+		if (settings?.[`${side}CapacityAutoScalingSettings`] !== void 0) return void 0;
+		const units = coerceCfnInteger(settings?.[`${side}CapacityUnits`]);
+		if (units === void 0) reportUnresolvedProvisionedCapacity(block, side, "min", { suppressed: "so cdkd sent no capacity for it and the old value stays on AWS" }, diagnostics, { blockName }, maskSecrets);
+		return units;
+	};
+	const read = literal(readBlockOf(properties), readBlockOf(previousProperties), "Read", localBlockOf(properties) !== void 0 ? `Replicas[local].${TABLE_READ_PROVISIONED_KEY}` : TABLE_READ_PROVISIONED_KEY);
+	const write = literal(properties[TABLE_WRITE_PROVISIONED_KEY], previousProperties[TABLE_WRITE_PROVISIONED_KEY], "Write", TABLE_WRITE_PROVISIONED_KEY);
+	const declaredOnReplica = localBlockOf(properties) !== void 0 || localBlockOf(previousProperties) !== void 0;
+	const declaredOnTable = properties[TABLE_READ_PROVISIONED_KEY] !== void 0 || previousProperties[TABLE_READ_PROVISIONED_KEY] !== void 0;
+	return {
+		...read !== void 0 && { read },
+		...write !== void 0 && { write },
+		readKeys: [...declaredOnTable ? [TABLE_READ_PROVISIONED_KEY] : [], ...declaredOnReplica ? ["Replicas"] : []]
+	};
+}
 const DEFAULT_CAPACITY_UNITS = 5;
 const DYNAMODB_SCALABLE_DIMENSIONS = /* @__PURE__ */ new Set([
 	"dynamodb:table:WriteCapacityUnits",
@@ -52465,8 +52250,7 @@ function lsiListOrEmpty(value) {
 	return value;
 }
 
-//#endregion
-//#region src/provisioning/protection-flags.ts
+// src/provisioning/protection-flags.ts
 const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Logs::LogGroup": "DeletionProtectionEnabled",
 	"AWS::RDS::DBInstance": "DeletionProtection",
@@ -52521,8 +52305,7 @@ function isProtectionValueActive(resourceType, value) {
 	return isTruthyCfnBoolean(value);
 }
 
-//#endregion
-//#region src/provisioning/recorded-protection.ts
+// src/provisioning/recorded-protection.ts
 const READER_LABELS = {
 	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled on the table or a replica",
 	"AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancerAttributes deletion_protection.enabled"
@@ -52556,8 +52339,7 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/update-replace.ts
+// src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement(engine, { change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent, nameGenerationFields }) {
 	const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
 		record: currentResource,
@@ -52834,8 +52616,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 	engine.logger.info(replacedLine);
 }
 
-//#endregion
-//#region src/provisioning/cc-autoroute-update-remedy.ts
+// src/provisioning/cc-autoroute-update-remedy.ts
 const TYPE_FORMAT = /^[A-Z][A-Za-z0-9]+(::[A-Z][A-Za-z0-9]+)+$/;
 const PROPERTY_FORMAT = /^[A-Z][A-Za-z0-9]*$/;
 const LOGICAL_ID_FORMAT = /^[A-Za-z][A-Za-z0-9]{0,254}$/;
@@ -52850,8 +52631,7 @@ function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedPrope
 	return `\nThis update moved the resource from its SDK provider to Cloud Control API, because the SDK provider does not handle ${shown}. Cloud Control addresses it by the physical id the SDK provider recorded, and for some types that is not an identifier Cloud Control accepts. ` + (nestedChild ? `It is in a nested stack, which --recreate-via-cc-api cannot address: ${preferSdk}, or remove ${them} from the template.` : `Two ways through: re-create the resource on Cloud Control with --recreate-via-cc-api ${id} (destroys and re-creates it), or ${preferSdk}.`);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/update-in-place.ts
+// src/deployment/deploy-engine/update-in-place.ts
 async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
 	engine.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = engine.providerRegistry.getProviderFor({
@@ -53249,12 +53029,10 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	engine.logger.info(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
-//#endregion
-//#region src/provisioning/changed-properties-consumers.ts
+// src/provisioning/changed-properties-consumers.ts
 const CHANGED_PROPERTIES_CONSUMER_TYPES = /* @__PURE__ */ new Set(["AWS::ServiceDiscovery::Service"]);
 
-//#endregion
-//#region src/deployment/deploy-engine/read-provenance-moved.ts
+// src/deployment/deploy-engine/read-provenance-moved.ts
 function occurrences(value, token) {
 	if (typeof value === "string") return value.includes(token) ? value.split(token).length - 1 : 0;
 	if (Array.isArray(value)) {
@@ -53365,8 +53143,7 @@ function withRefreshedReadVersions(record, unchanged) {
 	return withReferenceProvenance(record, out);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/update.ts
+// src/deployment/deploy-engine/update.ts
 function isWhollyMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.length > 0 && value.every(isWhollyMask);
@@ -54050,8 +53827,7 @@ function readsProducerReplacedThisRun(engine, template, logicalId, stateResource
 	});
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/provision.ts
+// src/deployment/deploy-engine/provision.ts
 const NESTED_STACK_ROW_TYPE = "AWS::CloudFormation::Stack";
 async function provisionResource(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
@@ -54232,8 +54008,7 @@ async function provisionResourceBody(engine, logicalId, change, stateResources,
 	});
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/execute.ts
+// src/deployment/deploy-engine/execute.ts
 const NO_REPLACEMENT_ORPHAN_TYPES = /* @__PURE__ */ new Set([
 	"AWS::CloudFormation::Stack",
 	"AWS::SQS::QueuePolicy",
@@ -54874,8 +54649,7 @@ async function journalOrphanIdentity(engine, orphanOp, carried) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/deploy-flow.ts
