@go-to-k/cdkd 0.318.0 → 0.320.0

package/dist/{deploy-engine-BnEvzfon.js → deploy-engine-BiJyU4j1.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-DWpHZk2l.js";
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-DiHodi76.js";
-import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-BpB3iPvn.js";
+import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-CmrPwGge.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BLXFsfMa.js";
-import { t as getCdkdVersion } from "./version-CFF8UOVj.js";
+import { t as getCdkdVersion } from "./version-CrtjwYuX.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14424,7 +14424,7 @@ function holderIdNames(physicalId, name) {
 const dnsFold = (value) => value.toLowerCase().replace(/\.$/, "");
 const zoneIdFold = (value) => value.replace(/^\/hostedzone\//i, "");
 const HOLDS = { holds: true };
-function elsewhere(diagnosis) {
+function elsewhere$1(diagnosis) {
 	return {
 		holds: false,
 		known: true,
@@ -14653,20 +14653,20 @@ function recordSetHolds(requested, recorded, observed, newPhysicalId, r, v) {
 	if (wantName === void 0 || wantType === void 0) return unproven(`cdkd cannot read the Name and Type ${v.createdRecord} asked for`);
 	const wanted = `${v.create} asked for Name ${r.quoted(wantName)}`;
 	if (haveName === void 0 || haveType === void 0) return unproven(`${wanted}, and cdkd cannot read the name ${newRecord} holds`);
-	if (dnsFold(wantName) !== dnsFold(haveName)) return /\\[0-9]{3}/.test(wantName + haveName) ? unproven(`${wanted}, and cdkd cannot compare it with the escaped name ${newRecord} holds`) : elsewhere(`${wanted}, while ${newRecord} holds Name ${r.quoted(haveName)}`);
+	if (dnsFold(wantName) !== dnsFold(haveName)) return /\\[0-9]{3}/.test(wantName + haveName) ? unproven(`${wanted}, and cdkd cannot compare it with the escaped name ${newRecord} holds`) : elsewhere$1(`${wanted}, while ${newRecord} holds Name ${r.quoted(haveName)}`);
 	const wantZoneId = valueAt(requested, ["HostedZoneId"]);
 	const haveZoneId = heldAt(recorded, observed, ["HostedZoneId"]).value;
 	const wantZoneName = valueAt(requested, ["HostedZoneName"]);
 	const haveZoneName = heldAt(recorded, observed, ["HostedZoneName"]).value;
 	const sameZone = wantZoneId !== void 0 && haveZoneId !== void 0 ? zoneIdFold(wantZoneId) === zoneIdFold(haveZoneId) : wantZoneName !== void 0 && haveZoneName !== void 0 ? dnsFold(wantZoneName) === dnsFold(haveZoneName) : void 0;
-	if (sameZone === false) return elsewhere(`${wanted}, while ${newRecord} is in another hosted zone`);
+	if (sameZone === false) return elsewhere$1(`${wanted}, while ${newRecord} is in another hosted zone`);
 	if (sameZone === void 0) return unproven(`${wanted}, and cdkd cannot tell whether ${newRecord} is in the same hosted zone`);
 	const wantSet = valueAt(requested, ["SetIdentifier"]);
 	const haveSet = heldAt(recorded, observed, ["SetIdentifier"]).value;
 	if (wantType.toUpperCase() === "CNAME" !== (haveType.toUpperCase() === "CNAME")) return HOLDS;
-	if (wantType.toUpperCase() !== haveType.toUpperCase()) return elsewhere(`${wanted} of Type ${r.quoted(wantType)}, while ${newRecord} is a ${r.quoted(haveType)} record of that name`);
+	if (wantType.toUpperCase() !== haveType.toUpperCase()) return elsewhere$1(`${wanted} of Type ${r.quoted(wantType)}, while ${newRecord} is a ${r.quoted(haveType)} record of that name`);
 	if (wantSet === void 0 !== (haveSet === void 0)) return unproven(`${wanted}, and only one of the two records carries a SetIdentifier, so cdkd cannot tell whether ${newRecord} holds it`);
-	return wantSet === haveSet ? HOLDS : elsewhere(`${wanted}, while ${newRecord} is a different record set of that name`);
+	return wantSet === haveSet ? HOLDS : elsewhere$1(`${wanted}, while ${newRecord} is a different record set of that name`);
 }
 function pathValue(bag, path) {
 	let node = bag;
@@ -14738,7 +14738,7 @@ function holderVerdict(input, v) {
 	const observedName = namePathHeld && valueAt(observed, namePathHeld);
 	if (namePathHeld !== void 0 && recordedName !== void 0 && observedName !== void 0 && !same(recordedName, observedName)) return unproven(`${wanted}, and the records of ${newResource} disagree on its ${r.shown(namePathHeld.join("."))} (recorded ${r.quoted(recordedName)}, read back ${r.quoted(observedName)}), so cdkd cannot show which name it holds`);
 	const haveName = namePathHeld === void 0 ? void 0 : heldAt(recorded, observed, namePathHeld).value;
-	if (!(haveName !== void 0 && same(haveName, wantName) || physicalId !== "" && !NO_PHYSICAL_ID_NAME_PROOF.has(newResourceType) && holderIdNames(inCase(physicalId), inCase(wantName)))) return haveName !== void 0 && !generatedName ? elsewhere(`${wanted}, while ${newResource} holds ${r.quoted(haveName)}`) : unproven(`${wanted}, and cdkd cannot show that ${newResource} holds that name`);
+	if (!(haveName !== void 0 && same(haveName, wantName) || physicalId !== "" && !NO_PHYSICAL_ID_NAME_PROOF.has(newResourceType) && holderIdNames(inCase(physicalId), inCase(wantName)))) return haveName !== void 0 && !generatedName ? elsewhere$1(`${wanted}, while ${newResource} holds ${r.quoted(haveName)}`) : unproven(`${wanted}, and cdkd cannot show that ${newResource} holds that name`);
 	for (const [i, path] of (oldKey.scope ?? []).entries()) {
 		const label = r.shown(path.join("."));
 		const wantRaw = valueAt(requested, path);
@@ -14751,7 +14751,7 @@ function holderVerdict(input, v) {
 		if (want === void 0 || got === void 0) return unproven(`${wanted}, and cdkd cannot show that ${newResource} shares its ${label}`);
 		if (want === got) continue;
 		if (isArn(want) !== isArn(got)) return unproven(`${wanted}, and cdkd cannot tell whether ${label} ${r.quoted(got)} is ${r.quoted(want)}`);
-		return elsewhere(`${wanted}, while ${newResource} is under ${label} ${r.quoted(got)}, not ${r.quoted(want)}`);
+		return elsewhere$1(`${wanted}, while ${newResource} is under ${label} ${r.quoted(got)}, not ${r.quoted(want)}`);
 	}
 	return HOLDS;
 }
@@ -16828,12 +16828,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"LocalGatewayId",
 			"NatGatewayId",
 			"NetworkInterfaceId",
+			"OdbNetworkArn",
 			"RouteTableId",
 			"TransitGatewayId",
 			"VpcEndpointId",
 			"VpcPeeringConnectionId"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["OdbNetworkArn", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["CidrBlock"]),
 		ccRouteUnavailable: false
@@ -17011,6 +17012,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"EnableECSManagedTags",
 			"EnableExecuteCommand",
 			"ForceNewDeployment",
+			"GatewayConnectors",
 			"HealthCheckGracePeriodSeconds",
 			"LaunchType",
 			"LoadBalancers",
@@ -17030,7 +17032,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VolumeConfigurations",
 			"VpcLatticeConfigurations"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["GatewayConnectors", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Name", "ServiceArn"]),
 		ccRouteUnavailable: false
@@ -17646,17 +17648,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"HttpEndpointDestinationConfiguration",
 			"IcebergDestinationConfiguration",
 			"KinesisStreamSourceConfiguration",
+			"MSKSourceConfiguration",
 			"RedshiftDestinationConfiguration",
