@go-to-k/cdkd 0.315.0 → 0.317.0

package/dist/{deploy-engine--bCIMkkk.js → deploy-engine-b0rYBotL.js}

@@ -1,8 +1,8 @@
-import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
-import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-agWtoyga.js";
-import { $n as plainOrDescribed, $t as formatLockOperation, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, Bt as createdResourceIdentityBeforeFailure, Cn as DynamicReferenceRegionAmbiguousError, Cr as isIamPropagationError, Ct as compositeIdSeparatorRefusal, Dn as LockError, Dt as resourceTypeShown, Er as retryClassificationText, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gn as SHELL_ACTIVE, Gt as markCreatedBeforeFailure, Hn as normalizeAwsError, Ht as isAuxiliaryFailure, It as RETRY_AUXILIARY_OWNER, J as deleteWithProtectionCompensation, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, K as compensateProtectionFlip, Kn as SHELL_ACTIVE_WHY, Ln as StateError, Lt as carryCreatedBeforeFailure, M as isMarkedNotGone, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nn as ResourceTimeoutError, Nt as maskDeep, On as MacroExpansionError, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, Qn as physicalIdShownBesideCommand, Qt as formatLockExpiry, R as isQuotableImportValue, Rn as SynthesisError, Sn as DeploymentNotApprovedError, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, Ut as isAuxiliaryMarkOf, V as refusalTypeShown, Vn as isSoftAbort, Vt as hasCreatedBeforeFailure, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yt as buildForceUnlockCommand, Zn as pasteableCommand, _ as removalWarning, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, b as withoutInjectedRemovals, bn as DependencyError, br as isAmbiguousCcHandlerErrorCode, bt as startInterruptWatch, cn as producerRecordKey, cr as isNameCollisionErrorFrom, dn as ambientClientDefaults, dr as isReplayedNameCollisionFrom, dt as protectedReplacementAdvice, en as formatLockOwner, er as quotedOrDescribed, et as observeThenDisableProtection, fn as ambientCredentialConfig, g as prepareRemovalForUpdate, gn as AssetError, gr as stripControlChars, hn as AccountIdUnavailableError, hr as escapeRegExp$3, ht as monotonicNowMs, i as reportCreatedResource, in as DEFAULT_STATE_PREFIX, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lr as isNameCooldownError, m as withUnchangedSecretPrincipalLists, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, n as clearCreatedReport, nn as sanitizeRecoveryValue, nr as shellQuote, or as isUpdateUnsupportedError, ot as DELETION_PROTECTION_DOC_POINTER, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, qn as UNSHOWABLE_VALUE, qt as replayMadeAnotherResource, r as collectCreatedResources, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, sr as hasReplayMayCollide, t as CreatedResourceSink, tn as recoveryCommandFlags, tr as shellBoundedDisplay, tt as protectionFlipKey, un as withPasteableAwsProfile, ur as isRecreateRetryableError, ut as pasteableAwsCommand, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, yn as CrossAccountSecretRefusalError, yr as formatRetryClassificationSignals, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn, zt as createdBeforeFailure } from "./created-resource-sink-QECX8C-Z.js";
-import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-Caty7J3x.js";
+import { c as __exportAll, r as getAwsClients } from "./aws-clients-DWpHZk2l.js";
+import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-DiHodi76.js";
+import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-BpB3iPvn.js";
+import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BLXFsfMa.js";
+import { t as getCdkdVersion } from "./version-BkSInxUL.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -40,7 +40,7 @@ import { DescribeDomainCommand, OpenSearchClient } from "@aws-sdk/client-opensea
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 
-//#region src/utils/aws-region-resolver.ts
+// src/utils/aws-region-resolver.ts
 const cache = /* @__PURE__ */ new Map();
 async function readClientRegion(client) {
 	try {
@@ -106,8 +106,7 @@ async function resolveCrossAccountStateBucket(accountId, credentials) {
 	};
 }
 
-//#endregion
-//#region src/utils/injected-aws-region.ts
+// src/utils/injected-aws-region.ts
 let injected;
 function injectAwsRegion(region) {
 	injected ??= {
@@ -132,8 +131,7 @@ function injectedAwsRegionOverride() {
 	return { AWS_REGION: injected.original };
 }
 
-//#endregion
-//#region src/synthesis/app-executor.ts
+// src/synthesis/app-executor.ts
 const CDK_ASM_VERSION = "38.0.0";
 const CONTEXT_OVERFLOW_LIMIT = 32768;
 function stripSurroundingQuotes(token) {
@@ -228,8 +226,7 @@ var AppExecutor = class {
 	}
 };
 
-//#endregion
-//#region src/types/assembly.ts
+// src/types/assembly.ts
 const ASSEMBLY_REGION_PREFIX = /^[a-z0-9-]+/;
 const CDK_ENVIRONMENT_PATTERN = /aws:\/\/([a-zA-Z0-9@._-]+)\/([a-z0-9-]+)/;
 const CANONICAL_ASSEMBLY_REGION = /^[a-z0-9-]+$/;
@@ -262,8 +259,7 @@ function unparsableRegionMessage(region, stackName) {
 	return `${head}\nIf an earlier cdkd version deployed this stack from such an assembly, it recorded the stack's state under that raw region spelling, and a deploy using the canonical spelling will not find that state: it starts the stack from no state at all. 'cdkd state show' and 'cdkd state orphan' still reach that record when '--stack-region' is given the exact raw spelling; 'state orphan' removes the record and leaves its AWS resources in place, unmanaged by cdkd.`;
 }
 
-//#endregion
-//#region src/utils/assembly-path.ts
+// src/utils/assembly-path.ts
 function isInside(base, candidate) {
 	const rel = path.relative(base, candidate);
 	if (rel === "" || rel === "..") return false;
@@ -408,8 +404,7 @@ function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverri
 	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
 }
 
-//#endregion
-//#region src/utils/own-keys.ts
+// src/utils/own-keys.ts
 function hasOwnKey(target, key) {
 	return Object.prototype.hasOwnProperty.call(target, key);
 }
@@ -432,8 +427,7 @@ function nullPrototypeRecord() {
 	return Object.create(null);
 }
 
-//#endregion
-//#region src/utils/json-parse-failure.ts
+// src/utils/json-parse-failure.ts
 function describeJsonParseFailure(err, bytes) {
 	const raw = describeAwsFailure(err).detail;
 	const at = / (?:in|after) JSON at position (\d+)(?: \(line \d+ column \d+\))?$/.exec(raw);
@@ -457,8 +451,7 @@ function parseJsonNamingNoBody(body, subject, debug) {
 	}
 }
 
-//#endregion
-//#region src/synthesis/stack-messages.ts
+// src/synthesis/stack-messages.ts
 const MESSAGE_ENTRY_TYPES = {
 	"aws:cdk:error": "error",
 	"aws:cdk:warning": "warning",
@@ -518,8 +511,7 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
-//#endregion
-//#region src/synthesis/failed-stages.ts
+// src/synthesis/failed-stages.ts
 var StageLoadError = class StageLoadError extends SynthesisError {
 	constructor(message) {
 		super(message);
@@ -557,8 +549,7 @@ function renderStagePath(stagePath) {
 	return displayIdent(stagePath, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 }
 
-//#endregion
-//#region src/synthesis/assembly-reader.ts
+// src/synthesis/assembly-reader.ts
 function manifestReadFailureText(error) {
 	const cause = error instanceof CdkdError ? error.cause : error;
 	const code = cause?.code;
@@ -716,8 +707,7 @@ var AssemblyReader = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-store.ts
+// src/synthesis/context-store.ts
 const CDK_CONTEXT_FILE = "cdk.context.json";
 var ContextStore = class {
 	logger = getLogger().child("ContextStore");
@@ -762,8 +752,7 @@ var ContextStore = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/az-provider.ts
+// src/synthesis/context-providers/az-provider.ts
 var AZContextProvider = class {
 	logger = getLogger().child("AZContextProvider");
 	awsConfig;
@@ -787,8 +776,7 @@ var AZContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/ssm-provider.ts
+// src/synthesis/context-providers/ssm-provider.ts
 var SSMContextProvider = class {
 	logger = getLogger().child("SSMContextProvider");
 	awsConfig;
@@ -821,8 +809,7 @@ var SSMContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/hosted-zone-provider.ts
+// src/synthesis/context-providers/hosted-zone-provider.ts
 var HostedZoneContextProvider = class {
 	logger = getLogger().child("HostedZoneContextProvider");
 	awsConfig;
@@ -869,8 +856,7 @@ var HostedZoneContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/vpc-provider.ts
+// src/synthesis/context-providers/vpc-provider.ts
 var VpcContextProvider = class {
 	logger = getLogger().child("VpcContextProvider");
 	awsConfig;
@@ -1017,8 +1003,7 @@ var VpcContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/cc-api-provider.ts
+// src/synthesis/context-providers/cc-api-provider.ts
 function parseResourceModel(body, typeName) {
 	try {
 		return JSON.parse(body);
@@ -1134,8 +1119,7 @@ var CcApiContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/ami-provider.ts
+// src/synthesis/context-providers/ami-provider.ts
 var AmiContextProvider = class {
 	logger = getLogger().child("AmiContextProvider");
 	awsConfig;
@@ -1170,8 +1154,7 @@ var AmiContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/security-group-provider.ts
+// src/synthesis/context-providers/security-group-provider.ts
 var SecurityGroupContextProvider = class {
 	logger = getLogger().child("SecurityGroupContextProvider");
 	awsConfig;
@@ -1219,8 +1202,7 @@ var SecurityGroupContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/load-balancer-provider.ts
+// src/synthesis/context-providers/load-balancer-provider.ts
 var LoadBalancerContextProvider = class {
 	logger = getLogger().child("LoadBalancerContextProvider");
 	awsConfig;
@@ -1293,8 +1275,7 @@ var LoadBalancerListenerContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/key-provider.ts
+// src/synthesis/context-providers/key-provider.ts
 var KeyContextProvider = class {
 	logger = getLogger().child("KeyContextProvider");
 	awsConfig;
@@ -1330,8 +1311,7 @@ var KeyContextProvider = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/context-providers/index.ts
+// src/synthesis/context-providers/index.ts
 const PROVIDER_ERROR_KEY = "$providerError";
 const TRANSIENT_CONTEXT_KEY = "$dontSaveContext";
 var ContextProviderRegistry = class {
@@ -1384,8 +1364,7 @@ var ContextProviderRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/synthesis/macro-detector.ts
+// src/synthesis/macro-detector.ts
 function containsMacro(template) {
 	if (!template || typeof template !== "object" || Array.isArray(template)) return false;
 	const t = template;
@@ -1474,8 +1453,7 @@ function collectFnTransformNames(value, seen, out) {
 	}
 }
 
-//#endregion
-//#region src/utils/aws-partition.ts
+// src/utils/aws-partition.ts
 const PARTITION_TABLE = [
 	{
 		prefix: "cn-",
@@ -1531,8 +1509,7 @@ function derivePartitionAndUrlSuffix(region) {
 	};
 }
 
-//#endregion
-//#region src/utils/expected-bucket-owner.ts
+// src/utils/expected-bucket-owner.ts
 var expected_bucket_owner_exports = /* @__PURE__ */ __exportAll({
 	expectedOwnerParam: () => expectedOwnerParam,
 	recordResolvedAccountId: () => recordResolvedAccountId,
@@ -1614,8 +1591,7 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
-//#endregion
-//#region src/utils/s3-listing-keys.ts
+// src/utils/s3-listing-keys.ts
 function decodeListingKey(value) {
 	if (value === void 0) return void 0;
 	try {
@@ -1625,8 +1601,7 @@ function decodeListingKey(value) {
 	}
 }
 
-//#endregion
-//#region src/state/s3-replication-purge-gap.ts
+// src/state/s3-replication-purge-gap.ts
 const DEFAULT_PURGED_OBJECT_DESCRIPTION = "the body of an object cdkd has just reported as removed";
 const replicationProbeCache = /* @__PURE__ */ new Map();
 const warnedWarnings = /* @__PURE__ */ new Set();
@@ -1758,8 +1733,7 @@ async function warnIfPurgeIsReplicated(s3Client, bucket, keys, options = {}) {
 	} catch {}
 }
 
-//#endregion
-//#region src/state/s3-noncurrent-version-purge.ts
+// src/state/s3-noncurrent-version-purge.ts
 const CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION = "a custom-resource response object, which is the handler's full cfn-response body including `Data`";
 const DELETE_BATCH_SIZE = 1e3;
 const MAX_NAMED_FAILURES = 5;
@@ -1933,8 +1907,7 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, scope, requestFields,
 	} while (keyMarker !== void 0);
 }
 
-//#endregion
-//#region src/cli/upload-cfn-template.ts
+// src/cli/upload-cfn-template.ts
 const CFN_TEMPLATE_BODY_LIMIT = 51200;
 const CFN_TEMPLATE_URL_LIMIT = 1048576;
 const MIGRATE_TMP_PREFIX = "cdkd-migrate-tmp";
@@ -2020,8 +1993,7 @@ function findLargeInlineResources(template, threshold = LARGE_INLINE_RESOURCE_TH
 	return result;
 }
 
-//#endregion
-//#region src/utils/parameter-types.ts
+// src/utils/parameter-types.ts
 function isListParameterType(type) {
 	if (type === "CommaDelimitedList") return true;
 	return type.length > 6 && type.startsWith("List<") && type.endsWith(">");
@@ -2033,8 +2005,7 @@ function ssmResolvedValueType(type) {
 	return inner.length > 0 ? inner : void 0;
 }
 
-//#endregion
-//#region src/synthesis/macro-expander.ts
+// src/synthesis/macro-expander.ts
 function displaySafeTransforms(names) {
 	return names.map((name) => displaySafe(name)).join(", ");
 }
@@ -2259,8 +2230,7 @@ function formatErr(err) {
 	return displayAwsMessage(describeAwsFailure(err).detail);
 }
 
-//#endregion
-//#region src/cli/config-loader.ts
+// src/cli/config-loader.ts
 function loadJsonConfig(filePath) {
 	const logger = getLogger();
 	if (!existsSync(filePath)) return null;
@@ -2360,7 +2330,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-Bu9EMILF.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-DWpHZk2l.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -2471,8 +2441,7 @@ async function probeBucket(client, bucketName, deps) {
 	}
 }
 
-//#endregion
-//#region src/synthesis/synthesizer.ts
+// src/synthesis/synthesizer.ts
 function isPreSynthesizedAssembly(app) {
 	const appPath = resolve(app);
 	return existsSync(appPath) && statSync(appPath).isDirectory();
@@ -2634,8 +2603,7 @@ function setsEqual(a, b) {
 	return true;
 }
 
-//#endregion
-//#region src/assets/absolute-asset-path-warning.ts
+// src/assets/absolute-asset-path-warning.ts
 function warnWholeAssemblyAsSource(w) {
 	getLogger().child("assets").warn(`${w.subject} has ${w.field} naming the output directory ITSELF: ${displayAssemblyPath(w.outdir)}. cdkd will ${w.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`);
 }
@@ -2643,8 +2611,7 @@ function warnAbsoluteAssetPath(w) {
 	getLogger().child("assets").warn(`${w.subject} has an absolute ${w.field} pointing outside the assembly: ${displayAssemblyPath(w.absolute)}` + (w.escape.escape === "symlink" ? ` (through a symbolic link to ${displayAssemblyPath(w.escape.realPath)})` : "") + `. cdkd will ${w.sink}. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted: an absolute source path is honoured as written, so nothing but this line stands between it and that step.`);
 }
 
-//#endregion
-//#region src/assets/asset-manifest-loader.ts
+// src/assets/asset-manifest-loader.ts
 function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 	const { assetOutdir, sink } = opts;
 	if (isAbsolute$1(asset.source.path)) {
@@ -2758,8 +2725,7 @@ function extractHashFromImageUri(imageUri) {
 	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
 }
 
-//#endregion
-//#region src/assets/file-asset-publisher.ts
+// src/assets/file-asset-publisher.ts
 var FileAssetPublisher = class {
 	logger = getLogger().child("FileAssetPublisher");
 	async publish(assetHash, asset, cdkOutputDir, accountId, region, assetOutdir) {
@@ -2838,8 +2804,7 @@ var FileAssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/docker-cmd.ts
+// src/utils/docker-cmd.ts
 function getDockerCmd() {
 	const override = process.env["CDK_DOCKER"];
 	return override && override.length > 0 ? override : "docker";
@@ -3477,16 +3442,14 @@ function describeDockerCapturedOutput(error, args, fallback) {
 	return redactDockerArgvInText(capturedStreamText(error, "stderr") || capturedStreamText(error, "stdout") || fallback, args);
 }
 
-//#endregion
-//#region src/assets/docker-cache-option.ts
+// src/assets/docker-cache-option.ts
 function cacheOptionToFlag(option) {
 	let flag = `type=${option.type}`;
 	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
 	return flag;
 }
 
-//#endregion
-//#region src/assets/manifest-passthrough-warnings.ts
+// src/assets/manifest-passthrough-warnings.ts
 function candidateHostPaths(value, opts) {
 	const out = [];
 	for (const part of value.split(",")) {
@@ -3599,8 +3562,7 @@ function warnUnrecognizedAssetDestination(opts) {
 	getLogger().child("assets").warn(`Asset destination ${opts.kind} ${displayIdent(opts.name)} is not a CDK-bootstrap or cdkd-managed name, so cdkd uploads there exactly as this asset manifest wrote it, with your credentials. That is what a custom bootstrap looks like and is expected for one; if you did not configure it, the manifest chose where your assets go.`);
 }
 
-//#endregion
-//#region src/assets/docker-build.ts
+// src/assets/docker-build.ts
 function resolveDockerContextDirectory(opts) {
 	const { manifestDir, directory, wrapError, assetOutdir, sink, assetId } = opts;
 	if (isAbsolute$1(directory)) {
@@ -3722,8 +3684,7 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 	return args;
 }
 
-//#endregion
-//#region src/assets/docker-asset-publisher.ts
+// src/assets/docker-asset-publisher.ts
 function ecrUrlSuffix(region) {
 	return derivePartitionAndUrlSuffix(region).urlSuffix;
 }
@@ -3881,8 +3842,7 @@ var DockerAssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/deny-external-access-policy.ts
+// src/utils/deny-external-access-policy.ts
 function buildDenyExternalAccessPolicy(bucketName, accountId, region) {
 	const { partition } = derivePartitionAndUrlSuffix(region);
 	return {
@@ -3898,8 +3858,7 @@ function buildDenyExternalAccessPolicy(bucketName, accountId, region) {
 	};
 }
 
-//#endregion
-//#region src/assets/asset-storage.ts
+// src/assets/asset-storage.ts
 const ASSET_SUPPORT_VERSION = 1;
 const BOOTSTRAP_MARKER_PREFIX = "cdkd-bootstrap/";
 function getCdkdAssetBucketName(accountId, region) {
@@ -4325,8 +4284,7 @@ var AssetModeResolver = class {
 	}
 };
 
-//#endregion
-//#region src/assets/asset-redirect.ts
+// src/assets/asset-redirect.ts
 function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
 	return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
 }
@@ -4596,8 +4554,7 @@ function createAssetRedirectResolver(opts) {
 	};
 }
 
-//#endregion
-//#region src/deployment/work-graph.ts
+// src/deployment/work-graph.ts
 var WorkGraph = class {
 	nodes = /* @__PURE__ */ new Map();
 	logger = getLogger().child("WorkGraph");
@@ -4688,8 +4645,7 @@ var WorkGraph = class {
 	}
 };
 
-//#endregion
-//#region src/utils/stringify.ts
+// src/utils/stringify.ts
 const SENSITIVE_ATTRIBUTE_NAME = /secret|password|credential/i;
 const NON_SENSITIVE_SUFFIX = /(arn|id|name|url|alias|status)$/i;
 function isSensitiveAttributeName(attributeName) {
@@ -4718,8 +4674,7 @@ function stringifyValue(value) {
 	}
 }
 
-//#endregion
-//#region src/assets/asset-publisher.ts
+// src/assets/asset-publisher.ts
 var AssetPublisher = class {
 	logger = getLogger().child("AssetPublisher");
 	filePublisher = new FileAssetPublisher();
@@ -4865,8 +4820,7 @@ var AssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/phase-timings.ts
+// src/utils/phase-timings.ts
 const now = () => globalThis.performance.now();
 const PHASE_TIMINGS_ENV = "CDKD_PHASE_TIMINGS";
 function phaseTimingsEnabled() {
@@ -4971,8 +4925,7 @@ function renderPhaseTimings() {
 	return lines;
 }
 
-//#endregion
-//#region src/types/state.ts
+// src/types/state.ts
 const STATE_SCHEMA_VERSIONS_READABLE = [
 	1,
 	2,
@@ -5059,8 +5012,7 @@ function orphansAfterRollback(previous, newlyOrphaned) {
 	return { orphans: [...byLogicalId.values()] };
 }
 
