@go-to-k/cdkd 0.320.0 → 0.321.0

package/dist/{deploy-engine-BiJyU4j1.js → deploy-engine-pGWgnV-6.js}

@@ -2,7 +2,7 @@ import { c as __exportAll, r as getAwsClients } from "./aws-clients-DWpHZk2l.js"
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-DiHodi76.js";
 import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-CmrPwGge.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BLXFsfMa.js";
-import { t as getCdkdVersion } from "./version-CrtjwYuX.js";
+import { t as getCdkdVersion } from "./version-DWSVZXE5.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16546,21 +16546,20 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"RestoreToTime",
+			"RestoreType",
 			"RotateMasterUserPassword",
 			"ServerlessV2ScalingConfiguration",
+			"SnapshotIdentifier",
+			"SourceDBClusterIdentifier",
 			"StorageEncrypted",
 			"StorageType",
 			"Tags",
+			"UseLatestRestorableTime",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["RestoreToTime", "not yet implemented by cdkd"],
-			["RestoreType", "not yet implemented by cdkd"],
-			["SnapshotIdentifier", "not yet implemented by cdkd"],
-			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
-			["UseLatestRestorableTime", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotIdentifier", "SourceDBClusterIdentifier"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"ClusterResourceId",
 			"Endpoint",
@@ -16627,9 +16626,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WriteProvisionedThroughputSettings"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["GlobalTableSourceArn", "not yet implemented by cdkd"],
-			["GlobalTableWitnesses", "not yet implemented by cdkd"],
-			["MultiRegionConsistency", "not yet implemented by cdkd"]
+			["GlobalTableSourceArn", "Multi-account replica: CDK's TableV2MultiAccountReplica renders no KeySchema (which create() requires) and DynamoDB asks for a ResourcePolicy on the CreateTable (measured 2026-11-01), a cross-account path this provider cannot exercise. Stays on Cloud Control"],
+			["GlobalTableWitnesses", "MRSC witness; same one-call UpdateTable shape as MultiRegionConsistency, measured 2026-11-01. Stays on Cloud Control"],
+			["MultiRegionConsistency", "MRSC does not fit the per-replica serial paths: measured 2026-11-01 (us-east-1 / us-east-2 / us-west-2), the replica and witness Creates must go out in ONE UpdateTable with the mode, a lone replica Delete is refused ('does not include all witnesses'), DeleteTable is refused until they are gone, TTL is refused, and the table carries no stream, which create()'s needsStream arm would enable. Stays on Cloud Control"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
@@ -17654,7 +17653,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SplunkDestinationConfiguration",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["DatabaseSourceConfiguration", "not yet implemented by cdkd"], ["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map([["DatabaseSourceConfiguration", "Database as a source was a public preview AWS removed on 2025-09-24 (Firehose document history); CreateDeliveryStream refused DeliveryStreamType DatabaseAsSource in every region probed, so an SDK path could not be verified. Stays on Cloud Control"], ["SnowflakeDestinationConfiguration", "Proving the wire shape live needs a real Snowflake account, and the block carries key material (PrivateKey, KeyPassphrase). Stays on Cloud Control"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["DatabaseSourceConfiguration"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
@@ -18123,6 +18122,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"AllocatedStorage",
 			"AllowMajorVersionUpgrade",
 			"AutoMinorVersionUpgrade",
+			"AvailabilityZone",
 			"BackupRetentionPeriod",
 			"CACertificateIdentifier",
 			"CertificateRotationRestart",
@@ -18131,6 +18131,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DBClusterIdentifier",
 			"DBInstanceClass",
 			"DBInstanceIdentifier",
+			"DBName",
 			"DBParameterGroupName",
 			"DBSubnetGroupName",
 			"DedicatedLogVolume",
@@ -18173,12 +18174,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AutomaticBackupReplicationKmsKeyId", "not yet implemented by cdkd"],
 			["AutomaticBackupReplicationRegion", "not yet implemented by cdkd"],
 			["AutomaticBackupReplicationRetentionPeriod", "not yet implemented by cdkd"],
-			["AvailabilityZone", "not yet implemented by cdkd"],
 			["BackupTarget", "not yet implemented by cdkd"],
 			["CharacterSetName", "not yet implemented by cdkd"],
 			["CustomIAMInstanceProfile", "not yet implemented by cdkd"],
 			["DBClusterSnapshotIdentifier", "not yet implemented by cdkd"],
-			["DBName", "not yet implemented by cdkd"],
 			["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
@@ -18210,7 +18209,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"BackupTarget",
 			"CharacterSetName",
 			"CustomIAMInstanceProfile",
-			"DBName",
 			"DBSystemId",
 			"NcharCharacterSetName",
 			"SourceRegion",
@@ -28610,7 +28608,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B4XVfH0S.js");
