@go-to-k/cdkd 0.320.0 → 0.322.0

package/dist/{deploy-engine-BiJyU4j1.js → deploy-engine-BC5pwkqY.js}

@@ -2,7 +2,7 @@ import { c as __exportAll, r as getAwsClients } from "./aws-clients-DWpHZk2l.js"
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, C as fallbackNamePropertyFor, D as getCurrentSkipPrefix, E as generatedNameFor, F as withNameGeneration, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, M as looksLikeCdkdGeneratedName, O as getCurrentStackInstanceId, P as stackInstanceNameSuffix, Q as plainIdentOr, R as withStackScopeBeforeStateRead, S as explicitNamePropertyFor, T as generateResourceNameWithFallback, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, a as safeStringify$1, b as currentNameGeneration, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as isNameGeneration, k as getCurrentStackName, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, p as installLogLineMaskerSource, q as displayIdent, s as getLogger, t as VERBOSE_POINTER, tt as terminalSafe, v as alternateNamePropertiesFor, y as applyDefaultNameForFallback, z as withoutGeneratedFallbackName } from "./aws-failure-text-DiHodi76.js";
 import { $ as isTerminalDeleteFailure, $n as physicalIdShownBesideCommand, $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, Bt as createdBeforeFailure, Cn as DeploymentNotApprovedError, Dr as retryClassificationText, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, Hn as isSoftAbort, Ht as hasCreatedBeforeFailure, It as withDerivedNameMasks, Jn as UNSHOWABLE_VALUE, Jt as replayMadeAnotherResource, K as ProtectionFlipRegistry, Kn as SHELL_ACTIVE, Kt as markCreatedBeforeFailure, Lt as RETRY_AUXILIARY_OWNER, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, N as isMarkedNotGone, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, On as LockError, Ot as resourceTypeShown, P as markNotGone, Pn as ResourceTimeoutError, Pt as maskDeep, Qn as pasteableCommand, Rn as StateError, Rt as carryCreatedBeforeFailure, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, Un as normalizeAwsError, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, Vt as createdResourceIdentityBeforeFailure, W as resolveExplicitPhysicalId, Wt as isAuxiliaryMarkOf, Xt as buildForceUnlockCommand, Y as deleteWithProtectionCompensation, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, _ as prepareRemovalForUpdate, _n as AssetError, _r as stripControlChars, an as DEFAULT_STATE_PREFIX, bn as CrossAccountSecretRefusalError, br as formatRetryClassificationSignals, bt as isInterruptedWaitError, cr as hasReplayMayCollide, dn as withPasteableAwsProfile, dr as isRecreateRetryableError, dt as pasteableAwsCommand, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, fr as isReplayedNameCollisionFrom, ft as protectedReplacementAdvice, gn as AccountIdUnavailableError, gr as escapeRegExp$3, gt as monotonicNowMs, h as withUnchangedSecretPrincipalLists, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, kn as MacroExpansionError, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, ln as producerRecordKey, lr as isNameCollisionErrorFrom, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, n as clearCreatedReport, nn as recoveryCommandFlags, nr as shellBoundedDisplay, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, pn as ambientCredentialConfig, q as compensateProtectionFlip, qn as SHELL_ACTIVE_WHY, r as collectCreatedResources, rn as sanitizeRecoveryValue, rr as shellQuote, sr as isUpdateUnsupportedError, st as DELETION_PROTECTION_DOC_POINTER, t as CreatedResourceSink, tn as formatLockOwner, tr as quotedOrDescribed, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ur as isNameCooldownError, v as removalWarning, vn as CdkdError, wn as DynamicReferenceRegionAmbiguousError, wr as isIamPropagationError, wt as compositeIdSeparatorRefusal, x as withoutInjectedRemovals, xn as DependencyError, xr as isAmbiguousCcHandlerErrorCode, xt as startInterruptWatch, z as isQuotableImportValue, zn as SynthesisError } from "./created-resource-sink-CmrPwGge.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BLXFsfMa.js";
-import { t as getCdkdVersion } from "./version-CrtjwYuX.js";
+import { n as getCdkdVersion } from "./version-BWH_L6He.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16546,21 +16546,20 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Port",
 			"PreferredBackupWindow",
 			"PreferredMaintenanceWindow",
+			"RestoreToTime",
+			"RestoreType",
 			"RotateMasterUserPassword",
 			"ServerlessV2ScalingConfiguration",
+			"SnapshotIdentifier",
+			"SourceDBClusterIdentifier",
 			"StorageEncrypted",
 			"StorageType",
 			"Tags",
+			"UseLatestRestorableTime",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["RestoreToTime", "not yet implemented by cdkd"],
-			["RestoreType", "not yet implemented by cdkd"],
-			["SnapshotIdentifier", "not yet implemented by cdkd"],
-			["SourceDBClusterIdentifier", "not yet implemented by cdkd"],