+// src/deployment/deploy-engine/deploy-flow.ts
 const TAIL_WARM_CONNECTIONS = 3;
 async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefetch) {
 	const startTime = Date.now();
@@ -55450,8 +55224,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine.ts
+// src/deployment/deploy-engine.ts
 const EMPTY_SECRETS = /* @__PURE__ */ new Map();
 var InterruptedError = class extends Error {
 	constructor(reason = "user") {
@@ -55905,6 +55678,5 @@ function sameGenerationClaimsOf(record) {
 	};
 }
 
-//#endregion
-export { ECR_AUTO_DELETE_IMAGES_TAG as $, explicitRoleArnOrThrow as $a, printingCorpusOf as $c, wouldReturnToSdkProvider as $i, importableOutputKeys as $l, retiredNameGenerationsAfter as $n, malformedOutputsRefusalMessage as $o, supersededAfterRollback as $r, isStatefulRecreateTargetSync as $s, journaledOrphanLines as $t, resolveApp as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, unsettledItemsField as Aa, isMarkedCoordinate as Ac, ownValue as Ad, earliestDefined as Ai, recordProvenPublicExpression as Al, isJournaledOrphan as An, STATE_REGION_DIVERGED as Ao, rollbackOrphanIds as Ar, refuseMalformedResourcesForExport as As, makeSiblingClaimReader as At, describeDockerCapturedOutput as Au, deleteTableWithIndexBusyRetry as B, s3BucketDualStackDomainName as Ba, readsNoEchoSource as Bc, DBPROXY_TAGS_WHAT as Bi, applyCrossPrefixScan as Bl, findNestedStackTypeChanges as Bn, isReadableOrphanRecord as Bo, withStackRecords as Br, unreadableResourceEntries as Bs, getNestedRevertRun as Bt, redactDockerArgvValues as Bu, planContributorInsightsOp as C, isTerminationProtectionPropagationError as Ca, emrClusterInstancesReplaced as Cc, describeJsonParseFailure as Cd, buildFinalSnapshotIdentifier as Ci, splitGetAttStringForm as Cl, settleUnsettledPrevious as Cn, refStateLookupFromResource as Co, maskingRetryLogger as Cr, refuseMalformedResourceEntriesForOrphan as Cs, enclosingDeadlineRemainingMs as Ct, parseBootstrapMarker as Cu, reverseMapTableContributorInsights as D, DiffCalculator as Da, DagBuilder as Dc, hasOwnKey as Dd, isFinalSnapshotError as Di, recordMaskOnlyValuesIn as Dl, equalModuloMask as Dn, passedParameterClassesOf as Do, findRefactorHints as Dr, refuseMalformedResourcePropertiesForOrphan as Ds, keptWholeReasonText as Dt, buildDenyExternalAccessPolicy as Du, reverseMapIndexContributorInsights as E, reEnableInstanceApiTermination as Ea, sameLambdaFunctionAddress as Ec, defineOwnKey as Ed, effectiveDeletionPolicy as Ei, recordMaskOnlyValue as El, equalModuloMarkedMask as En, parameterInputsFor as Eo, formatDestructiveChange as Er, refuseMalformedResourcePropertiesForExport as Es, isSecretBearingReferenceString as Et, validateContainerRepoName as Eu, resolveDynamoDbDeleteBudgetClock as F, IntrinsicFunctionResolver as Fa, noEchoCoordinatesOf as Fc, resolveAssemblyPath as Fd, DeploymentEventsReader as Fi, isLockInfoExpired as Fl, recordUnderIdIsNotOwn as Fn, deployRefusesOrphanRowsReason as Fo, parseMappingFile as Fr, repairMalformedResourceEntriesForReadOnly as Fs, recordRetainedForReadoption as Ft, formatDockerLoginError as Fu, readbackVectorIndexes as G, refuseUnreadableCdkCrossAccountRefs as Ga, redactForState as Gc, tagMapAsList as Gi, withStackInstanceIdWithheld as Gl, redactedDeleteAddressFields as Gn, malformedLocalOutputsWarning as Go, green as Gr, unwrittenCreateOnlyReplacement as Gs, withNestedRevertRun as Gt, warnFinchArgvExposure as Gu, relayedIndexBusyDelete as H, s3BucketWebsiteUrl as Ha, valueAtCoordinate as Hc, planTagDiff as Hi, isAccessDenied$1 as Hl, inheritProducerRegions as Hn, malformedDriftResourcePropertiesWarning as Ho, bold as Hr, findActionableSilentDrops as Hs, recordDisplacedSkips as Ht, redactedDockerCause as Hu, resolveDynamoDbDeleteBudgetMs as I, poisonRenderedSpellingsCollidingIn as Ia, noEchoLeavesOf as Ic, injectAwsRegion as Id, DeploymentEventsStore as Ii, S3StateBackend as Il, replacementNeverSwapped as In, displayLogicalId as Io, proposeRenames as Ir, repairMalformedResourcePropertiesForReadOnly as Is, NESTED_PENDING_PARENT_REASON as It, getDockerCmd as Iu, isTtlAlreadyDisabled as J, recordedOutputReferenceRegions as Ja, carryLogOnlyValues as Jc, stringifyIfAssigned as Ji, describeRegionValueKind as Jl, updatePartialReason as Jn, malformedOrphanRecordsRefusalMessage as Jo, addSuperseded as Jr, hasNoCloudControlHandlers as Js, withNestedStackContext as Jt, Synthesizer as Ju, vectorIndexesForCreate as K, keepHeldTokenProvenance as Ka, recordReferenceProvenanceEntry as Kc, tagPlanWarning as Ki, splitImportedOps as Kl, redactedDeleteAddressSkip as Kn, malformedLocalResourceEntriesWarning as Ko, red as Kr, withoutSilentDropProperties as Ks, collectNestedChildUnaddressed as Kt, AssetManifestLoader as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, isSettledInstanceState as La, noEchoOutputsComparison as Lc, injectedAwsRegionValue as Ld, extractDeploymentEventError as Li, rebuildClientForBucketRegion as Ll, resolveReplacementOldType as Ln, hasReadableOrphans as Lo, awaitInFlightSibling as Lr, repairMalformedResourcesForReadOnly as Ls, displacedOpClause as Lt, isDockerClientEnvKey as Lu, beginDeleteWait as M, unsettledPropertiesOf as Ma, maskReadbackAtCoordinates as Mc, describeFileReadFailure as Md, reserveStackCreateToken as Mi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ml, planFailedOps as Mn, UNREADABLE_ORPHANS_CONTAINER_ROW as Mo, isPairableType as Mr, repairMalformedOrphanRecordsForReadOnly as Ms, pendingRequestCount as Mt, describeDockerFailure as Mu, compensateRemovedDeletionProtection as