+			const { ASGProvider } = await import("./asg-provider-DIQU27yo.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28719,7 +28717,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-C_r5q9NM.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DjjNodrS.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BenOBQ9u.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DzedCIWf.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -32996,6 +32994,21 @@ function validatePropertyShapes(resources) {
 	throw new Error("Properties validation failed: the following resources declare a property whose kind contradicts the resource type's schema:\n" + lines.join("\n") + "\n\nCloudFormation rejects these templates too. Give each property a list where its schema expects a list and an object where it expects an object.");
 }
 
+// src/provisioning/sticky-exempt-physical-id.ts
+const ECS_SERVICE_CC_ID = /^(arn:aws[-a-z]*:ecs:[a-z0-9-]+:\d{12}:service\/([A-Za-z0-9_-]+)(?:\/([A-Za-z0-9_-]+))?)\|([^|\s]+)$/;
+const CLUSTER_ARN = /^arn:aws[-a-z]*:ecs:[a-z0-9-]+:\d{12}:cluster\/([A-Za-z0-9_-]+)$/;
+const CLUSTER_NAME = /^[A-Za-z0-9_-]+$/;
+function ecsServiceSdkPhysicalId(ccPhysicalId) {
+	const match = ECS_SERVICE_CC_ID.exec(ccPhysicalId);
+	if (match === null) throw new Error("its recorded physical id is not the `<serviceArn>|<cluster>` form Cloud Control records for AWS::ECS::Service");
+	const [, serviceArn, first, second, clusterSegment] = match;
+	const clusterArn = CLUSTER_ARN.exec(clusterSegment);
+	if (clusterArn === null && !CLUSTER_NAME.test(clusterSegment)) throw new Error("the cluster segment of its recorded physical id is neither a cluster name nor a cluster ARN");
+	const clusterName = clusterArn === null ? clusterSegment : clusterArn[1];
+	if (second !== void 0 && first !== clusterName) throw new Error("its recorded physical id names one cluster in the service ARN and another after the `|`");
+	return serviceArn;
+}
+
 // src/provisioning/provider-registry.ts
 const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 	["AWS::Scheduler::Schedule", {
@@ -33063,8 +33076,27 @@ const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 		physicalIdForm: "both layers store the bare `Z...` zone id, without the `/hostedzone/` prefix Route 53 answers with: the schema primaryIdentifier is Id, Route53Provider.create strips the prefix, and the Cloud Control Identifier has none (measured us-east-1, 2026-11-02)",
 		issue: "https://github.com/go-to-k/cdkd/issues/5641",
 		integFixture: "cc-to-sdk-reroute-hosted-zone"
+	}],
+	["AWS::ECS::Service", {
+		mode: "sdk-coverage",
+		physicalIdForm: "Cloud Control stores `<serviceArn>|<cluster>` (the schema primaryIdentifier is ServiceArn + Cluster; measured us-east-1, 2026-11-03) while ECSProvider.create records the bare CreateService serviceArn; normalizeCcPhysicalId keeps the ARN part, which the fixture observed equal to the live service ARN",
+		issue: "https://github.com/go-to-k/cdkd/issues/5654",
+		integFixture: "cc-to-sdk-reroute-ecs-service",
+		normalizeCcPhysicalId: ecsServiceSdkPhysicalId
 	}]
 ]);
+function sdkAddressedPhysicalId(resourceType, physicalId, logicalId) {
+	const entry = STICKY_CC_MIGRATION_EXEMPT.get(resourceType);
+	const normalize = entry?.normalizeCcPhysicalId;
+	if (normalize === void 0) return physicalId;
+	try {
+		return normalize(physicalId);
+	} catch (error) {
+		const reason = describeAwsFailure(error).detail;
+		const remedy = entry?.mode === "sdk-coverage" ? ` Pass --pin-cc-api ${logicalId} to keep it on Cloud Control.` : "";
+		throw new Error(`${logicalId} (${resourceType}) cannot move from Cloud Control to its SDK provider: ${reason}.${remedy}`);
+	}
+}
 const CC_BROKEN_REASON = "Cloud Control's handler cannot manage this type correctly";
 function ccBrokenReason(resourceType) {
 	return STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode === "cc-broken" ? CC_BROKEN_REASON : void 0;
@@ -33157,7 +33189,7 @@ var ProviderRegistry = class {
 			if (actionableDrops.length === 0) {
 				debug(`Using specific SDK provider for ${resourceType}`);
 				if (returningToSdk) {
-					debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
+					debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; the resource is updated in place`);
 					return {
 						provider: specificProvider,
 						provisionedBy: "sdk",
@@ -34471,6 +34503,48 @@ function provenanceBaselineOf(state, tokenFree) {
 	};
 }
 
+// src/deployment/label-routing.ts
+function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
+	try {
+		if (change.changeType === "DELETE") return existingState?.provisionedBy;
+		return registry.getProviderFor({
+			resourceType: change.resourceType,
+			properties: change.desiredProperties ?? {},
+			provisionedBy: existingState?.provisionedBy,
+			previousProperties: existingState?.properties,
+			forceCcApi
+		}).provisionedBy;
+	} catch {
+		return;
+	}
+}
+
+// src/deployment/deploy-engine/routing.ts
+function isPinnedToCcApi(options, stackName, logicalId) {
+	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
+}
+function recreateDirectionFor(options, stackName, logicalId) {
+	const targets = options.recreateTargets?.stackName === stackName ? options.recreateTargets : void 0;
+	if (targets === void 0) return void 0;
+	if (targets.viaCcApi.has(logicalId)) return "cc-api";