-			["UseLatestRestorableTime", "not yet implemented by cdkd"]
-		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotIdentifier", "SourceDBClusterIdentifier"]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"ClusterResourceId",
 			"Endpoint",
@@ -16627,9 +16626,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WriteProvisionedThroughputSettings"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
-			["GlobalTableSourceArn", "not yet implemented by cdkd"],
-			["GlobalTableWitnesses", "not yet implemented by cdkd"],
-			["MultiRegionConsistency", "not yet implemented by cdkd"]
+			["GlobalTableSourceArn", "Multi-account replica: CDK's TableV2MultiAccountReplica renders no KeySchema (which create() requires) and DynamoDB asks for a ResourcePolicy on the CreateTable (measured 2026-11-01), a cross-account path this provider cannot exercise. Stays on Cloud Control"],
+			["GlobalTableWitnesses", "MRSC witness; same one-call UpdateTable shape as MultiRegionConsistency, measured 2026-11-01. Stays on Cloud Control"],
+			["MultiRegionConsistency", "MRSC does not fit the per-replica serial paths: measured 2026-11-01 (us-east-1 / us-east-2 / us-west-2), the replica and witness Creates must go out in ONE UpdateTable with the mode, a lone replica Delete is refused ('does not include all witnesses'), DeleteTable is refused until they are gone, TTL is refused, and the table carries no stream, which create()'s needsStream arm would enable. Stays on Cloud Control"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
@@ -17654,7 +17653,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SplunkDestinationConfiguration",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["DatabaseSourceConfiguration", "not yet implemented by cdkd"], ["SnowflakeDestinationConfiguration", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map([["DatabaseSourceConfiguration", "Database as a source was a public preview AWS removed on 2025-09-24 (Firehose document history); CreateDeliveryStream refused DeliveryStreamType DatabaseAsSource in every region probed, so an SDK path could not be verified. Stays on Cloud Control"], ["SnowflakeDestinationConfiguration", "Proving the wire shape live needs a real Snowflake account, and the block carries key material (PrivateKey, KeyPassphrase). Stays on Cloud Control"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["DatabaseSourceConfiguration"]),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
@@ -18123,6 +18122,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"AllocatedStorage",
 			"AllowMajorVersionUpgrade",
 			"AutoMinorVersionUpgrade",
+			"AvailabilityZone",
 			"BackupRetentionPeriod",
 			"CACertificateIdentifier",
 			"CertificateRotationRestart",
@@ -18131,6 +18131,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DBClusterIdentifier",
 			"DBInstanceClass",
 			"DBInstanceIdentifier",
+			"DBName",
 			"DBParameterGroupName",
 			"DBSubnetGroupName",
 			"DedicatedLogVolume",
@@ -18173,12 +18174,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["AutomaticBackupReplicationKmsKeyId", "not yet implemented by cdkd"],
 			["AutomaticBackupReplicationRegion", "not yet implemented by cdkd"],
 			["AutomaticBackupReplicationRetentionPeriod", "not yet implemented by cdkd"],
-			["AvailabilityZone", "not yet implemented by cdkd"],
 			["BackupTarget", "not yet implemented by cdkd"],
 			["CharacterSetName", "not yet implemented by cdkd"],
 			["CustomIAMInstanceProfile", "not yet implemented by cdkd"],
 			["DBClusterSnapshotIdentifier", "not yet implemented by cdkd"],
-			["DBName", "not yet implemented by cdkd"],
 			["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
@@ -18210,7 +18209,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"BackupTarget",
 			"CharacterSetName",
 			"CustomIAMInstanceProfile",
-			"DBName",
 			"DBSystemId",
 			"NcharCharacterSetName",
 			"SourceRegion",
@@ -28610,7 +28608,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B4XVfH0S.js");
+			const { ASGProvider } = await import("./asg-provider-BymHNHgo.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28719,7 +28717,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-C_r5q9NM.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DjjNodrS.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CFm779-M.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BQ92M2BH.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -32996,6 +32994,21 @@ function validatePropertyShapes(resources) {
 	throw new Error("Properties validation failed: the following resources declare a property whose kind contradicts the resource type's schema:\n" + lines.join("\n") + "\n\nCloudFormation rejects these templates too. Give each property a list where its schema expects a list and an object where it expects an object.");
 }
 
+// src/provisioning/sticky-exempt-physical-id.ts
+const ECS_SERVICE_CC_ID = /^(arn:aws[-a-z]*:ecs:[a-z0-9-]+:\d{12}:service\/([A-Za-z0-9_-]+)(?:\/([A-Za-z0-9_-]+))?)\|([^|\s]+)$/;