N, withUnsettledProperties as Na, maskWholeValue as Nc, displayAssemblyPath as Nd, withCreateTokenLedger as Ni, isSingleDynamicReferenceToken as Nl, planRollback as Nn, UNREADABLE_RESOURCES_MAP_ROW as No, looselyEqual as Nr, repairMalformedOrphansForReadOnly as Ns, resolvePendingCloudControlRequests as Nt, dockerSpawnEnvWithSensitive as Nu, stripIndexContributorInsights as O, INTRINSIC_KEYS as Oa, TemplateParser as Oc, hasPlainPrototype$1 as Od, refusesFinalSnapshot as Oi, recordNoEchoAttributeValues as Ol, undeclaredEmptyObservedKeys as On, declaresNoEcho as Oo, hintSidesOf as Or, refuseMalformedResourcesForDeploy as Os, mergeNoChangeOutputs as Ot, buildDockerImage as Ou, deleteBudgetKey as P, withoutUnsettledProperties as Pa, maskedLeafCoordinatesOf as Pc, renderAssemblyPathEscape as Pd, acquireIdempotencyToken as Pi, LockManager as Pl, recheckFailedPlan as Pn, accountArgs as Po, mappingPairs as Pr, repairMalformedOutputsForReadOnly as Ps, keptForRetainedRecord as Pt, finchSecretArgvRefusal as Pu, sendTtlWaitingOutRateLimit as Q, assertSendableRoleArn as Qa, logOnlyValueCount as Qc, isCustomResource as Qi, hasUnverifiableParameterRefusal as Ql, retiredAfterRollback as Qn, malformedOrphansWarning as Qo, removeSuperseded as Qr, isStatefulRecreateTargetForReplace as Qs, isHandledOrphan as Qt, loadCdkJson as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, s3BucketArn as Ra, passedNoEchoParametersOf as Rc, clearBucketRegionCache as Rd, isRefusedByName as Ri, CrossPrefixReadError as Rl, seedsDeleteFirstGuard as Rn, hasReadableOutputs as Ro, destroyStackRecordsView as Rr, unpreviewableOrphanRecords as Rs, displacedPhysicalIdShown as Rt, isMalformedEnvKey as Ru, indexDeclaresContributorInsights as S, ec2InstanceProtectionSite as Sa, ecsServiceLaunchTypeSetOrChanged as Sc, processStackMessages as Sd, PRE_DELETE_SNAPSHOT_TYPES as Si, recordPhysicalNameCopy as Sl, recordAfterRollbackUpdate as Sn, lacksRecordedTableArn as So, DEFAULT_RESOURCE_WARN_AFTER_MS as Sr, refuseMalformedResourceEntriesForImportSave as Ss, enclosingDeadlineExpired as St, isCrossRegionRedirect as Su, readContributorInsightsSpec as T, reDisableInstanceApiTermination as Ta, lambdaFunctionNameForMask as Tc, utf8ByteLength as Td, createPreDeleteFinalSnapshot as Ti, provenPublicValue as Tl, calculateResourceDrift as Tn, withSharedDrainBudget as To, findDestructiveChanges as Tr, refuseMalformedResourcePropertiesForDrift as Ts, diffSecurity as Tt, validateAssetBucketName as Tu, waitForIndexesSettled as U, resolveDynamicReferences as Ua, liveMatchesUnresolvedTokenFrame as Uc, readTagList as Ui, isNotImplemented as Ul, REDACTED_DELETE_ADDRESS_SKIP_REASON as Un, malformedExportNamesWarning as Uo, cyan as Ur, findHandledUnwrittenCreateOnly as Us, revertNestedChildFromJournal as Ut, runDockerForeground as Uu, maskedLogger as V, s3BucketRegionalDomainName as Va, recordedNoEchoValuesOf as Vc, DBPROXY_TAG_OPTIONS as Vi, crossPrefixDeniedWarning as Vl, getCurrentProducerRegions as Vn, isReadableResourceEntry as Vo, replacedDeleteFailureVerdict as Vr, withheldAccountClause as Vs, nestedChildStackName as Vt, redactedCause as Vu, planVectorIndexUpdates as W, producerLookupOver as Wa, markSameGenerationBag as Wc, refuseMalformedDesiredTags as Wi, stackInstanceIdOf as Wl, isRedactedRecordedValue as Wn, malformedExportSourceWarning as Wo, gray as Wr, findSilentDropProperties as Ws, revertedNestedRowIds as Wt, runDockerStreaming as Wu, planTimeToLive as X, applyRoleArnIfSet as Xa, hasMaskableValues as Xc, ProviderRegistry as Xi, hasReadableExportSet as Xl, nameGenerationHighWaterOf as Xn, malformedOrphanRowsKeptWarning as Xo, holdsSupersededResources as Xr, shownType as Xs, dropFailedCommands as Xt, getDefaultStateBucketName as Xu, isTtlRateLimited as Y, recordedReferenceRegions as Ya, createUnionSecretMasker as Yc, CC_BROKEN_REASON as Yi, exportNamesCarriedFrom as Yl, nameGenerationCarriedFrom as Yn, malformedOrphanRecordsWarning as Yo, deleteSupersededEntry as Yr, findReplacedReadersOfRecreateTargets as Ys, deleteJournaledOrphans as Yt, synthesisStatusMessage as Yu, readTtlSpec as Z, assertFlagRoleArn as Za, literalSplitDelimitersOf as Zc, ccBrokenReason as Zi, hasReasonlessBaselineRefusal as Zl, nameScopeOf as Zn, malformedOrphansRefusalMessage as Zo, isSupersededResourceRecord as Zr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Zs, dropFailedHint as Zt, getLegacyStateBucketName as Zu, streamMemberRefusals as _, deleteSkipReason as _a, templateResourceTypes as _c, PARTITION_TABLE as _d, secretNamedAttributeNamesOf as _i, inheritNestedStackParameterAssociations as _l, pendingMovesRefusalMessage as _n, isNamelessDynamicReferenceError as _o, collectDeclaredOutputNames as _r, refuseMalformedResourceAttributesForOrphan as _s, templateIdentity as _t, AssetModeResolver as _u, isProtectionValueActive as a, withPrintingSecrets as aa, toFiniteNumber as ac, resolveUseCdkBootstrapAssets as ad, noEchoComparisonForTemplate as ai, errorCauseChain as al, isAccessDeniedError as an, envCredentialsAreAssumedRole as ao, resourcesNamingDeclaredParameter as ar, malformedScrubResourceEntriesRefusalMessage as as, IMPLICIT_DELETE_DEPENDENCIES as at, stackInstanceIdCarriedFrom as au, CONTRIBUTOR_INSIGHTS_KEY as b, markWaitAbandoned as ba, blockDeviceMappingsDifferOnlyInDeleteOnTermination as bc, AssemblyReader as bd, storedSecretNameNeedles as bi, physicalNameCopiesOf as bl, replayRollback as bn, cfnRefValueFromPhysicalId as bo, bindingSkippedOutputs as br, refuseMalformedResourceEntriesForDestroy as bs, parentSuppliedValues as bt, ensureAssetStorage as bu, DynamoDBGlobalTableProvider as c, customResourceResponseExpirationWarning