 			"S3DestinationConfiguration",
 			"SplunkDestinationConfiguration",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["DatabaseSourceConfiguration", "not yet implemented by cdkd"],
-			["MSKSourceConfiguration", "not yet implemented by cdkd"],
-			["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["DatabaseSourceConfiguration", "MSKSourceConfiguration"]),
+		silentDrop: /* @__PURE__ */ new Map([["DatabaseSourceConfiguration", "not yet implemented by cdkd"], ["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["DatabaseSourceConfiguration"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
 	}],
@@ -17950,27 +17949,18 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
-			"ServerlessScalingConfiguration",
-			"StorageEncrypted",
-			"Tags",
-			"VpcSecurityGroupIds"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["GlobalClusterIdentifier", "Cloud Control owns a global-cluster member: NeptuneProvider has no detach, and a member cannot be deleted while attached (deletesThroughSdkProvider keeps its delete there too)"],
-			["RestoreToTime", "not yet implemented by cdkd"],
-			["RestoreType", "not yet implemented by cdkd"],
-			["SnapshotIdentifier", "not yet implemented by cdkd"],
-			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
-			["UseLatestRestorableTime", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set([
-			"GlobalClusterIdentifier",
 			"RestoreToTime",
 			"RestoreType",
+			"ServerlessScalingConfiguration",
 			"SnapshotIdentifier",
 			"SourceDBClusterIdentifier",
-			"UseLatestRestorableTime"
+			"StorageEncrypted",
+			"Tags",
+			"UseLatestRestorableTime",
+			"VpcSecurityGroupIds"
 		]),
+		silentDrop: /* @__PURE__ */ new Map([["GlobalClusterIdentifier", "Cloud Control owns a global-cluster member: NeptuneProvider has no detach, and a member cannot be deleted while attached (deletesThroughSdkProvider keeps its delete there too)"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["GlobalClusterIdentifier"]),
 		readOnly: /* @__PURE__ */ new Set([
 			"ClusterResourceId",
 			"Endpoint",
@@ -18047,6 +18037,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DBClusterParameterGroupName",
 			"DBSubnetGroupName",
 			"DeletionProtection",
+			"EnableCloudwatchLogsExports",
 			"EnableIAMDatabaseAuthentication",
 			"Engine",
 			"EngineVersion",
@@ -18081,7 +18072,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
-			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
 			["EnableGlobalWriteForwarding", "not yet implemented by cdkd"],
 			["EnableHttpEndpoint", "not yet implemented by cdkd"],
 			["EnableLocalWriteForwarding", "not yet implemented by cdkd"],
@@ -18145,6 +18135,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DBSubnetGroupName",
 			"DedicatedLogVolume",
 			"DeletionProtection",
+			"EnableCloudwatchLogsExports",
 			"EnableIAMDatabaseAuthentication",
 			"EnablePerformanceInsights",
 			"Engine",
@@ -18198,7 +18189,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DomainFqdn", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["DomainOu", "not yet implemented by cdkd"],
-			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
 			["EngineLifecycleSupport", "not yet implemented by cdkd"],
 			["MasterUserAuthenticationType", "not yet implemented by cdkd"],
 			["NcharCharacterSetName", "not yet implemented by cdkd"],
@@ -28620,7 +28610,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-kV8DYFjT.js");
+			const { ASGProvider } = await import("./asg-provider-B4XVfH0S.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28729,7 +28719,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-bEeid6uI.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D8tkFP12.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-C_r5q9NM.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DjjNodrS.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29449,8 +29439,7 @@ var CloudControlProvider = class {
 			"AWS::CloudFormation::CustomResource",
 			"AWS::CDK::Metadata",
 			"Custom::CDKBucketDeployment",
-			"Custom::S3AutoDeleteObjects",
-			"AWS::Route53::HostedZone"
+			"Custom::S3AutoDeleteObjects"
 		])).has(resourceType)) return false;
 		if (resourceType.startsWith("Custom::") || resourceType.startsWith("AWS::CloudFormation::CustomResource")) return false;
 		if (isNonProvisionable(resourceType)) return false;
@@ -33062,6 +33051,18 @@ const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 		physicalIdForm: "both layers store the listener ARN: the schema primaryIdentifier is ListenerArn and ELBv2Provider.create records the CreateListener ListenerArn",
 		issue: "https://github.com/go-to-k/cdkd/issues/4679",
 		integFixture: "alb"
+	}],
+	["AWS::EFS::MountTarget", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the bare `fsmt-...` id: the schema primaryIdentifier is Id and EFSProvider.create records the CreateMountTarget MountTargetId (Cloud Control Identifier measured us-east-1, 2026-11-02)",
+		issue: "https://github.com/go-to-k/cdkd/issues/5641",
+		integFixture: "cc-to-sdk-reroute-mount-target"
+	}],
+	["AWS::Route53::HostedZone", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the bare `Z...` zone id, without the `/hostedzone/` prefix Route 53 answers with: the schema primaryIdentifier is Id, Route53Provider.create strips the prefix, and the Cloud Control Identifier has none (measured us-east-1, 2026-11-02)",
+		issue: "https://github.com/go-to-k/cdkd/issues/5641",
+		integFixture: "cc-to-sdk-reroute-hosted-zone"
 	}]
 ]);
 const CC_BROKEN_REASON = "Cloud Control's handler cannot manage this type correctly";
@@ -33170,7 +33171,7 @@ var ProviderRegistry = class {
 			}
 			const unroutable = this.ccRouteUnavailableReason(resourceType);
 			if (unroutable !== void 0) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops, unroutable));
-			debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
+			debug(`Auto-routing ${resourceType} via Cloud Control (SDK-unwired properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api",
@@ -33200,7 +33201,7 @@ var ProviderRegistry = class {
 	buildUnroutableSilentDropMessage(resourceType, drops, reason) {
 		const details = drops.map((d) => safeMsg`  - ${d.property}: ${d.rationale}`).join("\n");
 		const overrideHint = drops.map((d) => safeMsg`${resourceType}:${d.property}`).join(",");
-		return safeMsg`${resourceType} uses properties cdkd's SDK Provider does not handle, and ` + safeMsg`this type cannot fall back to Cloud Control API (${reason}):\n` + `${details}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
+		return safeMsg`${resourceType} uses properties cdkd's SDK Provider does not handle, and ` + safeMsg`this type cannot fall back to Cloud Control API (${reason}):\n` + `${details}\nRemove the properties, or force the SDK provider path and accept leaving them unwritten via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
 	}
 	getProvider(resourceType) {
 		return this.getProviderFor({ resourceType }).provider;
@@ -33300,7 +33301,7 @@ var ProviderRegistry = class {
 					const one = needsRecreate.length === 1;