+	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
+}
+function peekRoutingForLabel(providerRegistry, options, change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
+	if (needsReplacement) {
+		const hintRecord = {
+			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
+			...existingState?.properties !== void 0 && { properties: existingState.properties }
+		};
+		return deriveLabelRouting(change, hintRecord, providerRegistry, recreateDirection === "cc-api");
+	}
+	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
+}
+function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId, underivable = "refuse") {
+	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
+	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
+	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
+}
+
 // src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
@@ -35462,16 +35536,17 @@ async function readRecordAttributes(input) {
 	const { provider, logicalId, resource, stackName, region } = input;
 	if (!provider.import) return { kind: "not-attempted" };
 	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
+	const physicalId = resource.provisionedBy === "cc-api" && !(provider instanceof CloudControlProvider) ? sdkAddressedPhysicalId(resource.resourceType, resource.physicalId, logicalId) : resource.physicalId;
 	const found = await provider.import({
 		logicalId,
 		resourceType: resource.resourceType,
 		stackName,
 		region,
 		properties: resource.properties,
-		knownPhysicalId: resource.physicalId
+		knownPhysicalId: physicalId
 	});
 	if (found === null) return { kind: "not-found" };
-	if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
+	if (found.physicalId !== physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${physicalId})`);
 	const reported = Object.entries(normalizeHealedAttributes(found.attributes));
 	const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
 	const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
@@ -35838,7 +35913,8 @@ async function noEchoAttributeOverridesFor(run, deps, desiredProps, stateResourc
 						resourceType: record.resourceType,
 						properties: record.properties,
 						provisionedBy: record.provisionedBy,
-						previousProperties: record.properties
+						previousProperties: record.properties,
+						...deps.pinnedToCcApi?.(stackName, logicalId) === true && { forceCcApi: true }
 					});
 					const outcome = await readRecordAttributes({
 						provider,
@@ -36452,7 +36528,7 @@ function replayStackRecordsView(records, orphanLogicalIds = /* @__PURE__ */ new
 }
 
 // src/provisioning/restore-source-guard.ts
-const RESTORING_TYPES = /* @__PURE__ */ new Set(["AWS::Neptune::DBCluster"]);
+const RESTORING_TYPES = /* @__PURE__ */ new Set(["AWS::DocDB::DBCluster", "AWS::Neptune::DBCluster"]);
 function clusterName(identifier) {
 	return (identifier.split(":").pop() ?? identifier).toLowerCase();
 }
@@ -36462,8 +36538,15 @@ function elsewhere(identifier, scope) {
 	const differs = (carried, known) => Boolean(carried) && known !== void 0 && carried !== known;
 	return differs(region, scope.region) || differs(account, scope.account);
 }
+function automatedSnapshotOf(snapshot, name) {
+	const id = snapshot.startsWith("arn:") ? snapshot.split(":cluster-snapshot:")[1] ?? "" : snapshot;
+	const match = /^rds:(.+)-\d{4}-\d{2}-\d{2}-\d{2}-\d{2}$/i.exec(id);
+	return match !== null && match[1].toLowerCase() === name;
+}
 function refuseRestoreFromItself(resourceType, properties, physicalId, logicalId, scope) {
 	if (!RESTORING_TYPES.has(resourceType)) return;
+	const snapshot = properties["SnapshotIdentifier"];
+	if (typeof snapshot === "string" && automatedSnapshotOf(snapshot, clusterName(physicalId)) && !elsewhere(snapshot, scope)) throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType} ${logicalId}: SnapshotIdentifier names an automated snapshot of the cluster this creates or replaces, which its delete removes; restore from a manual snapshot instead. Nothing was changed.`, resourceType, logicalId, physicalId));
 	const source = properties["SourceDBClusterIdentifier"];
 	if (typeof source !== "string" || clusterName(source) !== clusterName(physicalId)) return;
 	if (elsewhere(source, scope)) return;
@@ -40167,6 +40250,7 @@ async function replayReverseReplacement(s) {
 		secrets
 	};
 	const deleteNewResourceFirst = async (purpose) => {
+		refuseRestoreFromItself(oldType, prev.properties ?? {}, current.physicalId, op.logicalId, { region: ctx.region });
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 		const deleteNewFirstRoute = resolveNewDeleteRoute();
 		const deleteNewFirst = await withReplayDeletePrinting(s, () => deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
@@ -41330,7 +41414,8 @@ var AttributeHealer = class {
 			resourceType: resource.resourceType,
 			properties: resource.properties,
 			provisionedBy: resource.provisionedBy,
-			previousProperties: resource.properties
+			previousProperties: resource.properties,
+			...this.deps.pinnedToCcApi?.(stackName, logicalId) === true && { forceCcApi: true }
 		});
 		const outcome = await withPrintingSecrets(healPrintingBag(this.deps.baseline, logicalId, resource, this.deps.namingSecrets()), () => readRecordAttributes({