as ca, configBooleanRefusal as cc, ssmResolvedValueType as cd, withAttemptedItemsMasked as ci, scrubResourceRecord as cl, readRefactorMarker as cn, producerRegionsFromState as co, exportAliasCollisionScrubWarning as cr, refuseDivergentRecordRegionForDestroy as cs, inheritedProvenanceForChildDiff as ct, timePhase as cu, declaredStreamPolicyMember as d, onlySecretReferencesDiffer as da, readConfigString as dc, MIGRATE_TMP_PREFIX as dd, journaledOrphanPrintingBag as di, DYNAMIC_REFERENCE_TOKEN_SCAN as dl, refactorMarkerRefusalMessage as dn, isUnboundTemplateParameter as do, secretSafeKeyDisplay as dr, refuseMalformedOrphanRecordsForDestroy as ds, serviceTokenBlockingReason as dt, stringifyValue as du, waitForLambdaFunctionActive as ea, renderStatefulReason as ec, resolveAutoAssetStorage as ed, supersededHeldByOtherTypeWarning as ei, recordLogOnlyParameterValue as el, loadJournaledOrphans as en, isIamRoleArn as eo, retiredNameGenerationsLeaving as er, malformedOutputsWarning as es, S3_AUTO_DELETE_OBJECTS_TAG as et, importableOutputs as eu, declaredStreamTagsMember as f, unchangedBehindSecretReference as fa, replayWarn as fc, findLargeInlineResources as fd, maskEventTextWithBoundBags as fi, dynamicReferenceTokens as fl, refuseRefactorMarker as fn, parameterTypeMayLoseSecretIdentity as fo, carriedExportAliasExposure as fr, refuseMalformedOrphans as fs, childTemplateLoader as ft, WorkGraph as fu, streamDeclaresTags as g, deleteLeftInPlace as ga, prefetchCreateOnlyPropertyPaths as gc, expectedOwnerParam as gd, secretNamePrintingBags as gi, identityKeyFor as gl, pendingMovesOutOf as gn, carriesFetchableDynamicReference as go, noEchoParameterValueSeed as gr, refuseMalformedOutputsForDestroy as gs, renderNestedTemplateTreeDefect as gt, rewriteTemplateAssetReferences as gu, streamDeclaresPolicy as h, deleteIndeterminateGuards as ha, requireConfigString as hc, decodeListingKey as hd, secretNamePrintingBag as hi, spelledKeysOf as hl, hasPendingMovesOut as hn, carriesDynamicReference as ho, isWholeDynamicReferenceValue as hr, refuseMalformedOutputs as hs, listNestedTemplateRows as ht, loadPublishableAssetManifest as hu, PROTECTION_PROPERTY_BY_TYPE as i, getCurrentResourceSecrets as ia, toCfnInteger as ic, resolveStateBucketWithDefaultAndSource as id, noEchoAttributeNamesOf as ii, createSecretMasker as il, chunks as in, callerEnvCredentials as io, reachableDivergentParameters as ir, malformedResourcesWarning as is, markRefusedBeforeApplying as it, shouldRetainResource as iu, DYNAMODB_DELETE_POLL_COST_MS as j, unsettledItemsOf as ja, maskAtCoordinates as jc, absoluteAssemblyPathEscape as jd, ledgerForStack as ji, wholeStringLeavesOf as jl, isReplacementOrphan as jn, STATE_RESOURCES_MALFORMED as jo, withMovedTo as jr, refuseMalformedState as js, planOrphanAdoption as jt, describeDockerExecFailure as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, isUsableAttemptedName as ka, canonicalCoordinates as kc, nullPrototypeRecord as kd, unsupportedFinalSnapshotError as ki, recordNoEchoParameterFreshValue as kl, demoteSupersededOrphans as kn, JSON_LISTING_HOLE_VALUE as ko, movedToHint as kr, refuseMalformedResourcesForDestroy as ks, makeCanonicalizePropertiesFn as kt, resolveDockerContextDirectory as ku, STREAM_POLICY_KEY as l, CloudControlProvider as la, configIntegerRefusal as lc, CFN_TEMPLATE_BODY_LIMIT as ld, createReadOnlyAttributeHealerFactory as li, withPhysicalNameCopies as ll, readRefactorMarkerOnce as ln, regionLessSecretName as lo, secretBearing as lr, refuseMalformedNestedChildOutputs as ls, deferredServiceTokenWarning as lt, AssetPublisher as lu, reverseMapStreamPolicy as m, UNSPECIFIED_SKIP_REASON as ma, requireConfigObject as mc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as md, orphanRecordsPrintingBag as mi, pathCrossesDottedKey as ml, updateRefactorMarker as mn, isImpossibleEmptyStoredAttribute as mo, exportNameSecretExposure as mr, refuseMalformedOrphansForOrphan as ms, isAbsoluteAssetPath as mt, createAssetRedirectResolver as mu, recordedProtectionEvidence as n, readsNoEchoDeleteValues as na, coerceWarmThroughput as nc, resolveSkipPrefix as nd, supersededResourcesOf as ni, shareLogOnlyValues as nl, sameJournaledOrphans as nn, AWS_CREDENTIAL_ENV_KEYS as no, computeParameterTaint as nr, malformedResourceEntriesWarning as ns, isTruthyCfnBoolean as nt, orphansAfterRollback as nu, perType as o, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as oa, coerceCfnBoolean as oc, stateBucketExistenceConfirmed as od, noEchoExactEchoLeavesOf as oi, maskSecretsInError as ol, lookupEachName as on, classifyRecordedSecretRegion as oo, WITHHELD_NAME_DISPLAY as or, malformedStateRefusalMessage as os, computeImplicitDeleteEdges as ot, PhaseClock as ou, planStreamMemberOps as p, RollbackInlinePolicyWriters as pa, requireConfigArray as pc, uploadCfnTemplate as pd, namingSecretsWithRecordedNoEcho as pi, isUncertifiedBaselineMaskPosition as pl, sameMove as pn, getAccountInfo as po, exportNameNoEchoParameters as pr, refuseMalformedOrphansForDestroy as ps, findNestedTemplateTreeDefect as pt, buildAssetRedirectMap as pu, vectorIndexesSettled as q, outputReferenceProvenanceOf as qa, snapshotPassProvenance as qc, definedAttributes as qi, acceptedCreateOnlyDropsOf as ql, updatePartialMessage as qn, malformedLocalResourcesWarning as qo, yellow as qr, NO_CC_HANDLERS_REASON as qs, getCurrentNestedStackContext as qt, getDockerImageBySourceHash as qu, recordedProtectionNote as r, isCustomResourceType as ra, isWarmThroughputDecrease as rc, resolveStateBucketWithDefault as rd, withoutSuperseded as ri, unionOfSecretBags as rl, formatResourceLine as