+const CLUSTER_ARN = /^arn:aws[-a-z]*:ecs:[a-z0-9-]+:\d{12}:cluster\/([A-Za-z0-9_-]+)$/;
+const CLUSTER_NAME = /^[A-Za-z0-9_-]+$/;
+function ecsServiceSdkPhysicalId(ccPhysicalId) {
+	const match = ECS_SERVICE_CC_ID.exec(ccPhysicalId);
+	if (match === null) throw new Error("its recorded physical id is not the `<serviceArn>|<cluster>` form Cloud Control records for AWS::ECS::Service");
+	const [, serviceArn, first, second, clusterSegment] = match;
+	const clusterArn = CLUSTER_ARN.exec(clusterSegment);
+	if (clusterArn === null && !CLUSTER_NAME.test(clusterSegment)) throw new Error("the cluster segment of its recorded physical id is neither a cluster name nor a cluster ARN");
+	const clusterName = clusterArn === null ? clusterSegment : clusterArn[1];
+	if (second !== void 0 && first !== clusterName) throw new Error("its recorded physical id names one cluster in the service ARN and another after the `|`");
+	return serviceArn;
+}
+
 // src/provisioning/provider-registry.ts
 const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 	["AWS::Scheduler::Schedule", {
@@ -33063,8 +33076,27 @@ const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 		physicalIdForm: "both layers store the bare `Z...` zone id, without the `/hostedzone/` prefix Route 53 answers with: the schema primaryIdentifier is Id, Route53Provider.create strips the prefix, and the Cloud Control Identifier has none (measured us-east-1, 2026-11-02)",
 		issue: "https://github.com/go-to-k/cdkd/issues/5641",
 		integFixture: "cc-to-sdk-reroute-hosted-zone"
+	}],
+	["AWS::ECS::Service", {
+		mode: "sdk-coverage",
+		physicalIdForm: "Cloud Control stores `<serviceArn>|<cluster>` (the schema primaryIdentifier is ServiceArn + Cluster; measured us-east-1, 2026-11-03) while ECSProvider.create records the bare CreateService serviceArn; normalizeCcPhysicalId keeps the ARN part, which the fixture observed equal to the live service ARN",
+		issue: "https://github.com/go-to-k/cdkd/issues/5654",
+		integFixture: "cc-to-sdk-reroute-ecs-service",
+		normalizeCcPhysicalId: ecsServiceSdkPhysicalId
 	}]
 ]);
+function sdkAddressedPhysicalId(resourceType, physicalId, logicalId) {
+	const entry = STICKY_CC_MIGRATION_EXEMPT.get(resourceType);
+	const normalize = entry?.normalizeCcPhysicalId;
+	if (normalize === void 0) return physicalId;
+	try {
+		return normalize(physicalId);
+	} catch (error) {
+		const reason = describeAwsFailure(error).detail;
+		const remedy = entry?.mode === "sdk-coverage" ? ` Pass --pin-cc-api ${logicalId} to keep it on Cloud Control.` : "";
+		throw new Error(`${logicalId} (${resourceType}) cannot move from Cloud Control to its SDK provider: ${reason}.${remedy}`);
+	}
+}
 const CC_BROKEN_REASON = "Cloud Control's handler cannot manage this type correctly";
 function ccBrokenReason(resourceType) {
 	return STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode === "cc-broken" ? CC_BROKEN_REASON : void 0;
@@ -33157,7 +33189,7 @@ var ProviderRegistry = class {
 			if (actionableDrops.length === 0) {
 				debug(`Using specific SDK provider for ${resourceType}`);
 				if (returningToSdk) {
-					debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
+					debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; the resource is updated in place`);
 					return {
 						provider: specificProvider,
 						provisionedBy: "sdk",
@@ -34471,6 +34503,48 @@ function provenanceBaselineOf(state, tokenFree) {
 	};
 }
 
+// src/deployment/label-routing.ts
+function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
+	try {
+		if (change.changeType === "DELETE") return existingState?.provisionedBy;
+		return registry.getProviderFor({
+			resourceType: change.resourceType,
+			properties: change.desiredProperties ?? {},
+			provisionedBy: existingState?.provisionedBy,
+			previousProperties: existingState?.properties,
+			forceCcApi
+		}).provisionedBy;
+	} catch {
+		return;
+	}
+}
+
+// src/deployment/deploy-engine/routing.ts
+function isPinnedToCcApi(options, stackName, logicalId) {
+	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
+}
+function recreateDirectionFor(options, stackName, logicalId) {
+	const targets = options.recreateTargets?.stackName === stackName ? options.recreateTargets : void 0;
+	if (targets === void 0) return void 0;
+	if (targets.viaCcApi.has(logicalId)) return "cc-api";
+	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
+}
+function peekRoutingForLabel(providerRegistry, options, change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
+	if (needsReplacement) {
+		const hintRecord = {
+			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
+			...existingState?.properties !== void 0 && { properties: existingState.properties }
+		};
+		return deriveLabelRouting(change, hintRecord, providerRegistry, recreateDirection === "cc-api");
+	}
+	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
+}
+function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId, underivable = "refuse") {