 			provider,
@@ -46541,48 +46626,6 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
-// src/deployment/label-routing.ts
-function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
-	try {
-		if (change.changeType === "DELETE") return existingState?.provisionedBy;
-		return registry.getProviderFor({
-			resourceType: change.resourceType,
-			properties: change.desiredProperties ?? {},
-			provisionedBy: existingState?.provisionedBy,
-			previousProperties: existingState?.properties,
-			forceCcApi
-		}).provisionedBy;
-	} catch {
-		return;
-	}
-}
-
-// src/deployment/deploy-engine/routing.ts
-function isPinnedToCcApi(options, stackName, logicalId) {
-	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
-}
-function recreateDirectionFor(options, stackName, logicalId) {
-	const targets = options.recreateTargets?.stackName === stackName ? options.recreateTargets : void 0;
-	if (targets === void 0) return void 0;
-	if (targets.viaCcApi.has(logicalId)) return "cc-api";
-	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
-}
-function peekRoutingForLabel(providerRegistry, options, change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
-	if (needsReplacement) {
-		const hintRecord = {
-			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
-			...existingState?.properties !== void 0 && { properties: existingState.properties }
-		};
-		return deriveLabelRouting(change, hintRecord, providerRegistry, recreateDirection === "cc-api");
-	}
-	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
-}
-function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId, underivable = "refuse") {
-	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
-	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
-	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
-}
-
 // src/deployment/deploy-engine/resolver-context.ts
 function buildResolverContext(deps, base, stackName) {
 	const recordedSecretValues = /* @__PURE__ */ new Map();
@@ -48385,6 +48428,11 @@ var DynamoDBGlobalTableProvider = class {
 		"VectorIndexes",
 		"WarmThroughput"
 	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Map([
+		["MultiRegionConsistency", "MRSC does not fit the per-replica serial paths: measured 2026-11-01 (us-east-1 / us-east-2 / us-west-2), the replica and witness Creates must go out in ONE UpdateTable with the mode, a lone replica Delete is refused ('does not include all witnesses'), DeleteTable is refused until they are gone, TTL is refused, and the table carries no stream, which create()'s needsStream arm would enable. Stays on Cloud Control"],
+		["GlobalTableWitnesses", "MRSC witness; same one-call UpdateTable shape as MultiRegionConsistency, measured 2026-11-01. Stays on Cloud Control"],
+		["GlobalTableSourceArn", "Multi-account replica: CDK's TableV2MultiAccountReplica renders no KeySchema (which create() requires) and DynamoDB asks for a ResourcePolicy on the CreateTable (measured 2026-11-01), a cross-account path this provider cannot exercise. Stays on Cloud Control"]
+	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
@@ -52666,18 +52714,22 @@ function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedPrope
 }
 
 // src/deployment/deploy-engine/update-in-place.ts
-async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
+async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource: recordedResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
 	engine.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = engine.providerRegistry.getProviderFor({
 		resourceType,
 		properties: resolvedProps,
-		provisionedBy: currentResource.provisionedBy,
-		previousProperties: currentResource.properties,
+		provisionedBy: recordedResource.provisionedBy,
+		previousProperties: recordedResource.properties,
 		...isPinnedToCcApi(engine.options, stackName, logicalId) && { forceCcApi: true }
 	});
+	const currentResource = updateDecision.sdkMigration === true ? {
+		...recordedResource,
+		physicalId: sdkAddressedPhysicalId(resourceType, recordedResource.physicalId, logicalId)
+	} : recordedResource;
 	if (updateDecision.sdkMigration === true) {
 		const exemptMode = STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode;
-		const preserved = "The physical id is preserved";
+		const preserved = currentResource.physicalId === recordedResource.physicalId ? "The physical id is preserved" : "The resource is kept in place, and its recorded physical id takes the SDK provider's form";
 		let message;
 		switch (exemptMode) {
 			case "cc-broken":
@@ -52783,6 +52835,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	} catch (updateError) {
 		const ccUnsupported = isUpdateUnsupportedError(updateError, logicalId);
 		const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && engine.options.replace === true;
+		if ((ccUnsupported || replaceOptIn) && currentResource.physicalId !== recordedResource.physicalId) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) needs a replacement for this change, which cdkd ` + `does not run on the deploy that moves it from Cloud Control to its SDK provider. ` + safeMsg`Re-run with --pin-cc-api ${logicalId} to replace it through Cloud Control.`, "SDK_MIGRATION_REPLACEMENT_REFUSED", updateError instanceof Error ? updateError : void 0));