rn, applyCallerIdentityCredentials as ro, namesAnyDeclaredParameter as rr, malformedResourcePropertiesWarning as rs, getPriorAttempts as rt, orphansCarriedFrom as ru, readProtection as s, applyCustomResourceResponseExpiration as sa, coerceCfnInteger as sc, warnDeprecatedNoPrefixCliFlag as sd, noEchoParameterNamesOf as si, maskSecretsInText as sl, withApiLimit as sn, classifyReplaySecretRegion as so, displayTextOrWithheld as sr, previewableOrphanRecords as ss, crossStackOutputProvenanceSource as st, renderPhaseTimings as su, DeployEngine as t, TemplateNoEchoReresolver as ta, WARM_THROUGHPUT_MEMBERS as tc, resolveCaptureObservedState as td, supersededHolderOf as ti, recordLogOnlyValue as tl, makeForeignHolderScan as tn, sendableAssumeRoleCommand as to, withNameGenerationReached as tr, malformedRenderedContainersWarning as ts, hasCdkAutoDeleteTag as tt, isReadableBag as tu, STREAM_TAGS_KEY as u, slowCcOperationTimeoutMs as ua, configStringRefusal as uc, CFN_TEMPLATE_URL_LIMIT as ud, completedReplayEntries as ui, withoutPhysicalNameCopies as ul, refactorMarkerMovesOf as un, coerceParameterTypedValue as uo, secretBearingStateKeyWarning as ur, refuseMalformedOrphanRecords as us, findServiceTokenRefusals as ut, isSensitiveAttributeName as uu, streamPolicyMatchesDeclared as v, withIndeterminateGuard as va, describeTypeWithThrottleRetry as vc, canonicalizeRegion as vd, secretNamedRecordNeedles as vi, recordNestedStackParameterExpressions as vl, refusePendingMovesOut as vn, keepsSecretReferenceToken as vo, collectPublishedOutputNames as vr, refuseMalformedResourceEntries as vs, conditionFingerprint as vt, BOOTSTRAP_MARKER_PREFIX as vu, planIndexContributorInsightsOps as w, observeThenDisableInstanceApiTermination as wa, canonicalLambdaFunctionName as wc, parseFailureDebugDetail as wd, ccRoutedFinalSnapshotError as wi, carriesSecretMask as wl, withUnprovenUnsettled as wn, parseWebACLArn as wo, constructPathOf as wr, refuseMalformedResourcePropertiesForDestroy as ws, withResourceDeadline as wt, readBootstrapMarkerBody as wu, contributorInsightsRefusals as x, disableInstanceApiTermination as xa, dbInstanceEngineChangeIsInPlace as xc, StageLoadError as xd, ATOMIC_FINAL_SNAPSHOT_TYPES as xi, recordAttributeIdCopy as xl, removeProtectionTypeList as xn, isStalePlaceholderArnAttribute as xo, DEFAULT_RESOURCE_TIMEOUT_MS as xr, refuseMalformedResourceEntriesForImport as xs, readRecordedConditionVerdicts as xt, getBootstrapMarkerKey as xu, streamTagsMatchDeclared as y, isWaitAbandonedError as ya, withRetry as yc, derivePartitionAndUrlSuffix as yd, stateSecretNameNeedles as yi, recoverMaskedOutput as yl, replayFailedOperations as yn, AWS_NO_VALUE as yo, isExportAliasCollision as yr, refuseMalformedResourceEntriesForDeploy as ys, conditionInputsFrom as yt, assertAssetBucketRegion as yu, TABLE_INDEX_NOUN as z, s3BucketDomainName as za, readbackPathFor as zc, resolveBucketRegion as zd, markDeleteStarted as zi, CrossPrefixScanCache as zl, orphanNeedsIdentity as zn, hasReadableResources as zo, getStackRecords as zr, unreadableOrphanRecords as zs, dropSettledNestedJournals as zt, partitionSensitiveEnv as zu };
-//# sourceMappingURL=deploy-engine-ClIUqDQL.js.map
+export { sendTtlWaitingOutRateLimit as $, assertSendableRoleArn as $a, logOnlyValueCount as $c, isCustomResource as $i, hasUnverifiableParameterRefusal as $l, retiredAfterRollback as $n, malformedOrphansWarning as $o, removeSuperseded as $r, isStatefulRecreateTargetForReplace as $s, isHandledOrphan as $t, loadCdkJson as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, isUsableAttemptedName as Aa, canonicalCoordinates as Ac, nullPrototypeRecord as Ad, unsupportedFinalSnapshotError as Ai, recordNoEchoParameterFreshValue as Al, demoteSupersededOrphans as An, JSON_LISTING_HOLE_VALUE as Ao, movedToHint as Ar, refuseMalformedResourcesForDestroy as As, makeCanonicalizePropertiesFn as At, resolveDockerContextDirectory as Au, deleteTableWithIndexBusyRetry as B, s3BucketDomainName as Ba, readbackPathFor as Bc, resolveBucketRegion as Bd, markDeleteStarted as Bi, CrossPrefixScanCache as Bl, orphanNeedsIdentity as Bn, hasReadableResources as Bo, getStackRecords as Br, unreadableOrphanRecords as Bs, dropSettledNestedJournals as Bt, partitionSensitiveEnv as Bu, planContributorInsightsOp as C, ec2InstanceProtectionSite as Ca, ecsServiceLaunchTypeSetOrChanged as Cc, processStackMessages as Cd, PRE_DELETE_SNAPSHOT_TYPES as Ci, recordPhysicalNameCopy as Cl, recordAfterRollbackUpdate as Cn, lacksRecordedTableArn as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImportSave as Cs, enclosingDeadlineExpired as Ct, isCrossRegionRedirect as Cu, reverseMapTableContributorInsights as D, reEnableInstanceApiTermination as Da, sameLambdaFunctionAddress as Dc, defineOwnKey as Dd, effectiveDeletionPolicy as Di, recordMaskOnlyValue as Dl, equalModuloMarkedMask as Dn, parameterInputsFor as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForExport as Ds, isSecretBearingReferenceString as Dt, validateContainerRepoName as Du, reverseMapIndexContributorInsights as E, reDisableInstanceApiTermination as Ea, lambdaFunctionNameForMask as Ec, utf8ByteLength as Ed, createPreDeleteFinalSnapshot as Ei, provenPublicValue as El, calculateResourceDrift as En, withSharedDrainBudget as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDrift as Es, diffSecurity as Et, validateAssetBucketName as Eu, resolveDynamoDbDeleteBudgetClock as F, withoutUnsettledProperties as Fa, maskedLeafCoordinatesOf as Fc, renderAssemblyPathEscape as Fd, acquireIdempotencyToken as Fi, LockManager as Fl, recheckFailedPlan as Fn, accountArgs as Fo, mappingPairs as