-//#endregion
-//#region src/types/rollback-journal.ts
+// src/types/rollback-journal.ts
 const ROLLBACK_JOURNAL_VERSION = 1;
 function splitImportedOps(ops, segment, except = /* @__PURE__ */ new Set()) {
 	const marks = segment.importedResources ?? [];
@@ -5242,8 +5194,7 @@ function parseRollbackJournal(bodyString, stackName) {
 	};
 }
 
-//#endregion
-//#region src/state/create-token-ledger.ts
+// src/state/create-token-ledger.ts
 const CREATE_TOKEN_LEDGER_VERSION = 1;
 function emptyCreateTokenLedger(nonce) {
 	return {
@@ -5294,8 +5245,7 @@ async function notifyStateSaved(stackName, region) {
 	await stateSavedObserver.getStore()?.(stackName, region);
 }
 
-//#endregion
-//#region src/state/stack-instance-id.ts
+// src/state/stack-instance-id.ts
 const STACK_INSTANCE_SIBLING_VERSION = 1;
 const STACK_INSTANCE_SIBLING_FILE = "stack-instance.json";
 const STACK_INSTANCE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
@@ -5341,8 +5291,7 @@ function withStackInstanceIdWithheld(state) {
 	};
 }
 
-//#endregion
-//#region src/state/cross-prefix-stack-scan.ts
+// src/state/cross-prefix-stack-scan.ts
 function journalCanOwnResources(journal) {
 	return recordCanOwnResources({ resources: {} }, journal);
 }
@@ -5704,8 +5653,7 @@ function applyCrossPrefixScan(result, s, action, warn, info) {
 	}
 }
 
-//#endregion
-//#region src/state/earlier-state-versions.ts
+// src/state/earlier-state-versions.ts
 async function readEarlierStateResources(s3, bucket, owner, key, max) {
 	const versions = ((await s3.send(new ListObjectVersionsCommand({
 		Bucket: bucket,
@@ -5775,8 +5723,7 @@ async function listVersionedSubdirectories(s3, bucket, owner, prefix) {
 	}
 }
 
-//#endregion
-//#region src/state/retained-time.ts
+// src/state/retained-time.ts
 var RetainedTimeUnconfirmedError = class extends Error {
 	cause;
 	constructor(cause) {
@@ -5786,8 +5733,7 @@ var RetainedTimeUnconfirmedError = class extends Error {
 	}
 };
 
-//#endregion
-//#region src/utils/bucket-region-client.ts
+// src/utils/bucket-region-client.ts
 async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	const config = client.config;
 	if (!config || typeof config.region !== "function") {
@@ -5825,8 +5771,7 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	return replacement;
 }
 
-//#endregion
-//#region src/state/token-free-state.ts
+// src/state/token-free-state.ts
 const tokenFreeStates = /* @__PURE__ */ new WeakSet();
 function bodyMayCarryReferences(body) {
 	return body.includes("{{resolve:") || body.includes("\"referenceProvenance\"") || body.includes("\"outputReferenceProvenance\"");
@@ -5838,8 +5783,7 @@ function isKnownTokenFreeState(state) {
 	return state !== void 0 && tokenFreeStates.has(state);
 }
 
-//#endregion
-//#region src/state/s3-state-backend.ts
+// src/state/s3-state-backend.ts
 function errorDetail$2(error) {
 	return displaySafe(error instanceof Error ? error.message : error, { asciiOnly: true }) || "<unrenderable>";
 }
@@ -7240,8 +7184,7 @@ function addSupersededIds(segment, ids) {
 	if (merged.size > 0) segment.supersededLogicalIds = [...merged];
 }
 
-//#endregion
-//#region src/state/lock-manager.ts
+// src/state/lock-manager.ts
 const MAX_RENEWAL_INTERVAL_MS = 12e4;
 const RENEWAL_TTL_FRACTION = 4;
 const MIN_RENEWAL_INTERVAL_MS = 1e3;
@@ -7755,8 +7698,7 @@ function nanIfUncoercible(value) {
 	}
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/rules.ts
+// src/deployment/secret-redaction/rules.ts
 const MIN_NEEDLE_LENGTH = 4;
 function printingNeedles(values) {
 	const out = /* @__PURE__ */ new Set();
@@ -7851,8 +7793,7 @@ function isPlainObject$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/mask-only.ts
+// src/deployment/secret-redaction/mask-only.ts
 const recordedSecretExpressions = /* @__PURE__ */ new Set();
 const secretVerdictScopes = /* @__PURE__ */ new Map();
 function pinScopedSecretVerdict(scope, expression, secret) {
@@ -8076,8 +8017,7 @@ function isSecretExpressionByVerdictOrSpelling(expression) {
 	return expression.startsWith("{{resolve:secretsmanager:") || expression.startsWith("{{resolve:ssm-secure:") || isRecordedSecretExpression(expression);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/cross-stack.ts
+// src/deployment/secret-redaction/cross-stack.ts
 const crossStackAssociations = /* @__PURE__ */ new WeakMap();
 const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
 const CROSS_STACK_KEY_SEPARATOR = "\0";
@@ -8195,8 +8135,7 @@ function storeAssociation(associations, key, expression, plaintext) {
 	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/certified-positions.ts
+// src/deployment/secret-redaction/certified-positions.ts
 function plaintextIndexOf(secrets) {
 	const plaintextOf = /* @__PURE__ */ new Map();
 	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING_PLAINTEXT : plaintext);
@@ -8233,8 +8172,7 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/resolver-outcomes.ts
+// src/deployment/secret-redaction/resolver-outcomes.ts
 const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
 const takenBranches = /* @__PURE__ */ new WeakMap();
 function recordTakenIfBranch(secrets, source, tookTrueBranch) {
@@ -8267,8 +8205,7 @@ function droppedArrayElementsOf(secrets, source) {
 	return dropped === CONFLICTING ? void 0 : dropped;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/physical-name-copies.ts
+// src/deployment/secret-redaction/physical-name-copies.ts
 const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
 function recordPhysicalNameCopy(secrets, physicalId) {
 	if (physicalId === "") return;
@@ -8289,8 +8226,7 @@ function physicalNameSpans(names, value) {
 	return spans;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/fresh-noecho.ts
+// src/deployment/secret-redaction/fresh-noecho.ts
 function embedsFreshNoEchoValue(text, secrets, freshClass) {
 	const fresh = freshNoEchoValuesOf.get(secrets);
 	if (fresh === void 0) return false;
@@ -8434,8 +8370,7 @@ function recoverMaskedOutput(identity, stackName, region, outputKey) {
 	return recoverableMaskedOutputs.get(maskedOutputKey(identity, stackName, region, outputKey));
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/nested-stack.ts
+// src/deployment/secret-redaction/nested-stack.ts
 const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
@@ -9056,8 +8991,7 @@ function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
 	return visit(value);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/placeholder-positions.ts
+// src/deployment/secret-redaction/placeholder-positions.ts
 function keyedPart(source) {
 	const key = crossStackSourceKey(source);
 	return key === void 0 ? UNKNOWN_PART : { key };
@@ -9263,8 +9197,7 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/identity-keys.ts
+// src/deployment/secret-redaction/identity-keys.ts
 const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
 function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
@@ -9287,8 +9220,7 @@ function positionListByCrossStackSource(bag, source, secrets) {
 	return certifiedListForLeaf(secrets, association, bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/redact-path.ts
+// src/deployment/secret-redaction/redact-path.ts
 const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
 	"Fn::Join",
 	"Fn::Sub",
@@ -9740,8 +9672,7 @@ function deepEqualJsonValue(a, b) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/readback-certification.ts
+// src/deployment/secret-redaction/readback-certification.ts
 function renderedDefinitionLiterals(source) {
 	const keep = /* @__PURE__ */ new Set();
 	const scalarKeep = /* @__PURE__ */ new Set();
@@ -9912,8 +9843,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 	return refuseAgainstSource(bag, source, failClosed, mark);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/anchors.ts
+// src/deployment/secret-redaction/anchors.ts
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
@@ -10063,8 +9993,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/redact-state.ts
+// src/deployment/secret-redaction/redact-state.ts
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
 	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
 }
@@ -10418,8 +10347,7 @@ function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
 	return stored;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/mask-errors.ts
+// src/deployment/secret-redaction/mask-errors.ts
 function maskSecretsInText(text, secrets) {
 	const logOnly = logOnlyValuesOf.get(secrets);
 	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
@@ -10620,8 +10548,7 @@ function createSecretMasker(secrets) {
 	return (text) => maskSecretsInText(text, secrets);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/log-only.ts
+// src/deployment/secret-redaction/log-only.ts
 const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
 function recordLogOnlyValue(secrets, plaintext) {
 	if (plaintext === "") return;
@@ -10810,8 +10737,7 @@ function hasMaskableValues(secrets) {
 	return logOnly !== void 0 && logOnly.size > 0;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/reference-provenance.ts
+// src/deployment/secret-redaction/reference-provenance.ts
 const passProvenanceOf = /* @__PURE__ */ new WeakMap();
 const MAX_REFERENCE_VERSIONS = 8;
 function provenanceTableFor(secrets) {
@@ -10911,8 +10837,7 @@ function snapshotPassProvenance(secrets) {
 	return out;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/recording.ts
+// src/deployment/secret-redaction/recording.ts
 const scopeMaps = /* @__PURE__ */ new WeakSet();
 var WriteThroughSecrets = class extends Map {
 	pass;
@@ -10974,8 +10899,7 @@ function recordSecretResolution(secrets, expression, plaintext, options) {
 	if (options.pairEvidence) recordResolvedPair(secrets, expression, plaintext);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/context.ts
+// src/deployment/secret-redaction/context.ts
 const RULES_BY_PROVENANCE = {
 	"template-derived": TEMPLATE_DERIVED_RULES,
 	"template-sourced": TEMPLATE_SOURCED_RULES,
@@ -11010,8 +10934,7 @@ function shallowCopy(bag) {
 	return Array.isArray(bag) ? [...bag] : { ...bag };
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/positions.ts
+// src/deployment/secret-redaction/positions.ts
 const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
 const MAX_SKELETON_WILDCARDS = 3;
 const MAX_SKELETON_CANDIDATE_LENGTH = 512;
@@ -11303,8 +11226,7 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	}, bagIsSameGeneration);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/pairs.ts
+// src/deployment/secret-redaction/pairs.ts
 const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
 const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
 function pairsFor(secrets) {
@@ -11435,8 +11357,7 @@ function carryRedactionMarks(from, to) {
 	return to;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/unresolved-token-frame.ts
+// src/deployment/secret-redaction/unresolved-token-frame.ts
 function liveMatchesUnresolvedTokenFrame(send, live, unresolvedTokens, secrets) {
 	const wildcards = dynamicReferenceSpans(send).filter((span) => unresolvedTokens.has(send.slice(span.start, span.end)));
 	if (wildcards.length === 0) return false;
@@ -11473,8 +11394,7 @@ function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/noecho-leaves.ts
+// src/deployment/secret-redaction/noecho-leaves.ts
 const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
 function intrinsicKeyOf(node) {
 	const keys = Object.keys(node);
@@ -12004,8 +11924,7 @@ function passedNoEchoParametersOf(bag) {
 	return bag === void 0 ? void 0 : passedNoEchoParameters.get(bag);
 }
 
-//#endregion
-//#region src/analyzer/template-parser.ts
+// src/analyzer/template-parser.ts
 var TemplateParser = class {
 	logger = getLogger().child("TemplateParser");
 	getResourceIds(template) {
@@ -12179,8 +12098,7 @@ var TemplateParser = class {
 	}
 };
 
-//#endregion
-//#region src/analyzer/lambda-vpc-deps.ts
+// src/analyzer/lambda-vpc-deps.ts
 function extractLambdaVpcDeleteDeps(resources) {
 	const edges = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -12227,8 +12145,7 @@ function collectRefIds(value, out) {
 	}
 }
 
-//#endregion
-//#region src/analyzer/cdk-defensive-deps.ts
+// src/analyzer/cdk-defensive-deps.ts
 const DEFENSIVE_DEPENDS_ON_TYPE_PAIRS = [
 	{
 		fromType: "AWS::IAM::Role",
@@ -12287,8 +12204,7 @@ function defensiveDependsOnToSkip(resource, template) {
 	return skip;
 }
 
-//#endregion
-//#region src/analyzer/dag-builder.ts
+// src/analyzer/dag-builder.ts
 const { Graph, alg } = graphlib;
 const IAM_ROLE_POLICY_TYPES = /* @__PURE__ */ new Set([
 	"AWS::IAM::Policy",
@@ -12531,8 +12447,7 @@ var DagBuilder = class {
 	}
 };
 
-//#endregion
-//#region src/utils/lambda-function-name.ts
+// src/utils/lambda-function-name.ts
 function parseLambdaFunctionAddress(value) {
 	const full = /^arn:([^:]+):lambda:([^:]+):(\d{12}):function:([^:]+)$/.exec(value);
 	if (full) return {
@@ -12562,8 +12477,7 @@ function lambdaFunctionNameForMask(value) {
 	return /^(?:arn:[^:]+:lambda:[^:]+:\d{12}:function:|\d{12}:function:)?([A-Za-z0-9_-]+)(?::[^:]+)?$/.exec(value)?.[1] ?? canonicalLambdaFunctionName(value);
 }
 
-//#endregion
-//#region src/analyzer/replacement-rules.ts
+// src/analyzer/replacement-rules.ts
 function vpcInstanceTenancyChangeReplaces(oldValue, newValue) {
 	const tenancyOf = (v) => v == null ? "default" : String(v);
 	return tenancyOf(newValue) !== "default" && tenancyOf(newValue) !== tenancyOf(oldValue);
@@ -13156,8 +13070,7 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/retry.ts
+// src/deployment/retry.ts
 const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
 const IAM_PROPAGATION_MAX_DELAY_MS = 2e3;
 const IAM_PROPAGATION_MAX_RETRIES = 26;
@@ -13253,8 +13166,7 @@ function retryErrorClass(error) {
 	return parts.length > 0 ? `${name} (${parts.join(", ")})` : name;
 }
 
-//#endregion
-//#region src/utils/concurrency-limiter.ts
+// src/utils/concurrency-limiter.ts
 var BackgroundTaskCancelledError = class extends Error {
 	constructor() {
 		super("Background task cancelled");
@@ -13378,8 +13290,7 @@ function createConcurrencyLimiter(limit) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/describe-type.ts
+// src/provisioning/describe-type.ts
 const describeTypeRetryDelays = {};
 const MAX_THROTTLE_RETRIES = 4;
 const DESCRIBE_TYPE_MAX_IN_FLIGHT = 20;
@@ -13436,8 +13347,7 @@ function hasNoRegistrySchema(resourceType) {
 	return resourceType === "AWS::CDK::Metadata" || resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
 }
 
-//#endregion
-//#region src/provisioning/create-only-paths.ts
+// src/provisioning/create-only-paths.ts
 function parseCreateOnlyPropertyPointers(createOnly) {
 	const result = [];
 	if (!Array.isArray(createOnly)) return result;
@@ -13453,8 +13363,7 @@ function unescapeJsonPointerSegment$2(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
-//#endregion
-//#region src/provisioning/create-only-snapshot.generated.ts
+// src/provisioning/create-only-snapshot.generated.ts
 const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Account", []],
 	["AWS::ApiGateway::Authorizer", [["RestApiId"]]],
@@ -14047,8 +13956,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::WAFv2::WebACL", [["Name"], ["Scope"]]]
 ]);
 
-//#endregion
-//#region src/provisioning/create-only-properties.ts
+// src/provisioning/create-only-properties.ts
 const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 const inFlightLookups = /* @__PURE__ */ new Map();
 function getCreateOnlyPropertyPaths(resourceType) {
@@ -14168,8 +14076,7 @@ function parseCreateOnlyResponse(resourceType, schema) {
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/write-only-properties.ts
+// src/provisioning/write-only-properties.ts
 const writeOnlyPropertiesCache = /* @__PURE__ */ new Map();
 const settledWriteOnlyProperties = /* @__PURE__ */ new Map();
 const settledUnreadableCreateOnlyPaths = /* @__PURE__ */ new Map();
@@ -14248,8 +14155,7 @@ function parseRegistrySchema(resourceType, schema) {
 	return parseJsonNamingNoBody(schema, "the DescribeType schema", (line) => getLogger().child("WriteOnlyProperties").debug(safeMsg`${resourceType}: ${line}`));
 }
 
-//#endregion
-//#region src/deployment/replacement-name-holder/name-keys.ts
+// src/deployment/replacement-name-holder/name-keys.ts
 const flat = (property) => ({ name: [[property]] });
 function ownEntry$1(table, key) {
 	return Object.hasOwn(table, key) ? table[key] : void 0;
@@ -14446,8 +14352,7 @@ const SENT_NAME_REWRITTEN = {
 	}
 };
 
-//#endregion
-//#region src/deployment/replacement-name-holder/holder-probe.ts
+// src/deployment/replacement-name-holder/holder-probe.ts
 const SHARED_NAME_SPACES = [
 	/* @__PURE__ */ new Set(["AWS::DynamoDB::Table", "AWS::DynamoDB::GlobalTable"]),
 	/* @__PURE__ */ new Set([
@@ -14585,8 +14490,7 @@ const DERIVED_GENERATED_NAMES = {
 	"AWS::SSM::Parameter": derivedEntry("AWS::SSM::Parameter", "ssm-parameter-provider.ts")
 };
 
-//#endregion
-//#region src/deployment/replacement-name-holder/rewritten.ts
+// src/deployment/replacement-name-holder/rewritten.ts
 function replayPrefixChoice(input) {
 	const rewrite = ownEntry$1(SENT_NAME_REWRITTEN, input.resourceType);
 	if (rewrite === void 0 || input.via === "cc-api") return { kind: "not-applicable" };
@@ -14739,8 +14643,7 @@ function reverseReplacementTrustsGeneratedName(resourceType) {
 	return GENERATED_NAME_VERBATIM.has(resourceType);
 }
 
-//#endregion
-//#region src/deployment/replacement-name-holder/holder.ts
+// src/deployment/replacement-name-holder/holder.ts
 function recordSetHolds(requested, recorded, observed, newPhysicalId, r, v) {
 	const newRecord = `${v.holderRecord} (${r.shown(newPhysicalId)})`;
 	const wantName = valueAt(requested, ["Name"]);
@@ -14879,8 +14782,7 @@ function isPlainName(value) {
 	return !/\s/.test(value) && displayIdent(value, { maxCodePoints: 1152 }) === value;
 }
 
-//#endregion
-//#region src/deployment/replacement-name-holder/deploy-name.ts
+// src/deployment/replacement-name-holder/deploy-name.ts
 function nameValue(bag, property) {
 	const value = bag?.[property];
 	if (typeof value !== "string" || value === "" || value === "***") return void 0;
@@ -15028,8 +14930,7 @@ function probeFoundSameId(resourceType, a, b) {
 	return pa !== void 0 && pa === path(b);
 }
 
-//#endregion
-//#region src/provisioning/config-shape.ts
+// src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
 	if (!isPlainObject$10(container) || isUnresolvedIntrinsicContainer(container)) {
@@ -15162,8 +15063,7 @@ function describe(value) {
 	return typeof value === "object" ? "an object" : `a ${typeof value}`;
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-warm-throughput.ts
+// src/provisioning/dynamodb-warm-throughput.ts
 const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
 function toFiniteNumber(value) {
 	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
@@ -15209,8 +15109,7 @@ function isWarmThroughputDecrease(desired, live) {
 	return sawDecrease;
 }
 
-//#endregion
-//#region src/provisioning/stateful-types.ts
+// src/provisioning/stateful-types.ts
 const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBCluster",
@@ -15372,8 +15271,7 @@ function renderStatefulReason(reason) {
 	}
 }
 
-//#endregion
-//#region src/deployment/recreate-target-readers.ts
+// src/deployment/recreate-target-readers.ts
 async function findReplacedReadersOfRecreateTargets(input) {
 	const conditions = input.conditions;
 	const resources = Object.create(null);
@@ -15584,8 +15482,7 @@ function readsOnlyId(value, id) {
 	return !other && ids > 0;
 }
 
-//#endregion
-//#region src/deployment/child-of-recreated-parent.ts
+// src/deployment/child-of-recreated-parent.ts
 const LAMBDA_FUNCTION = "AWS::Lambda::Function";
 const IAM_ROLE = "AWS::IAM::Role";
 const IAM_USER = "AWS::IAM::User";
@@ -15910,8 +15807,7 @@ function withRecreatedAttachmentsDropped(input) {
 	} : void 0;
 }
 