 		if (ccUnsupported || replaceOptIn) {
 			const fallbackStackInstanceId = getCurrentStackInstanceId();
 			const fallbackGeneration = fallbackStackInstanceId === void 0 ? void 0 : nextNameGeneration(currentResource, logicalId, fallbackStackInstanceId);
@@ -55378,7 +55431,8 @@ var DeployEngine = class {
 			logger: this.logger,
 			baseline: resources,
 			resolvedSecretsOf: (logicalId) => this.secretsRun.perResourceSecrets.get(logicalId),
-			namingSecrets: () => stateNamingSecrets(this.secretsRun)
+			namingSecrets: () => stateNamingSecrets(this.secretsRun),
+			pinnedToCcApi: (stackName, logicalId) => isPinnedToCcApi(this.options, stackName, logicalId)
 		});
 		return this.attributeHealer;
 	}
@@ -55408,7 +55462,8 @@ var DeployEngine = class {
 			perResourceResolvedType: () => this.secretsRun.perResourceResolvedType,
 			outputsRun: () => this.outputsRun,
 			readReaderForFreshNoEchoCeiling: (...args) => readReaderForFreshNoEchoCeiling(this.maskingDeps(), ...args),
-			maskForResource: (...args) => maskForResource(this.secretsRun, ...args)
+			maskForResource: (...args) => maskForResource(this.secretsRun, ...args),
+			pinnedToCcApi: (stackName, logicalId) => isPinnedToCcApi(this.options, stackName, logicalId)
 		};
 	}
 	maskingDeps() {
@@ -55717,4 +55772,4 @@ function sameGenerationClaimsOf(record) {
 }
 
 export { sendTtlWaitingOutRateLimit as $, assertFlagRoleArn as $a, literalSplitDelimitersOf as $c, ccBrokenReason as $i, hasReasonlessBaselineRefusal as $l, retiredAfterRollback as $n, malformedOrphansRefusalMessage as $o, isSupersededResourceRecord as $r, MULTI_REGION_RECREATE_BLOCKED_TYPES as $s, isHandledOrphan as $t, getLegacyStateBucketName as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, INTRINSIC_KEYS as Aa, TemplateParser as Ac, hasPlainPrototype$1 as Ad, refusesFinalSnapshot as Ai, recordNoEchoAttributeValues as Al, demoteSupersededOrphans as An, declaresNoEcho as Ao, movedToHint as Ar, refuseMalformedResourcesForDeploy as As, makeCanonicalizePropertiesFn as At, buildDockerImage as Au, deleteTableWithIndexBusyRetry as B, s3BucketArn as Ba, passedNoEchoParametersOf as Bc, clearBucketRegionCache as Bd, isRefusedByName as Bi, CrossPrefixReadError as Bl, orphanNeedsIdentity as Bn, hasReadableOutputs as Bo, destroyStackRecordsView as Br, unpreviewableOrphanRecords as Bs, dropSettledNestedJournals as Bt, isMalformedEnvKey as Bu, planContributorInsightsOp as C, disableInstanceApiTermination as Ca, dbInstanceEngineChangeIsInPlace as Cc, StageLoadError as Cd, ATOMIC_FINAL_SNAPSHOT_TYPES as Ci, recordAttributeIdCopy as Cl, recordAfterRollbackUpdate as Cn, isStalePlaceholderArnAttribute as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImport as Cs, enclosingDeadlineExpired as Ct, getBootstrapMarkerKey as Cu, reverseMapTableContributorInsights as D, reDisableInstanceApiTermination as Da, lambdaFunctionNameForMask as Dc, utf8ByteLength as Dd, createPreDeleteFinalSnapshot as Di, provenPublicValue as Dl, equalModuloMarkedMask as Dn, withSharedDrainBudget as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForDrift as Ds, isSecretBearingReferenceString as Dt, validateAssetBucketName as Du, reverseMapIndexContributorInsights as E, observeThenDisableInstanceApiTermination as Ea, canonicalLambdaFunctionName as Ec, parseFailureDebugDetail as Ed, ccRoutedFinalSnapshotError as Ei, carriesSecretMask as El, calculateResourceDrift as En, parseWebACLArn as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDestroy as Es, diffSecurity as Et, readBootstrapMarkerBody as Eu, resolveDynamoDbDeleteBudgetClock as F, withUnsettledProperties as Fa, maskWholeValue as Fc, displayAssemblyPath as Fd, withCreateTokenLedger as Fi, isSingleDynamicReferenceToken as Fl, recheckFailedPlan as Fn, UNREADABLE_RESOURCES_MAP_ROW as Fo, mappingPairs as Fr, repairMalformedOrphansForReadOnly as Fs, keptForRetainedRecord as Ft, dockerSpawnEnvWithSensitive as Fu, readbackVectorIndexes as G, resolveDynamicReferences as Ga, liveMatchesUnresolvedTokenFrame as Gc, readTagList as Gi, isNotImplemented as Gl, isRedactedRecordedValue as Gn, malformedExportNamesWarning as Go, cyan as Gr, findHandledUnwrittenCreateOnly as Gs, revertedNestedRowIds as Gt, runDockerForeground as Gu, relayedIndexBusyDelete as H, s3BucketDualStackDomainName as Ha, readsNoEchoSource as Hc, DBPROXY_TAGS_WHAT as Hi, applyCrossPrefixScan as Hl, getCurrentProducerRegions as Hn, isReadableOrphanRecord as Ho, withStackRecords as Hr, unreadableResourceEntries as Hs, nestedChildStackName as Ht, redactDockerArgvValues as Hu, resolveDynamoDbDeleteBudgetMs as I, withoutUnsettledProperties as Ia, maskedLeafCoordinatesOf as Ic, renderAssemblyPathEscape as Id, acquireIdempotencyToken as Ii, LockManager as Il, recordUnderIdIsNotOwn as In, accountArgs as Io, parseMappingFile as Ir, repairMalformedOutputsForReadOnly as Is, recordRetainedForReadoption as It, finchSecretArgvRefusal as Iu, vectorIndexesShapeDetail as J, keepHeldTokenProvenance as Ja, recordReferenceProvenanceEntry as Jc, tagPlanWarning as Ji, splitImportedOps as Jl, updatePartialMessage as Jn, malformedLocalResourceEntriesWarning as Jo, red as