Fr, repairMalformedOutputsForReadOnly as Fs, keptForRetainedRecord as Ft, finchSecretArgvRefusal as Fu, readbackVectorIndexes as G, producerLookupOver as Ga, markSameGenerationBag as Gc, refuseMalformedDesiredTags as Gi, stackInstanceIdOf as Gl, isRedactedRecordedValue as Gn, malformedExportSourceWarning as Go, gray as Gr, findSilentDropProperties as Gs, revertedNestedRowIds as Gt, runDockerStreaming as Gu, relayedIndexBusyDelete as H, s3BucketRegionalDomainName as Ha, recordedNoEchoValuesOf as Hc, DBPROXY_TAG_OPTIONS as Hi, crossPrefixDeniedWarning as Hl, getCurrentProducerRegions as Hn, isReadableResourceEntry as Ho, replacedDeleteFailureVerdict as Hr, withheldAccountClause as Hs, nestedChildStackName as Ht, redactedCause as Hu, resolveDynamoDbDeleteBudgetMs as I, IntrinsicFunctionResolver as Ia, noEchoCoordinatesOf as Ic, resolveAssemblyPath as Id, DeploymentEventsReader as Ii, isLockInfoExpired as Il, recordUnderIdIsNotOwn as In, deployRefusesOrphanRowsReason as Io, parseMappingFile as Ir, repairMalformedResourceEntriesForReadOnly as Is, recordRetainedForReadoption as It, formatDockerLoginError as Iu, vectorIndexesShapeDetail as J, outputReferenceProvenanceOf as Ja, snapshotPassProvenance as Jc, definedAttributes as Ji, acceptedCreateOnlyDropsOf as Jl, updatePartialMessage as Jn, malformedLocalResourcesWarning as Jo, yellow as Jr, NO_CC_HANDLERS_REASON as Js, getCurrentNestedStackContext as Jt, getDockerImageBySourceHash as Ju, vectorIndexesForCreate as K, refuseUnreadableCdkCrossAccountRefs as Ka, redactForState as Kc, tagMapAsList as Ki, withStackInstanceIdWithheld as Kl, redactedDeleteAddressFields as Kn, malformedLocalOutputsWarning as Ko, green as Kr, unwrittenCreateOnlyReplacement as Ks, withNestedRevertRun as Kt, warnFinchArgvExposure as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, poisonRenderedSpellingsCollidingIn as La, noEchoLeavesOf as Lc, injectAwsRegion as Ld, DeploymentEventsStore as Li, S3StateBackend as Ll, replacementNeverSwapped as Ln, displayLogicalId as Lo, proposeRenames as Lr, repairMalformedResourcePropertiesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, getDockerCmd as Lu, beginDeleteWait as M, unsettledItemsOf as Ma, maskAtCoordinates as Mc, absoluteAssemblyPathEscape as Md, ledgerForStack as Mi, wholeStringLeavesOf as Ml, isReplacementOrphan as Mn, STATE_RESOURCES_MALFORMED as Mo, withMovedTo as Mr, refuseMalformedState as Ms, planOrphanAdoption as Mt, describeDockerExecFailure as Mu, compensateRemovedDeletionProtection as N, unsettledPropertiesOf as Na, maskReadbackAtCoordinates as Nc, describeFileReadFailure as Nd, reserveStackCreateToken as Ni, WHOLE_DYNAMIC_REFERENCE_PATTERN as Nl, planFailedOps as Nn, UNREADABLE_ORPHANS_CONTAINER_ROW as No, isPairableType as Nr, repairMalformedOrphanRecordsForReadOnly as Ns, pendingRequestCount as Nt, describeDockerFailure as Nu, stripIndexContributorInsights as O, DiffCalculator as Oa, DagBuilder as Oc, hasOwnKey as Od, isFinalSnapshotError as Oi, recordMaskOnlyValuesIn as Ol, equalModuloMask as On, passedParameterClassesOf as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForOrphan as Os, keptWholeReasonText as Ot, buildDenyExternalAccessPolicy as Ou, deleteBudgetKey as P, withUnsettledProperties as Pa, maskWholeValue as Pc, displayAssemblyPath as Pd, withCreateTokenLedger as Pi, isSingleDynamicReferenceToken as Pl, planRollback as Pn, UNREADABLE_RESOURCES_MAP_ROW as Po, looselyEqual as Pr, repairMalformedOrphansForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, dockerSpawnEnvWithSensitive as Pu, readTtlSpec as Q, assertFlagRoleArn as Qa, literalSplitDelimitersOf as Qc, ccBrokenReason as Qi, hasReasonlessBaselineRefusal as Ql, nameScopeOf as Qn, malformedOrphansRefusalMessage as Qo, isSupersededResourceRecord as Qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qs, dropFailedHint as Qt, getLegacyStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, isSettledInstanceState as Ra, noEchoOutputsComparison as Rc, injectedAwsRegionValue as Rd, extractDeploymentEventError as Ri, rebuildClientForBucketRegion as Rl, resolveReplacementOldType as Rn, hasReadableOrphans as Ro, awaitInFlightSibling as Rr, repairMalformedResourcesForReadOnly as Rs, displacedOpClause as Rt, isDockerClientEnvKey as Ru, indexDeclaresContributorInsights as S, disableInstanceApiTermination as Sa, dbInstanceEngineChangeIsInPlace as Sc, StageLoadError as Sd, ATOMIC_FINAL_SNAPSHOT_TYPES as Si, recordAttributeIdCopy as Sl, removeProtectionTypeList as Sn, isStalePlaceholderArnAttribute as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForImport as Ss, readRecordedConditionVerdicts as St, getBootstrapMarkerKey as Su, readContributorInsightsSpec as T, observeThenDisableInstanceApiTermination as Ta, canonicalLambdaFunctionName as Tc, parseFailureDebugDetail as Td, ccRoutedFinalSnapshotError as Ti, carriesSecretMask as Tl, withUnprovenUnsettled as Tn, parseWebACLArn as To, constructPathOf as Tr, refuseMalformedResourcePropertiesForDestroy as Ts, withResourceDeadline as Tt, readBootstrapMarkerBody as Tu, waitForIndexesSettled as U, s3BucketWebsiteUrl as Ua, valueAtCoordinate as Uc, planTagDiff as Ui, isAccessDenied$1 as Ul, inheritProducerRegions as Un, malformedDriftResourcePropertiesWarning as Uo, bold as Ur, findActionableSilentDrops as Us, recordDisplacedSkips as Ut, redactedDockerCause as Uu, maskedLogger as V, s3BucketDualStackDomainName as Va, readsNoEchoSource as Vc, DBPROXY_TAGS_WHAT as Vi, applyCrossPrefixScan as Vl, findNestedStackTypeChanges as Vn, isReadableOrphanRecord as Vo, withStackRecords as Vr, unreadableResourceEntries as Vs, getNestedRevertRun as