-//#endregion
-//#region src/provisioning/property-coverage.generated.ts
+// src/provisioning/property-coverage.generated.ts
 const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Account", {
 		handled: /* @__PURE__ */ new Set(["CloudWatchRoleArn"]),
@@ -16535,10 +16431,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceVersion",
 			"Tags",
 			"TimeoutInMinutes",
+			"Triggers",
 			"Visibility",
 			"VpcConfig"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["Triggers", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: true
@@ -16639,6 +16536,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DeletionProtection",
 			"EnableCloudwatchLogsExports",
 			"EngineVersion",
+			"GlobalClusterIdentifier",
 			"KmsKeyId",
 			"ManageMasterUserPassword",
 			"MasterUsername",
@@ -16656,7 +16554,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcSecurityGroupIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
 			["SnapshotIdentifier", "not yet implemented by cdkd"],
@@ -17228,6 +17125,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"PreferredAvailabilityZone",
 			"PreferredAvailabilityZones",
 			"PreferredMaintenanceWindow",
+			"SnapshotArns",
 			"SnapshotName",
 			"SnapshotRetentionLimit",
 			"SnapshotWindow",
@@ -17235,8 +17133,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TransitEncryptionEnabled",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"], ["SnapshotArns", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotArns"]),
+		silentDrop: /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["ConfigurationEndpoint", "RedisEndpoint"]),
 		ccRouteUnavailable: false
 	}],
@@ -17746,6 +17644,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ElasticsearchDestinationConfiguration",
 			"ExtendedS3DestinationConfiguration",
 			"HttpEndpointDestinationConfiguration",
+			"IcebergDestinationConfiguration",
 			"KinesisStreamSourceConfiguration",
 			"RedshiftDestinationConfiguration",
 			"S3DestinationConfiguration",
@@ -17754,7 +17653,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["DatabaseSourceConfiguration", "not yet implemented by cdkd"],
-			["IcebergDestinationConfiguration", "not yet implemented by cdkd"],
 			["MSKSourceConfiguration", "not yet implemented by cdkd"],
 			["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]
 		]),
@@ -18234,14 +18132,19 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::RDS::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
 			"AllocatedStorage",
+			"AllowMajorVersionUpgrade",
 			"AutoMinorVersionUpgrade",
 			"BackupRetentionPeriod",
 			"CACertificateIdentifier",
+			"CertificateRotationRestart",
 			"CopyTagsToSnapshot",
+			"DatabaseInsightsMode",
 			"DBClusterIdentifier",
 			"DBInstanceClass",
 			"DBInstanceIdentifier",
+			"DBParameterGroupName",
 			"DBSubnetGroupName",
+			"DedicatedLogVolume",
 			"DeletionProtection",
 			"EnableIAMDatabaseAuthentication",
 			"EnablePerformanceInsights",
@@ -18249,6 +18152,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EngineVersion",
 			"Iops",
 			"KmsKeyId",
+			"LicenseModel",
 			"ManageMasterUserPassword",
 			"MasterUsername",
 			"MasterUserPassword",
@@ -18257,12 +18161,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"MonitoringInterval",
 			"MonitoringRoleArn",
 			"MultiAZ",
+			"NetworkType",
 			"OptionGroupName",
 			"PerformanceInsightsKMSKeyId",
 			"PerformanceInsightsRetentionPeriod",
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"PromotionTier",
 			"PubliclyAccessible",
 			"StorageEncrypted",
 			"StorageThroughput",
@@ -18272,7 +18178,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
 			["AdditionalStorageVolumes", "not yet implemented by cdkd"],
-			["AllowMajorVersionUpgrade", "not yet implemented by cdkd"],
 			["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
 			["AssociatedRoles", "not yet implemented by cdkd"],
 			["AutomaticBackupReplicationKmsKeyId", "not yet implemented by cdkd"],
@@ -18280,17 +18185,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AutomaticBackupReplicationRetentionPeriod", "not yet implemented by cdkd"],
 			["AvailabilityZone", "not yet implemented by cdkd"],
 			["BackupTarget", "not yet implemented by cdkd"],
-			["CertificateRotationRestart", "not yet implemented by cdkd"],
 			["CharacterSetName", "not yet implemented by cdkd"],
 			["CustomIAMInstanceProfile", "not yet implemented by cdkd"],
-			["DatabaseInsightsMode", "not yet implemented by cdkd"],
 			["DBClusterSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBName", "not yet implemented by cdkd"],
-			["DBParameterGroupName", "not yet implemented by cdkd"],
 			["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
-			["DedicatedLogVolume", "not yet implemented by cdkd"],
 			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainAuthSecretArn", "not yet implemented by cdkd"],
@@ -18300,12 +18201,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DomainOu", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
 			["EngineLifecycleSupport", "not yet implemented by cdkd"],
-			["LicenseModel", "not yet implemented by cdkd"],
 			["MasterUserAuthenticationType", "not yet implemented by cdkd"],
 			["NcharCharacterSetName", "not yet implemented by cdkd"],
-			["NetworkType", "not yet implemented by cdkd"],
 			["ProcessorFeatures", "not yet implemented by cdkd"],
-			["PromotionTier", "not yet implemented by cdkd"],
 			["ReplicaMode", "not yet implemented by cdkd"],
 			["RestoreTime", "not yet implemented by cdkd"],
 			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
@@ -18824,8 +18722,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}]
 ]);
 
-//#endregion
-//#region src/provisioning/unsupported-types.generated.ts
+// src/provisioning/unsupported-types.generated.ts
 const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"Alexa::ASK::Skill",
 	"AWS::AmazonMQ::ConfigurationAssociation",
@@ -19158,8 +19055,7 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::WorkSpaces::WorkspaceImage"
 ]);
 
-//#endregion
-//#region src/provisioning/unsupported-types.ts
+// src/provisioning/unsupported-types.ts
 function isNonProvisionable(resourceType) {
 	return NON_PROVISIONABLE_TYPES.has(resourceType);
 }
@@ -19192,8 +19088,7 @@ function unsupportedTypeIssueUrl(resourceType) {
 	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support resource type ${resourceType}`)}&labels=resource-support`;
 }
 
-//#endregion
-//#region src/provisioning/property-coverage.ts
+// src/provisioning/property-coverage.ts
 function getPropertyCoverage(resourceType) {
 	return PROPERTY_COVERAGE_BY_TYPE.get(resourceType);
 }
@@ -19335,8 +19230,7 @@ function findUnrecognizedProperties(resourceType, templateProperties) {
 	return unrecognized.sort((a, b) => a.localeCompare(b));
 }
 
-//#endregion
-//#region src/state/malformed-resources-bag.ts
+// src/state/malformed-resources-bag.ts
 const UNREADABLE_RESOURCES_MAP_ROW = "(resources map)";
 const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
 function hasReadableResources(state) {
@@ -20145,8 +20039,7 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
-//#endregion
-//#region src/deployment/assumed-conditions.ts
+// src/deployment/assumed-conditions.ts
 const assumedConditionNames = /* @__PURE__ */ new WeakMap();
 function recordAssumedConditions(conditions, assumed) {
 	assumedConditionNames.set(conditions, assumed);
@@ -20155,8 +20048,7 @@ function conditionsAssumedFalse(conditions) {
 	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
 }
 
-//#endregion
-//#region src/deployment/noecho-declared.ts
+// src/deployment/noecho-declared.ts
 function isNoEchoDeclared(noEcho) {
 	return noEcho === true || noEcho === "true";
 }
@@ -20164,8 +20056,7 @@ function declaresNoEcho(definition) {
 	return definition !== null && typeof definition === "object" && isNoEchoDeclared(definition.NoEcho);
 }
 
-//#endregion
-//#region src/deployment/masked-property-fingerprints.ts
+// src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
 const INPUT_FINGERPRINT_LAYOUT = 2;
 function canonicalJson$4(value) {
@@ -21078,8 +20969,7 @@ function backfillMaskedPropertyFingerprints(resources, template, noEchoParameter
 	return stamped;
 }
 
-//#endregion
-//#region src/deployment/drain-budget.ts
+// src/deployment/drain-budget.ts
 const drainDeadlines = new AsyncLocalStorage();
 async function withSharedDrainBudget(fn) {
 	if (drainDeadlines.getStore() !== void 0) return await fn();
@@ -21090,8 +20980,7 @@ async function withSharedDrainBudget(fn) {
 	}, fn);
 }
 
-//#endregion
-//#region src/provisioning/providers/wafv2-arn.ts
+// src/provisioning/providers/wafv2-arn.ts
 function parseWebACLArn(arn) {
 	const segments = arn.split(":").slice(5).join(":").split("/");
 	const scopeRaw = segments[0];
@@ -21103,8 +20992,7 @@ function parseWebACLArn(arn) {
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/ref-values.ts
+// src/deployment/intrinsic-resolver/ref-values.ts
 const AWS_NO_VALUE = Symbol("AWS::NoValue");
 const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Model",
@@ -21327,8 +21215,7 @@ function buildUnknownIntrinsicError(key) {
 	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function ${shown}: cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
 
-//#endregion
-//#region src/deployment/stale-attribute-heal.ts
+// src/deployment/stale-attribute-heal.ts
 var StaleAttributeMissSignal = class StaleAttributeMissSignal extends Error {
 	constructor() {
 		super("stale attribute miss (internal control flow — must not escape resolveGetAtt)");
@@ -21373,8 +21260,7 @@ function mergeHealedAttributes(recorded, healed, isStaleValue) {
 	return merged ?? recorded;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/context.ts
+// src/deployment/intrinsic-resolver/context.ts
 function withoutProducerRegions(context) {
 	if (context?.producerRegions === void 0) return context;
 	const { producerRegions: _stripped, ...rest } = context;
@@ -21473,8 +21359,7 @@ const cachedVpcDefaultSecurityGroups = Object.create(null);
 const cachedCloudFrontDomainNames = Object.create(null);
 const cachedSecurityGroupVpcIds = Object.create(null);
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/account-drain.ts
+// src/deployment/intrinsic-resolver/account-drain.ts
 function effectiveAccountInfoRegion(overrideRegion) {
 	return canonicalizeRegion(overrideRegion || process.env["AWS_REGION"]) || "us-east-1";
 }
@@ -21657,8 +21542,7 @@ function embedsAccountId(value, accountId) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/support.ts
+// src/deployment/intrinsic-resolver/support.ts
 function collectReferencedParameterNames(template) {
 	const parser = new TemplateParser();
 	const referenced = /* @__PURE__ */ new Set();
@@ -21744,8 +21628,7 @@ function quotedRender(rendered, quote, described = "(not shown: it is not a plai
 	return QUOTABLE_RENDER.test(rendered) ? `${quote}${rendered}${quote}` : described;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/masking.ts
+// src/deployment/intrinsic-resolver/masking.ts
 function maskSecretsRaw(resolver, text, context) {
 	const registered = registeredLogTwin(resolver, text, context);
 	const needled = maskNeedlesForLog(resolver, text, context);
@@ -21915,8 +21798,7 @@ function rememberLogTwin(resolver, context, result, twin) {
 	twins.set(result, existing === void 0 || existing === twin ? twin : "***");
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/masking-display.ts
+// src/deployment/intrinsic-resolver/masking-display.ts
 function maskValueLeaves(masker, value, context) {
 	const done = /* @__PURE__ */ new Map();
 	const walk = (node) => {
@@ -21960,8 +21842,7 @@ function displayLeaf(resolver, value, context) {
 	return displayMasked(resolver, logTextOfLeaf(resolver, value, context), context);
 }
 
-//#endregion
-//#region src/deployment/secret-region-classification.ts
+// src/deployment/secret-region-classification.ts
 const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
 	"secretsmanager",
 	"ssm",
@@ -22042,8 +21923,7 @@ function classifyRecordedSecretRegion(expression, consumerRegion, importedProduc
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/cfn-fallback.ts
+// src/deployment/intrinsic-resolver/cfn-fallback.ts
 var CfnFallbackCache = class {
 	cfnExportsPromises = /* @__PURE__ */ new Map();
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
@@ -22126,8 +22006,7 @@ function describeAvailableOutputs(masker, keys, context) {
 	return hidden > 0 ? `${rendered} (+${hidden} more)` : rendered;
 }
 
-//#endregion
-//#region src/utils/caller-credentials.ts
+// src/utils/caller-credentials.ts
 const AWS_CREDENTIAL_ENV_KEYS = [
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
@@ -22164,8 +22043,7 @@ function applyCallerIdentityCredentials(env) {
 	else delete env["AWS_SESSION_TOKEN"];
 }
 
-//#endregion
-//#region src/utils/role-arn.ts
+// src/utils/role-arn.ts
 const crossAccountCredentialsCache = /* @__PURE__ */ new Map();
 const CRED_EXPIRY_SAFETY_MS = 6e4;
 const IAM_ROLE_ARN_RE = /^arn:(aws[a-z0-9-]*):iam::(\d{12}):role\/[\w+=,.@-]+(?:\/[\w+=,.@-]+)*$/;
@@ -22298,8 +22176,7 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/stack-state.ts
+// src/deployment/intrinsic-resolver/stack-state.ts
 async function getSameAccountStackState(stackName, region, context) {
 	if (!context.stateBackend) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: state backend is required for cross-stack references"));
 	return context.stateBackend.getState(stackName, region);
@@ -22338,8 +22215,7 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 	}).getState(stackName, region);
 }
 
-//#endregion
-//#region src/deployment/reference-provenance-record.ts
+// src/deployment/reference-provenance-record.ts
 const SSM_VERSION = /^[0-9]{1,10}$/;
 const SECRETS_MANAGER_VERSION = /^[A-Za-z0-9_+=.@/-]{32,64}$/;
 function referenceTokensIn(value, into = /* @__PURE__ */ new Set()) {
@@ -22538,8 +22414,7 @@ function withReferenceProvenance(record, field) {
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/recorded-reference-routes.ts
+// src/deployment/intrinsic-resolver/recorded-reference-routes.ts
 function tokensOf(value) {
 	const out = /* @__PURE__ */ new Set();
 	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) out.add(token);
@@ -22687,8 +22562,7 @@ async function rebuildByToken(value, resolveToken) {
 	return value;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/cross-stack.ts
+// src/deployment/intrinsic-resolver/cross-stack.ts
 async function reresolveCrossStackValue(resolver, value, producerRegion, context, origin, sourceKey, producerOutput, producerRegionLogText) {
 	if (context.crossStackReads !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && sourceKey !== void 0) context.crossStackReads.set(sourceKey, {
 		stackName: producerOutput.stackName,
@@ -22926,8 +22800,7 @@ function physicalIdsOf(state) {
 	return ids;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
+// src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
 function producerLookupOver(stacks) {
 	return (stackName, account, region) => stacks.find((s) => s.stackName === stackName && s.account === account && sameRegion(s.region, region));
 }
@@ -23097,8 +22970,7 @@ function refuseUnreadableCdkCrossAccountRefs(refs, deployed, consumerOf, lookup)
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/stack-output.ts
+// src/deployment/intrinsic-resolver/stack-output.ts
 async function resolveGetStackOutput(resolver, arg, context) {
 	if (!arg || typeof arg !== "object" || Array.isArray(arg)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: argument must be an object with StackName/OutputName/Region/RoleArn, got ${arg === null ? "null" : Array.isArray(arg) ? "array" : typeof arg}`));
 	const args = arg;
@@ -23285,8 +23157,7 @@ function namedRequestMasks(resolver, pairs, context) {
 	};
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
+// src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
 async function resolveSecretsManagerReference(resolver, inner, context, nameLogText, versionOut, pinVersion) {
 	const afterService = inner.substring(15);
 	let secretId;
@@ -23395,8 +23266,7 @@ function withoutSsmSelector(parameterName) {
 	return selector < 0 ? parameterName : parameterName.slice(0, selector);
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/dynamic-refs.ts
+// src/deployment/intrinsic-resolver/dynamic-refs.ts
 var DynamicReferenceCache = class {
 	cachedDynamicReferences = /* @__PURE__ */ new Map();
 	warnedUnrecognizedSsmTypes = /* @__PURE__ */ new Set();
@@ -23596,8 +23466,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 	};
 }
 
-//#endregion
-//#region src/utils/s3-endpoints.ts
+// src/utils/s3-endpoints.ts
 const S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS = /* @__PURE__ */ new Set([
 	"ap-northeast-1",
 	"ap-southeast-1",
@@ -23629,8 +23498,7 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-heal.ts
+// src/deployment/intrinsic-resolver/getatt-heal.ts
 function staleRecordRemedy(resolver, outcome, context) {
 	const touch = "change any property of the resource so its next update re-records the attributes, or re-import it with 'cdkd import'";
 	if (outcome === void 0) return `Run 'cdkd deploy': it re-reads a stale record's attributes from AWS and heals the record. Otherwise ${touch}.`;
@@ -23761,8 +23629,7 @@ function healMaskedOwnIdAttribute(resolver, logicalId, resource, attributeName,
 	})();
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-refusals.ts
+// src/deployment/intrinsic-resolver/getatt-refusals.ts
 function refuseUnservedAttribute(resolver, site) {
 	const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
 	throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${displayMasked(resolver, logicalId, context)}, ${displayMasked(resolver, attributeName, context)}] for ${displayMasked(resolver, resourceType, context)}: ${observed}. The physical id ${quotedRender(displayMasked(resolver, physicalId, context), "\"")} is not a usable ${displayMasked(resolver, attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
@@ -23807,8 +23674,7 @@ function guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceT
 	return physicalId;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-construct-core.ts
+// src/deployment/intrinsic-resolver/getatt-construct-core.ts
 const NOT_CONSTRUCTED = Symbol("NOT_CONSTRUCTED");
 async function constructAttributeForCoreTypes(resolver, resource, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
 	if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
@@ -23961,8 +23827,7 @@ async function constructAttributeForCoreTypes(resolver, resource, attributeName,
 	return NOT_CONSTRUCTED;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-construct-app.ts
+// src/deployment/intrinsic-resolver/getatt-construct-app.ts
 async function constructAttributeForAppTypes(resolver, resource, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
 	if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 		case "Arn": {
@@ -24100,14 +23965,12 @@ async function constructAttributeForAppTypes(resolver, resource, attributeName,
 	return NOT_CONSTRUCTED;
 }
 
-//#endregion
-//#region src/provisioning/ec2-instance-state.ts
+// src/provisioning/ec2-instance-state.ts
 function isSettledInstanceState(stateName) {
 	return stateName !== void 0 && stateName !== "pending";
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt-construct-compute.ts
+// src/deployment/intrinsic-resolver/getatt-construct-compute.ts
 async function constructAttributeForComputeTypes(resolver, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
 	if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 		case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
@@ -24377,8 +24240,7 @@ const natGatewayAttributeWait = {
 	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 };
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/functions.ts
+// src/deployment/intrinsic-resolver/functions.ts
 async function resolveIf(resolver, ifArgs, context, source) {
 	const [conditionName, valueIfTrue, valueIfFalse] = ifArgs;
 	const resolveBranch = async (branch) => {
@@ -24637,8 +24499,7 @@ function bigIntToIPv6(_resolver, n) {
 	return parts.join(":");
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
+// src/deployment/intrinsic-resolver/parameter-secrets.ts
 function recordInheritedParameterSecrets(resolver, parameterName, value, context) {
 	const inherited = context.inheritedSecrets;
 	const recorded = context.recordedSecretValues;
@@ -24917,8 +24778,7 @@ function refuseCoercedInheritedSecret(resolver, name, paramDef, userValue, inher
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/refs.ts
+// src/deployment/intrinsic-resolver/refs.ts
 function nameIsNeverAResource(_resolver, logicalId, context) {
 	if (logicalId.startsWith("AWS::")) return true;
 	const declared = context.template?.Parameters;
@@ -24994,8 +24854,7 @@ function noteRefStateMask(resolver, logicalId, key, context) {
 	});
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/getatt.ts
+// src/deployment/intrinsic-resolver/getatt.ts
 function pushRedactedAttributeRead(_resolver, context, read) {
 	const bag = context.redactedAttributeReads;
 	if (bag === void 0) return;
@@ -25282,8 +25141,7 @@ async function constructAttribute(resolver, resource, attributeName, context, lo
 	return guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context);
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/string-functions.ts
+// src/deployment/intrinsic-resolver/string-functions.ts
 function partParameterSpans(context, part, resolved) {
 	if (context.recordedSecretValues === void 0) return [];
 	if (typeof part !== "object" || part === null) return [];
@@ -25493,8 +25351,7 @@ async function resolveSplit(resolver, splitArgs, context) {
 	return result;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/params-conditions.ts
+// src/deployment/intrinsic-resolver/params-conditions.ts
 async function resolveParameters(resolver, template, userParameters, options) {
 	const inheritedSecrets = options?.inheritedSecrets;
 	if (inheritedSecrets && options?.recordPseudoParameters !== false) await recordInheritedPseudoParameterValues(resolver, inheritedSecrets, template);
@@ -25605,8 +25462,7 @@ async function resolveKeyUnit(resolver, key, val, context, abandoned) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/sub.ts
+// src/deployment/intrinsic-resolver/sub.ts
 function subPlaceholderWarning(_resolver, varName, error) {
 	return `Fn::Sub variable ${varName} could not be resolved (${describeAwsFailure(error).detail}), keeping placeholder`;
 }
@@ -25805,8 +25661,7 @@ async function resolveSub(resolver, subArgs, context, source) {
 	return result;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/clients.ts
+// src/deployment/intrinsic-resolver/clients.ts
 var ResolverClients = class {
 	regionScopedClients = /* @__PURE__ */ new Map();
 	serviceDiscoveryClients = /* @__PURE__ */ new Map();
@@ -25867,8 +25722,7 @@ var ResolverClients = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/intrinsic-function-resolver.ts
+// src/deployment/intrinsic-function-resolver.ts
 var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
@@ -26034,8 +25888,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	}
 };
 