Jr, withoutSilentDropProperties as Js, getCurrentNestedStackContext as Jt, AssetManifestLoader as Ju, vectorIndexesForCreate as K, producerLookupOver as Ka, markSameGenerationBag as Kc, refuseMalformedDesiredTags as Ki, stackInstanceIdOf as Kl, redactedDeleteAddressFields as Kn, malformedExportSourceWarning as Ko, gray as Kr, findSilentDropProperties as Ks, withNestedRevertRun as Kt, runDockerStreaming as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, IntrinsicFunctionResolver as La, noEchoCoordinatesOf as Lc, resolveAssemblyPath as Ld, DeploymentEventsReader as Li, isLockInfoExpired as Ll, replacementNeverSwapped as Ln, deployRefusesOrphanRowsReason as Lo, proposeRenames as Lr, repairMalformedResourceEntriesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, formatDockerLoginError as Lu, beginDeleteWait as M, unsettledItemsField as Ma, isMarkedCoordinate as Mc, ownValue as Md, earliestDefined as Mi, recordProvenPublicExpression as Ml, isReplacementOrphan as Mn, STATE_REGION_DIVERGED as Mo, withMovedTo as Mr, refuseMalformedResourcesForExport as Ms, planOrphanAdoption as Mt, describeDockerCapturedOutput as Mu, compensateRemovedDeletionProtection as N, unsettledItemsOf as Na, maskAtCoordinates as Nc, absoluteAssemblyPathEscape as Nd, ledgerForStack as Ni, wholeStringLeavesOf as Nl, planFailedOps as Nn, STATE_RESOURCES_MALFORMED as No, isPairableType as Nr, refuseMalformedState as Ns, pendingRequestCount as Nt, describeDockerExecFailure as Nu, stripIndexContributorInsights as O, reEnableInstanceApiTermination as Oa, sameLambdaFunctionAddress as Oc, defineOwnKey as Od, effectiveDeletionPolicy as Oi, recordMaskOnlyValue as Ol, equalModuloMask as On, parameterInputsFor as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForExport as Os, keptWholeReasonText as Ot, validateContainerRepoName as Ou, deleteBudgetKey as P, unsettledPropertiesOf as Pa, maskReadbackAtCoordinates as Pc, describeFileReadFailure as Pd, reserveStackCreateToken as Pi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Pl, planRollback as Pn, UNREADABLE_ORPHANS_CONTAINER_ROW as Po, looselyEqual as Pr, repairMalformedOrphanRecordsForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, describeDockerFailure as Pu, readTtlSpec as Q, applyRoleArnIfSet as Qa, hasMaskableValues as Qc, ProviderRegistry as Qi, hasReadableExportSet as Ql, nameScopeOf as Qn, malformedOrphanRowsKeptWarning as Qo, holdsSupersededResources as Qr, shownType as Qs, dropFailedHint as Qt, getDefaultStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, poisonRenderedSpellingsCollidingIn as Ra, noEchoLeavesOf as Rc, injectAwsRegion as Rd, DeploymentEventsStore as Ri, S3StateBackend as Rl, resolveReplacementOldType as Rn, displayLogicalId as Ro, refuseRestoreFromItself as Rr, repairMalformedResourcePropertiesForReadOnly as Rs, displacedOpClause as Rt, getDockerCmd as Ru, indexDeclaresContributorInsights as S, markWaitAbandoned as Sa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as Sc, AssemblyReader as Sd, storedSecretNameNeedles as Si, physicalNameCopiesOf as Sl, removeProtectionTypeList as Sn, cfnRefValueFromPhysicalId as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForDestroy as Ss, readRecordedConditionVerdicts as St, ensureAssetStorage as Su, readContributorInsightsSpec as T, isTerminationProtectionPropagationError as Ta, emrClusterInstancesReplaced as Tc, describeJsonParseFailure as Td, buildFinalSnapshotIdentifier as Ti, splitGetAttStringForm as Tl, withUnprovenUnsettled as Tn, refStateLookupFromResource as To, constructPathOf as Tr, refuseMalformedResourceEntriesForOrphan as Ts, withResourceDeadline as Tt, parseBootstrapMarker as Tu, waitForIndexesSettled as U, s3BucketRegionalDomainName as Ua, recordedNoEchoValuesOf as Uc, DBPROXY_TAG_OPTIONS as Ui, crossPrefixDeniedWarning as Ul, inheritProducerRegions as Un, isReadableResourceEntry as Uo, replacedDeleteFailureVerdict as Ur, withheldAccountClause as Us, recordDisplacedSkips as Ut, redactedCause as Uu, maskedLogger as V, s3BucketDomainName as Va, readbackPathFor as Vc, resolveBucketRegion as Vd, markDeleteStarted as Vi, CrossPrefixScanCache as Vl, findNestedStackTypeChanges as Vn, hasReadableResources as Vo, getStackRecords as Vr, unreadableOrphanRecords as Vs, getNestedRevertRun as Vt, partitionSensitiveEnv as Vu, planVectorIndexUpdates as W, s3BucketWebsiteUrl as Wa, valueAtCoordinate as Wc, planTagDiff as Wi, isAccessDenied$1 as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedDriftResourcePropertiesWarning as Wo, bold as Wr, findActionableSilentDrops as Ws, revertNestedChildFromJournal as Wt, redactedDockerCause as Wu, isTtlRateLimited as X, recordedOutputReferenceRegions as Xa, carryLogOnlyValues as Xc, stringifyIfAssigned as Xi, describeRegionValueKind as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsRefusalMessage as Xo, addSuperseded as Xr, hasNoCloudControlHandlers as Xs, deleteJournaledOrphans as Xt, Synthesizer as Xu, isTtlAlreadyDisabled as Y, outputReferenceProvenanceOf as Ya, snapshotPassProvenance as Yc, definedAttributes as Yi, acceptedCreateOnlyDropsOf as Yl, updatePartialReason as Yn, malformedLocalResourcesWarning as Yo, yellow as Yr, NO_CC_HANDLERS_REASON as Ys, withNestedStackContext