+	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
+	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
+	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
+}
+
 // src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
@@ -35462,16 +35536,17 @@ async function readRecordAttributes(input) {
 	const { provider, logicalId, resource, stackName, region } = input;
 	if (!provider.import) return { kind: "not-attempted" };
 	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
+	const physicalId = resource.provisionedBy === "cc-api" && !(provider instanceof CloudControlProvider) ? sdkAddressedPhysicalId(resource.resourceType, resource.physicalId, logicalId) : resource.physicalId;
 	const found = await provider.import({
 		logicalId,
 		resourceType: resource.resourceType,
 		stackName,
 		region,
 		properties: resource.properties,
-		knownPhysicalId: resource.physicalId
+		knownPhysicalId: physicalId
 	});
 	if (found === null) return { kind: "not-found" };
-	if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
+	if (found.physicalId !== physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${physicalId})`);
 	const reported = Object.entries(normalizeHealedAttributes(found.attributes));
 	const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
 	const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
@@ -35838,7 +35913,8 @@ async function noEchoAttributeOverridesFor(run, deps, desiredProps, stateResourc
 						resourceType: record.resourceType,
 						properties: record.properties,
 						provisionedBy: record.provisionedBy,
-						previousProperties: record.properties
+						previousProperties: record.properties,
+						...deps.pinnedToCcApi?.(stackName, logicalId) === true && { forceCcApi: true }
 					});
 					const outcome = await readRecordAttributes({
 						provider,
@@ -36452,7 +36528,7 @@ function replayStackRecordsView(records, orphanLogicalIds = /* @__PURE__ */ new
 }
 
 // src/provisioning/restore-source-guard.ts
-const RESTORING_TYPES = /* @__PURE__ */ new Set(["AWS::Neptune::DBCluster"]);
+const RESTORING_TYPES = /* @__PURE__ */ new Set(["AWS::DocDB::DBCluster", "AWS::Neptune::DBCluster"]);
 function clusterName(identifier) {
 	return (identifier.split(":").pop() ?? identifier).toLowerCase();
 }
@@ -36462,8 +36538,15 @@ function elsewhere(identifier, scope) {
 	const differs = (carried, known) => Boolean(carried) && known !== void 0 && carried !== known;
 	return differs(region, scope.region) || differs(account, scope.account);
 }
+function automatedSnapshotOf(snapshot, name) {
+	const id = snapshot.startsWith("arn:") ? snapshot.split(":cluster-snapshot:")[1] ?? "" : snapshot;
+	const match = /^rds:(.+)-\d{4}-\d{2}-\d{2}-\d{2}-\d{2}$/i.exec(id);
+	return match !== null && match[1].toLowerCase() === name;
+}
 function refuseRestoreFromItself(resourceType, properties, physicalId, logicalId, scope) {
 	if (!RESTORING_TYPES.has(resourceType)) return;
+	const snapshot = properties["SnapshotIdentifier"];
+	if (typeof snapshot === "string" && automatedSnapshotOf(snapshot, clusterName(physicalId)) && !elsewhere(snapshot, scope)) throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType} ${logicalId}: SnapshotIdentifier names an automated snapshot of the cluster this creates or replaces, which its delete removes; restore from a manual snapshot instead. Nothing was changed.`, resourceType, logicalId, physicalId));
 	const source = properties["SourceDBClusterIdentifier"];
 	if (typeof source !== "string" || clusterName(source) !== clusterName(physicalId)) return;
 	if (elsewhere(source, scope)) return;
@@ -40167,6 +40250,7 @@ async function replayReverseReplacement(s) {
 		secrets
 	};
 	const deleteNewResourceFirst = async (purpose) => {
+		refuseRestoreFromItself(oldType, prev.properties ?? {}, current.physicalId, op.logicalId, { region: ctx.region });
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 		const deleteNewFirstRoute = resolveNewDeleteRoute();
 		const deleteNewFirst = await withReplayDeletePrinting(s, () => deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
@@ -41330,7 +41414,8 @@ var AttributeHealer = class {
 			resourceType: resource.resourceType,
 			properties: resource.properties,
 			provisionedBy: resource.provisionedBy,
-			previousProperties: resource.properties
+			previousProperties: resource.properties,
+			...this.deps.pinnedToCcApi?.(stackName, logicalId) === true && { forceCcApi: true }
 		});
 		const outcome = await withPrintingSecrets(healPrintingBag(this.deps.baseline, logicalId, resource, this.deps.namingSecrets()), () => readRecordAttributes({
 			provider,
@@ -46541,48 +46626,6 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
-// src/deployment/label-routing.ts
-function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
-	try {
-		if (change.changeType === "DELETE") return existingState?.provisionedBy;
-		return registry.getProviderFor({
-			resourceType: change.resourceType,