-//#endregion
-//#region src/state/unsettled-properties.ts
+// src/state/unsettled-properties.ts
 function unsettledPropertiesOf(record) {
 	if (record === null || typeof record !== "object") return /* @__PURE__ */ new Set();
 	const value = record.unsettledProperties;
@@ -26130,8 +25983,7 @@ function unsettledContextOf(...records) {
 	};
 }
 
-//#endregion
-//#region src/analyzer/read-provenance-promotion.ts
+// src/analyzer/read-provenance-promotion.ts
 function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -26225,8 +26077,7 @@ async function readProvenancePromotions(args) {
 	return out;
 }
 
-//#endregion
-//#region src/analyzer/diff-calculator.ts
+// src/analyzer/diff-calculator.ts
 const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Ref",
 	"Fn::Sub",
@@ -26879,8 +26730,7 @@ var DiffCalculator = class DiffCalculator {
 	}
 };
 
-//#endregion
-//#region src/provisioning/ec2-termination-protection.ts
+// src/provisioning/ec2-termination-protection.ts
 async function disableInstanceApiTermination(client, instanceId, logger) {
 	try {
 		await client.send(new ModifyInstanceAttributeCommand({
@@ -26948,8 +26798,7 @@ function ec2InstanceProtectionSite(instanceId, region) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/wait-abandoned.ts
+// src/provisioning/wait-abandoned.ts
 const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
 const ABANDONED_REQUEST = Symbol.for("cdkd.waitAbandoned.request");
 const MAX_CAUSE_CHAIN_DEPTH = 5;
@@ -26986,8 +26835,7 @@ function abandonedRequestOf(error) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/ec2-volume-delete.ts
+// src/provisioning/ec2-volume-delete.ts
 async function deleteEc2VolumeDirect(client, volumeId, logicalId, opts) {
 	const now = opts.now ?? Date.now;
 	try {
@@ -27053,8 +26901,7 @@ function errorName(error) {
 	return typeof name === "string" ? name : "";
 }
 
-//#endregion
-//#region src/deployment/delete-outcome.ts
+// src/deployment/delete-outcome.ts
 function deleteSkipReason(result) {
 	if (!result || result.outcome !== "skipped") return void 0;
 	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
@@ -27109,8 +26956,7 @@ function deleteIndeterminateGuards(result) {
 	return out;
 }
 
-//#endregion
-//#region src/deployment/inline-policy-claims.ts
+// src/deployment/inline-policy-claims.ts
 function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
 	const { selfLogicalId, writers, changes, stateResources } = args;
 	for (const [lid, write] of writers) {
@@ -27614,8 +27460,7 @@ function ownPoliciesChange(change) {
 	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
 
-//#endregion
-//#region src/provisioning/json-patch-generator.ts
+// src/provisioning/json-patch-generator.ts
 var JsonPatchGenerator = class {
 	logger = getLogger().child("JsonPatchGenerator");
 	generatePatch(previousProperties, desiredProperties) {
@@ -27670,8 +27515,7 @@ var JsonPatchGenerator = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/guardduty-detector-patch.ts
+// src/provisioning/guardduty-detector-patch.ts
 const DETECTOR_TYPE = "AWS::GuardDuty::Detector";
 const READ_BACK_KEYS = ["Features", "DataSources"];
 function withGuardDutyDetectorReadBackOps(resourceType, patch, desired, readback) {
@@ -27726,8 +27570,7 @@ function featureName(entry) {
 	return typeof name === "string" ? name : void 0;
 }
 
-//#endregion
-//#region src/provisioning/apigwv2-body-import-patch.ts
+// src/provisioning/apigwv2-body-import-patch.ts
 const API_TYPE = "AWS::ApiGatewayV2::Api";
 const DEFINITION_KEYS = ["Body", "BodyS3Location"];
 const IMPORT_KEYS = [
@@ -27778,8 +27621,7 @@ function apiGatewayV2DefinitionObject(location) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/secret-reference-immutable.ts
+// src/provisioning/secret-reference-immutable.ts
 const IDENTITY = maskerOrIdentity(void 0);
 async function unchangedBehindSecretReference(evidence) {
 	const { resourceType, key, desired, previous, physicalName, maskSecrets } = evidence;
@@ -27839,8 +27681,7 @@ function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-//#endregion
-//#region src/provisioning/getatt-attributes.generated.ts
+// src/provisioning/getatt-attributes.generated.ts
 const WRITABLE_GETATT_ATTRIBUTES = {
 	"AWS::Amplify::Branch": ["BranchName"],
 	"AWS::Amplify::Domain": [
@@ -27994,8 +27835,7 @@ const SHAPE_MISMATCHED_GETATT_ATTRIBUTES = {
 	"AWS::MediaLive::Input": ["Destinations", "Sources"]
 };
 
-//#endregion
-//#region src/provisioning/read-only-properties.ts
+// src/provisioning/read-only-properties.ts
 function isDefinitiveRefusal(error) {
 	if (isThrottlingError(error)) return false;
 	let current = error;
@@ -28062,8 +27902,7 @@ function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
-//#endregion
-//#region src/provisioning/cc-import-identifier.ts
+// src/provisioning/cc-import-identifier.ts
 const primaryIdentifierCache = /* @__PURE__ */ new Map();
 function getPrimaryIdentifierFields(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
@@ -28124,8 +27963,7 @@ function toCloudControlIdentifier(input) {
 	return identifier;
 }
 
-//#endregion
-//#region src/provisioning/cc-protection-properties.ts
+// src/provisioning/cc-protection-properties.ts
 const CC_PROTECTION_PROPERTIES = {
 	"AWS::DSQL::Cluster": {
 		property: "DeletionProtectionEnabled",
@@ -28200,8 +28038,7 @@ function ccProtectionSite(resourceType, physicalId, entry, region) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/slow-cc-operation-timeouts.ts
+// src/provisioning/slow-cc-operation-timeouts.ts
 const MINUTE_MS = 6e4;
 const SLOW_CC_OPERATION_TIMEOUTS = {
 	"AWS::OpenSearchService::Domain": {
@@ -28252,8 +28089,7 @@ function slowCcOperationTimeoutMs(resourceType, operation) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/cloud-control-provider.ts
+// src/provisioning/cloud-control-provider.ts
 const JSON_STRING_PROPERTIES = { "AWS::Events::Rule": /* @__PURE__ */ new Set(["EventPattern"]) };
 function stringifyJsonProperties(resourceType, properties) {
 	const jsonProps = JSON_STRING_PROPERTIES[resourceType];
@@ -28785,7 +28621,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DpNkEibf.js");
+			const { ASGProvider } = await import("./asg-provider-WornuySB.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28894,7 +28730,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Cm3dsmFW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BNxotnbp.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BUNLNluC.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BfzktOKC.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29831,8 +29667,7 @@ function maskLeavesDeep(value) {
 	return "***";
 }
 
-//#endregion
-//#region src/state/state-bucket-lifecycle.ts
+// src/state/state-bucket-lifecycle.ts
 const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID = "cdkd-custom-resource-responses-expiration";
 const CUSTOM_RESOURCE_RESPONSE_EXPIRATION_DAYS = 1;
 const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX = `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/cdkd-1`;
@@ -29949,8 +29784,7 @@ function ensureCustomResourceResponseExpirationOnce(s3, bucket, log) {
 	return run;
 }
 
-//#endregion
-//#region src/deployment/resource-secrets-scope.ts
+// src/deployment/resource-secrets-scope.ts
 const currentResourceSecretsStore = new AsyncLocalStorage();
 const boundSecretBagsStore = new AsyncLocalStorage();
 installLogLineMaskerSource(() => {
@@ -29970,8 +29804,7 @@ function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
 
-//#endregion
-//#region src/provisioning/custom-resource-secure-references.ts
+// src/provisioning/custom-resource-secure-references.ts
 function isCustomResourceType(resourceType) {
 	return resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
 }
@@ -30033,8 +29866,7 @@ function findResolvedSecretPaths(properties, secrets) {
 	return paths;
 }
 
-//#endregion
-//#region src/deployment/noecho-delete-reresolution.ts
+// src/deployment/noecho-delete-reresolution.ts
 function readsNoEchoDeleteValues(resourceType) {
 	return resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::Stack";
 }
@@ -30362,8 +30194,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/custom-resource-provider.ts
+// src/provisioning/providers/custom-resource-provider.ts
 function deletePathMasker(callerMask, noEchoMask) {
 	if (callerMask === void 0) return noEchoMask;
 	if (noEchoMask === void 0) return callerMask;
@@ -31406,8 +31237,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 };
 
-//#endregion
-//#region src/provisioning/mutually-exclusive-properties.ts
+// src/provisioning/mutually-exclusive-properties.ts
 const MUTUALLY_EXCLUSIVE_PROPERTIES = /* @__PURE__ */ new Map([["AWS::EC2::Route", [{
 	properties: [
 		"DestinationCidrBlock",
@@ -31453,8 +31283,7 @@ function buildMutuallyExclusiveMessage(logicalId, violation) {
 	return `  - ${logicalId} (${resourceType}) declares ${declared.join(" and ")}\n      ${rule.rationale}${winnerNote}\n      Declare at most one of: ${rule.properties.join(" / ")}`;
 }
 
-//#endregion
-//#region src/provisioning/nested-required.generated.ts
+// src/provisioning/nested-required.generated.ts
 const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageDescription.Tags", ["Key", "Value"]]])],
 	["AWS::ApiGateway::Method", /* @__PURE__ */ new Map([
@@ -32838,8 +32667,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 	])]
 ]);
 
-//#endregion
-//#region src/provisioning/nested-required.ts
+// src/provisioning/nested-required.ts
 const CFN_ENFORCED_TYPES = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Deployment",
 	"AWS::ApiGateway::Method",
@@ -32968,8 +32796,7 @@ function buildNestedRequiredMessage(logicalId, violation) {
 	return `  - ${logicalId} (${violation.resourceType}): ${violation.path} is missing required ${violation.missing.length === 1 ? "member" : "members"} ${violation.missing.join(", ")}`;
 }
 
-//#endregion
-//#region src/provisioning/property-shape.generated.ts
+// src/provisioning/property-shape.generated.ts
 const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Authorizer", "{\"ProviderARNs\":\"array\"}"],
 	["AWS::ApiGateway::Deployment", "{\"DeploymentCanarySettings\":\"object\",\"DeploymentCanarySettings.StageVariableOverrides\":\"object\",\"StageDescription\":\"object\",\"StageDescription.AccessLogSetting\":\"object\",\"StageDescription.CanarySetting\":\"object\",\"StageDescription.CanarySetting.StageVariableOverrides\":\"object\",\"StageDescription.MethodSettings\":\"array\",\"StageDescription.MethodSettings[]\":\"object\",\"StageDescription.Tags\":\"array\",\"StageDescription.Tags[]\":\"object\",\"StageDescription.Variables\":\"object\"}"],
@@ -33087,8 +32914,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::WAFv2::WebACL", "{\"ApplicationConfig\":\"object\",\"ApplicationConfig.Attributes\":\"array\",\"ApplicationConfig.Attributes[]\":\"object\",\"ApplicationConfig.Attributes[].Values\":\"array\",\"AssociationConfig\":\"object\",\"AssociationConfig.RequestBody\":\"object\",\"CaptchaConfig\":\"object\",\"CaptchaConfig.ImmunityTimeProperty\":\"object\",\"ChallengeConfig\":\"object\",\"ChallengeConfig.ImmunityTimeProperty\":\"object\",\"CustomResponseBodies\":\"object\",\"DataProtectionConfig\":\"object\",\"DataProtectionConfig.DataProtections\":\"array\",\"DataProtectionConfig.DataProtections[]\":\"object\",\"DataProtectionConfig.DataProtections[].Field\":\"object\",\"DataProtectionConfig.DataProtections[].Field.FieldKeys\":\"array\",\"DefaultAction\":\"object\",\"DefaultAction.Allow\":\"object\",\"DefaultAction.Allow.CustomRequestHandling\":\"object\",\"DefaultAction.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"DefaultAction.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"DefaultAction.Block\":\"object\",\"DefaultAction.Block.CustomResponse\":\"object\",\"DefaultAction.Block.CustomResponse.ResponseHeaders\":\"array\",\"DefaultAction.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"MonetizationConfig\":\"object\",\"MonetizationConfig.CryptoConfig\":\"object\",\"MonetizationConfig.CryptoConfig.PaymentNetworks\":\"array\",\"MonetizationConfig.CryptoConfig.PaymentNetworks[]\":\"object\",\"MonetizationConfig.CryptoConfig.PaymentNetworks[].Prices\":\"array\",\"MonetizationConfig.CryptoConfig.PaymentNetworks[].Prices[]\":\"object\",\"OnSourceDDoSProtectionConfig\":\"object\",\"Rules\":\"array\",\"Rules[]\":\"object\",\"Rules[].Action\":\"object\",\"Rules[].Action.Allow\":\"object\",\"Rules[].Action.Allow.CustomRequestHandling\":\"object\",\"Rules[].Action.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Block\":\"object\",\"Rules[].Action.Block.CustomResponse\":\"object\",\"Rules[].Action.Block.CustomResponse.ResponseHeaders\":\"array\",\"Rules[].Action.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"Rules[].Action.Captcha\":\"object\",\"Rules[].Action.Captcha.CustomRequestHandling\":\"object\",\"Rules[].Action.Captcha.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Captcha.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Challenge\":\"object\",\"Rules[].Action.Challenge.CustomRequestHandling\":\"object\",\"Rules[].Action.Challenge.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Challenge.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Count\":\"object\",\"Rules[].Action.Count.CustomRequestHandling\":\"object\",\"Rules[].Action.Count.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Action.Count.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Action.Monetize\":\"object\",\"Rules[].CaptchaConfig\":\"object\",\"Rules[].CaptchaConfig.ImmunityTimeProperty\":\"object\",\"Rules[].ChallengeConfig\":\"object\",\"Rules[].ChallengeConfig.ImmunityTimeProperty\":\"object\",\"Rules[].OverrideAction\":\"object\",\"Rules[].OverrideAction.Count\":\"object\",\"Rules[].OverrideAction.None\":\"object\",\"Rules[].RuleLabels\":\"array\",\"Rules[].RuleLabels[]\":\"object\",\"Rules[].Statement\":\"object\",\"Rules[].Statement.AndStatement\":\"object\",\"Rules[].Statement.AndStatement.Statements\":\"array\",\"Rules[].Statement.AsnMatchStatement\":\"object\",\"Rules[].Statement.AsnMatchStatement.AsnList\":\"array\",\"Rules[].Statement.AsnMatchStatement.ForwardedIPConfig\":\"object\",\"Rules[].Statement.ByteMatchStatement\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.ByteMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.ByteMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.ByteMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.ByteMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.ByteMatchStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.GeoMatchStatement\":\"object\",\"Rules[].Statement.GeoMatchStatement.CountryCodes\":\"array\",\"Rules[].Statement.GeoMatchStatement.ForwardedIPConfig\":\"object\",\"Rules[].Statement.IPSetReferenceStatement\":\"object\",\"Rules[].Statement.IPSetReferenceStatement.IPSetForwardedIPConfig\":\"object\",\"Rules[].Statement.LabelMatchStatement\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ExcludedRules\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ExcludedRules[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.AddressFields\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.AddressFields[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.EmailField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.PasswordField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.PhoneNumberFields\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.PhoneNumberFields[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.RequestInspection.UsernameField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains.FailureStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains.SuccessStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Header\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Header.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Header.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Json\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Json.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.Json.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode.FailureCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode.SuccessCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.RequestInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.RequestInspection.PasswordField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.RequestInspection.UsernameField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains.FailureStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains.SuccessStrings\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Header\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Header.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Header.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Json\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Json.FailureValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.Json.SuccessValues\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode.FailureCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode.SuccessCodes\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge.ExemptUriRegularExpressions\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge.ExemptUriRegularExpressions[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].AWSManagedRulesBotControlRuleSet\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].PasswordField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs[].UsernameField\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.ManagedRuleGroupStatement.RuleActionOverrides[].ActionToUse.Monetize\":\"object\",\"Rules[].Statement.NotStatement\":\"object\",\"Rules[].Statement.OrStatement\":\"object\",\"Rules[].Statement.OrStatement.Statements\":\"array\",\"Rules[].Statement.RateBasedStatement\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].ASN\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Cookie\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Cookie.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Cookie.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].ForwardedIP\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].HTTPMethod\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Header\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Header.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].Header.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].IP\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].JA3Fingerprint\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].JA4Fingerprint\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].LabelNamespace\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryArgument\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryArgument.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryArgument.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryString\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryString.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].QueryString.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].UriPath\":\"object\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].UriPath.TextTransformations\":\"array\",\"Rules[].Statement.RateBasedStatement.CustomKeys[].UriPath.TextTransformations[]\":\"object\",\"Rules[].Statement.RateBasedStatement.ForwardedIPConfig\":\"object\",\"Rules[].Statement.RegexMatchStatement\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.RegexMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.RegexMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.RegexMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.RegexMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.RegexMatchStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.RegexPatternSetReferenceStatement.TextTransformations\":\"array\",\"Rules[].Statement.RegexPatternSetReferenceStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.ExcludedRules\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.ExcludedRules[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Allow.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Block.CustomResponse.ResponseHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Captcha.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Challenge.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders\":\"array\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Count.CustomRequestHandling.InsertHeaders[]\":\"object\",\"Rules[].Statement.RuleGroupReferenceStatement.RuleActionOverrides[].ActionToUse.Monetize\":\"object\",\"Rules[].Statement.SizeConstraintStatement\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.SizeConstraintStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.SizeConstraintStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.SizeConstraintStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.SizeConstraintStatement.TextTransformations\":\"array\",\"Rules[].Statement.SizeConstraintStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.SqliMatchStatement\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.SqliMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.SqliMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.SqliMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.SqliMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.SqliMatchStatement.TextTransformations[]\":\"object\",\"Rules[].Statement.XssMatchStatement\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.AllQueryArguments\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Body\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern.All\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern.ExcludedCookies\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Cookies.MatchPattern.IncludedCookies\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.HeaderOrder\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern.All\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern.ExcludedHeaders\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Headers.MatchPattern.IncludedHeaders\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JA3Fingerprint\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JA4Fingerprint\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody.MatchPattern\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody.MatchPattern.All\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.JsonBody.MatchPattern.IncludedPaths\":\"array\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.Method\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.QueryString\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.SingleHeader\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.SingleQueryArgument\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.UriFragment\":\"object\",\"Rules[].Statement.XssMatchStatement.FieldToMatch.UriPath\":\"object\",\"Rules[].Statement.XssMatchStatement.PreParseTextTransformations\":\"array\",\"Rules[].Statement.XssMatchStatement.PreParseTextTransformations[]\":\"object\",\"Rules[].Statement.XssMatchStatement.TextTransformations\":\"array\",\"Rules[].Statement.XssMatchStatement.TextTransformations[]\":\"object\",\"Rules[].VisibilityConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TokenDomains\":\"array\",\"VisibilityConfig\":\"object\"}"]
 ]);
 
-//#endregion
-//#region src/provisioning/property-shape.ts
+// src/provisioning/property-shape.ts
 const treeCache = /* @__PURE__ */ new Map();
 function buildShapeTree(rows) {
 	const root = { props: /* @__PURE__ */ new Map() };
@@ -33182,8 +33008,7 @@ function validatePropertyShapes(resources) {
 	throw new Error("Properties validation failed: the following resources declare a property whose kind contradicts the resource type's schema:\n" + lines.join("\n") + "\n\nCloudFormation rejects these templates too. Give each property a list where its schema expects a list and an object where it expects an object.");
 }
 
-//#endregion
-//#region src/provisioning/provider-registry.ts
+// src/provisioning/provider-registry.ts
 const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 	["AWS::Scheduler::Schedule", {
 		mode: "cc-broken",
@@ -33523,8 +33348,7 @@ function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
+// src/provisioning/attribute-map.ts
 function definedAttributes(entries) {
 	const out = {};
 	for (const [key, value] of Object.entries(entries)) {
@@ -33538,8 +33362,7 @@ function stringifyIfAssigned(value) {
 	return String(value);
 }
 
-//#endregion
-//#region src/provisioning/tag-list.ts
+// src/provisioning/tag-list.ts
 function isScalar(value) {
 	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
 }
@@ -33633,8 +33456,7 @@ function recordedTagsUnreadableWarning(resourceType, id, applied) {
 	return safeMsg`The recorded Tags of ${resourceType} ${id} is not a list cdkd can read, so cdkd removed no tag and applied the ${applied} desired tag(s) only. Untag any key the template no longer names yourself.`;
 }
 