Vt, redactDockerArgvValues as Vu, planVectorIndexUpdates as W, resolveDynamicReferences as Wa, liveMatchesUnresolvedTokenFrame as Wc, readTagList as Wi, isNotImplemented as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedExportNamesWarning as Wo, cyan as Wr, findHandledUnwrittenCreateOnly as Ws, revertNestedChildFromJournal as Wt, runDockerForeground as Wu, isTtlRateLimited as X, recordedReferenceRegions as Xa, createUnionSecretMasker as Xc, CC_BROKEN_REASON as Xi, exportNamesCarriedFrom as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsWarning as Xo, deleteSupersededEntry as Xr, findReplacedReadersOfRecreateTargets as Xs, deleteJournaledOrphans as Xt, synthesisStatusMessage as Xu, isTtlAlreadyDisabled as Y, recordedOutputReferenceRegions as Ya, carryLogOnlyValues as Yc, stringifyIfAssigned as Yi, describeRegionValueKind as Yl, updatePartialReason as Yn, malformedOrphanRecordsRefusalMessage as Yo, addSuperseded as Yr, hasNoCloudControlHandlers as Ys, withNestedStackContext as Yt, Synthesizer as Yu, planTimeToLive as Z, applyRoleArnIfSet as Za, hasMaskableValues as Zc, ProviderRegistry as Zi, hasReadableExportSet as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRowsKeptWarning as Zo, holdsSupersededResources as Zr, shownType as Zs, dropFailedCommands as Zt, getDefaultStateBucketName as Zu, streamMemberRefusals as _, deleteLeftInPlace as _a, prefetchCreateOnlyPropertyPaths as _c, expectedOwnerParam as _d, secretNamePrintingBags as _i, identityKeyFor as _l, pendingMovesOutOf as _n, carriesFetchableDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputsForDestroy as _s, renderNestedTemplateTreeDefect as _t, rewriteTemplateAssetReferences as _u, isProtectionValueActive as a, getCurrentResourceSecrets as aa, toCfnInteger as ac, resolveStateBucketWithDefaultAndSource as ad, noEchoAttributeNamesOf as ai, createSecretMasker as al, chunks as an, callerEnvCredentials as ao, reachableDivergentParameters as ar, malformedResourcesWarning as as, markRefusedBeforeApplying as at, shouldRetainResource as au, CONTRIBUTOR_INSIGHTS_KEY as b, isWaitAbandonedError as ba, withRetry as bc, derivePartitionAndUrlSuffix as bd, stateSecretNameNeedles as bi, recoverMaskedOutput as bl, replayFailedOperations as bn, AWS_NO_VALUE as bo, isExportAliasCollision as br, refuseMalformedResourceEntriesForDeploy as bs, conditionInputsFrom as bt, assertAssetBucketRegion as bu, DynamoDBGlobalTableProvider as c, applyCustomResourceResponseExpiration as ca, coerceCfnInteger as cc, warnDeprecatedNoPrefixCliFlag as cd, noEchoParameterNamesOf as ci, maskSecretsInText as cl, withApiLimit as cn, classifyReplaySecretRegion as co, displayTextOrWithheld as cr, previewableOrphanRecords as cs, crossStackOutputProvenanceSource as ct, renderPhaseTimings as cu, declaredStreamPolicyMember as d, slowCcOperationTimeoutMs as da, configStringRefusal as dc, CFN_TEMPLATE_URL_LIMIT as dd, completedReplayEntries as di, withoutPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, coerceParameterTypedValue as do, secretBearingStateKeyWarning as dr, refuseMalformedOrphanRecords as ds, findServiceTokenRefusals as dt, isSensitiveAttributeName as du, wouldReturnToSdkProvider as ea, isStatefulRecreateTargetSync as ec, resolveApp as ed, supersededAfterRollback as ei, printingCorpusOf as el, journaledOrphanLines as en, explicitRoleArnOrThrow as eo, retiredNameGenerationsAfter as er, malformedOutputsRefusalMessage as es, ECR_AUTO_DELETE_IMAGES_TAG as et, importableOutputKeys as eu, declaredStreamTagsMember as f, onlySecretReferencesDiffer as fa, readConfigString as fc, MIGRATE_TMP_PREFIX as fd, journaledOrphanPrintingBag as fi, DYNAMIC_REFERENCE_TOKEN_SCAN as fl, refactorMarkerRefusalMessage as fn, isUnboundTemplateParameter as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecordsForDestroy as fs, serviceTokenBlockingReason as ft, stringifyValue as fu, streamDeclaresTags as g, deleteIndeterminateGuards as ga, requireConfigString as gc, decodeListingKey as gd, secretNamePrintingBag as gi, spelledKeysOf as gl, hasPendingMovesOut as gn, carriesDynamicReference as go, isWholeDynamicReferenceValue as gr, refuseMalformedOutputs as gs, listNestedTemplateRows as gt, loadPublishableAssetManifest as gu, streamDeclaresPolicy as h, UNSPECIFIED_SKIP_REASON as ha, requireConfigObject as hc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hd, orphanRecordsPrintingBag as hi, pathCrossesDottedKey as hl, updateRefactorMarker as hn, isImpossibleEmptyStoredAttribute as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForOrphan as hs, isAbsoluteAssetPath as ht, createAssetRedirectResolver as hu, PROTECTION_PROPERTY_BY_TYPE as i, isCustomResourceType as ia, isWarmThroughputDecrease as ic, resolveStateBucketWithDefault as id, withoutSuperseded as ii, unionOfSecretBags as il, formatResourceLine as in, applyCallerIdentityCredentials as io, namesAnyDeclaredParameter as ir, malformedResourcePropertiesWarning as is, getPriorAttempts as it, orphansCarriedFrom as iu, DYNAMODB_DELETE_POLL_COST_MS as j, unsettledItemsField as ja, isMarkedCoordinate as jc, ownValue as jd, earliestDefined as ji, recordProvenPublicExpression as jl, isJournaledOrphan as jn, STATE_REGION_DIVERGED as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForExport as js, makeSiblingClaimReader as jt, describeDockerCapturedOutput as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, INTRINSIC_KEYS as ka, TemplateParser as kc, hasPlainPrototype$1 as kd, refusesFinalSnapshot as ki, recordNoEchoAttributeValues as kl, undeclaredEmptyObservedKeys as kn, declaresNoEcho as ko, hintSidesOf as kr, refuseMalformedResourcesForDeploy as