-			properties: change.desiredProperties ?? {},
-			provisionedBy: existingState?.provisionedBy,
-			previousProperties: existingState?.properties,
-			forceCcApi
-		}).provisionedBy;
-	} catch {
-		return;
-	}
-}
-
-// src/deployment/deploy-engine/routing.ts
-function isPinnedToCcApi(options, stackName, logicalId) {
-	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
-}
-function recreateDirectionFor(options, stackName, logicalId) {
-	const targets = options.recreateTargets?.stackName === stackName ? options.recreateTargets : void 0;
-	if (targets === void 0) return void 0;
-	if (targets.viaCcApi.has(logicalId)) return "cc-api";
-	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
-}
-function peekRoutingForLabel(providerRegistry, options, change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
-	if (needsReplacement) {
-		const hintRecord = {
-			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
-			...existingState?.properties !== void 0 && { properties: existingState.properties }
-		};
-		return deriveLabelRouting(change, hintRecord, providerRegistry, recreateDirection === "cc-api");
-	}
-	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
-}
-function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId, underivable = "refuse") {
-	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
-	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
-	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
-}
-
 // src/deployment/deploy-engine/resolver-context.ts
 function buildResolverContext(deps, base, stackName) {
 	const recordedSecretValues = /* @__PURE__ */ new Map();
@@ -47390,6 +47433,67 @@ function isResourceNotFoundError(error) {
 	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
 }
 
+// src/provisioning/resource-timeout-registry.ts
+let resolved;
+function setResolvedResourceTimeouts(opt) {
+	resolved = opt;
+}
+function resolvedResourceTimeoutMs(resourceType) {
+	if (!resolved) return void 0;
+	return resolved.perTypeMs?.[resourceType] ?? resolved.globalMs;
+}
+
+// src/provisioning/delete-gone-wait.ts
+async function waitForGoneAfterDelete(opts) {
+	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+	const now = opts.now ?? Date.now;
+	const userTimeoutMs = resolvedResourceTimeoutMs(opts.resourceType);
+	const maxWaitMs = userTimeoutMs === void 0 ? opts.maxWaitMs : Math.min(opts.maxWaitMs, userTimeoutMs / 2);
+	const startedAt = now();
+	const stopped = `${opts.what}: the delete was ACCEPTED by AWS, but cdkd stopped waiting for it to disappear`;
+	const consequence = opts.consequence ?? "AWS finishes the delete on its side; until it does, a create of the same name is refused with \"already exists\".";
+	const watch = startInterruptWatch(`${opts.what} deletion wait`);
+	try {
+		let lastStatus;
+		let sawNonFailedStatus = false;
+		for (;;) {
+			if (watch.isInterrupted()) {
+				opts.logger.warn(safeMsg`${stopped} (interrupted). ${consequence}`);
+				return;
+			}
+			try {
+				const status = await opts.describe();
+				if (status === void 0) {
+					opts.logger.debug(safeMsg`${opts.what} is gone`);
+					return;
+				}
+				const failure = opts.failedStatus?.(status);
+				if (failure !== void 0) {
+					if (sawNonFailedStatus || now() - startedAt >= opts.pollIntervalMs) throw markWaitAbandoned(failure);
+				} else sawNonFailedStatus = true;
+				lastStatus = status;
+				opts.logger.debug(safeMsg`${opts.what} status: ${status}, waiting for it to disappear`);
+			} catch (error) {
+				if (isWaitAbandonedError(error)) throw error;
+				if (!isThrottlingError(error) && !isTransientServerError(error)) {
+					opts.logger.debug(safeMsg`${opts.what}: status read failed: ${describeAwsFailure(error).detail}`);
+					opts.logger.warn(safeMsg`${stopped}: its status could not be read (${describeAwsFailure(error).summary}). ${consequence}`);
+					return;
+				}
+				opts.logger.debug(safeMsg`${opts.what}: status read throttled or failed transiently, re-polling`);
+			}
+			const remainingMs = maxWaitMs - (now() - startedAt);
+			if (remainingMs <= 0) {
+				opts.logger.warn(safeMsg`${stopped} after ${Math.round(maxWaitMs / 1e3)}s` + safeMsg`${lastStatus !== void 0 ? ` (last status: ${lastStatus})` : ""}. ${consequence}`);
+				return;
+			}
+			await sleep(Math.min(opts.pollIntervalMs, remainingMs));
+		}
+	} finally {
+		watch.dispose();
+	}
+}
+
 // src/provisioning/dynamodb-contributor-insights.ts
 const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
 function readContributorInsightsSpec(value, path) {
@@ -48364,6 +48468,7 @@ var DynamoDBGlobalTableProvider = class {
 	attributeCache = /* @__PURE__ */ new Map();
 	deleteBudgets = new ElapsedBudgetRegistry();
 	protectionFlips = new ProtectionFlipRegistry();
+	droppedReplicaRegions = /* @__PURE__ */ new Map();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
@@ -48385,6 +48490,11 @@ var DynamoDBGlobalTableProvider = class {
 		"VectorIndexes",
 		"WarmThroughput"