-//#endregion
-//#region src/provisioning/delete-started.ts
+// src/provisioning/delete-started.ts
 const DELETE_STARTED = Symbol.for("cdkd.deleteStarted");
 const MAX_DEPTH = 10;
 function markDeleteStarted(error) {
@@ -33685,8 +33507,7 @@ function isRefusedByName(error) {
 	return false;
 }
 
-//#endregion
-//#region src/types/deployment-events.ts
+// src/types/deployment-events.ts
 function extractDeploymentEventError(err) {
 	if (!(err instanceof Error)) return {
 		name: "UnknownError",
@@ -33709,8 +33530,7 @@ function extractDeploymentEventError(err) {
 	return result;
 }
 
-//#endregion
-//#region src/state/deployment-events-store.ts
+// src/state/deployment-events-store.ts
 const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
 const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
@@ -34048,8 +33868,7 @@ var DeploymentEventsReader = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/kept-in-history.ts
+// src/deployment/kept-in-history.ts
 function keptInEarlierRecords(records) {
 	const out = [];
 	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
@@ -34122,8 +33941,7 @@ async function loadRollbackRetainedCopies(sources, stackName, region) {
 	return rollbackRetainedInEventHistory(await readRecentRuns(sources, stackName, region), stackName);
 }
 
-//#endregion
-//#region src/provisioning/providers/idempotency-token.ts
+// src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
 const inFlight$1 = /* @__PURE__ */ new Map();
 const generations = /* @__PURE__ */ new Map();
@@ -34164,8 +33982,7 @@ function stackScopedCreateToken(options) {
 	return `cdkd-${logicalId.slice(0, prefixLength)}-${digest}`;
 }
 
-//#endregion
-//#region src/provisioning/providers/create-token-ledger.ts
+// src/provisioning/providers/create-token-ledger.ts
 var CreateTokenLedger = class {
 	doc;
 	loadedAbsent = false;
@@ -34494,8 +34311,7 @@ async function reserveStackCreateToken(options) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-value-equality.ts
+// src/deployment/deploy-value-equality.ts
 function isReplacementCeiling(pc) {
 	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
 }
@@ -34549,8 +34365,7 @@ function deepEqualValue(a, b) {
 	return true;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/provenance-capture.ts
+// src/deployment/deploy-engine/provenance-capture.ts
 var ProvenanceCapture = class {
 	tasks = /* @__PURE__ */ new Map();
 	deps;
@@ -34656,8 +34471,7 @@ function provenanceBaselineOf(state, tokenFree) {
 	};
 }
 
-//#endregion
-//#region src/provisioning/final-snapshot.ts
+// src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBCluster",
@@ -35008,13 +34822,11 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/types.ts
+// src/deployment/rollback-executor/types.ts
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
-//#endregion
-//#region src/deployment/rollback-executor/messages.ts
+// src/deployment/rollback-executor/messages.ts
 function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause, guardScope) {
 	recordRollbackDeleteGuards(result, logicalId, physicalId, guardScope);
 	const reason = deleteSkipReason(result);
@@ -35209,8 +35021,7 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/names.ts
+// src/deployment/rollback-executor/names.ts
 function replayPrefixScope(input, logger, mask, restoring) {
 	const generation = input.nameGeneration;
 	const inGeneration = (fn) => generation === void 0 ? fn() : withNameGeneration({
@@ -35376,8 +35187,7 @@ async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask)
 	}
 }
 
-//#endregion
-//#region src/deployment/secret-name-needles.ts
+// src/deployment/secret-name-needles.ts
 function secretNameNeedlesOf(logicalId, record, secrets, options) {
 	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
 	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
@@ -35647,8 +35457,7 @@ function maskEventTextWithBoundBags(event) {
 	return masked;
 }
 
-//#endregion
-//#region src/deployment/read-only-attribute-healer.ts
+// src/deployment/read-only-attribute-healer.ts
 async function readRecordAttributes(input) {
 	const { provider, logicalId, resource, stackName, region } = input;
 	if (!provider.import) return { kind: "not-attempted" };
@@ -35709,8 +35518,7 @@ function createReadOnlyAttributeHealerFactory(options) {
 	return (stackName, region) => Object.assign((logicalId, resource) => readOnce(stackName, region, logicalId, resource), { readOnly: true });
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/noecho.ts
+// src/deployment/deploy-engine/noecho.ts
 var NoEchoRunState = class {
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
 	persistedNoEchoAttributes = /* @__PURE__ */ new Map();
@@ -36091,8 +35899,7 @@ function noEchoComparisonForTemplate(template, knownConditions, values, resource
 	return (input) => compare(input);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/masking.ts
+// src/deployment/deploy-engine/masking.ts
 var SecretsRunState = class {
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	secretNameNeedles = /* @__PURE__ */ new Map();
@@ -36378,8 +36185,7 @@ function maskedRecordRemedyFor(reads, resources, causeScoped = false) {
 	return [parts.join(" "), ...commandLines].join("\n");
 }
 
-//#endregion
-//#region src/deployment/delete-guard-scope.ts
+// src/deployment/delete-guard-scope.ts
 const storage$1 = new AsyncLocalStorage();
 function collectDeleteGuards(sink, fn) {
 	return storage$1.run(sink, fn);
@@ -36396,8 +36202,7 @@ function reportDeleteGuards(result, target) {
 	});
 }
 
-//#endregion
-//#region src/deployment/superseded-resources.ts
+// src/deployment/superseded-resources.ts
 function supersededResourcesOf(state) {
 	const rows = state?.supersededResources;
 	if (!Array.isArray(rows)) return [];
@@ -36521,8 +36326,7 @@ function holdsSupersededResources(record) {
 	return rows !== void 0 && (!Array.isArray(rows) || rows.length > 0);
 }
 
-//#endregion
-//#region src/utils/colors.ts
+// src/utils/colors.ts
 const codes = {
 	reset: "\x1B[0m",
 	bright: "\x1B[1m",
@@ -36541,8 +36345,7 @@ const cyan = (s) => `${codes.cyan}${s}${codes.reset}`;
 const gray = (s) => `${codes.gray}${s}${codes.reset}`;
 const bold = (s) => `${codes.bright}${s}${codes.reset}`;
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-scope.ts
+// src/deployment/rollback-executor/replay-scope.ts
 function withReplayDeletePrinting(scope, fn) {
 	const deployBag = scope.ctx.logOnlyNeedlesFor?.(scope.op.logicalId);
 	return withPrintingSecrets(scope.secrets, () => deployBag === void 0 ? fn() : withPrintingSecrets(deployBag, fn));
@@ -36558,8 +36361,7 @@ function noteRolledBackCreate(scope, op, record) {
 	scope.onRolledBackCreate?.(create);
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replaced-survivor.ts
+// src/deployment/rollback-executor/replaced-survivor.ts
 function replacedDeleteFailureVerdict(error) {
 	if (isDeleteStarted(error)) return "unconfirmed";
 	return isRefusedByName(error) ? "kept" : "unconfirmed";
@@ -36606,8 +36408,7 @@ async function readSurvivor(s, oldType) {
 	}
 }
 
-//#endregion
-//#region src/deployment/stack-records-scope.ts
+// src/deployment/stack-records-scope.ts
 async function awaitInFlightSibling(view, self, sibling) {
 	const waiting = view.waiting;
 	if (waiting === void 0 || waiting.has(sibling.logicalId)) return void 0;
@@ -36650,8 +36451,7 @@ function replayStackRecordsView(records, orphanLogicalIds = /* @__PURE__ */ new
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/name-collision.ts
+// src/deployment/deploy-engine/name-collision.ts
 function replacementNameOrigin(logicalId, physicalId) {
 	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName(), getCurrentStackInstanceId())) return {
 		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
@@ -36729,8 +36529,7 @@ function isReplacementNameRefusal(error, logicalId) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/replacement.ts
+// src/deployment/deploy-engine/replacement.ts
 var ReplacementRunState = class {
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	deferredReplacedDeletes = void 0;
@@ -37085,8 +36884,7 @@ function warnUnretriedReplacedDeletes(run, deps, why) {
 	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(secretNameBagFor(deps.secretsRun(), logicalId), () => deps.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${noteFor(logicalId)})`));
 }
 
-//#endregion
-//#region src/analyzer/refactor-pairing.ts
+// src/analyzer/refactor-pairing.ts
 const UNPAIRABLE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata", "AWS::CloudFormation::Stack"]);
 function isPairableType(resourceType) {
 	return !UNPAIRABLE_TYPES.has(resourceType);
@@ -37256,8 +37054,7 @@ function splitLocation(location) {
 	};
 }
 
-//#endregion
-//#region src/analyzer/refactor-hints.ts
+// src/analyzer/refactor-hints.ts
 function findRefactorHints(stacks) {
 	const hints = /* @__PURE__ */ new Map();
 	for (const env of new Set(stacks.map((s) => s.env))) {
@@ -37332,8 +37129,7 @@ function withMovedTo(changes, hints) {
 	});
 }
 
-//#endregion
-//#region src/analyzer/destructive-changes.ts
+// src/analyzer/destructive-changes.ts
 const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
 const PATH_METADATA_KEY = "aws:cdk:path";
 function findDestructiveChanges(stackName, changes, records, template, recreateTargets = /* @__PURE__ */ new Set()) {
@@ -37408,8 +37204,7 @@ function withConstructPath(record, path) {
 	};
 }
 
-//#endregion
-//#region src/deployment/masking-retry-logger.ts
+// src/deployment/masking-retry-logger.ts
 function maskingRetryLogger(logger, secrets) {
 	return {
 		debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)),
@@ -37417,8 +37212,7 @@ function maskingRetryLogger(logger, secrets) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/options.ts
+// src/deployment/deploy-engine/options.ts
 const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 const DEFAULT_UNSETTLED_REVERT_WAIT = {
@@ -37426,8 +37220,7 @@ const DEFAULT_UNSETTLED_REVERT_WAIT = {
 	pollMs: 1e4
 };
 
-//#endregion
-//#region src/analyzer/skipped-outputs.ts
+// src/analyzer/skipped-outputs.ts
 function canonicalJson$3(value) {
 	return JSON.stringify(value, (_key, v) => {
 		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
@@ -37541,8 +37334,7 @@ function skippedOutputsEqual(a, b) {
 	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
 }
 
-//#endregion
-//#region src/deployment/outputs-export-alias/names.ts
+// src/deployment/outputs-export-alias/names.ts
 function isOutputSuppressedByCondition(output, conditions) {
 	return output.Condition !== void 0 && conditions?.[output.Condition] === false;
 }
@@ -37558,8 +37350,7 @@ function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
 	return exportName !== outputKey && ownedOutputNames.has(exportName);
 }
 
-//#endregion
-//#region src/deployment/outputs-export-alias/secret-scan.ts
+// src/deployment/outputs-export-alias/secret-scan.ts
 const MIN_SECRET_NEEDLE = 4;
 const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
 const SECRET_DETECTION_ONLY = /\p{Mn}/gu;
@@ -37678,8 +37469,7 @@ function maskEveryOccurrence(text, exposure) {
 	return maskMatchSpans(text, Array.from(exposure.keys()).filter((value) => value !== ""), "***");
 }
 
-//#endregion
-//#region src/deployment/outputs-export-alias/warnings.ts
+// src/deployment/outputs-export-alias/warnings.ts
 function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets, noEchoOnly = false) {
 	const corpus = printingCorpusOf(secrets ?? exposure);
 	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
@@ -37757,8 +37547,7 @@ function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
 	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/outputs.ts
+// src/deployment/deploy-engine/outputs.ts
 var OutputsRunState = class {
 	outputSecrets = /* @__PURE__ */ new Map();
 	outputsPassSecretMaps = [];
@@ -37925,8 +37714,7 @@ function seedOnlyAliasRefusal(seed) {
 	};
 }
 
-//#endregion
-//#region src/analyzer/parameter-dependence.ts
+// src/analyzer/parameter-dependence.ts
 const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
 	"Fn::GetAtt",
 	"Fn::Join",
@@ -38113,8 +37901,7 @@ function resourcesNamingDeclaredParameter(template) {
 	}
 }
 
-//#endregion
-//#region src/deployment/masked-baseline-recapture.ts
+// src/deployment/masked-baseline-recapture.ts
 function isMaskedBaselineRecaptureCandidate(record) {
 	if (record.observedBaselineRefused === true) return false;
 	const observed = record.observedProperties;
@@ -38230,8 +38017,7 @@ function recaptureMaskedBaseline(args) {
 	return changed ? result : void 0;
 }
 
-//#endregion
-//#region src/state/name-generation.ts
+// src/state/name-generation.ts
 var MalformedNameGenerationError = class extends Error {
 	constructor(where, reason = "malformed") {
 		super(`The state record holds a name generation for ${displayIdent(where)} that is ` + (reason === "exhausted" ? "too large to derive the next one from (the next is not a safe integer). " : "not a non-negative integer. ") + "cdkd does not guess which name the resource was given, since the next replacement's name derives from it; restore the field from an earlier version of state.json.");
@@ -38360,8 +38146,7 @@ function retiredNameGenerationsLeaving(state, remaining) {
 	}
 }
 
-//#endregion
-//#region src/deployment/update-outcome.ts
+// src/deployment/update-outcome.ts
 function updatePartialReason(result) {
 	if (!result || result.outcome !== "partial") return void 0;
 	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
@@ -38373,8 +38158,7 @@ function updatePartialMessage(reason) {
 	return `partial (${reason})`;
 }
 
-//#endregion
-//#region src/provisioning/redacted-delete-address.ts
+// src/provisioning/redacted-delete-address.ts
 function isRedactedRecordedValue(value) {
 	if (carriesSecretMask(value)) return true;
 	let text;
@@ -38398,8 +38182,7 @@ function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, cont
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
+// src/deployment/rollback-executor/replay-inline-policy-restore.ts
 async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
 	for (const removal of writers.takeHeldRemovals(stateResources)) await restoreOne(removal, stateResources, stackName, ctx, result, options.refuseAll === true);
 }
@@ -38478,8 +38261,7 @@ function serializedDocument(document) {
 	return isRedactedRecordedValue(document) ? void 0 : JSON.stringify(document);
 }
 
-//#endregion
-//#region src/deployment/producer-regions-scope.ts
+// src/deployment/producer-regions-scope.ts
 const producerRegionsStore = new AsyncLocalStorage();
 function withProducerRegions(evidence, fn) {
 	return producerRegionsStore.run(evidence, fn);
@@ -38502,8 +38284,7 @@ function inheritProducerRegions(own, inherited) {
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-secrets.ts
+// src/deployment/rollback-executor/replay-secrets.ts
 function replayProducerRegionEvidence(ctx) {
 	return {
 		regions: ctx.importedProducerRegions ?? [],
@@ -38617,8 +38398,7 @@ function isPlainRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype$1(value);
 }
 
-//#endregion
-//#region src/deployment/type-change-guard.ts
+// src/deployment/type-change-guard.ts
 function equalIdNamesDifferentResources(input) {
 	if (input.resourceType === "AWS::Lambda::Permission") return permissionsOnDifferentFunctions(input.oldProperties, input.newProperties);
 	if (input.resourceType !== "AWS::Glue::Table" || input.physicalId === void 0) return false;
@@ -38676,8 +38456,7 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place.\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/orphan-identity.ts
+// src/deployment/rollback-executor/orphan-identity.ts
 const UNIQUE_PHYSICAL_ID_TYPES = /* @__PURE__ */ new Set([
 	"AWS::EC2::VPC",
 	"AWS::EC2::Subnet",
@@ -38767,8 +38546,7 @@ async function askForeignHolder(foreignHolder, op) {
 	}
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/plan.ts
+// src/deployment/rollback-executor/plan.ts
 function journaledOldTypes(op) {
 	return {
 		stamped: nonEmptyString(op.previousResourceType) ? op.previousResourceType : void 0,
@@ -39190,8 +38968,7 @@ function someStringLeaf(value, test, depth = 0) {
 	return (Array.isArray(value) ? value : Object.values(value)).some((child) => someStringLeaf(child, test, depth + 1));
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-noecho.ts
+// src/deployment/rollback-executor/replay-noecho.ts
 const NOECHO_REPLAY_READBACK_TIMEOUT_MS = 3e4;
 const NESTED_STACK_TYPE$3 = "AWS::CloudFormation::Stack";
 function coordinatePath(coordinate) {
@@ -39355,8 +39132,7 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-props.ts
+// src/deployment/rollback-executor/replay-props.ts
 async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId, record) {
 	if (props === void 0) return void 0;
 	const recordedRegions = recordedReferenceRegions(record);
@@ -39456,8 +39232,7 @@ function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are five ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. (5) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: restore the property with a 'cdkd deploy' that changes this resource, which sends it the value again. Every rollback to such a baseline refuses while the two values still overlap there, so to end this, change the property (or rotate one of the secrets) so that they no longer overlap. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
-//#endregion
-//#region src/analyzer/drift-normalize.ts
+// src/analyzer/drift-normalize.ts
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
 		const mapped = v.map(canonicalizeTagListsDeep);
@@ -39544,8 +39319,7 @@ function walkUnordered(v, path, paths) {
 	return v;
 }
 
-//#endregion
-//#region src/analyzer/drift-calculator.ts
+// src/analyzer/drift-calculator.ts
 function calculateResourceDrift(stateProperties, awsProperties, options) {
 	const drifts = [];
 	const ignore = options?.ignorePaths ?? [];
@@ -39694,8 +39468,7 @@ function isPlainObject$5(value) {
 	return typeof value === "object" && value !== null;
 }
 
-//#endregion
-//#region src/deployment/unsettled-convergence.ts
+// src/deployment/unsettled-convergence.ts
 const MERGE_SEMANTICS_KEYS = /* @__PURE__ */ new Set(["Tags"]);
 async function readLive(args, names) {
 	const { provider, physicalId, logicalId, resourceType, recordedProperties } = args;
@@ -39873,8 +39646,7 @@ function addedByFailedUpdateWarning(logicalId, resourceType, names) {
 	return safeMsg`${logicalId} (${resourceType}): ${one ? "property" : "properties"} ${names.join(", ")} ${one ? "is" : "are"} set on the resource but in no template: an earlier failed update applied ${one ? "it" : "them"}. cdkd has no default to reset ${one ? "it" : "them"} to, so the value stays; remove it by hand if it should not be there.`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-retry.ts
+// src/deployment/rollback-executor/replay-retry.ts
 const RECREATE_RETRY_SCHEDULE = {
 	maxRetries: 8,
 	initialDelayMs: 2e3,
@@ -39968,8 +39740,7 @@ function copyClaimingProviderBag(properties) {
 	return isSameGenerationBag(properties) ? markSameGenerationBag(copy) : copy;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-orphan-delete.ts
+// src/deployment/rollback-executor/replay-orphan-delete.ts
 async function replayOrphanFlag(s) {
 	const { op, stateResources, stackName, ctx, afterOp, logger, mask } = s;
 	if (op.changeType === "CREATE") {
@@ -40087,8 +39858,7 @@ async function replayDelete(s) {
 	});
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-revert.ts
+// src/deployment/rollback-executor/replay-revert.ts
 async function replayReadopt(s, survivor) {
 	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, logger, mask } = s;
 	const oldKind = survivor === void 0 ? "retained" : "surviving";
@@ -40267,8 +40037,7 @@ async function replayRevert(s) {
 	});
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/replay-reverse-replacement.ts
+// src/deployment/rollback-executor/replay-reverse-replacement.ts
 function refuseSameIdParentReversal(s) {
 	const { op, stateResources, ctx, createdInSegment, orphanLogicalIds } = s;
 	const children = Object.entries(stateResources).filter(([logicalId, record]) => logicalId !== op.logicalId && !createdInSegment.has(logicalId) && !orphanLogicalIds.has(logicalId) && mayBeStoredIn(record.resourceType, op.resourceType) && (!Array.isArray(record.dependencies) || record.dependencies.includes(op.logicalId))).map(([logicalId]) => logicalId).sort();
@@ -40666,8 +40435,7 @@ function survivorUnprovenRefusal(s, oldType, verdict) {
 	return ownRemedyError(markNonRetryable(new CdkdError(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(oldType)}): the deploy did not confirm that it deleted the old resource (${oldShown}), so it may still exist, and ${why}. Nothing was sent and the journal is kept.` + (remedy.offered ? " To keep the new resource in its place instead, re-run with the command below, then delete the old resource by hand if it still exists." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown)}` + remedy.line, "REPLACED_SURVIVOR_UNPROVEN")));
 }
 