 					remedies.push(`${needsRecreate.join(", ")} ${one ? "is" : "are"} create-only, so removing the override does not apply ${one ? "it" : "them"} in place -- a create-only property can only be applied by recreating the resource. Where cdkd created the resource without ${one ? "it" : "them"}, a deploy without the override refuses unless something else already forces a replacement or the recreate is opted into.`);
 				}
-				this.logger.warn(`${logicalId} (${resourceType}): ${overridden.join(", ")} will be silently dropped (--prefer-sdk-route override accepted). ${remedies.join(" ")}`);
+				this.logger.warn(`${logicalId} (${resourceType}): ${overridden.join(", ")} will be left unwritten (--prefer-sdk-route override accepted). ${remedies.join(" ")}`);
 			}
 			this.reportUnrecognizedProperties(logicalId, resourceType, properties, {
 				provisionedBy,
@@ -36450,6 +36451,25 @@ function replayStackRecordsView(records, orphanLogicalIds = /* @__PURE__ */ new
 	};
 }
 
+// src/provisioning/restore-source-guard.ts
+const RESTORING_TYPES = /* @__PURE__ */ new Set(["AWS::Neptune::DBCluster"]);
+function clusterName(identifier) {
+	return (identifier.split(":").pop() ?? identifier).toLowerCase();
+}
+function elsewhere(identifier, scope) {
+	if (!identifier.startsWith("arn:")) return false;
+	const [, , , region, account] = identifier.split(":");
+	const differs = (carried, known) => Boolean(carried) && known !== void 0 && carried !== known;
+	return differs(region, scope.region) || differs(account, scope.account);
+}
+function refuseRestoreFromItself(resourceType, properties, physicalId, logicalId, scope) {
+	if (!RESTORING_TYPES.has(resourceType)) return;
+	const source = properties["SourceDBClusterIdentifier"];
+	if (typeof source !== "string" || clusterName(source) !== clusterName(physicalId)) return;
+	if (elsewhere(source, scope)) return;
+	throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType} ${logicalId}: SourceDBClusterIdentifier must be another cluster than the one this creates or replaces; nothing was changed.`, resourceType, logicalId, physicalId));
+}
+
 // src/deployment/deploy-engine/name-collision.ts
 function replacementNameOrigin(logicalId, physicalId) {
 	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName(), getCurrentStackInstanceId())) return {
@@ -36564,6 +36584,10 @@ async function prepareFinalSnapshotForDelete(deps, logicalId, resourceType, curr
 	throw unsupportedFinalSnapshotError(logicalId, resourceType, "--skip-final-snapshot");
 }
 async function replaceDeleteFirstAndRecreate(run, deps, logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy, oldDeleteProvisionedBy, noEchoDeleteValues) {
+	refuseRestoreFromItself(resourceType, replaceProps, currentResource.physicalId, logicalId, {
+		region: deps.stackRegion,
+		account: deps.options.consumerAccount
+	});
 	const createContext = { maskSecrets: createSecretMasker(secrets) };
 	const deleteMask = createUnionSecretMasker([secrets, secretNameBagFor(deps.secretsRun(), logicalId)]);
 	const finalSnapshotIdentifier = await prepareFinalSnapshotForDelete(deps, logicalId, oldResourceType, currentResource, updateReplacePolicy, deleteMask);
@@ -52442,6 +52466,10 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 			noEchoDeleteValues
 		});
 	} else if (recreateFlagged) {
+		refuseRestoreFromItself(resourceType, replaceProps, currentResource.physicalId, logicalId, {
+			region: engine.stackRegion,
+			account: engine.options.consumerAccount
+		});
 		const recreateFlagName = recreateViaCcApi ? "--recreate-via-cc-api" : "--recreate-via-sdk-provider";
 		if (updateReplacePolicy === "Retain") {
 			engine.replacementRun.retainedOldOnReplacement.add(logicalId);
@@ -52798,6 +52826,10 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				engine.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 				if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
 				if (!retainOldOnReplace && !createFirst) {
+					refuseRestoreFromItself(resourceType, replProps, currentResource.physicalId, logicalId, {
+						region: engine.stackRegion,
+						account: engine.options.consumerAccount
+					});
 					const fallbackUpdateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy;
 					const fallbackFinalSnapshotId = await prepareFinalSnapshotForDelete(engine.replacementDeps(), logicalId, resourceType, currentResource, fallbackUpdateReplacePolicy, createUnionSecretMasker([updateSecrets, secretNameBagFor(engine.secretsRun, logicalId)]));
 					let fallbackDeleteResult = void 0;
@@ -55684,5 +55716,5 @@ function sameGenerationClaimsOf(record) {
 	};
 }
 
-export { sendTtlWaitingOutRateLimit as $, assertSendableRoleArn as $a, logOnlyValueCount as $c, isCustomResource as $i, hasUnverifiableParameterRefusal as $l, retiredAfterRollback as $n, malformedOrphansWarning as $o, removeSuperseded as $r, isStatefulRecreateTargetForReplace as $s, isHandledOrphan as $t, loadCdkJson as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, isUsableAttemptedName as Aa, canonicalCoordinates as Ac, nullPrototypeRecord as Ad, unsupportedFinalSnapshotError as Ai, recordNoEchoParameterFreshValue as Al, demoteSupersededOrphans as An, JSON_LISTING_HOLE_VALUE as Ao, movedToHint as Ar, refuseMalformedResourcesForDestroy as As, makeCanonicalizePropertiesFn as At, resolveDockerContextDirectory as Au, deleteTableWithIndexBusyRetry as B, s3BucketDomainName as Ba, readbackPathFor as Bc, resolveBucketRegion as Bd, markDeleteStarted as Bi, CrossPrefixScanCache as Bl, orphanNeedsIdentity as Bn, hasReadableResources as Bo, getStackRecords as Br, unreadableOrphanRecords as Bs, dropSettledNestedJournals as Bt, partitionSensitiveEnv as Bu, planContributorInsightsOp as C, ec2InstanceProtectionSite as Ca, ecsServiceLaunchTypeSetOrChanged as Cc, processStackMessages as Cd, PRE_DELETE_SNAPSHOT_TYPES as Ci, recordPhysicalNameCopy as Cl, recordAfterRollbackUpdate as Cn, lacksRecordedTableArn as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImportSave as Cs, enclosingDeadlineExpired as Ct, isCrossRegionRedirect as Cu, reverseMapTableContributorInsights as D, reEnableInstanceApiTermination as Da, sameLambdaFunctionAddress as Dc, defineOwnKey as Dd, effectiveDeletionPolicy as Di, recordMaskOnlyValue as Dl, equalModuloMarkedMask as Dn, parameterInputsFor as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForExport as Ds, isSecretBearingReferenceString as Dt, validateContainerRepoName as Du, reverseMapIndexContributorInsights as E, reDisableInstanceApiTermination as Ea, lambdaFunctionNameForMask as Ec, utf8ByteLength as Ed, createPreDeleteFinalSnapshot as Ei, provenPublicValue as El, calculateResourceDrift as En, withSharedDrainBudget as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDrift as Es, diffSecurity as Et, validateAssetBucketName as Eu, resolveDynamoDbDeleteBudgetClock as F, withoutUnsettledProperties as Fa, maskedLeafCoordinatesOf as Fc, renderAssemblyPathEscape as Fd, acquireIdempotencyToken as Fi, LockManager as Fl, recheckFailedPlan as Fn, accountArgs as Fo, mappingPairs as Fr, repairMalformedOutputsForReadOnly as Fs, keptForRetainedRecord as Ft, finchSecretArgvRefusal as Fu, readbackVectorIndexes as G, producerLookupOver as Ga, markSameGenerationBag as Gc, refuseMalformedDesiredTags as Gi, stackInstanceIdOf as Gl, isRedactedRecordedValue as