 	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Map([
+		["MultiRegionConsistency", "MRSC does not fit the per-replica serial paths: measured 2026-11-01 (us-east-1 / us-east-2 / us-west-2), the replica and witness Creates must go out in ONE UpdateTable with the mode, a lone replica Delete is refused ('does not include all witnesses'), DeleteTable is refused until they are gone, TTL is refused, and the table carries no stream, which create()'s needsStream arm would enable. Stays on Cloud Control"],
+		["GlobalTableWitnesses", "MRSC witness; same one-call UpdateTable shape as MultiRegionConsistency, measured 2026-11-01. Stays on Cloud Control"],
+		["GlobalTableSourceArn", "Multi-account replica: CDK's TableV2MultiAccountReplica renders no KeySchema (which create() requires) and DynamoDB asks for a ResourcePolicy on the CreateTable (measured 2026-11-01), a cross-account path this provider cannot exercise. Stays on Cloud Control"]
+	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
@@ -50543,6 +50653,9 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		let preDeleteTable;
 		let indexNoun;
+		const droppedKey = deleteBudgetKey(physicalId, context?.expectedRegion);
+		const droppedReplicaRegions = this.droppedReplicaRegions.get(droppedKey) ?? /* @__PURE__ */ new Set();
+		this.droppedReplicaRegions.set(droppedKey, droppedReplicaRegions);
 		try {
 			const describe = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const replicas = describe.Table?.Replicas ?? [];
@@ -50558,6 +50671,7 @@ var DynamoDBGlobalTableProvider = class {
 					await this.dropReplicaForDelete(physicalId, region, context?.removeProtection === true, logicalId, budget, deleteMask);
 					progress.stripped = true;
 					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
+					droppedReplicaRegions.add(region);
 					await this.deregisterRemovedReplicaScalableTargets(physicalId, region, {
 						budget,
 						maskSecrets: deleteMask,
@@ -50617,9 +50731,26 @@ var DynamoDBGlobalTableProvider = class {
 				sleepSeam: deleteTableRetryDelays
 			});
 			await this.waitForTableGone(physicalId, logicalId, 600, budget, context?.maskSecrets);
+			await Promise.all([...droppedReplicaRegions].map((region) => waitForGoneAfterDelete({
+				what: deleteMask(`DynamoDB GlobalTable ${physicalId} replica in ${region}`),
+				resourceType,
+				consequence: `AWS finishes the delete on its side; until it does, the table still exists in ${region}, and a dependent deleted in the meantime (such as its KMS key) goes while it is still in use.`,
+				describe: async () => {
+					try {
+						return (await this.getRegionalClient(region).send(new DescribeTableCommand({ TableName: physicalId }))).Table?.TableStatus ?? "UNKNOWN";
+					} catch (describeError) {
+						if (describeError instanceof ResourceNotFoundException$1) return void 0;
+						throw describeError;
+					}
+				},
+				logger: loopLogger,
+				pollIntervalMs: replicaDeleteGoneWait.pollIntervalMs,
+				maxWaitMs: Math.min(replicaDeleteGoneWait.maxWaitMs, budget.remainingMs())
+			})));
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+			this.droppedReplicaRegions.delete(droppedKey);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
 				const clientRegion = await this.dynamoDBClient.config.region();
@@ -50627,6 +50758,7 @@ var DynamoDBGlobalTableProvider = class {
 				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  DynamoDB GlobalTable ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
 				else this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
+				this.droppedReplicaRegions.delete(droppedKey);
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
 			}
@@ -51559,6 +51691,10 @@ const REPLICA_GONE_WAIT_ATTEMPTS = 600;
 const GLOBAL_TABLE_ACTIVE_WAIT_ATTEMPTS = 600;
 const VECTOR_INDEX_SETTLE_ATTEMPTS = 1800;
 const TABLE_GONE_WAIT_ATTEMPTS = 600;
+const replicaDeleteGoneWait = {
+	maxWaitMs: 600 * DYNAMODB_DELETE_POLL_COST_MS,
+	pollIntervalMs: INDEX_SETTLE_POLL_INTERVAL_MS
+};
 const deleteTableRetryDelays = {};
 const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
 function collectAutoScalingTargets(properties, localRegion) {
@@ -52666,18 +52802,22 @@ function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedPrope
 }
 
 // src/deployment/deploy-engine/update-in-place.ts
-async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
+async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource: recordedResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
 	engine.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = engine.providerRegistry.getProviderFor({
 		resourceType,
 		properties: resolvedProps,
-		provisionedBy: currentResource.provisionedBy,
-		previousProperties: currentResource.properties,
+		provisionedBy: recordedResource.provisionedBy,
+		previousProperties: recordedResource.properties,
 		...isPinnedToCcApi(engine.options, stackName, logicalId) && { forceCcApi: true }
 	});
+	const currentResource = updateDecision.sdkMigration === true ? {