-//#endregion
-//#region src/provisioning/remove-protection-types.ts
+// src/provisioning/remove-protection-types.ts
 const SDK_REMOVE_PROTECTION_TYPES = [
 	"AWS::Logs::LogGroup",
 	"AWS::RDS::DBInstance",
@@ -40692,8 +40460,7 @@ function removeProtectionTypeList() {
 	return `${types.slice(0, -1).join(", ")}, and ${types[types.length - 1]}`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor.ts
+// src/deployment/rollback-executor.ts
 function nonEmptyOrUndefined(items) {
 	return items.length > 0 ? items : void 0;
 }
@@ -41281,8 +41048,7 @@ async function replayFailedOperations(...args) {
 	return await withProducerRegions(() => replayProducerRegionEvidence(args[3]), () => withStackRecords(replayStackRecordsView(args[1]), () => replayFailedOperationsUnbound(...args)));
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/observed-capture.ts
+// src/deployment/deploy-engine/observed-capture.ts
 var ObservedCapture = class {
 	observedCaptureTasks = /* @__PURE__ */ new Map();
 	recapturedBaselines = /* @__PURE__ */ new WeakMap();
@@ -41508,8 +41274,7 @@ function stampReasonlessParameterRefusals(logger, stateResources, template) {
 	if (stamped > 0) logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/attribute-healer.ts
+// src/deployment/deploy-engine/attribute-healer.ts
 var AttributeHealer = class {
 	heals = /* @__PURE__ */ new Map();
 	healed = /* @__PURE__ */ new Map();
@@ -41595,8 +41360,7 @@ function healPrintingBag(baseline, logicalId, resource, namingSecrets) {
 	return hit.judge(logicalId);
 }
 
-//#endregion
-//#region src/state/pending-moves.ts
+// src/state/pending-moves.ts
 function pendingMovesOutOf(state) {
 	const raw = state.pendingMovesOut;
 	if (raw === void 0) return {
@@ -41630,8 +41394,7 @@ function refusePendingMovesOut(state, stackName, region, command) {
 	throw markNonRetryable(new CdkdError(pendingMovesRefusalMessage(state, stackName, region, command), "REFACTOR_UNFINISHED"));
 }
 
-//#endregion
-//#region src/state/refactor-marker.ts
+// src/state/refactor-marker.ts
 function refactorMarkerMovesOf(body) {
 	const raw = body?.moves;
 	if (body === null || typeof body !== "object" || !Array.isArray(raw)) return {
@@ -41725,8 +41488,7 @@ function sameMove(a, b) {
 	return a.fromStack === b.fromStack && a.fromRegion === b.fromRegion && a.from === b.from;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/superseded-retry.ts
+// src/deployment/deploy-engine/superseded-retry.ts
 async function retryCarriedSupersededResources(engine, host, carried, resources, options = {}) {
 	let changed = false;
 	if (carried.length === 0) return changed;
@@ -41788,8 +41550,7 @@ async function retryCarriedSupersededResources(engine, host, carried, resources,
 	return changed;
 }
 
-//#endregion
-//#region src/provisioning/name-lookup.ts
+// src/provisioning/name-lookup.ts
 const inFlight = /* @__PURE__ */ new Map();
 const waiting = /* @__PURE__ */ new Map();
 async function withApiLimit(api, max, fn) {
@@ -41826,8 +41587,7 @@ function isAccessDeniedError(error) {
 	return name === "AccessDenied" || name === "AccessDeniedException" || name === "AuthorizationError" || name === "UnauthorizedOperation" || status === 403;
 }
 
-//#endregion
-//#region src/deployment/generated-name-guard.ts
+// src/deployment/generated-name-guard.ts
 const GROUP_WINDOW_MS = 15;
 const DEFAULT_TIMING = {
 	now: () => Date.now(),
@@ -42443,8 +42203,7 @@ async function lookupType(input, resourceType, group) {
 	});
 }
 
-//#endregion
-//#region src/utils/resource-line.ts
+// src/utils/resource-line.ts
 function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	const body = `${bold(displaySafe(logicalId))} ${gray(`(${displaySafe(resourceType)})`)}`;
 	const verb = verbOverride === void 0 ? void 0 : displaySafe(verbOverride);
@@ -42456,8 +42215,7 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/journaled-orphans.ts
+// src/deployment/rollback-executor/journaled-orphans.ts
 const NONE = {
 	segments: [],
 	count: 0
@@ -42907,8 +42665,7 @@ function sameJournaledOrphans(a, b) {
 	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
 }
 
-//#endregion
-//#region src/provisioning/nested-stack-context.ts
+// src/provisioning/nested-stack-context.ts
 const storage = new AsyncLocalStorage();
 function withNestedStackContext(ctx, fn) {
 	return storage.run(ctx, fn);
@@ -42932,8 +42689,7 @@ async function collectNestedChildUnaddressed(fn) {
 	};
 }
 
-//#endregion
-//#region src/deployment/nested-child-journal.ts
+// src/deployment/nested-child-journal.ts
 const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
 const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
 const MAX_NESTED_WALK_DEPTH = 32;
@@ -43254,8 +43010,7 @@ async function revertNestedChildFromJournal(args) {
 	}
 }
 
-//#endregion
-//#region src/deployment/retained-readoption.ts
+// src/deployment/retained-readoption.ts
 function keptUnderGeneratedName(resource) {
 	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
 	const property = explicitNamePropertyFor(resource.resourceType);
@@ -43331,8 +43086,7 @@ var KeptForReadoption = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/deploy-engine/delete.ts
+// src/deployment/deploy-engine/delete.ts
 const keptByEngine = /* @__PURE__ */ new WeakMap();
 async function flushKeptForReadoption(engine) {
 	await keptByEngine.get(engine)?.flush();
@@ -43492,8 +43246,7 @@ Drop the record with: ${dropCommand}`);
 	deps.logger.info(safeMsg`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
 }
 
-//#endregion
-//#region src/deployment/cc-pending-requests.ts
+// src/deployment/cc-pending-requests.ts
 function hasPendingCloudControlRequest(op) {
 	return op.pendingCloudControlRequest !== void 0;
 }
@@ -43656,8 +43409,7 @@ function withoutPendingRequest(op) {
 	return rest;
 }
 
-//#endregion
-//#region src/deployment/orphan-adoption.ts
+// src/deployment/orphan-adoption.ts
 function templateStillDeclares(template, record, nameProperties) {
 	const declared = template.Resources?.[record.logicalId];
 	if (!declared) return false;
@@ -43805,8 +43557,7 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/rollback.ts
+// src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(deps, operations) {
 	return operations.map((op) => {
 		const secrets = deps.secretsRun().perResourceSecrets.get(op.logicalId);
@@ -44351,8 +44102,7 @@ async function orphanUntakenResumes(deps, stackName, finalResources) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/canonicalize-properties.ts
+// src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
 	const logger = getLogger().child("canonicalize-properties");
 	return (resourceType, properties) => {
@@ -44366,8 +44116,7 @@ function makeCanonicalizePropertiesFn(registry) {
 	};
 }
 
-//#endregion
-//#region src/deployment/no-change-outputs-merge.ts
+// src/deployment/no-change-outputs-merge.ts
 function isSecretBearingReferenceString(value) {
 	if (typeof value !== "string") return false;
 	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
@@ -44441,8 +44190,7 @@ function keptWholeReasonText(reason) {
 	}
 }
 
-//#endregion
-//#region src/deployment/output-value-preflight.ts
+// src/deployment/output-value-preflight.ts
 function selectsNoValue(value, conditions, assumed, depth = 0) {
 	if (depth > 64 || value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -44463,8 +44211,7 @@ function refuseNoValueOutputs(outputs, conditions) {
 	throw markNonRetryable(/* @__PURE__ */ new Error(`Output ${offending.join(", ")} evaluates to AWS::NoValue, and CloudFormation rejects the template for it ("The Value field of every Outputs member must evaluate to a String") before creating anything. To publish an Output only sometimes, give it a Condition instead of selecting AWS::NoValue in its Value.`));
 }
 
-//#endregion
-//#region src/analyzer/security-changes.ts
+// src/analyzer/security-changes.ts
 const RESOURCE_SCRUTINY = {
 	"AWS::Bedrock::KnowledgeBasePolicy": "ResourcePolicyResource",
 	"AWS::Bedrock::ResourcePolicy": "ResourcePolicyResource",
@@ -45438,8 +45185,7 @@ function stdoutSupportsColor(env = process.env, argv = process.argv, isTTY = pro
 	return min > 0;
 }
 
-//#endregion
-//#region src/analyzer/security-diff.ts
+// src/analyzer/security-diff.ts
 function isSyntheticChange(pc) {
 	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true || pc.unsettled === true;
 }
@@ -45597,8 +45343,7 @@ function logicalIdToPath(records, template) {
 	return map;
 }
 
-//#endregion
-//#region src/deployment/resource-deadline.ts
+// src/deployment/resource-deadline.ts
 var InvalidResourceDeadlineError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -45698,8 +45443,7 @@ function enclosingDeadlineRemainingMs() {
 	return deadlineScope.getStore()?.remainingMs() ?? Number.POSITIVE_INFINITY;
 }
 
-//#endregion
-//#region src/deployment/deployment-approval.ts
+// src/deployment/deployment-approval.ts
 const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 async function requireDeploymentApproval(args) {
 	const level = args.options.requireApproval ?? "never";
@@ -45805,8 +45549,7 @@ function isNoEchoPromotionOnly(change) {
 	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
 }
 
-//#endregion
-//#region src/deployment/condition-verdicts.ts
+// src/deployment/condition-verdicts.ts
 function conditionInputsFrom(args) {
 	return (parameter) => {
 		if (args.unavailable?.has(parameter)) return void 0;
@@ -46023,8 +45766,7 @@ function conditionVerdictRecordsEqual(a, b) {
 	return names.every((name) => Object.hasOwn(right, name) && left[name].verdict === right[name].verdict && left[name].fingerprint === right[name].fingerprint);
 }
 
-//#endregion
-//#region src/utils/nested-template-cycle.ts
+// src/utils/nested-template-cycle.ts
 const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
 function isAbsoluteAssetPath(p) {
 	return path.isAbsolute(p) || p.startsWith("/");
@@ -46164,8 +45906,7 @@ function renderNestedTemplateTreeDefect(defect, stackName, action) {
 	return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
 }
 
-//#endregion
-//#region src/deployment/nested-output-templates.ts
+// src/deployment/nested-output-templates.ts
 function childTemplateLoader(nestedTemplates) {
 	if (nestedTemplates === void 0) return void 0;
 	const read = /* @__PURE__ */ new Map();
@@ -46201,8 +45942,7 @@ function childIndex(template, templatePath) {
 	return index;
 }
 
-//#endregion
-//#region src/deployment/recreate-target-promotion.ts
+// src/deployment/recreate-target-promotion.ts
 function recreateTargetIdsFor(recreateTargets, stackName) {
 	if (recreateTargets === void 0 || recreateTargets.stackName !== stackName) return void 0;
 	const ids = /* @__PURE__ */ new Set([...recreateTargets.viaCcApi, ...recreateTargets.viaSdkProvider]);
@@ -46234,8 +45974,7 @@ function promoteRecreateTargets(changes, recreateTargets, stackName) {
 	};
 }
 
-//#endregion
-//#region src/deployment/custom-resource-service-token.ts
+// src/deployment/custom-resource-service-token.ts
 const SERVICE_TOKEN_CHANGE_REFUSED = "CUSTOM_RESOURCE_SERVICE_TOKEN_CHANGED";
 function uncomparableToken(value) {
 	if (value === void 0 || value === null || value === "") return "absent";
@@ -46343,8 +46082,7 @@ function deferredServiceTokenWarning(row) {
 	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back. A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
 }
 
-//#endregion
-//#region src/deployment/read-provenance-sources.ts
+// src/deployment/read-provenance-sources.ts
 function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -46404,8 +46142,7 @@ function inheritedProvenanceForChildDiff(args) {
 	return out.size === 0 ? void 0 : out;
 }
 
-//#endregion
-//#region src/deployment/dag-executor.ts
+// src/deployment/dag-executor.ts
 var DagExecutor = class {
 	nodes = /* @__PURE__ */ new Map();
 	logger = getLogger().child("DagExecutor");
@@ -46531,8 +46268,7 @@ var DagExecutor = class {
 	}
 };
 
-//#endregion
-//#region src/analyzer/implicit-delete-deps.ts
+// src/analyzer/implicit-delete-deps.ts
 const IMPLICIT_DELETE_DEPENDENCIES = {
 	"AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment", "AWS::EC2::NatGateway"],
 	"AWS::EC2::VPCGatewayAttachment": ["AWS::EC2::NatGateway"],
@@ -46596,8 +46332,7 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/dependencies.ts
+// src/deployment/deploy-engine/dependencies.ts
 function hasPending(executor) {
 	for (const node of executor.values()) if (node.state === "pending") return true;
 	return false;
@@ -46656,8 +46391,7 @@ function addImplicitDeleteDependencies(deleteIds, state, dependedBy, logger) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/record-shape.ts
+// src/deployment/deploy-engine/record-shape.ts
 function auditResolvedAssetReferences(options, logicalId, resourceType, resolvedProps) {
 	const redirect = options.assetRedirect;
 	if (!redirect) return;
@@ -46701,8 +46435,7 @@ function secretNamedAttributesField(result, previous) {
 	return names.length > 0 ? { secretNamedAttributes: names } : {};
 }
 
-//#endregion
-//#region src/deployment/prior-attempt-scope.ts
+// src/deployment/prior-attempt-scope.ts
 const priorAttemptStore = new AsyncLocalStorage();
 function withPriorAttempts(lookup, fn) {
 	return priorAttemptStore.run(lookup, fn);
@@ -46785,8 +46518,7 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/label-routing.ts
+// src/deployment/label-routing.ts
 function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
 	try {
 		if (change.changeType === "DELETE") return existingState?.provisionedBy;
@@ -46802,8 +46534,7 @@ function deriveLabelRouting(change, existingState, registry, forceCcApi = false)
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/routing.ts
+// src/deployment/deploy-engine/routing.ts
 function isPinnedToCcApi(options, stackName, logicalId) {
 	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
 }
@@ -46829,8 +46560,7 @@ function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps
 	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/resolver-context.ts
+// src/deployment/deploy-engine/resolver-context.ts
 function buildResolverContext(deps, base, stackName) {
 	const recordedSecretValues = /* @__PURE__ */ new Map();
 	if (deps.options.inheritedSecrets && deps.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, deps.options.inheritedSecrets);
@@ -46913,8 +46643,7 @@ function maskedInputSources(deps, template, resources, conditions, stackName) {
 	};
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/create.ts
+// src/deployment/deploy-engine/create.ts
 async function provisionCreate(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
 	const renderer = getLiveRenderer();
@@ -47192,8 +46921,7 @@ async function resumeAbandonedCreate(engine, args) {
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/data-delete-intent.ts
+// src/provisioning/data-delete-intent.ts
 const S3_AUTO_DELETE_OBJECTS_TAG = "aws-cdk:auto-delete-objects";
 const ECR_AUTO_DELETE_IMAGES_TAG = "aws-cdk:auto-delete-images";
 function hasCdkAutoDeleteTag(properties, tagKey) {
@@ -47209,8 +46937,7 @@ function isTruthyCfnBoolean(value) {
 	return value === true || value === "true";
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-ttl.ts
+// src/provisioning/dynamodb-ttl.ts
 function readTtlSpec(spec) {
 	if (spec === void 0 || spec === null) return {
 		enabled: false,
@@ -47276,8 +47003,7 @@ async function sendTtlWaitingOutRateLimit(send, options) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-vector-indexes.ts
+// src/provisioning/dynamodb-vector-indexes.ts
 function vectorIndexesByName(value) {
 	const out = /* @__PURE__ */ new Map();
 	if (!Array.isArray(value)) return out;
@@ -47395,8 +47121,7 @@ function vectorIndexesSettled(live) {
 	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-index-busy-delete.ts
+// src/provisioning/dynamodb-index-busy-delete.ts
 function maskedLogger(logger, maskSecrets, name) {
 	if (maskSecrets === void 0) return logger;
 	const maskedName = name === void 0 || name === "" ? name : maskSecrets(name);
@@ -47529,8 +47254,7 @@ async function deleteTableWithIndexBusyRetry(opts) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/providers/dynamodb-delete-budget.ts
+// src/provisioning/providers/dynamodb-delete-budget.ts
 const DYNAMODB_DELETE_POLL_RTT_MS = 200;
 const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
 const DYNAMODB_DELETE_BUDGET_MS = 156e4;
@@ -47643,8 +47367,7 @@ function isResourceNotFoundError(error) {
 	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-contributor-insights.ts
+// src/provisioning/dynamodb-contributor-insights.ts
 const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
 function readContributorInsightsSpec(value, path) {
 	if (value === void 0 || value === null) return { kind: "absent" };
@@ -47748,8 +47471,7 @@ function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
 	return block;
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-replica-settings.ts
+// src/provisioning/dynamodb-replica-settings.ts
 const PITR_KEY = "PointInTimeRecoverySpecification";
 const KINESIS_KEY = "KinesisStreamSpecification";
 const TABLE_POLICY_KEY = "ResourcePolicy";
@@ -48278,8 +48000,7 @@ function keepUnreadReplicaMembers(desired, previous) {
 	} : desired;
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-stream-members.ts
+// src/provisioning/dynamodb-stream-members.ts
 const STREAM_SPECIFICATION_KEY$1 = "StreamSpecification";
 const STREAM_POLICY_KEY = "ResourcePolicy";
 const STREAM_TAGS_KEY = "Tags";
@@ -48476,8 +48197,7 @@ function canonicalJson(value) {
 	return JSON.stringify(value) ?? "null";
 }
 