Gn, malformedExportSourceWarning as Go, gray as Gr, findSilentDropProperties as Gs, revertedNestedRowIds as Gt, runDockerStreaming as Gu, relayedIndexBusyDelete as H, s3BucketRegionalDomainName as Ha, recordedNoEchoValuesOf as Hc, DBPROXY_TAG_OPTIONS as Hi, crossPrefixDeniedWarning as Hl, getCurrentProducerRegions as Hn, isReadableResourceEntry as Ho, replacedDeleteFailureVerdict as Hr, withheldAccountClause as Hs, nestedChildStackName as Ht, redactedCause as Hu, resolveDynamoDbDeleteBudgetMs as I, IntrinsicFunctionResolver as Ia, noEchoCoordinatesOf as Ic, resolveAssemblyPath as Id, DeploymentEventsReader as Ii, isLockInfoExpired as Il, recordUnderIdIsNotOwn as In, deployRefusesOrphanRowsReason as Io, parseMappingFile as Ir, repairMalformedResourceEntriesForReadOnly as Is, recordRetainedForReadoption as It, formatDockerLoginError as Iu, vectorIndexesShapeDetail as J, outputReferenceProvenanceOf as Ja, snapshotPassProvenance as Jc, definedAttributes as Ji, acceptedCreateOnlyDropsOf as Jl, updatePartialMessage as Jn, malformedLocalResourcesWarning as Jo, yellow as Jr, NO_CC_HANDLERS_REASON as Js, getCurrentNestedStackContext as Jt, getDockerImageBySourceHash as Ju, vectorIndexesForCreate as K, refuseUnreadableCdkCrossAccountRefs as Ka, redactForState as Kc, tagMapAsList as Ki, withStackInstanceIdWithheld as Kl, redactedDeleteAddressFields as Kn, malformedLocalOutputsWarning as Ko, green as Kr, unwrittenCreateOnlyReplacement as Ks, withNestedRevertRun as Kt, warnFinchArgvExposure as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, poisonRenderedSpellingsCollidingIn as La, noEchoLeavesOf as Lc, injectAwsRegion as Ld, DeploymentEventsStore as Li, S3StateBackend as Ll, replacementNeverSwapped as Ln, displayLogicalId as Lo, proposeRenames as Lr, repairMalformedResourcePropertiesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, getDockerCmd as Lu, beginDeleteWait as M, unsettledItemsOf as Ma, maskAtCoordinates as Mc, absoluteAssemblyPathEscape as Md, ledgerForStack as Mi, wholeStringLeavesOf as Ml, isReplacementOrphan as Mn, STATE_RESOURCES_MALFORMED as Mo, withMovedTo as Mr, refuseMalformedState as Ms, planOrphanAdoption as Mt, describeDockerExecFailure as Mu, compensateRemovedDeletionProtection as N, unsettledPropertiesOf as Na, maskReadbackAtCoordinates as Nc, describeFileReadFailure as Nd, reserveStackCreateToken as Ni, WHOLE_DYNAMIC_REFERENCE_PATTERN as Nl, planFailedOps as Nn, UNREADABLE_ORPHANS_CONTAINER_ROW as No, isPairableType as Nr, repairMalformedOrphanRecordsForReadOnly as Ns, pendingRequestCount as Nt, describeDockerFailure as Nu, stripIndexContributorInsights as O, DiffCalculator as Oa, DagBuilder as Oc, hasOwnKey as Od, isFinalSnapshotError as Oi, recordMaskOnlyValuesIn as Ol, equalModuloMask as On, passedParameterClassesOf as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForOrphan as Os, keptWholeReasonText as Ot, buildDenyExternalAccessPolicy as Ou, deleteBudgetKey as P, withUnsettledProperties as Pa, maskWholeValue as Pc, displayAssemblyPath as Pd, withCreateTokenLedger as Pi, isSingleDynamicReferenceToken as Pl, planRollback as Pn, UNREADABLE_RESOURCES_MAP_ROW as Po, looselyEqual as Pr, repairMalformedOrphansForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, dockerSpawnEnvWithSensitive as Pu, readTtlSpec as Q, assertFlagRoleArn as Qa, literalSplitDelimitersOf as Qc, ccBrokenReason as Qi, hasReasonlessBaselineRefusal as Ql, nameScopeOf as Qn, malformedOrphansRefusalMessage as Qo, isSupersededResourceRecord as Qr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qs, dropFailedHint as Qt, getLegacyStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, isSettledInstanceState as Ra, noEchoOutputsComparison as Rc, injectedAwsRegionValue as Rd, extractDeploymentEventError as Ri, rebuildClientForBucketRegion as Rl, resolveReplacementOldType as Rn, hasReadableOrphans as Ro, awaitInFlightSibling as Rr, repairMalformedResourcesForReadOnly as Rs, displacedOpClause as Rt, isDockerClientEnvKey as Ru, indexDeclaresContributorInsights as S, disableInstanceApiTermination as Sa, dbInstanceEngineChangeIsInPlace as Sc, StageLoadError as Sd, ATOMIC_FINAL_SNAPSHOT_TYPES as Si, recordAttributeIdCopy as Sl, removeProtectionTypeList as Sn, isStalePlaceholderArnAttribute as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForImport as Ss, readRecordedConditionVerdicts as St, getBootstrapMarkerKey as Su, readContributorInsightsSpec as T, observeThenDisableInstanceApiTermination as Ta, canonicalLambdaFunctionName as Tc, parseFailureDebugDetail as Td, ccRoutedFinalSnapshotError as Ti, carriesSecretMask as Tl, withUnprovenUnsettled as Tn, parseWebACLArn as To, constructPathOf as Tr, refuseMalformedResourcePropertiesForDestroy as Ts, withResourceDeadline as Tt, readBootstrapMarkerBody as Tu, waitForIndexesSettled as U, s3BucketWebsiteUrl as Ua, valueAtCoordinate as Uc, planTagDiff as Ui, isAccessDenied$1 as Ul, inheritProducerRegions as Un, malformedDriftResourcePropertiesWarning as Uo, bold as Ur, findActionableSilentDrops as Us, recordDisplacedSkips as Ut, redactedDockerCause as Uu, maskedLogger as V, s3BucketDualStackDomainName as Va, readsNoEchoSource as Vc, DBPROXY_TAGS_WHAT as Vi, applyCrossPrefixScan as Vl, findNestedStackTypeChanges as Vn, isReadableOrphanRecord as Vo, withStackRecords as Vr, unreadableResourceEntries as Vs, getNestedRevertRun as Vt, redactDockerArgvValues as Vu, planVectorIndexUpdates as W, resolveDynamicReferences as Wa, liveMatchesUnresolvedTokenFrame as Wc, readTagList as Wi, isNotImplemented as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedExportNamesWarning as Wo, cyan as Wr, findHandledUnwrittenCreateOnly as Ws, revertNestedChildFromJournal as Wt, runDockerForeground as Wu, isTtlRateLimited as X, recordedReferenceRegions as Xa, createUnionSecretMasker as Xc, CC_BROKEN_REASON as Xi, exportNamesCarriedFrom as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsWarning as Xo, deleteSupersededEntry as Xr, findReplacedReadersOfRecreateTargets as Xs, deleteJournaledOrphans as Xt, synthesisStatusMessage as Xu, isTtlAlreadyDisabled as Y, recordedOutputReferenceRegions as Ya, carryLogOnlyValues as Yc, stringifyIfAssigned as Yi, describeRegionValueKind as Yl, updatePartialReason as Yn, malformedOrphanRecordsRefusalMessage as Yo, addSuperseded as Yr, hasNoCloudControlHandlers as Ys, withNestedStackContext as Yt, Synthesizer as Yu, planTimeToLive as Z, applyRoleArnIfSet as Za, hasMaskableValues as Zc, ProviderRegistry as Zi, hasReadableExportSet as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRowsKeptWarning as Zo, holdsSupersededResources as Zr, shownType as Zs, dropFailedCommands as Zt, getDefaultStateBucketName as Zu, streamMemberRefusals as _, deleteLeftInPlace as _a, prefetchCreateOnlyPropertyPaths as _c, expectedOwnerParam as _d, secretNamePrintingBags as _i, identityKeyFor as _l, pendingMovesOutOf as _n, carriesFetchableDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputsForDestroy as _s, renderNestedTemplateTreeDefect as _t, rewriteTemplateAssetReferences as _u, isProtectionValueActive as a, getCurrentResourceSecrets as aa, toCfnInteger as ac, resolveStateBucketWithDefaultAndSource as ad, noEchoAttributeNamesOf as