as Yt, getDockerImageBySourceHash as Yu, planTimeToLive as Z, recordedReferenceRegions as Za, createUnionSecretMasker as Zc, CC_BROKEN_REASON as Zi, exportNamesCarriedFrom as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRecordsWarning as Zo, deleteSupersededEntry as Zr, findReplacedReadersOfRecreateTargets as Zs, dropFailedCommands as Zt, synthesisStatusMessage as Zu, streamMemberRefusals as _, deleteIndeterminateGuards as _a, requireConfigString as _c, decodeListingKey as _d, secretNamePrintingBag as _i, spelledKeysOf as _l, pendingMovesOutOf as _n, carriesDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputs as _s, renderNestedTemplateTreeDefect as _t, loadPublishableAssetManifest as _u, isProtectionValueActive as a, isCustomResourceType as aa, isWarmThroughputDecrease as ac, resolveStateBucketWithDefault as ad, withoutSuperseded as ai, unionOfSecretBags as al, chunks as an, applyCallerIdentityCredentials as ao, reachableDivergentParameters as ar, malformedResourcePropertiesWarning as as, markRefusedBeforeApplying as at, orphansCarriedFrom as au, CONTRIBUTOR_INSIGHTS_KEY as b, withIndeterminateGuard as ba, describeTypeWithThrottleRetry as bc, canonicalizeRegion as bd, secretNamedRecordNeedles as bi, recordNestedStackParameterExpressions as bl, replayFailedOperations as bn, keepsSecretReferenceToken as bo, isExportAliasCollision as br, refuseMalformedResourceEntries as bs, conditionInputsFrom as bt, BOOTSTRAP_MARKER_PREFIX as bu, DynamoDBGlobalTableProvider as c, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as ca, coerceCfnBoolean as cc, stateBucketExistenceConfirmed as cd, noEchoExactEchoLeavesOf as ci, maskSecretsInError as cl, withApiLimit as cn, classifyRecordedSecretRegion as co, displayTextOrWithheld as cr, malformedStateRefusalMessage as cs, crossStackOutputProvenanceSource as ct, PhaseClock as cu, declaredStreamPolicyMember as d, CloudControlProvider as da, configIntegerRefusal as dc, CFN_TEMPLATE_BODY_LIMIT as dd, createReadOnlyAttributeHealerFactory as di, withPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, regionLessSecretName as do, secretBearingStateKeyWarning as dr, refuseMalformedNestedChildOutputs as ds, findServiceTokenRefusals as dt, AssetPublisher as du, isCustomResource as ea, isStatefulRecreateTargetForReplace as ec, loadCdkJson as ed, removeSuperseded as ei, logOnlyValueCount as el, journaledOrphanLines as en, assertSendableRoleArn as eo, retiredNameGenerationsAfter as er, malformedOrphansWarning as es, ECR_AUTO_DELETE_IMAGES_TAG as et, hasUnverifiableParameterRefusal as eu, declaredStreamTagsMember as f, slowCcOperationTimeoutMs as fa, configStringRefusal as fc, CFN_TEMPLATE_URL_LIMIT as fd, completedReplayEntries as fi, withoutPhysicalNameCopies as fl, refactorMarkerRefusalMessage as fn, coerceParameterTypedValue as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecords as fs, serviceTokenBlockingReason as ft, isSensitiveAttributeName as fu, streamDeclaresTags as g, UNSPECIFIED_SKIP_REASON as ga, requireConfigObject as gc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gd, orphanRecordsPrintingBag as gi, pathCrossesDottedKey as gl, hasPendingMovesOut as gn, isImpossibleEmptyStoredAttribute as go, isWholeDynamicReferenceValue as gr, refuseMalformedOrphansForOrphan as gs, listNestedTemplateRows as gt, createAssetRedirectResolver as gu, streamDeclaresPolicy as h, RollbackInlinePolicyWriters as ha, requireConfigArray as hc, uploadCfnTemplate as hd, namingSecretsWithRecordedNoEcho as hi, isUncertifiedBaselineMaskPosition as hl, updateRefactorMarker as hn, getAccountInfo as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForDestroy as hs, isAbsoluteAssetPath as ht, buildAssetRedirectMap as hu, PROTECTION_PROPERTY_BY_TYPE as i, readsNoEchoDeleteValues as ia, coerceWarmThroughput as ic, resolveSkipPrefix as id, supersededResourcesOf as ii, shareLogOnlyValues as il, formatResourceLine as in, AWS_CREDENTIAL_ENV_KEYS as io, namesAnyDeclaredParameter as ir, malformedResourceEntriesWarning as is, getPriorAttempts as it, orphansAfterRollback as iu, DYNAMODB_DELETE_POLL_COST_MS as j, isUsableAttemptedName as ja, canonicalCoordinates as jc, nullPrototypeRecord as jd, unsupportedFinalSnapshotError as ji, recordNoEchoParameterFreshValue as jl, isJournaledOrphan as jn, JSON_LISTING_HOLE_VALUE as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForDestroy as js, makeSiblingClaimReader as jt, resolveDockerContextDirectory as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, DiffCalculator as ka, DagBuilder as kc, hasOwnKey as kd, isFinalSnapshotError as ki, recordMaskOnlyValuesIn as kl, undeclaredEmptyObservedKeys as kn, passedParameterClassesOf as ko, hintSidesOf as kr, refuseMalformedResourcePropertiesForOrphan as ks, mergeNoChangeOutputs as kt, buildDenyExternalAccessPolicy as ku, STREAM_POLICY_KEY as l, applyCustomResourceResponseExpiration as la, coerceCfnInteger as lc, warnDeprecatedNoPrefixCliFlag as ld, noEchoParameterNamesOf as li, maskSecretsInText as ll, readRefactorMarker as ln, classifyReplaySecretRegion as lo, exportAliasCollisionScrubWarning as lr, previewableOrphanRecords as ls, inheritedProvenanceForChildDiff as lt, renderPhaseTimings as