-//#endregion
-//#region src/provisioning/providers/dynamodb-globaltable-provider.ts
+// src/provisioning/providers/dynamodb-globaltable-provider.ts
 function isTableName(id) {
 	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
 }
@@ -48881,6 +48601,7 @@ var DynamoDBGlobalTableProvider = class {
 			toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		}
 		this.reportThroughputDiagnostics(diagnostics, logicalId, tableName, maskSecrets);
+		let registeredBeforeReplicas = [];
 		let createdTableId;
 		try {
 			createdTableId = (await (await this.getCreateClient()).send(new CreateTableCommand(createParams)))?.TableDescription?.TableId;
@@ -48893,6 +48614,9 @@ var DynamoDBGlobalTableProvider = class {
 		try {
 			const tableInfo = await this.waitForTableActive(tableName, logicalId, void 0, maskSecrets);
 			if (createVectorIndexes !== void 0) await this.waitForVectorIndexesSettled(tableName, logicalId, maskSecrets);
+			const scalingSpecs = billingMode === "PROVISIONED" ? collectAutoScalingTargets(wiringProperties, currentRegion) : [];
+			if (wiringReplicas.some((r) => r["Region"] !== currentRegion)) registeredBeforeReplicas = scalingSpecs.filter((spec) => spec.region === currentRegion && spec.dimension.endsWith("WriteCapacityUnits"));
+			if (registeredBeforeReplicas.length > 0) await this.reconcileAutoScalingTargets(tableName, [], registeredBeforeReplicas, currentRegion, void 0, maskSecrets);
 			for (const replica of wiringReplicas) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
@@ -48916,7 +48640,7 @@ var DynamoDBGlobalTableProvider = class {
 				}
 			}));
 			if (billingMode === "PROVISIONED") try {
-				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(wiringProperties, currentRegion), currentRegion, void 0, maskSecrets);
+				await this.reconcileAutoScalingTargets(tableName, [], scalingSpecs, currentRegion, new Set(registeredBeforeReplicas.map(autoScalingTargetKey)), maskSecrets);
 			} catch (autoScalingErr) {
 				warn(`Auto-scaling registration failed for ${tableName}: ${describeAwsFailure(autoScalingErr).detail}. The table was created successfully; re-run the deploy to register the scaling targets.`);
 			}
@@ -48958,12 +48682,13 @@ var DynamoDBGlobalTableProvider = class {
 						warn(`Partial-create cleanup: failed to drop replica ${region} on ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup: failed to drop replica ${region} on ${tableName}: `, replicaCleanupErr)} Run: ${pasteableAwsCommand(maskSecrets)`aws dynamodb update-table --table-name ${tableName} --replica-updates 'Delete={RegionName='${region}'}' --region ${currentRegion}`.render()}`);
 					}
 				}
+				for (const spec of registeredBeforeReplicas) await this.applyAutoScalingDiff(tableName, spec.dimension, spec.settings, void 0, void 0, spec.indexName, void 0, maskSecrets);
 				if (createVectorIndexes !== void 0) await this.rollBackCreatedVectorTable(logicalId, tableName, maskSecrets);
 				else await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 				retractCreatedResource(logicalId, resourceType, tableName);
 			} catch (cleanupErr) {
 				tableLeftBehind = true;
-				warn(`Partial-create cleanup failed for ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup failed for ${tableName}: `, cleanupErr)} To remove the orphaned AWS-side table, run: ` + pasteableAwsCommand(maskSecrets)`aws dynamodb delete-table --table-name ${tableName}`.render());
+				warn(`Partial-create cleanup failed for ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup failed for ${tableName}: `, cleanupErr)} ` + (registeredBeforeReplicas.length > 0 ? "Its write scalable targets and scaling policies may still be registered. To remove the table and them, run cdkd rollback --revert-failed." : `To remove the orphaned AWS-side table, run: ` + pasteableAwsCommand(maskSecrets)`aws dynamodb delete-table --table-name ${tableName}`.render()));
 			}
 			markAuxiliaryFailure(wiringError, logicalId);
 			const cause = wiringError instanceof Error ? wiringError : void 0;
@@ -49083,6 +48808,19 @@ var DynamoDBGlobalTableProvider = class {
 			await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
 		}
 		await this.waitForReplicaActive(tableName, region, logicalId, void 0, maskSecrets);
+		const provisionedIndexes = replicaIndexes?.filter((i) => i.ProvisionedThroughputOverride);
+		if (create.ProvisionedThroughputOverride || provisionedIndexes?.length) {
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+			await this.dynamoDBClient.send(new UpdateTableCommand({
+				TableName: tableName,
+				ReplicaUpdates: [{ Update: {
+					RegionName: region,
+					...create.ProvisionedThroughputOverride && { ProvisionedThroughputOverride: create.ProvisionedThroughputOverride },
+					...provisionedIndexes?.length && { GlobalSecondaryIndexes: provisionedIndexes }
+				} }]
+			}));
+			await this.waitForGlobalTableSettled(tableName, logicalId, maskSecrets);
+		}
 		if (readReplicaDeletionProtection(replica, region, (message) => this.logger.warn(maskSecrets(message))) === true) await this.setReplicaDeletionProtection(tableName, region, true, logicalId, maskSecrets);
 	}
 	async setReplicaDeletionProtection(tableName, region, enabled, logicalId, maskSecrets, budget) {
@@ -49875,6 +49613,17 @@ var DynamoDBGlobalTableProvider = class {
 			await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
+			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
+			const declaredRegions = declaredCrossRegions(properties, currentRegion);
+			const staysReplicated = liveHasCrossRegionReplica && declaredRegions.length > 0;
+			const literalWriteMoves = staysReplicated && literalWriteSideMoves(properties, previousProperties, currentRegion, describeResp.Table);
+			const statePath = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+			const addsRegionToLiteral = !statePath && properties["BillingMode"] === "PROVISIONED" && !writeSideScaled(properties) && declaredRegions.some((region) => !describeResp.Table?.Replicas?.some((r) => r.RegionName === region));
+			if (literalWriteMoves || addsRegionToLiteral) {
+				const refusal = `AWS::DynamoDB::GlobalTable ${logicalId}: a table with a cross-region replica needs an auto-scaled write side, and this update declares none: CloudFormation refuses a literal WriteCapacityUnits, and DynamoDB refuses every replica update without auto-scaling`;
+				if (statePath) warn(`${refusal}${refusal}. No capacity beyond what a billing flip carries was sent.`);
+				else throw new ProvisioningError(maskSecrets(`${refusal}. Nothing was applied to the table; declare WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings`), resourceType, logicalId, physicalId);
+			}
 			const vectorIndexesChanged = !deepEqual(properties["VectorIndexes"], previousProperties["VectorIndexes"]);
 			const vectorIndexShape = vectorIndexesShapeDetail(properties["VectorIndexes"]);
 			if (vectorIndexShape !== void 0 && vectorIndexesChanged) warn(`${vectorIndexShape}; the VectorIndexes change was not applied`);
@@ -49924,6 +49673,7 @@ var DynamoDBGlobalTableProvider = class {
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics, maskSecrets);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
 			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics, maskSecrets);
+			const tableCapacityChange = !literalWriteMoves && oldBilling === "PROVISIONED" && newBilling === "PROVISIONED" && liveBillingMode === "PROVISIONED" ? readTableCapacityChange(properties, previousProperties, currentRegion, diagnostics, maskSecrets) : void 0;
 			let desiredGsiUnusable = false;
 			const onUnusableGsiBlock = (message) => {
 				desiredGsiUnusable = true;
@@ -50046,7 +49796,6 @@ var DynamoDBGlobalTableProvider = class {
 				TableName: physicalId,
 				TableClass: tableClassUpdate
 			}, tableClassFromTemplate, "TableClass", physicalId, logicalId, maskSecrets);
-			const liveHasCrossRegionReplica = (describeResp.Table?.Replicas ?? []).some((r) => r.RegionName !== void 0 && r.RegionName !== currentRegion);
 			if (sseUpdate?.KMSMasterKeyId !== void 0 && liveHasCrossRegionReplica) {
 				deferredSseUpdate = sseUpdate;
 				deferredSseFromTemplate = sseFromTemplate;
@@ -50110,33 +49859,47 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
-			const readBlockOf = (bag) => localReplicaEntry(bag, currentRegion)?.[TABLE_READ_PROVISIONED_KEY] ?? bag[TABLE_READ_PROVISIONED_KEY];
-			if (oldBilling === "PROVISIONED" && newBilling === "PROVISIONED" && liveBillingMode === "PROVISIONED" && (properties[TABLE_READ_PROVISIONED_KEY] !== void 0 || previousProperties[TABLE_READ_PROVISIONED_KEY] !== void 0) && !deepEqual(readBlockOf(properties), readBlockOf(previousProperties))) {
-				const wantRead = coerceCfnInteger(asRecord(readBlockOf(properties))?.["ReadCapacityUnits"]);
-				const liveThroughput = describeResp.Table?.ProvisionedThroughput;
-				if (wantRead !== void 0 && liveThroughput?.WriteCapacityUnits !== void 0 && wantRead !== liveThroughput.ReadCapacityUnits) {
-					markUnsettled(TABLE_READ_PROVISIONED_KEY);
-					await this.dynamoDBClient.send(new UpdateTableCommand({
-						TableName: physicalId,
-						ProvisionedThroughput: {
-							ReadCapacityUnits: wantRead,
-							WriteCapacityUnits: liveThroughput.WriteCapacityUnits
-						}
-					}));
-					await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
-				}
-			}
 			const writeAutoScalingOld = (previousProperties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const writeAutoScalingNew = (properties["WriteProvisionedThroughputSettings"] ?? {})["WriteCapacityAutoScalingSettings"];
 			const effectiveNewAutoScaling = oldBilling === "PROVISIONED" && newBilling === "PAY_PER_REQUEST" ? void 0 : writeAutoScalingNew;
 			const autoScalingApplied = /* @__PURE__ */ new Set();
-			if ((newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !deepEqual(writeAutoScalingOld, effectiveNewAutoScaling)) {
+			const autoScalingMeaningful = newBilling === "PROVISIONED" || oldBilling === "PROVISIONED";
+			if (literalWriteMoves) autoScalingApplied.add(autoScalingTargetKey({
+				dimension: "dynamodb:table:WriteCapacityUnits",
+				region: currentRegion
+			}));
+			if (autoScalingMeaningful && !literalWriteMoves && !deepEqual(writeAutoScalingOld, effectiveNewAutoScaling)) {
 				await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", writeAutoScalingOld, effectiveNewAutoScaling, void 0, void 0, void 0, maskSecrets);
 				autoScalingApplied.add(autoScalingTargetKey({
 					dimension: "dynamodb:table:WriteCapacityUnits",
 					region: currentRegion
 				}));
 			}
+			if (tableCapacityChange) {
+				const liveThroughput = describeResp.Table?.ProvisionedThroughput;
+				const sendRead = tableCapacityChange.read ?? liveThroughput?.ReadCapacityUnits;
+				const sendWrite = tableCapacityChange.write ?? liveThroughput?.WriteCapacityUnits;
+				const readMoves = sendRead !== liveThroughput?.ReadCapacityUnits;
+				const writeMoves = sendWrite !== liveThroughput?.WriteCapacityUnits;
+				if (sendRead !== void 0 && sendWrite !== void 0 && (readMoves || writeMoves)) {
+					markUnsettled(...readMoves ? tableCapacityChange.readKeys : [], ...writeMoves ? [TABLE_WRITE_PROVISIONED_KEY] : []);
+					await this.dynamoDBClient.send(new UpdateTableCommand(staysReplicated ? {
+						TableName: physicalId,
+						ReplicaUpdates: [{ Update: {
+							RegionName: currentRegion,
+							ProvisionedThroughputOverride: { ReadCapacityUnits: sendRead }
+						} }]
+					} : {
+						TableName: physicalId,
+						ProvisionedThroughput: {
+							ReadCapacityUnits: sendRead,
+							WriteCapacityUnits: sendWrite
+						}
+					}));
+					if (liveHasCrossRegionReplica) await this.waitForGlobalTableSettled(physicalId, logicalId, maskSecrets);
+					else await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
+				}
+			}
 			const modeUpdate = replicationModeUpdate(properties, previousProperties);
 			if (modeUpdate === "DISABLED" && readReplicationMode(properties).kind === "absent") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
 			const replicaDiff = diffReplicas(previousProperties["Replicas"] ?? [], properties["Replicas"] ?? []);
@@ -50218,7 +49981,7 @@ var DynamoDBGlobalTableProvider = class {
 					TableName: physicalId,
 					ReplicaUpdates: [{ Update: updateAction }]
 				}));
-				await this.waitForReplicaActive(physicalId, region, logicalId, void 0, maskSecrets);
+				await this.waitForGlobalTableSettled(physicalId, logicalId, maskSecrets, { region });
 			}
 			const addedReplicaRegions = new Set(replicaDiff.added.map((r) => r["Region"]));
 			if (modeUpdate !== void 0 && readReplicationMode(properties).kind === "usable") await this.sendReplicationMode(physicalId, logicalId, modeUpdate, maskSecrets);
@@ -50983,12 +50746,15 @@ var DynamoDBGlobalTableProvider = class {
 				let protection;
 				let disassociationProtection;
 				let streamArn;
+				let regionalRead;
 				if (isLocal) {
+					regionalRead = table.ProvisionedThroughput?.ReadCapacityUnits;
 					protection = table.DeletionProtectionEnabled;
 					disassociationProtection = table.DisassociationProtectionEnabled;
 					streamArn = table.LatestStreamArn;
 				} else try {
 					const regional = await client.send(new DescribeTableCommand({ TableName: tableNameForSubs }));
+					regionalRead = regional.Table?.ProvisionedThroughput?.ReadCapacityUnits;
 					protection = regional.Table?.DeletionProtectionEnabled;
 					disassociationProtection = regional.Table?.DisassociationProtectionEnabled;
 					streamArn = regional.Table?.LatestStreamArn;
@@ -51019,6 +50785,7 @@ var DynamoDBGlobalTableProvider = class {
 					const replicaAutoScalingClient = isLocal ? void 0 : this.getRegionalAutoScalingClient(regionLabel);
 					const readAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:table:ReadCapacityUnits", replicaAutoScalingClient);
 					if (readAutoScaling) entry["ReadProvisionedThroughputSettings"] = { ReadCapacityAutoScalingSettings: readAutoScaling };
+					else if (strictFor("Replicas") && regionalRead !== void 0) entry["ReadProvisionedThroughputSettings"] = { ReadCapacityUnits: regionalRead };
 				}
 				return entry;
 			})));
@@ -51566,6 +51333,7 @@ const REPLICA_SETTING_MEMBERS = [
 const REPLICATION_MODE_KEY = "GlobalTableSettingsReplicationMode";
 const TABLE_READ_ON_DEMAND_KEY = "ReadOnDemandThroughputSettings";
 const TABLE_READ_PROVISIONED_KEY = "ReadProvisionedThroughputSettings";
+const TABLE_WRITE_PROVISIONED_KEY = "WriteProvisionedThroughputSettings";
 function readReplicationMode(properties) {
 	const replicas = Array.isArray(properties["Replicas"]) ? properties["Replicas"] : [];
 	const declared = replicas.map((entry) => asRecord(entry)?.[REPLICATION_MODE_KEY]).filter((value) => value !== void 0 && value !== null);
@@ -51712,6 +51480,41 @@ function derivePerCallProvisionedThroughput(properties, region, source = "min",
 		WriteCapacityUnits: write ?? DEFAULT_CAPACITY_UNITS
 	};
 }
+function declaredCrossRegions(properties, region) {
+	const replicas = properties["Replicas"];
+	return (Array.isArray(replicas) ? replicas : []).map((replica) => asRecord(replica)?.["Region"]).filter((name) => typeof name === "string" && name !== region);
+}
+function writeSideScaled(bag) {
+	return asRecord(bag[TABLE_WRITE_PROVISIONED_KEY])?.["WriteCapacityAutoScalingSettings"] !== void 0;
+}
+function literalWriteSideMoves(properties, previousProperties, region, live) {
+	if (properties["BillingMode"] !== "PROVISIONED" || writeSideScaled(properties)) return false;
+	if (writeSideScaled(previousProperties)) return true;
+	if (live?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST") return true;
+	const change = readTableCapacityChange(properties, previousProperties, region, [], (t) => t);
+	return change.write !== void 0 && change.write !== live?.ProvisionedThroughput?.WriteCapacityUnits || change.read !== void 0 && change.read !== live?.ProvisionedThroughput?.ReadCapacityUnits;
+}
+function readTableCapacityChange(properties, previousProperties, region, diagnostics, maskSecrets) {
+	const localBlockOf = (bag) => localReplicaEntry(bag, region)?.[TABLE_READ_PROVISIONED_KEY];
+	const readBlockOf = (bag) => localBlockOf(bag) ?? bag[TABLE_READ_PROVISIONED_KEY];
+	const literal = (block, previousBlock, side, blockName) => {
+		if (deepEqual(block, previousBlock)) return void 0;
+		const settings = asRecord(block);
+		if (settings?.[`${side}CapacityAutoScalingSettings`] !== void 0) return void 0;
+		const units = coerceCfnInteger(settings?.[`${side}CapacityUnits`]);
+		if (units === void 0) reportUnresolvedProvisionedCapacity(block, side, "min", { suppressed: "so cdkd sent no capacity for it and the old value stays on AWS" }, diagnostics, { blockName }, maskSecrets);
+		return units;
+	};
+	const read = literal(readBlockOf(properties), readBlockOf(previousProperties), "Read", localBlockOf(properties) !== void 0 ? `Replicas[local].${TABLE_READ_PROVISIONED_KEY}` : TABLE_READ_PROVISIONED_KEY);
+	const write = literal(properties[TABLE_WRITE_PROVISIONED_KEY], previousProperties[TABLE_WRITE_PROVISIONED_KEY], "Write", TABLE_WRITE_PROVISIONED_KEY);
+	const declaredOnReplica = localBlockOf(properties) !== void 0 || localBlockOf(previousProperties) !== void 0;
+	const declaredOnTable = properties[TABLE_READ_PROVISIONED_KEY] !== void 0 || previousProperties[TABLE_READ_PROVISIONED_KEY] !== void 0;
+	return {
+		...read !== void 0 && { read },
+		...write !== void 0 && { write },
+		readKeys: [...declaredOnTable ? [TABLE_READ_PROVISIONED_KEY] : [], ...declaredOnReplica ? ["Replicas"] : []]
+	};
+}
 const DEFAULT_CAPACITY_UNITS = 5;
 const DYNAMODB_SCALABLE_DIMENSIONS = /* @__PURE__ */ new Set([
 	"dynamodb:table:WriteCapacityUnits",
@@ -52454,8 +52257,7 @@ function lsiListOrEmpty(value) {
 	return value;
 }
 
-//#endregion
-//#region src/provisioning/protection-flags.ts
+// src/provisioning/protection-flags.ts
 const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Logs::LogGroup": "DeletionProtectionEnabled",
 	"AWS::RDS::DBInstance": "DeletionProtection",
@@ -52510,8 +52312,7 @@ function isProtectionValueActive(resourceType, value) {
 	return isTruthyCfnBoolean(value);
 }
 
-//#endregion
-//#region src/provisioning/recorded-protection.ts
+// src/provisioning/recorded-protection.ts
 const READER_LABELS = {
 	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled on the table or a replica",
 	"AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancerAttributes deletion_protection.enabled"
@@ -52545,8 +52346,7 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/update-replace.ts
+// src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement(engine, { change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent, nameGenerationFields }) {
 	const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
 		record: currentResource,
@@ -52823,8 +52623,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 	engine.logger.info(replacedLine);
 }
 
-//#endregion
-//#region src/provisioning/cc-autoroute-update-remedy.ts
+// src/provisioning/cc-autoroute-update-remedy.ts
 const TYPE_FORMAT = /^[A-Z][A-Za-z0-9]+(::[A-Z][A-Za-z0-9]+)+$/;
 const PROPERTY_FORMAT = /^[A-Z][A-Za-z0-9]*$/;
 const LOGICAL_ID_FORMAT = /^[A-Za-z][A-Za-z0-9]{0,254}$/;
@@ -52839,8 +52638,7 @@ function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedPrope
 	return `\nThis update moved the resource from its SDK provider to Cloud Control API, because the SDK provider does not handle ${shown}. Cloud Control addresses it by the physical id the SDK provider recorded, and for some types that is not an identifier Cloud Control accepts. ` + (nestedChild ? `It is in a nested stack, which --recreate-via-cc-api cannot address: ${preferSdk}, or remove ${them} from the template.` : `Two ways through: re-create the resource on Cloud Control with --recreate-via-cc-api ${id} (destroys and re-creates it), or ${preferSdk}.`);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/update-in-place.ts
+// src/deployment/deploy-engine/update-in-place.ts
 async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
 	engine.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = engine.providerRegistry.getProviderFor({
@@ -53238,12 +53036,10 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	engine.logger.info(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
-//#endregion
-//#region src/provisioning/changed-properties-consumers.ts
+// src/provisioning/changed-properties-consumers.ts
 const CHANGED_PROPERTIES_CONSUMER_TYPES = /* @__PURE__ */ new Set(["AWS::ServiceDiscovery::Service"]);
 
-//#endregion
-//#region src/deployment/deploy-engine/read-provenance-moved.ts
+// src/deployment/deploy-engine/read-provenance-moved.ts
 function occurrences(value, token) {
 	if (typeof value === "string") return value.includes(token) ? value.split(token).length - 1 : 0;
 	if (Array.isArray(value)) {
@@ -53354,8 +53150,7 @@ function withRefreshedReadVersions(record, unchanged) {
 	return withReferenceProvenance(record, out);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/update.ts
+// src/deployment/deploy-engine/update.ts
 function isWhollyMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.length > 0 && value.every(isWhollyMask);
@@ -54039,8 +53834,7 @@ function readsProducerReplacedThisRun(engine, template, logicalId, stateResource
 	});
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/provision.ts
+// src/deployment/deploy-engine/provision.ts
 const NESTED_STACK_ROW_TYPE = "AWS::CloudFormation::Stack";
 async function provisionResource(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
@@ -54221,8 +54015,7 @@ async function provisionResourceBody(engine, logicalId, change, stateResources,
 	});
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/execute.ts
+// src/deployment/deploy-engine/execute.ts
 const NO_REPLACEMENT_ORPHAN_TYPES = /* @__PURE__ */ new Set([
 	"AWS::CloudFormation::Stack",
 	"AWS::SQS::QueuePolicy",
@@ -54863,8 +54656,7 @@ async function journalOrphanIdentity(engine, orphanOp, carried) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/deploy-flow.ts
+// src/deployment/deploy-engine/deploy-flow.ts
 const TAIL_WARM_CONNECTIONS = 3;
 async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefetch) {
 	const startTime = Date.now();
@@ -55439,8 +55231,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine.ts
+// src/deployment/deploy-engine.ts
 const EMPTY_SECRETS = /* @__PURE__ */ new Map();
 var InterruptedError = class extends Error {
 	constructor(reason = "user") {
@@ -55894,6 +55685,5 @@ function sameGenerationClaimsOf(record) {
 	};
 }
 