ai, createSecretMasker as al, chunks as an, callerEnvCredentials as ao, reachableDivergentParameters as ar, malformedResourcesWarning as as, markRefusedBeforeApplying as at, shouldRetainResource as au, CONTRIBUTOR_INSIGHTS_KEY as b, isWaitAbandonedError as ba, withRetry as bc, derivePartitionAndUrlSuffix as bd, stateSecretNameNeedles as bi, recoverMaskedOutput as bl, replayFailedOperations as bn, AWS_NO_VALUE as bo, isExportAliasCollision as br, refuseMalformedResourceEntriesForDeploy as bs, conditionInputsFrom as bt, assertAssetBucketRegion as bu, DynamoDBGlobalTableProvider as c, applyCustomResourceResponseExpiration as ca, coerceCfnInteger as cc, warnDeprecatedNoPrefixCliFlag as cd, noEchoParameterNamesOf as ci, maskSecretsInText as cl, withApiLimit as cn, classifyReplaySecretRegion as co, displayTextOrWithheld as cr, previewableOrphanRecords as cs, crossStackOutputProvenanceSource as ct, renderPhaseTimings as cu, declaredStreamPolicyMember as d, slowCcOperationTimeoutMs as da, configStringRefusal as dc, CFN_TEMPLATE_URL_LIMIT as dd, completedReplayEntries as di, withoutPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, coerceParameterTypedValue as do, secretBearingStateKeyWarning as dr, refuseMalformedOrphanRecords as ds, findServiceTokenRefusals as dt, isSensitiveAttributeName as du, wouldReturnToSdkProvider as ea, isStatefulRecreateTargetSync as ec, resolveApp as ed, supersededAfterRollback as ei, printingCorpusOf as el, journaledOrphanLines as en, explicitRoleArnOrThrow as eo, retiredNameGenerationsAfter as er, malformedOutputsRefusalMessage as es, ECR_AUTO_DELETE_IMAGES_TAG as et, importableOutputKeys as eu, declaredStreamTagsMember as f, onlySecretReferencesDiffer as fa, readConfigString as fc, MIGRATE_TMP_PREFIX as fd, journaledOrphanPrintingBag as fi, DYNAMIC_REFERENCE_TOKEN_SCAN as fl, refactorMarkerRefusalMessage as fn, isUnboundTemplateParameter as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecordsForDestroy as fs, serviceTokenBlockingReason as ft, stringifyValue as fu, streamDeclaresTags as g, deleteIndeterminateGuards as ga, requireConfigString as gc, decodeListingKey as gd, secretNamePrintingBag as gi, spelledKeysOf as gl, hasPendingMovesOut as gn, carriesDynamicReference as go, isWholeDynamicReferenceValue as gr, refuseMalformedOutputs as gs, listNestedTemplateRows as gt, loadPublishableAssetManifest as gu, streamDeclaresPolicy as h, UNSPECIFIED_SKIP_REASON as ha, requireConfigObject as hc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hd, orphanRecordsPrintingBag as hi, pathCrossesDottedKey as hl, updateRefactorMarker as hn, isImpossibleEmptyStoredAttribute as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForOrphan as hs, isAbsoluteAssetPath as ht, createAssetRedirectResolver as hu, PROTECTION_PROPERTY_BY_TYPE as i, isCustomResourceType as ia, isWarmThroughputDecrease as ic, resolveStateBucketWithDefault as id, withoutSuperseded as ii, unionOfSecretBags as il, formatResourceLine as in, applyCallerIdentityCredentials as io, namesAnyDeclaredParameter as ir, malformedResourcePropertiesWarning as is, getPriorAttempts as it, orphansCarriedFrom as iu, DYNAMODB_DELETE_POLL_COST_MS as j, unsettledItemsField as ja, isMarkedCoordinate as jc, ownValue as jd, earliestDefined as ji, recordProvenPublicExpression as jl, isJournaledOrphan as jn, STATE_REGION_DIVERGED as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForExport as js, makeSiblingClaimReader as jt, describeDockerCapturedOutput as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, INTRINSIC_KEYS as ka, TemplateParser as kc, hasPlainPrototype$1 as kd, refusesFinalSnapshot as ki, recordNoEchoAttributeValues as kl, undeclaredEmptyObservedKeys as kn, declaresNoEcho as ko, hintSidesOf as kr, refuseMalformedResourcesForDeploy as ks, mergeNoChangeOutputs as kt, buildDockerImage as ku, STREAM_POLICY_KEY as l, customResourceResponseExpirationWarning as la, configBooleanRefusal as lc, ssmResolvedValueType as ld, withAttemptedItemsMasked as li, scrubResourceRecord as ll, readRefactorMarker as ln, producerRegionsFromState as lo, exportAliasCollisionScrubWarning as lr, refuseDivergentRecordRegionForDestroy as ls, inheritedProvenanceForChildDiff as lt, timePhase as lu, reverseMapStreamPolicy as m, RollbackInlinePolicyWriters as ma, requireConfigArray as mc, uploadCfnTemplate as md, namingSecretsWithRecordedNoEcho as mi, isUncertifiedBaselineMaskPosition as ml, sameMove as mn, getAccountInfo as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphansForDestroy as ms, findNestedTemplateTreeDefect as mt, buildAssetRedirectMap as mu, recordedProtectionEvidence as n, TemplateNoEchoReresolver as na, WARM_THROUGHPUT_MEMBERS as nc, resolveCaptureObservedState as nd, supersededHolderOf as ni, recordLogOnlyValue as nl, makeForeignHolderScan as nn, sendableAssumeRoleCommand as no, withNameGenerationReached as nr, malformedRenderedContainersWarning as ns, hasCdkAutoDeleteTag as nt, isReadableBag as nu, perType as o, withPrintingSecrets as oa, toFiniteNumber as oc, resolveUseCdkBootstrapAssets as od, noEchoComparisonForTemplate as oi, errorCauseChain as ol, isAccessDeniedError as on, envCredentialsAreAssumedRole as oo, resourcesNamingDeclaredParameter as or, malformedScrubResourceEntriesRefusalMessage as os, IMPLICIT_DELETE_DEPENDENCIES as ot, stackInstanceIdCarriedFrom as ou, planStreamMemberOps as p, unchangedBehindSecretReference as pa, replayWarn as pc, findLargeInlineResources as pd, maskEventTextWithBoundBags as pi, dynamicReferenceTokens as pl, refuseRefactorMarker as pn, parameterTypeMayLoseSecretIdentity as po, carriedExportAliasExposure as pr, refuseMalformedOrphans as ps, childTemplateLoader as pt, WorkGraph as pu, vectorIndexesSettled as q, keepHeldTokenProvenance as qa, recordReferenceProvenanceEntry as qc, tagPlanWarning as qi, splitImportedOps as ql, redactedDeleteAddressSkip as qn, malformedLocalResourceEntriesWarning as qo, red as qr, withoutSilentDropProperties as qs, collectNestedChildUnaddressed as qt, AssetManifestLoader as qu, recordedProtectionNote as r, readsNoEchoDeleteValues as ra, coerceWarmThroughput as rc, resolveSkipPrefix as rd, supersededResourcesOf as ri, shareLogOnlyValues as rl, sameJournaledOrphans as rn, AWS_CREDENTIAL_ENV_KEYS as ro, computeParameterTaint as rr, malformedResourceEntriesWarning as rs, isTruthyCfnBoolean as rt, orphansAfterRollback as ru, readProtection as s, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as sa, coerceCfnBoolean as sc, stateBucketExistenceConfirmed as sd, noEchoExactEchoLeavesOf as si, maskSecretsInError as sl, lookupEachName as sn, classifyRecordedSecretRegion as so, WITHHELD_NAME_DISPLAY as sr, malformedStateRefusalMessage as ss, computeImplicitDeleteEdges as st, PhaseClock as su, DeployEngine as t, waitForLambdaFunctionActive as ta, renderStatefulReason as tc, resolveAutoAssetStorage as td, supersededHeldByOtherTypeWarning as ti, recordLogOnlyParameterValue as tl, loadJournaledOrphans as tn, isIamRoleArn as to, retiredNameGenerationsLeaving as tr, malformedOutputsWarning as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputs as tu, STREAM_TAGS_KEY as u, CloudControlProvider as ua, configIntegerRefusal as uc, CFN_TEMPLATE_BODY_LIMIT