ks, mergeNoChangeOutputs as kt, buildDockerImage as ku, STREAM_POLICY_KEY as l, customResourceResponseExpirationWarning as la, configBooleanRefusal as lc, ssmResolvedValueType as ld, withAttemptedItemsMasked as li, scrubResourceRecord as ll, readRefactorMarker as ln, producerRegionsFromState as lo, exportAliasCollisionScrubWarning as lr, refuseDivergentRecordRegionForDestroy as ls, inheritedProvenanceForChildDiff as lt, timePhase as lu, reverseMapStreamPolicy as m, RollbackInlinePolicyWriters as ma, requireConfigArray as mc, uploadCfnTemplate as md, namingSecretsWithRecordedNoEcho as mi, isUncertifiedBaselineMaskPosition as ml, sameMove as mn, getAccountInfo as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphansForDestroy as ms, findNestedTemplateTreeDefect as mt, buildAssetRedirectMap as mu, recordedProtectionEvidence as n, TemplateNoEchoReresolver as na, WARM_THROUGHPUT_MEMBERS as nc, resolveCaptureObservedState as nd, supersededHolderOf as ni, recordLogOnlyValue as nl, makeForeignHolderScan as nn, sendableAssumeRoleCommand as no, withNameGenerationReached as nr, malformedRenderedContainersWarning as ns, hasCdkAutoDeleteTag as nt, isReadableBag as nu, perType as o, withPrintingSecrets as oa, toFiniteNumber as oc, resolveUseCdkBootstrapAssets as od, noEchoComparisonForTemplate as oi, errorCauseChain as ol, isAccessDeniedError as on, envCredentialsAreAssumedRole as oo, resourcesNamingDeclaredParameter as or, malformedScrubResourceEntriesRefusalMessage as os, IMPLICIT_DELETE_DEPENDENCIES as ot, stackInstanceIdCarriedFrom as ou, planStreamMemberOps as p, unchangedBehindSecretReference as pa, replayWarn as pc, findLargeInlineResources as pd, maskEventTextWithBoundBags as pi, dynamicReferenceTokens as pl, refuseRefactorMarker as pn, parameterTypeMayLoseSecretIdentity as po, carriedExportAliasExposure as pr, refuseMalformedOrphans as ps, childTemplateLoader as pt, WorkGraph as pu, vectorIndexesSettled as q, keepHeldTokenProvenance as qa, recordReferenceProvenanceEntry as qc, tagPlanWarning as qi, splitImportedOps as ql, redactedDeleteAddressSkip as qn, malformedLocalResourceEntriesWarning as qo, red as qr, withoutSilentDropProperties as qs, collectNestedChildUnaddressed as qt, AssetManifestLoader as qu, recordedProtectionNote as r, readsNoEchoDeleteValues as ra, coerceWarmThroughput as rc, resolveSkipPrefix as rd, supersededResourcesOf as ri, shareLogOnlyValues as rl, sameJournaledOrphans as rn, AWS_CREDENTIAL_ENV_KEYS as ro, computeParameterTaint as rr, malformedResourceEntriesWarning as rs, isTruthyCfnBoolean as rt, orphansAfterRollback as ru, readProtection as s, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as sa, coerceCfnBoolean as sc, stateBucketExistenceConfirmed as sd, noEchoExactEchoLeavesOf as si, maskSecretsInError as sl, lookupEachName as sn, classifyRecordedSecretRegion as so, WITHHELD_NAME_DISPLAY as sr, malformedStateRefusalMessage as ss, computeImplicitDeleteEdges as st, PhaseClock as su, DeployEngine as t, waitForLambdaFunctionActive as ta, renderStatefulReason as tc, resolveAutoAssetStorage as td, supersededHeldByOtherTypeWarning as ti, recordLogOnlyParameterValue as tl, loadJournaledOrphans as tn, isIamRoleArn as to, retiredNameGenerationsLeaving as tr, malformedOutputsWarning as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputs as tu, STREAM_TAGS_KEY as u, CloudControlProvider as ua, configIntegerRefusal as uc, CFN_TEMPLATE_BODY_LIMIT as ud, createReadOnlyAttributeHealerFactory as ui, withPhysicalNameCopies as ul, readRefactorMarkerOnce as un, regionLessSecretName as uo, secretBearing as ur, refuseMalformedNestedChildOutputs as us, deferredServiceTokenWarning as ut, AssetPublisher as uu, streamPolicyMatchesDeclared as v, deleteSkipReason as va, templateResourceTypes as vc, PARTITION_TABLE as vd, secretNamedAttributeNamesOf as vi, inheritNestedStackParameterAssociations as vl, pendingMovesRefusalMessage as vn, isNamelessDynamicReferenceError as vo, collectDeclaredOutputNames as vr, refuseMalformedResourceAttributesForOrphan as vs, templateIdentity as vt, AssetModeResolver as vu, planIndexContributorInsightsOps as w, isTerminationProtectionPropagationError as wa, emrClusterInstancesReplaced as wc, describeJsonParseFailure as wd, buildFinalSnapshotIdentifier as wi, splitGetAttStringForm as wl, settleUnsettledPrevious as wn, refStateLookupFromResource as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForOrphan as ws, enclosingDeadlineRemainingMs as wt, parseBootstrapMarker as wu, contributorInsightsRefusals as x, markWaitAbandoned as xa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as xc, AssemblyReader as xd, storedSecretNameNeedles as xi, physicalNameCopiesOf as xl, replayRollback as xn, cfnRefValueFromPhysicalId as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDestroy as xs, parentSuppliedValues as xt, ensureAssetStorage as xu, streamTagsMatchDeclared as y, withIndeterminateGuard as ya, describeTypeWithThrottleRetry as yc, canonicalizeRegion as yd, secretNamedRecordNeedles as yi, recordNestedStackParameterExpressions as yl, refusePendingMovesOut as yn, keepsSecretReferenceToken as yo, collectPublishedOutputNames as yr, refuseMalformedResourceEntries as ys, conditionFingerprint as yt, BOOTSTRAP_MARKER_PREFIX as yu, TABLE_INDEX_NOUN as z, s3BucketArn as za, passedNoEchoParametersOf as zc, clearBucketRegionCache as zd, isRefusedByName as zi, CrossPrefixReadError as zl, seedsDeleteFirstGuard as zn, hasReadableOutputs as zo, destroyStackRecordsView as zr, unpreviewableOrphanRecords as zs, displacedPhysicalIdShown as zt, isMalformedEnvKey as zu };
+//# sourceMappingURL=deploy-engine-NYjdxQWe.js.map