+		...recordedResource,
+		physicalId: sdkAddressedPhysicalId(resourceType, recordedResource.physicalId, logicalId)
+	} : recordedResource;
 	if (updateDecision.sdkMigration === true) {
 		const exemptMode = STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode;
-		const preserved = "The physical id is preserved";
+		const preserved = currentResource.physicalId === recordedResource.physicalId ? "The physical id is preserved" : "The resource is kept in place, and its recorded physical id takes the SDK provider's form";
 		let message;
 		switch (exemptMode) {
 			case "cc-broken":
@@ -52783,6 +52923,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	} catch (updateError) {
 		const ccUnsupported = isUpdateUnsupportedError(updateError, logicalId);
 		const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && engine.options.replace === true;
+		if ((ccUnsupported || replaceOptIn) && currentResource.physicalId !== recordedResource.physicalId) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) needs a replacement for this change, which cdkd ` + `does not run on the deploy that moves it from Cloud Control to its SDK provider. ` + safeMsg`Re-run with --pin-cc-api ${logicalId} to replace it through Cloud Control.`, "SDK_MIGRATION_REPLACEMENT_REFUSED", updateError instanceof Error ? updateError : void 0));
 		if (ccUnsupported || replaceOptIn) {
 			const fallbackStackInstanceId = getCurrentStackInstanceId();
 			const fallbackGeneration = fallbackStackInstanceId === void 0 ? void 0 : nextNameGeneration(currentResource, logicalId, fallbackStackInstanceId);
@@ -55378,7 +55519,8 @@ var DeployEngine = class {
 			logger: this.logger,
 			baseline: resources,
 			resolvedSecretsOf: (logicalId) => this.secretsRun.perResourceSecrets.get(logicalId),
-			namingSecrets: () => stateNamingSecrets(this.secretsRun)
+			namingSecrets: () => stateNamingSecrets(this.secretsRun),
+			pinnedToCcApi: (stackName, logicalId) => isPinnedToCcApi(this.options, stackName, logicalId)
 		});
 		return this.attributeHealer;
 	}
@@ -55408,7 +55550,8 @@ var DeployEngine = class {
 			perResourceResolvedType: () => this.secretsRun.perResourceResolvedType,
 			outputsRun: () => this.outputsRun,
 			readReaderForFreshNoEchoCeiling: (...args) => readReaderForFreshNoEchoCeiling(this.maskingDeps(), ...args),
-			maskForResource: (...args) => maskForResource(this.secretsRun, ...args)
+			maskForResource: (...args) => maskForResource(this.secretsRun, ...args),
+			pinnedToCcApi: (stackName, logicalId) => isPinnedToCcApi(this.options, stackName, logicalId)
 		};
 	}
 	maskingDeps() {
@@ -55716,5 +55859,5 @@ function sameGenerationClaimsOf(record) {
 	};
 }
 
-export { sendTtlWaitingOutRateLimit as $, assertFlagRoleArn as $a, literalSplitDelimitersOf as $c, ccBrokenReason as $i, hasReasonlessBaselineRefusal as $l, retiredAfterRollback as $n, malformedOrphansRefusalMessage as $o, isSupersededResourceRecord as $r, MULTI_REGION_RECREATE_BLOCKED_TYPES as $s, isHandledOrphan as $t, getLegacyStateBucketName as $u, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as A, INTRINSIC_KEYS as Aa, TemplateParser as Ac, hasPlainPrototype$1 as Ad, refusesFinalSnapshot as Ai, recordNoEchoAttributeValues as Al, demoteSupersededOrphans as An, declaresNoEcho as Ao, movedToHint as Ar, refuseMalformedResourcesForDeploy as As, makeCanonicalizePropertiesFn as At, buildDockerImage as Au, deleteTableWithIndexBusyRetry as B, s3BucketArn as Ba, passedNoEchoParametersOf as Bc, clearBucketRegionCache as Bd, isRefusedByName as Bi, CrossPrefixReadError as Bl, orphanNeedsIdentity as Bn, hasReadableOutputs as Bo, destroyStackRecordsView as Br, unpreviewableOrphanRecords as Bs, dropSettledNestedJournals as Bt, isMalformedEnvKey as Bu, planContributorInsightsOp as C, disableInstanceApiTermination as Ca, dbInstanceEngineChangeIsInPlace as Cc, StageLoadError as Cd, ATOMIC_FINAL_SNAPSHOT_TYPES as Ci, recordAttributeIdCopy as Cl, recordAfterRollbackUpdate as Cn, isStalePlaceholderArnAttribute as Co, DEFAULT_RESOURCE_WARN_AFTER_MS as Cr, refuseMalformedResourceEntriesForImport as Cs, enclosingDeadlineExpired as Ct, getBootstrapMarkerKey as Cu, reverseMapTableContributorInsights as D, reDisableInstanceApiTermination as Da, lambdaFunctionNameForMask as Dc, utf8ByteLength as Dd, createPreDeleteFinalSnapshot as Di, provenPublicValue as Dl, equalModuloMarkedMask as Dn, withSharedDrainBudget as Do, formatDestructiveChange as Dr, refuseMalformedResourcePropertiesForDrift as Ds, isSecretBearingReferenceString as Dt, validateAssetBucketName as Du, reverseMapIndexContributorInsights as E, observeThenDisableInstanceApiTermination as Ea, canonicalLambdaFunctionName as Ec, parseFailureDebugDetail as Ed, ccRoutedFinalSnapshotError as Ei, carriesSecretMask as El, calculateResourceDrift as En, parseWebACLArn as Eo, findDestructiveChanges as Er, refuseMalformedResourcePropertiesForDestroy as Es, diffSecurity as Et, readBootstrapMarkerBody as