as ud, createReadOnlyAttributeHealerFactory as ui, withPhysicalNameCopies as ul, readRefactorMarkerOnce as un, regionLessSecretName as uo, secretBearing as ur, refuseMalformedNestedChildOutputs as us, deferredServiceTokenWarning as ut, AssetPublisher as uu, streamPolicyMatchesDeclared as v, deleteSkipReason as va, templateResourceTypes as vc, PARTITION_TABLE as vd, secretNamedAttributeNamesOf as vi, inheritNestedStackParameterAssociations as vl, pendingMovesRefusalMessage as vn, isNamelessDynamicReferenceError as vo, collectDeclaredOutputNames as vr, refuseMalformedResourceAttributesForOrphan as vs, templateIdentity as vt, AssetModeResolver as vu, planIndexContributorInsightsOps as w, isTerminationProtectionPropagationError as wa, emrClusterInstancesReplaced as wc, describeJsonParseFailure as wd, buildFinalSnapshotIdentifier as wi, splitGetAttStringForm as wl, settleUnsettledPrevious as wn, refStateLookupFromResource as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForOrphan as ws, enclosingDeadlineRemainingMs as wt, parseBootstrapMarker as wu, contributorInsightsRefusals as x, markWaitAbandoned as xa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as xc, AssemblyReader as xd, storedSecretNameNeedles as xi, physicalNameCopiesOf as xl, replayRollback as xn, cfnRefValueFromPhysicalId as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDestroy as xs, parentSuppliedValues as xt, ensureAssetStorage as xu, streamTagsMatchDeclared as y, withIndeterminateGuard as ya, describeTypeWithThrottleRetry as yc, canonicalizeRegion as yd, secretNamedRecordNeedles as yi, recordNestedStackParameterExpressions as yl, refusePendingMovesOut as yn, keepsSecretReferenceToken as yo, collectPublishedOutputNames as yr, refuseMalformedResourceEntries as ys, conditionFingerprint as yt, BOOTSTRAP_MARKER_PREFIX as yu, TABLE_INDEX_NOUN as z, s3BucketArn as za, passedNoEchoParametersOf as zc, clearBucketRegionCache as zd, isRefusedByName as zi, CrossPrefixReadError as zl, seedsDeleteFirstGuard as zn, hasReadableOutputs as zo, destroyStackRecordsView as zr, unpreviewableOrphanRecords as zs, displacedPhysicalIdShown as zt, isMalformedEnvKey as zu };
-//# sourceMappingURL=deploy-engine-BnEvzfon.js.map
+export { sendTtlWaitingOutRateLimit as $, assertFlagRoleArn as $a, literalSplitDelimitersOf as $c, ccBrokenReason as $i, hasReasonlessBaselineRefusal as $l, retiredAfterRollback as $n, malformedOrphansRefusalMessage as $o, isSupersededResourceRecord as $r, MULTI_REGION_RECREATE_BLOCKED_TYPES as $s, isHandledOrphan as $t, getLegacyStateBucketName as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, INTRINSIC_KEYS as Aa, TemplateParser as Ac, hasPlainPrototype$1 as Ad, refusesFinalSnapshot as Ai, recordNoEchoAttributeValues as Al, demoteSupersededOrphans as An, declaresNoEcho as Ao, movedToHint as Ar, refuseMalformedResourcesForDeploy as As, makeCanonicalizePropertiesFn as At, buildDockerImage as Au, deleteTableWithIndexBusyRetry as B, s3BucketArn as Ba, passedNoEchoParametersOf as Bc, clearBucketRegionCache as Bd, isRefusedByName as Bi, CrossPrefixReadError as Bl, orphanNeedsIdentity as Bn, hasReadableOutputs as Bo, destroyStackRecordsView as Br, unpreviewableOrphanRecords as Bs, dropSettledNestedJournals as Bt, isMalformedEnvKey as Bu, planContributorInsightsOp as C, disableInstanceApiTermination as Ca, dbInstanceEngineChangeIsInPlace as Cc, StageLoadError as Cd, ATOMIC_FINAL_SNAPSHOT_TYPES as Ci, recordAttributeIdCopy as Cl, recordAfterRollbackUpdate as Cn, isStalePlaceholderArnAttribute as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImport as Cs, enclosingDeadlineExpired as Ct, getBootstrapMarkerKey as Cu, reverseMapTableContributorInsights as D, reDisableInstanceApiTermination as Da, lambdaFunctionNameForMask as Dc, utf8ByteLength as Dd, createPreDeleteFinalSnapshot as Di, provenPublicValue as Dl, equalModuloMarkedMask as Dn, withSharedDrainBudget as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForDrift as Ds, isSecretBearingReferenceString as Dt, validateAssetBucketName as Du, reverseMapIndexContributorInsights as E, observeThenDisableInstanceApiTermination as Ea, canonicalLambdaFunctionName as Ec, parseFailureDebugDetail as Ed, ccRoutedFinalSnapshotError as Ei, carriesSecretMask as El, calculateResourceDrift as En, parseWebACLArn as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDestroy as Es, diffSecurity as Et, readBootstrapMarkerBody as Eu, resolveDynamoDbDeleteBudgetClock as F, withUnsettledProperties as Fa, maskWholeValue as Fc, displayAssemblyPath as Fd, withCreateTokenLedger as Fi, isSingleDynamicReferenceToken as Fl, recheckFailedPlan as Fn, UNREADABLE_RESOURCES_MAP_ROW as Fo, mappingPairs as Fr, repairMalformedOrphansForReadOnly as Fs, keptForRetainedRecord as Ft, dockerSpawnEnvWithSensitive as Fu, readbackVectorIndexes as G, resolveDynamicReferences as Ga, liveMatchesUnresolvedTokenFrame as Gc, readTagList as Gi, isNotImplemented as Gl, isRedactedRecordedValue as Gn, malformedExportNamesWarning as Go, cyan as Gr, findHandledUnwrittenCreateOnly as Gs, revertedNestedRowIds as Gt, runDockerForeground as Gu, relayedIndexBusyDelete as H, s3BucketDualStackDomainName as Ha, readsNoEchoSource as Hc, DBPROXY_TAGS_WHAT as Hi, applyCrossPrefixScan as Hl, getCurrentProducerRegions as Hn, isReadableOrphanRecord as Ho, withStackRecords as Hr, unreadableResourceEntries as Hs, nestedChildStackName as Ht, redactDockerArgvValues as Hu, resolveDynamoDbDeleteBudgetMs as I, withoutUnsettledProperties as Ia, maskedLeafCoordinatesOf as Ic, renderAssemblyPathEscape as Id, acquireIdempotencyToken as Ii, LockManager as Il, recordUnderIdIsNotOwn as In, accountArgs as Io, parseMappingFile as Ir, repairMalformedOutputsForReadOnly as Is, recordRetainedForReadoption as It, finchSecretArgvRefusal as Iu, vectorIndexesShapeDetail as J, keepHeldTokenProvenance as Ja, recordReferenceProvenanceEntry as Jc, tagPlanWarning as Ji, splitImportedOps as Jl, updatePartialMessage as Jn, malformedLocalResourceEntriesWarning as Jo, red as Jr, withoutSilentDropProperties as Js, getCurrentNestedStackContext as Jt, AssetManifestLoader as Ju, vectorIndexesForCreate as K, producerLookupOver as Ka, markSameGenerationBag as Kc, refuseMalformedDesiredTags as Ki, stackInstanceIdOf as Kl, redactedDeleteAddressFields as Kn, malformedExportSourceWarning as Ko, gray as Kr, findSilentDropProperties as Ks, withNestedRevertRun as Kt, runDockerStreaming as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, IntrinsicFunctionResolver as La, noEchoCoordinatesOf as Lc, resolveAssemblyPath as Ld, DeploymentEventsReader as Li, isLockInfoExpired as Ll, replacementNeverSwapped as Ln, deployRefusesOrphanRowsReason as Lo, proposeRenames as Lr, repairMalformedResourceEntriesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, formatDockerLoginError as Lu, beginDeleteWait as M, unsettledItemsField as Ma, isMarkedCoordinate as Mc, ownValue as Md, earliestDefined as Mi, recordProvenPublicExpression as Ml, isReplacementOrphan as Mn, STATE_REGION_DIVERGED as Mo, withMovedTo as Mr, refuseMalformedResourcesForExport as Ms, planOrphanAdoption as Mt, describeDockerCapturedOutput as Mu, compensateRemovedDeletionProtection as