-//#endregion
 export { sendTtlWaitingOutRateLimit as $, assertSendableRoleArn as $a, logOnlyValueCount as $c, isCustomResource as $i, hasUnverifiableParameterRefusal as $l, retiredAfterRollback as $n, malformedOrphansWarning as $o, removeSuperseded as $r, isStatefulRecreateTargetForReplace as $s, isHandledOrphan as $t, loadCdkJson as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, isUsableAttemptedName as Aa, canonicalCoordinates as Ac, nullPrototypeRecord as Ad, unsupportedFinalSnapshotError as Ai, recordNoEchoParameterFreshValue as Al, demoteSupersededOrphans as An, JSON_LISTING_HOLE_VALUE as Ao, movedToHint as Ar, refuseMalformedResourcesForDestroy as As, makeCanonicalizePropertiesFn as At, resolveDockerContextDirectory as Au, deleteTableWithIndexBusyRetry as B, s3BucketDomainName as Ba, readbackPathFor as Bc, resolveBucketRegion as Bd, markDeleteStarted as Bi, CrossPrefixScanCache as Bl, orphanNeedsIdentity as Bn, hasReadableResources as Bo, getStackRecords as Br, unreadableOrphanRecords as Bs, dropSettledNestedJournals as Bt, partitionSensitiveEnv as Bu, planContributorInsightsOp as C, ec2InstanceProtectionSite as Ca, ecsServiceLaunchTypeSetOrChanged as Cc, processStackMessages as Cd, PRE_DELETE_SNAPSHOT_TYPES as Ci, recordPhysicalNameCopy as Cl, recordAfterRollbackUpdate as Cn, lacksRecordedTableArn as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImportSave as Cs, enclosingDeadlineExpired as Ct, isCrossRegionRedirect as Cu, reverseMapTableContributorInsights as D, reEnableInstanceApiTermination as Da, sameLambdaFunctionAddress as Dc, defineOwnKey as Dd, effectiveDeletionPolicy as Di, recordMaskOnlyValue as Dl, equalModuloMarkedMask as Dn, parameterInputsFor as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForExport as Ds, isSecretBearingReferenceString as Dt, validateContainerRepoName as Du, reverseMapIndexContributorInsights as E, reDisableInstanceApiTermination as Ea, lambdaFunctionNameForMask as Ec, utf8ByteLength as Ed, createPreDeleteFinalSnapshot as Ei, provenPublicValue as El, calculateResourceDrift as En, withSharedDrainBudget as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDrift as Es, diffSecurity as Et, validateAssetBucketName as Eu, resolveDynamoDbDeleteBudgetClock as F, withoutUnsettledProperties as Fa, maskedLeafCoordinatesOf as Fc, renderAssemblyPathEscape as Fd, acquireIdempotencyToken as Fi, LockManager as Fl, recheckFailedPlan as Fn, accountArgs as Fo, mappingPairs as Fr, repairMalformedOutputsForReadOnly as Fs, keptForRetainedRecord as Ft, finchSecretArgvRefusal as Fu, readbackVectorIndexes as G, producerLookupOver as Ga, markSameGenerationBag as Gc, refuseMalformedDesiredTags as Gi, stackInstanceIdOf as Gl, isRedactedRecordedValue as Gn, malformedExportSourceWarning as Go, gray as Gr, findSilentDropProperties as Gs, revertedNestedRowIds as Gt, runDockerStreaming as Gu, relayedIndexBusyDelete as H, s3BucketRegionalDomainName as Ha, recordedNoEchoValuesOf as Hc, DBPROXY_TAG_OPTIONS as Hi, crossPrefixDeniedWarning as Hl, getCurrentProducerRegions as Hn, isReadableResourceEntry as Ho, replacedDeleteFailureVerdict as Hr, withheldAccountClause as Hs, nestedChildStackName as Ht, redactedCause as Hu, resolveDynamoDbDeleteBudgetMs as I, IntrinsicFunctionResolver as Ia, noEchoCoordinatesOf as Ic, resolveAssemblyPath as Id, DeploymentEventsReader as Ii, isLockInfoExpired as Il, recordUnderIdIsNotOwn as In, deployRefusesOrphanRowsReason as Io, parseMappingFile as Ir, repairMalformedResourceEntriesForReadOnly as Is, recordRetainedForReadoption as It, formatDockerLoginError as Iu, vectorIndexesShapeDetail as J, outputReferenceProvenanceOf as Ja, snapshotPassProvenance as Jc, definedAttributes as Ji, acceptedCreateOnlyDropsOf as Jl, updatePartialMessage as Jn, malformedLocalResourcesWarning as Jo, yellow as Jr, NO_CC_HANDLERS_REASON as Js, getCurrentNestedStackContext as Jt, getDockerImageBySourceHash as Ju, vectorIndexesForCreate as K, refuseUnreadableCdkCrossAccountRefs as Ka, redactForState as Kc, tagMapAsList as Ki, withStackInstanceIdWithheld as Kl, redactedDeleteAddressFields as Kn, malformedLocalOutputsWarning as Ko, green as Kr, unwrittenCreateOnlyReplacement as Ks, withNestedRevertRun as Kt, warnFinchArgvExposure as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, poisonRenderedSpellingsCollidingIn as La, noEchoLeavesOf as Lc, injectAwsRegion as Ld, DeploymentEventsStore as Li, S3StateBackend as Ll, replacementNeverSwapped as Ln, displayLogicalId as Lo, proposeRenames as Lr, repairMalformedResourcePropertiesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, getDockerCmd as Lu, beginDeleteWait as M, unsettledItemsOf as Ma, maskAtCoordinates as Mc, absoluteAssemblyPathEscape as Md, ledgerForStack as Mi, wholeStringLeavesOf as Ml, isReplacementOrphan as Mn, STATE_RESOURCES_MALFORMED as Mo, withMovedTo as Mr, refuseMalformedState as Ms, planOrphanAdoption as Mt, describeDockerExecFailure as Mu, compensateRemovedDeletionProtection as N, unsettledPropertiesOf as Na, maskReadbackAtCoordinates as Nc, describeFileReadFailure as Nd, reserveStackCreateToken as Ni, WHOLE_DYNAMIC_REFERENCE_PATTERN as Nl, planFailedOps as Nn, UNREADABLE_ORPHANS_CONTAINER_ROW as No, isPairableType as Nr, repairMalformedOrphanRecordsForReadOnly as Ns, pendingRequestCount as Nt, describeDockerFailure as Nu, stripIndexContributorInsights as O, DiffCalculator as Oa, DagBuilder as Oc, hasOwnKey as Od, isFinalSnapshotError as Oi, recordMaskOnlyValuesIn as Ol, equalModuloMask as On, passedParameterClassesOf as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForOrphan as Os, keptWholeReasonText as Ot, buildDenyExternalAccessPolicy as Ou, deleteBudgetKey as P, withUnsettledProperties as Pa, maskWholeValue as Pc, displayAssemblyPath as Pd, withCreateTokenLedger as Pi, isSingleDynamicReferenceToken as Pl, planRollback as Pn, UNREADABLE_RESOURCES_MAP_ROW as Po, looselyEqual as Pr, repairMalformedOrphansForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, dockerSpawnEnvWithSensitive as Pu, readTtlSpec as Q, assertFlagRoleArn as Qa, literalSplitDelimitersOf as Qc, ccBrokenReason as Qi, hasReasonlessBaselineRefusal as Ql, nameScopeOf as Qn, malformedOrphansRefusalMessage as Qo, isSupersededResourceRecord as Qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qs, dropFailedHint as Qt, getLegacyStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, isSettledInstanceState as Ra, noEchoOutputsComparison as Rc, injectedAwsRegionValue as Rd, extractDeploymentEventError as Ri, rebuildClientForBucketRegion as Rl, resolveReplacementOldType as Rn, hasReadableOrphans as Ro, awaitInFlightSibling as Rr, repairMalformedResourcesForReadOnly as Rs, displacedOpClause as Rt, isDockerClientEnvKey as Ru, indexDeclaresContributorInsights as S, disableInstanceApiTermination as Sa, dbInstanceEngineChangeIsInPlace as Sc, StageLoadError as Sd, ATOMIC_FINAL_SNAPSHOT_TYPES as Si, recordAttributeIdCopy as Sl, removeProtectionTypeList as Sn, isStalePlaceholderArnAttribute as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForImport as Ss, readRecordedConditionVerdicts as St, getBootstrapMarkerKey as Su, readContributorInsightsSpec as T, observeThenDisableInstanceApiTermination as Ta, canonicalLambdaFunctionName as Tc, parseFailureDebugDetail as Td, ccRoutedFinalSnapshotError as Ti, carriesSecretMask as Tl, withUnprovenUnsettled as Tn, parseWebACLArn as To, constructPathOf as Tr, refuseMalformedResourcePropertiesForDestroy as Ts, withResourceDeadline as Tt, readBootstrapMarkerBody as Tu, waitForIndexesSettled as U, s3BucketWebsiteUrl as Ua, valueAtCoordinate as Uc, planTagDiff as Ui, isAccessDenied$1 as Ul, inheritProducerRegions as Un, malformedDriftResourcePropertiesWarning as Uo, bold as Ur, findActionableSilentDrops as Us, recordDisplacedSkips as Ut, redactedDockerCause as Uu, maskedLogger as V, s3BucketDualStackDomainName as Va, readsNoEchoSource as Vc, DBPROXY_TAGS_WHAT as Vi, applyCrossPrefixScan as Vl, findNestedStackTypeChanges as Vn, isReadableOrphanRecord as Vo, withStackRecords as Vr, unreadableResourceEntries as Vs, getNestedRevertRun as Vt, redactDockerArgvValues as Vu, planVectorIndexUpdates as W, resolveDynamicReferences as Wa, liveMatchesUnresolvedTokenFrame as Wc, readTagList as Wi, isNotImplemented as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedExportNamesWarning as Wo, cyan as Wr, findHandledUnwrittenCreateOnly as Ws, revertNestedChildFromJournal as Wt, runDockerForeground as Wu, isTtlRateLimited as X, recordedReferenceRegions as Xa, createUnionSecretMasker as Xc, CC_BROKEN_REASON as Xi, exportNamesCarriedFrom as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsWarning as Xo, deleteSupersededEntry as Xr, findReplacedReadersOfRecreateTargets as Xs, deleteJournaledOrphans as Xt, synthesisStatusMessage as Xu, isTtlAlreadyDisabled as Y, recordedOutputReferenceRegions as Ya, carryLogOnlyValues as Yc, stringifyIfAssigned as Yi, describeRegionValueKind as Yl, updatePartialReason as Yn, malformedOrphanRecordsRefusalMessage as Yo, addSuperseded as Yr, hasNoCloudControlHandlers as Ys, withNestedStackContext as Yt, Synthesizer as Yu, planTimeToLive as Z, applyRoleArnIfSet as Za, hasMaskableValues as Zc, ProviderRegistry as Zi, hasReadableExportSet as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRowsKeptWarning as Zo, holdsSupersededResources as Zr, shownType as Zs, dropFailedCommands as Zt, getDefaultStateBucketName as Zu, streamMemberRefusals as _, deleteLeftInPlace as _a, prefetchCreateOnlyPropertyPaths as _c, expectedOwnerParam as _d, secretNamePrintingBags as _i, identityKeyFor as _l, pendingMovesOutOf as _n, carriesFetchableDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputsForDestroy as _s, renderNestedTemplateTreeDefect as _t, rewriteTemplateAssetReferences as _u, isProtectionValueActive as a, getCurrentResourceSecrets as aa, toCfnInteger as ac, resolveStateBucketWithDefaultAndSource as ad, noEchoAttributeNamesOf as ai, createSecretMasker as al, chunks as an, callerEnvCredentials as ao, reachableDivergentParameters as ar, malformedResourcesWarning as as, markRefusedBeforeApplying as at, shouldRetainResource as au, CONTRIBUTOR_INSIGHTS_KEY as b, isWaitAbandonedError as ba, withRetry as bc, derivePartitionAndUrlSuffix as bd, stateSecretNameNeedles as bi, recoverMaskedOutput as bl, replayFailedOperations as bn, AWS_NO_VALUE as bo, isExportAliasCollision as br, refuseMalformedResourceEntriesForDeploy as bs, conditionInputsFrom as bt, assertAssetBucketRegion as bu, DynamoDBGlobalTableProvider as c, applyCustomResourceResponseExpiration as ca, coerceCfnInteger as cc, warnDeprecatedNoPrefixCliFlag as cd, noEchoParameterNamesOf as ci, maskSecretsInText as cl, withApiLimit as cn, classifyReplaySecretRegion as co, displayTextOrWithheld as cr, previewableOrphanRecords as cs, crossStackOutputProvenanceSource as ct, renderPhaseTimings as cu, declaredStreamPolicyMember as d, slowCcOperationTimeoutMs as da, configStringRefusal as dc, CFN_TEMPLATE_URL_LIMIT as dd, completedReplayEntries as di, withoutPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, coerceParameterTypedValue as do, secretBearingStateKeyWarning as dr, refuseMalformedOrphanRecords as ds, findServiceTokenRefusals as dt, isSensitiveAttributeName as du, wouldReturnToSdkProvider as ea, isStatefulRecreateTargetSync as ec, resolveApp as ed, supersededAfterRollback as ei, printingCorpusOf as el, journaledOrphanLines as en, explicitRoleArnOrThrow as eo, retiredNameGenerationsAfter as er, malformedOutputsRefusalMessage as es, ECR_AUTO_DELETE_IMAGES_TAG as et, importableOutputKeys as eu, declaredStreamTagsMember as f, onlySecretReferencesDiffer as fa, readConfigString as fc, MIGRATE_TMP_PREFIX as fd, journaledOrphanPrintingBag as fi, DYNAMIC_REFERENCE_TOKEN_SCAN as fl, refactorMarkerRefusalMessage as fn, isUnboundTemplateParameter as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecordsForDestroy as fs, serviceTokenBlockingReason as ft, stringifyValue as fu, streamDeclaresTags as g, deleteIndeterminateGuards as ga, requireConfigString as gc, decodeListingKey as gd, secretNamePrintingBag as gi, spelledKeysOf as gl, hasPendingMovesOut as gn, carriesDynamicReference as go, isWholeDynamicReferenceValue as gr, refuseMalformedOutputs as gs, listNestedTemplateRows as gt, loadPublishableAssetManifest as gu, streamDeclaresPolicy as h, UNSPECIFIED_SKIP_REASON as ha, requireConfigObject as hc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hd, orphanRecordsPrintingBag as hi, pathCrossesDottedKey as hl, updateRefactorMarker as hn, isImpossibleEmptyStoredAttribute as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForOrphan as hs, isAbsoluteAssetPath as ht, createAssetRedirectResolver as hu, PROTECTION_PROPERTY_BY_TYPE as i, isCustomResourceType as ia, isWarmThroughputDecrease as ic, resolveStateBucketWithDefault as id, withoutSuperseded as ii, unionOfSecretBags as il, formatResourceLine as in, applyCallerIdentityCredentials as io, namesAnyDeclaredParameter as ir, malformedResourcePropertiesWarning as is, getPriorAttempts as it, orphansCarriedFrom as iu, DYNAMODB_DELETE_POLL_COST_MS as j, unsettledItemsField as ja, isMarkedCoordinate as jc, ownValue as jd, earliestDefined as ji, recordProvenPublicExpression as jl, isJournaledOrphan as jn, STATE_REGION_DIVERGED as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForExport as js, makeSiblingClaimReader as jt, describeDockerCapturedOutput as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, INTRINSIC_KEYS as ka, TemplateParser as kc, hasPlainPrototype$1 as kd, refusesFinalSnapshot as ki, recordNoEchoAttributeValues as kl, undeclaredEmptyObservedKeys as kn, declaresNoEcho as ko, hintSidesOf as kr, refuseMalformedResourcesForDeploy as ks, mergeNoChangeOutputs as kt, buildDockerImage as ku, STREAM_POLICY_KEY as l, customResourceResponseExpirationWarning as la, configBooleanRefusal as lc, ssmResolvedValueType as ld, withAttemptedItemsMasked as li, scrubResourceRecord as ll, readRefactorMarker as ln, producerRegionsFromState as lo, exportAliasCollisionScrubWarning as lr, refuseDivergentRecordRegionForDestroy as ls, inheritedProvenanceForChildDiff as lt, timePhase as lu, reverseMapStreamPolicy as m, RollbackInlinePolicyWriters as ma, requireConfigArray as mc, uploadCfnTemplate as md, namingSecretsWithRecordedNoEcho as mi, isUncertifiedBaselineMaskPosition as ml, sameMove as mn, getAccountInfo as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphansForDestroy as ms, findNestedTemplateTreeDefect as mt, buildAssetRedirectMap as mu, recordedProtectionEvidence as n, TemplateNoEchoReresolver as na, WARM_THROUGHPUT_MEMBERS as nc, resolveCaptureObservedState as nd, supersededHolderOf as ni, recordLogOnlyValue as nl, makeForeignHolderScan as nn, sendableAssumeRoleCommand as no, withNameGenerationReached as nr, malformedRenderedContainersWarning as ns, hasCdkAutoDeleteTag as nt, isReadableBag as nu, perType as o, withPrintingSecrets as oa, toFiniteNumber as oc, resolveUseCdkBootstrapAssets as od, noEchoComparisonForTemplate as oi, errorCauseChain as ol, isAccessDeniedError as on, envCredentialsAreAssumedRole as oo, resourcesNamingDeclaredParameter as or, malformedScrubResourceEntriesRefusalMessage as os, IMPLICIT_DELETE_DEPENDENCIES as ot, stackInstanceIdCarriedFrom as ou, planStreamMemberOps as p, unchangedBehindSecretReference as pa, replayWarn as pc, findLargeInlineResources as pd, maskEventTextWithBoundBags as pi, dynamicReferenceTokens as pl, refuseRefactorMarker as pn, parameterTypeMayLoseSecretIdentity as po, carriedExportAliasExposure as pr, refuseMalformedOrphans as ps, childTemplateLoader as pt, WorkGraph as pu, vectorIndexesSettled as q, keepHeldTokenProvenance as qa, recordReferenceProvenanceEntry as qc, tagPlanWarning as qi, splitImportedOps as ql, redactedDeleteAddressSkip as qn, malformedLocalResourceEntriesWarning as qo, red as qr, withoutSilentDropProperties as qs, collectNestedChildUnaddressed as qt, AssetManifestLoader as qu, recordedProtectionNote as r, readsNoEchoDeleteValues as ra, coerceWarmThroughput as rc, resolveSkipPrefix as rd, supersededResourcesOf as ri, shareLogOnlyValues as rl, sameJournaledOrphans as rn, AWS_CREDENTIAL_ENV_KEYS as ro, computeParameterTaint as rr, malformedResourceEntriesWarning as rs, isTruthyCfnBoolean as rt, orphansAfterRollback as ru, readProtection as s, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as sa, coerceCfnBoolean as sc, stateBucketExistenceConfirmed as sd, noEchoExactEchoLeavesOf as si, maskSecretsInError as sl, lookupEachName as sn, classifyRecordedSecretRegion as so, WITHHELD_NAME_DISPLAY as sr, malformedStateRefusalMessage as ss, computeImplicitDeleteEdges as st, PhaseClock as su, DeployEngine as t, waitForLambdaFunctionActive as ta, renderStatefulReason as tc, resolveAutoAssetStorage as td, supersededHeldByOtherTypeWarning as ti, recordLogOnlyParameterValue as tl, loadJournaledOrphans as tn, isIamRoleArn as to, retiredNameGenerationsLeaving as tr, malformedOutputsWarning as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputs as tu, STREAM_TAGS_KEY as u, CloudControlProvider as ua, configIntegerRefusal as uc, CFN_TEMPLATE_BODY_LIMIT as ud, createReadOnlyAttributeHealerFactory as ui, withPhysicalNameCopies as ul, readRefactorMarkerOnce as un, regionLessSecretName as uo, secretBearing as ur, refuseMalformedNestedChildOutputs as us, deferredServiceTokenWarning as ut, AssetPublisher as uu, streamPolicyMatchesDeclared as v, deleteSkipReason as va, templateResourceTypes as vc, PARTITION_TABLE as vd, secretNamedAttributeNamesOf as vi, inheritNestedStackParameterAssociations as vl, pendingMovesRefusalMessage as vn, isNamelessDynamicReferenceError as vo, collectDeclaredOutputNames as vr, refuseMalformedResourceAttributesForOrphan as vs, templateIdentity as vt, AssetModeResolver as vu, planIndexContributorInsightsOps as w, isTerminationProtectionPropagationError as wa, emrClusterInstancesReplaced as wc, describeJsonParseFailure as wd, buildFinalSnapshotIdentifier as wi, splitGetAttStringForm as wl, settleUnsettledPrevious as wn, refStateLookupFromResource as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForOrphan as ws, enclosingDeadlineRemainingMs as wt, parseBootstrapMarker as wu, contributorInsightsRefusals as x, markWaitAbandoned as xa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as xc, AssemblyReader as xd, storedSecretNameNeedles as xi, physicalNameCopiesOf as xl, replayRollback as xn, cfnRefValueFromPhysicalId as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDestroy as xs, parentSuppliedValues as xt, ensureAssetStorage as xu, streamTagsMatchDeclared as y, withIndeterminateGuard as ya, describeTypeWithThrottleRetry as yc, canonicalizeRegion as yd, secretNamedRecordNeedles as yi, recordNestedStackParameterExpressions as yl, refusePendingMovesOut as yn, keepsSecretReferenceToken as yo, collectPublishedOutputNames as yr, refuseMalformedResourceEntries as ys, conditionFingerprint as yt, BOOTSTRAP_MARKER_PREFIX as yu, TABLE_INDEX_NOUN as z, s3BucketArn as za, passedNoEchoParametersOf as zc, clearBucketRegionCache as zd, isRefusedByName as zi, CrossPrefixReadError as zl, seedsDeleteFirstGuard as zn, hasReadableOutputs as zo, destroyStackRecordsView as zr, unpreviewableOrphanRecords as zs, displacedPhysicalIdShown as zt, isMalformedEnvKey as zu };
-//# sourceMappingURL=deploy-engine--bCIMkkk.js.map
+//# sourceMappingURL=deploy-engine-b0rYBotL.js.map