lu, reverseMapStreamPolicy as m, unchangedBehindSecretReference as ma, replayWarn as mc, findLargeInlineResources as md, maskEventTextWithBoundBags as mi, dynamicReferenceTokens as ml, sameMove as mn, parameterTypeMayLoseSecretIdentity as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphans as ms, findNestedTemplateTreeDefect as mt, WorkGraph as mu, recordedProtectionEvidence as n, waitForLambdaFunctionActive as na, renderStatefulReason as nc, resolveAutoAssetStorage as nd, supersededHeldByOtherTypeWarning as ni, recordLogOnlyParameterValue as nl, makeForeignHolderScan as nn, isIamRoleArn as no, withNameGenerationReached as nr, malformedOutputsWarning as ns, hasCdkAutoDeleteTag as nt, importableOutputs as nu, perType as o, getCurrentResourceSecrets as oa, toCfnInteger as oc, resolveStateBucketWithDefaultAndSource as od, noEchoAttributeNamesOf as oi, createSecretMasker as ol, isAccessDeniedError as on, callerEnvCredentials as oo, resourcesNamingDeclaredParameter as or, malformedResourcesWarning as os, IMPLICIT_DELETE_DEPENDENCIES as ot, shouldRetainResource as ou, planStreamMemberOps as p, onlySecretReferencesDiffer as pa, readConfigString as pc, MIGRATE_TMP_PREFIX as pd, journaledOrphanPrintingBag as pi, DYNAMIC_REFERENCE_TOKEN_SCAN as pl, refuseRefactorMarker as pn, isUnboundTemplateParameter as po, carriedExportAliasExposure as pr, refuseMalformedOrphanRecordsForDestroy as ps, childTemplateLoader as pt, stringifyValue as pu, vectorIndexesSettled as q, refuseUnreadableCdkCrossAccountRefs as qa, redactForState as qc, tagMapAsList as qi, withStackInstanceIdWithheld as ql, redactedDeleteAddressSkip as qn, malformedLocalOutputsWarning as qo, green as qr, unwrittenCreateOnlyReplacement as qs, collectNestedChildUnaddressed as qt, warnFinchArgvExposure as qu, recordedProtectionNote as r, TemplateNoEchoReresolver as ra, WARM_THROUGHPUT_MEMBERS as rc, resolveCaptureObservedState as rd, supersededHolderOf as ri, recordLogOnlyValue as rl, sameJournaledOrphans as rn, sendableAssumeRoleCommand as ro, computeParameterTaint as rr, malformedRenderedContainersWarning as rs, isTruthyCfnBoolean as rt, isReadableBag as ru, readProtection as s, withPrintingSecrets as sa, toFiniteNumber as sc, resolveUseCdkBootstrapAssets as sd, noEchoComparisonForTemplate as si, errorCauseChain as sl, lookupEachName as sn, envCredentialsAreAssumedRole as so, WITHHELD_NAME_DISPLAY as sr, malformedScrubResourceEntriesRefusalMessage as ss, computeImplicitDeleteEdges as st, stackInstanceIdCarriedFrom as su, DeployEngine as t, wouldReturnToSdkProvider as ta, isStatefulRecreateTargetSync as tc, resolveApp as td, supersededAfterRollback as ti, printingCorpusOf as tl, loadJournaledOrphans as tn, explicitRoleArnOrThrow as to, retiredNameGenerationsLeaving as tr, malformedOutputsRefusalMessage as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputKeys as tu, STREAM_TAGS_KEY as u, customResourceResponseExpirationWarning as ua, configBooleanRefusal as uc, ssmResolvedValueType as ud, withAttemptedItemsMasked as ui, scrubResourceRecord as ul, readRefactorMarkerOnce as un, producerRegionsFromState as uo, secretBearing as ur, refuseDivergentRecordRegionForDestroy as us, deferredServiceTokenWarning as ut, timePhase as uu, streamPolicyMatchesDeclared as v, deleteLeftInPlace as va, prefetchCreateOnlyPropertyPaths as vc, expectedOwnerParam as vd, secretNamePrintingBags as vi, identityKeyFor as vl, pendingMovesRefusalMessage as vn, carriesFetchableDynamicReference as vo, collectDeclaredOutputNames as vr, refuseMalformedOutputsForDestroy as vs, templateIdentity as vt, rewriteTemplateAssetReferences as vu, planIndexContributorInsightsOps as w, ec2InstanceProtectionSite as wa, ecsServiceLaunchTypeSetOrChanged as wc, processStackMessages as wd, PRE_DELETE_SNAPSHOT_TYPES as wi, recordPhysicalNameCopy as wl, settleUnsettledPrevious as wn, lacksRecordedTableArn as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForImportSave as ws, enclosingDeadlineRemainingMs as wt, isCrossRegionRedirect as wu, contributorInsightsRefusals as x, isWaitAbandonedError as xa, withRetry as xc, derivePartitionAndUrlSuffix as xd, stateSecretNameNeedles as xi, recoverMaskedOutput as xl, replayRollback as xn, AWS_NO_VALUE as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDeploy as xs, parentSuppliedValues as xt, assertAssetBucketRegion as xu, streamTagsMatchDeclared as y, deleteSkipReason as ya, templateResourceTypes as yc, PARTITION_TABLE as yd, secretNamedAttributeNamesOf as yi, inheritNestedStackParameterAssociations as yl, refusePendingMovesOut as yn, isNamelessDynamicReferenceError as yo, collectPublishedOutputNames as yr, refuseMalformedResourceAttributesForOrphan as ys, conditionFingerprint as yt, AssetModeResolver as yu, TABLE_INDEX_NOUN as z, isSettledInstanceState as za, noEchoOutputsComparison as zc, injectedAwsRegionValue as zd, extractDeploymentEventError as zi, rebuildClientForBucketRegion as zl, seedsDeleteFirstGuard as zn, hasReadableOrphans as zo, awaitInFlightSibling as zr, repairMalformedResourcesForReadOnly as zs, displacedPhysicalIdShown as zt, isDockerClientEnvKey as zu };
-//# sourceMappingURL=deploy-engine-BiJyU4j1.js.map
+//# sourceMappingURL=deploy-engine-pGWgnV-6.js.map