N, unsettledItemsOf as Na, maskAtCoordinates as Nc, absoluteAssemblyPathEscape as Nd, ledgerForStack as Ni, wholeStringLeavesOf as Nl, planFailedOps as Nn, STATE_RESOURCES_MALFORMED as No, isPairableType as Nr, refuseMalformedState as Ns, pendingRequestCount as Nt, describeDockerExecFailure as Nu, stripIndexContributorInsights as O, reEnableInstanceApiTermination as Oa, sameLambdaFunctionAddress as Oc, defineOwnKey as Od, effectiveDeletionPolicy as Oi, recordMaskOnlyValue as Ol, equalModuloMask as On, parameterInputsFor as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForExport as Os, keptWholeReasonText as Ot, validateContainerRepoName as Ou, deleteBudgetKey as P, unsettledPropertiesOf as Pa, maskReadbackAtCoordinates as Pc, describeFileReadFailure as Pd, reserveStackCreateToken as Pi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Pl, planRollback as Pn, UNREADABLE_ORPHANS_CONTAINER_ROW as Po, looselyEqual as Pr, repairMalformedOrphanRecordsForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, describeDockerFailure as Pu, readTtlSpec as Q, applyRoleArnIfSet as Qa, hasMaskableValues as Qc, ProviderRegistry as Qi, hasReadableExportSet as Ql, nameScopeOf as Qn, malformedOrphanRowsKeptWarning as Qo, holdsSupersededResources as Qr, shownType as Qs, dropFailedHint as Qt, getDefaultStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, poisonRenderedSpellingsCollidingIn as Ra, noEchoLeavesOf as Rc, injectAwsRegion as Rd, DeploymentEventsStore as Ri, S3StateBackend as Rl, resolveReplacementOldType as Rn, displayLogicalId as Ro, refuseRestoreFromItself as Rr, repairMalformedResourcePropertiesForReadOnly as Rs, displacedOpClause as Rt, getDockerCmd as Ru, indexDeclaresContributorInsights as S, markWaitAbandoned as Sa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as Sc, AssemblyReader as Sd, storedSecretNameNeedles as Si, physicalNameCopiesOf as Sl, removeProtectionTypeList as Sn, cfnRefValueFromPhysicalId as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForDestroy as Ss, readRecordedConditionVerdicts as St, ensureAssetStorage as Su, readContributorInsightsSpec as T, isTerminationProtectionPropagationError as Ta, emrClusterInstancesReplaced as Tc, describeJsonParseFailure as Td, buildFinalSnapshotIdentifier as Ti, splitGetAttStringForm as Tl, withUnprovenUnsettled as Tn, refStateLookupFromResource as To, constructPathOf as Tr, refuseMalformedResourceEntriesForOrphan as Ts, withResourceDeadline as Tt, parseBootstrapMarker as Tu, waitForIndexesSettled as U, s3BucketRegionalDomainName as Ua, recordedNoEchoValuesOf as Uc, DBPROXY_TAG_OPTIONS as Ui, crossPrefixDeniedWarning as Ul, inheritProducerRegions as Un, isReadableResourceEntry as Uo, replacedDeleteFailureVerdict as Ur, withheldAccountClause as Us, recordDisplacedSkips as Ut, redactedCause as Uu, maskedLogger as V, s3BucketDomainName as Va, readbackPathFor as Vc, resolveBucketRegion as Vd, markDeleteStarted as Vi, CrossPrefixScanCache as Vl, findNestedStackTypeChanges as Vn, hasReadableResources as Vo, getStackRecords as Vr, unreadableOrphanRecords as Vs, getNestedRevertRun as Vt, partitionSensitiveEnv as Vu, planVectorIndexUpdates as W, s3BucketWebsiteUrl as Wa, valueAtCoordinate as Wc, planTagDiff as Wi, isAccessDenied$1 as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedDriftResourcePropertiesWarning as Wo, bold as Wr, findActionableSilentDrops as Ws, revertNestedChildFromJournal as Wt, redactedDockerCause as Wu, isTtlRateLimited as X, recordedOutputReferenceRegions as Xa, carryLogOnlyValues as Xc, stringifyIfAssigned as Xi, describeRegionValueKind as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsRefusalMessage as Xo, addSuperseded as Xr, hasNoCloudControlHandlers as Xs, deleteJournaledOrphans as Xt, Synthesizer as Xu, isTtlAlreadyDisabled as Y, outputReferenceProvenanceOf as Ya, snapshotPassProvenance as Yc, definedAttributes as Yi, acceptedCreateOnlyDropsOf as Yl, updatePartialReason as Yn, malformedLocalResourcesWarning as Yo, yellow as Yr, NO_CC_HANDLERS_REASON as Ys, withNestedStackContext as Yt, getDockerImageBySourceHash as Yu, planTimeToLive as Z, recordedReferenceRegions as Za, createUnionSecretMasker as Zc, CC_BROKEN_REASON as Zi, exportNamesCarriedFrom as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRecordsWarning as Zo, deleteSupersededEntry as Zr, findReplacedReadersOfRecreateTargets as Zs, dropFailedCommands as Zt, synthesisStatusMessage as Zu, streamMemberRefusals as _, deleteIndeterminateGuards as _a, requireConfigString as _c, decodeListingKey as _d, secretNamePrintingBag as _i, spelledKeysOf as _l, pendingMovesOutOf as _n, carriesDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputs as _s, renderNestedTemplateTreeDefect as _t, loadPublishableAssetManifest as _u, isProtectionValueActive as a, isCustomResourceType as aa, isWarmThroughputDecrease as ac, resolveStateBucketWithDefault as ad, withoutSuperseded as ai, unionOfSecretBags as al, chunks as an, applyCallerIdentityCredentials as ao, reachableDivergentParameters as ar, malformedResourcePropertiesWarning as as, markRefusedBeforeApplying as at, orphansCarriedFrom as au, CONTRIBUTOR_INSIGHTS_KEY as b, withIndeterminateGuard as ba, describeTypeWithThrottleRetry as bc, canonicalizeRegion as bd, secretNamedRecordNeedles as bi, recordNestedStackParameterExpressions as bl, replayFailedOperations as bn, keepsSecretReferenceToken as bo, isExportAliasCollision as br, refuseMalformedResourceEntries as bs, conditionInputsFrom as bt, BOOTSTRAP_MARKER_PREFIX as bu, DynamoDBGlobalTableProvider as c, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as ca, coerceCfnBoolean as cc, stateBucketExistenceConfirmed as cd, noEchoExactEchoLeavesOf as ci, maskSecretsInError as cl, withApiLimit as cn, classifyRecordedSecretRegion as co, displayTextOrWithheld as cr, malformedStateRefusalMessage as cs, crossStackOutputProvenanceSource as ct, PhaseClock as cu, declaredStreamPolicyMember as d, CloudControlProvider as da, configIntegerRefusal as dc, CFN_TEMPLATE_BODY_LIMIT as dd, createReadOnlyAttributeHealerFactory as di, withPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, regionLessSecretName as do, secretBearingStateKeyWarning as dr, refuseMalformedNestedChildOutputs as ds, findServiceTokenRefusals as dt, AssetPublisher as du, isCustomResource as ea, isStatefulRecreateTargetForReplace as ec, loadCdkJson as ed, removeSuperseded as ei, logOnlyValueCount as el, journaledOrphanLines as en, assertSendableRoleArn as eo, retiredNameGenerationsAfter as er, malformedOrphansWarning as es, ECR_AUTO_DELETE_IMAGES_TAG as et, hasUnverifiableParameterRefusal as eu, declaredStreamTagsMember as f, slowCcOperationTimeoutMs as fa, configStringRefusal as fc, CFN_TEMPLATE_URL_LIMIT as fd, completedReplayEntries as fi, withoutPhysicalNameCopies as fl, refactorMarkerRefusalMessage as fn, coerceParameterTypedValue as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecords as fs, serviceTokenBlockingReason as ft, isSensitiveAttributeName as fu, streamDeclaresTags as g, UNSPECIFIED_SKIP_REASON as ga, requireConfigObject as gc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gd, orphanRecordsPrintingBag as gi, pathCrossesDottedKey as gl, hasPendingMovesOut as gn, isImpossibleEmptyStoredAttribute as go, isWholeDynamicReferenceValue as gr, refuseMalformedOrphansForOrphan as gs, listNestedTemplateRows as gt, createAssetRedirectResolver as gu, streamDeclaresPolicy as h, RollbackInlinePolicyWriters as ha, requireConfigArray as hc, uploadCfnTemplate as hd, namingSecretsWithRecordedNoEcho as hi, isUncertifiedBaselineMaskPosition as hl, updateRefactorMarker as hn, getAccountInfo as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForDestroy as hs, isAbsoluteAssetPath as ht, buildAssetRedirectMap as hu, PROTECTION_PROPERTY_BY_TYPE as i, readsNoEchoDeleteValues as ia, coerceWarmThroughput as ic, resolveSkipPrefix as id, supersededResourcesOf as ii, shareLogOnlyValues as il, formatResourceLine as in, AWS_CREDENTIAL_ENV_KEYS as io, namesAnyDeclaredParameter as ir, malformedResourceEntriesWarning as is, getPriorAttempts as it, orphansAfterRollback as iu, DYNAMODB_DELETE_POLL_COST_MS as j, isUsableAttemptedName as ja, canonicalCoordinates as jc, nullPrototypeRecord as jd, unsupportedFinalSnapshotError as ji, recordNoEchoParameterFreshValue as jl, isJournaledOrphan as jn, JSON_LISTING_HOLE_VALUE as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForDestroy as js, makeSiblingClaimReader as jt, resolveDockerContextDirectory as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, DiffCalculator as ka, DagBuilder as kc, hasOwnKey as kd, isFinalSnapshotError as ki, recordMaskOnlyValuesIn as kl, undeclaredEmptyObservedKeys as kn, passedParameterClassesOf as ko, hintSidesOf as kr, refuseMalformedResourcePropertiesForOrphan as ks, mergeNoChangeOutputs as kt, buildDenyExternalAccessPolicy as ku, STREAM_POLICY_KEY as l, applyCustomResourceResponseExpiration as la, coerceCfnInteger as lc, warnDeprecatedNoPrefixCliFlag as ld, noEchoParameterNamesOf as li, maskSecretsInText as ll, readRefactorMarker as ln, classifyReplaySecretRegion as lo, exportAliasCollisionScrubWarning as lr, previewableOrphanRecords as ls, inheritedProvenanceForChildDiff as lt, renderPhaseTimings as lu, reverseMapStreamPolicy as m, unchangedBehindSecretReference as ma, replayWarn as mc, findLargeInlineResources as md, maskEventTextWithBoundBags as mi, dynamicReferenceTokens as ml, sameMove as mn, parameterTypeMayLoseSecretIdentity as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphans as ms, findNestedTemplateTreeDefect as mt, WorkGraph as mu, recordedProtectionEvidence as n, waitForLambdaFunctionActive as na, renderStatefulReason as nc, resolveAutoAssetStorage as nd, supersededHeldByOtherTypeWarning as ni, recordLogOnlyParameterValue as nl, makeForeignHolderScan as nn, isIamRoleArn as no, withNameGenerationReached as nr, malformedOutputsWarning as ns, hasCdkAutoDeleteTag as nt, importableOutputs as nu, perType as o, getCurrentResourceSecrets as oa, toCfnInteger as oc, resolveStateBucketWithDefaultAndSource as od, noEchoAttributeNamesOf as oi, createSecretMasker as ol, isAccessDeniedError as on, callerEnvCredentials as oo, resourcesNamingDeclaredParameter as or, malformedResourcesWarning as os, IMPLICIT_DELETE_DEPENDENCIES as ot, shouldRetainResource as ou, planStreamMemberOps as p, onlySecretReferencesDiffer as pa, readConfigString as pc, MIGRATE_TMP_PREFIX as pd, journaledOrphanPrintingBag as pi, DYNAMIC_REFERENCE_TOKEN_SCAN as pl, refuseRefactorMarker as pn, isUnboundTemplateParameter as po, carriedExportAliasExposure as pr, refuseMalformedOrphanRecordsForDestroy as ps, childTemplateLoader as pt, stringifyValue as pu, vectorIndexesSettled as q, refuseUnreadableCdkCrossAccountRefs as qa, redactForState as qc, tagMapAsList as qi, withStackInstanceIdWithheld as ql, redactedDeleteAddressSkip as qn, malformedLocalOutputsWarning as qo, green as qr, unwrittenCreateOnlyReplacement as qs, collectNestedChildUnaddressed as qt, warnFinchArgvExposure as qu, recordedProtectionNote as r, TemplateNoEchoReresolver as ra, WARM_THROUGHPUT_MEMBERS as rc, resolveCaptureObservedState as rd, supersededHolderOf as ri, recordLogOnlyValue as rl, sameJournaledOrphans as rn, sendableAssumeRoleCommand as ro, computeParameterTaint as rr, malformedRenderedContainersWarning as rs, isTruthyCfnBoolean as rt, isReadableBag as ru, readProtection as s, withPrintingSecrets as sa, toFiniteNumber as sc, resolveUseCdkBootstrapAssets as sd, noEchoComparisonForTemplate as si, errorCauseChain as sl, lookupEachName as sn, envCredentialsAreAssumedRole as so, WITHHELD_NAME_DISPLAY as sr, malformedScrubResourceEntriesRefusalMessage as ss, computeImplicitDeleteEdges as st, stackInstanceIdCarriedFrom as su, DeployEngine as t, wouldReturnToSdkProvider as ta, isStatefulRecreateTargetSync as tc, resolveApp as td, supersededAfterRollback as ti, printingCorpusOf as tl, loadJournaledOrphans as tn, explicitRoleArnOrThrow as to, retiredNameGenerationsLeaving as tr, malformedOutputsRefusalMessage as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputKeys as tu, STREAM_TAGS_KEY as u, customResourceResponseExpirationWarning as ua, configBooleanRefusal as uc, ssmResolvedValueType as ud, withAttemptedItemsMasked as ui, scrubResourceRecord as ul, readRefactorMarkerOnce as un, producerRegionsFromState as uo, secretBearing as ur, refuseDivergentRecordRegionForDestroy as us, deferredServiceTokenWarning as ut, timePhase as uu, streamPolicyMatchesDeclared as v, deleteLeftInPlace as va, prefetchCreateOnlyPropertyPaths as vc, expectedOwnerParam as vd, secretNamePrintingBags as vi, identityKeyFor as vl, pendingMovesRefusalMessage as vn, carriesFetchableDynamicReference as vo, collectDeclaredOutputNames as vr, refuseMalformedOutputsForDestroy as vs, templateIdentity as vt, rewriteTemplateAssetReferences as vu, planIndexContributorInsightsOps as w, ec2InstanceProtectionSite as wa, ecsServiceLaunchTypeSetOrChanged as wc, processStackMessages as wd, PRE_DELETE_SNAPSHOT_TYPES as wi, recordPhysicalNameCopy as wl, settleUnsettledPrevious as wn, lacksRecordedTableArn as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForImportSave as ws, enclosingDeadlineRemainingMs as wt, isCrossRegionRedirect as wu, contributorInsightsRefusals as x, isWaitAbandonedError as xa, withRetry as xc, derivePartitionAndUrlSuffix as xd, stateSecretNameNeedles as xi, recoverMaskedOutput as xl, replayRollback as xn, AWS_NO_VALUE as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDeploy as xs, parentSuppliedValues as xt, assertAssetBucketRegion as xu, streamTagsMatchDeclared as y, deleteSkipReason as ya, templateResourceTypes as yc, PARTITION_TABLE as yd, secretNamedAttributeNamesOf as yi, inheritNestedStackParameterAssociations as yl, refusePendingMovesOut as yn, isNamelessDynamicReferenceError as yo, collectPublishedOutputNames as yr, refuseMalformedResourceAttributesForOrphan as ys, conditionFingerprint as yt, AssetModeResolver as yu, TABLE_INDEX_NOUN as z, isSettledInstanceState as za, noEchoOutputsComparison as zc, injectedAwsRegionValue as zd, extractDeploymentEventError as zi, rebuildClientForBucketRegion as zl, seedsDeleteFirstGuard as zn, hasReadableOrphans as zo, awaitInFlightSibling as zr, repairMalformedResourcesForReadOnly as zs, displacedPhysicalIdShown as zt, isDockerClientEnvKey as zu };
+//# sourceMappingURL=deploy-engine-BiJyU4j1.js.map