Eu, resolveDynamoDbDeleteBudgetClock as F, withUnsettledProperties as Fa, maskWholeValue as Fc, displayAssemblyPath as Fd, withCreateTokenLedger as Fi, isSingleDynamicReferenceToken as Fl, recheckFailedPlan as Fn, UNREADABLE_RESOURCES_MAP_ROW as Fo, mappingPairs as Fr, repairMalformedOrphansForReadOnly as Fs, keptForRetainedRecord as Ft, dockerSpawnEnvWithSensitive as Fu, readbackVectorIndexes as G, resolveDynamicReferences as Ga, liveMatchesUnresolvedTokenFrame as Gc, readTagList as Gi, isNotImplemented as Gl, isRedactedRecordedValue as Gn, malformedExportNamesWarning as Go, cyan as Gr, findHandledUnwrittenCreateOnly as Gs, revertedNestedRowIds as Gt, runDockerForeground as Gu, relayedIndexBusyDelete as H, s3BucketDualStackDomainName as Ha, readsNoEchoSource as Hc, DBPROXY_TAGS_WHAT as Hi, applyCrossPrefixScan as Hl, getCurrentProducerRegions as Hn, isReadableOrphanRecord as Ho, withStackRecords as Hr, unreadableResourceEntries as Hs, nestedChildStackName as Ht, redactDockerArgvValues as Hu, resolveDynamoDbDeleteBudgetMs as I, withoutUnsettledProperties as Ia, maskedLeafCoordinatesOf as Ic, renderAssemblyPathEscape as Id, acquireIdempotencyToken as Ii, LockManager as Il, recordUnderIdIsNotOwn as In, accountArgs as Io, parseMappingFile as Ir, repairMalformedOutputsForReadOnly as Is, recordRetainedForReadoption as It, finchSecretArgvRefusal as Iu, vectorIndexesShapeDetail as J, keepHeldTokenProvenance as Ja, recordReferenceProvenanceEntry as Jc, tagPlanWarning as Ji, splitImportedOps as Jl, updatePartialMessage as Jn, malformedLocalResourceEntriesWarning as Jo, red as Jr, withoutSilentDropProperties as Js, getCurrentNestedStackContext as Jt, AssetManifestLoader as Ju, vectorIndexesForCreate as K, producerLookupOver as Ka, markSameGenerationBag as Kc, refuseMalformedDesiredTags as Ki, stackInstanceIdOf as Kl, redactedDeleteAddressFields as Kn, malformedExportSourceWarning as Ko, gray as Kr, findSilentDropProperties as Ks, withNestedRevertRun as Kt, runDockerStreaming as Ku, DELETE_INDEX_WAIT_PROCEED_NOTE as L, IntrinsicFunctionResolver as La, noEchoCoordinatesOf as Lc, resolveAssemblyPath as Ld, DeploymentEventsReader as Li, isLockInfoExpired as Ll, replacementNeverSwapped as Ln, deployRefusesOrphanRowsReason as Lo, proposeRenames as Lr, repairMalformedResourceEntriesForReadOnly as Ls, NESTED_PENDING_PARENT_REASON as Lt, formatDockerLoginError as Lu, beginDeleteWait as M, unsettledItemsField as Ma, isMarkedCoordinate as Mc, ownValue as Md, earliestDefined as Mi, recordProvenPublicExpression as Ml, isReplacementOrphan as Mn, STATE_REGION_DIVERGED as Mo, withMovedTo as Mr, refuseMalformedResourcesForExport as Ms, planOrphanAdoption as Mt, describeDockerCapturedOutput as Mu, compensateRemovedDeletionProtection as N, unsettledItemsOf as Na, maskAtCoordinates as Nc, absoluteAssemblyPathEscape as Nd, ledgerForStack as Ni, wholeStringLeavesOf as Nl, planFailedOps as Nn, STATE_RESOURCES_MALFORMED as No, isPairableType as Nr, refuseMalformedState as Ns, pendingRequestCount as Nt, describeDockerExecFailure as Nu, stripIndexContributorInsights as O, reEnableInstanceApiTermination as Oa, sameLambdaFunctionAddress as Oc, defineOwnKey as Od, effectiveDeletionPolicy as Oi, recordMaskOnlyValue as Ol, equalModuloMask as On, parameterInputsFor as Oo, findRefactorHints as Or, refuseMalformedResourcePropertiesForExport as Os, keptWholeReasonText as Ot, validateContainerRepoName as Ou, deleteBudgetKey as P, unsettledPropertiesOf as Pa, maskReadbackAtCoordinates as Pc, describeFileReadFailure as Pd, reserveStackCreateToken as Pi, WHOLE_DYNAMIC_REFERENCE_PATTERN as Pl, planRollback as Pn, UNREADABLE_ORPHANS_CONTAINER_ROW as Po, looselyEqual as Pr, repairMalformedOrphanRecordsForReadOnly as Ps, resolvePendingCloudControlRequests as Pt, describeDockerFailure as Pu, readTtlSpec as Q, applyRoleArnIfSet as Qa, hasMaskableValues as Qc, ProviderRegistry as Qi, hasReadableExportSet as Ql, nameScopeOf as Qn, malformedOrphanRowsKeptWarning as Qo, holdsSupersededResources as Qr, shownType as Qs, dropFailedHint as Qt, getDefaultStateBucketName as Qu, INDEX_SETTLE_POLL_INTERVAL_MS as R, poisonRenderedSpellingsCollidingIn as Ra, noEchoLeavesOf as Rc, injectAwsRegion as Rd, DeploymentEventsStore as Ri, S3StateBackend as Rl, resolveReplacementOldType as Rn, displayLogicalId as Ro, refuseRestoreFromItself as Rr, repairMalformedResourcePropertiesForReadOnly as Rs, displacedOpClause as Rt, getDockerCmd as Ru, indexDeclaresContributorInsights as S, markWaitAbandoned as Sa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as Sc, AssemblyReader as Sd, storedSecretNameNeedles as Si, physicalNameCopiesOf as Sl, removeProtectionTypeList as Sn, cfnRefValueFromPhysicalId as So, DEFAULT_RESOURCE_TIMEOUT_MS as Sr, refuseMalformedResourceEntriesForDestroy as Ss, readRecordedConditionVerdicts as St, ensureAssetStorage as Su, readContributorInsightsSpec as T, isTerminationProtectionPropagationError as Ta, emrClusterInstancesReplaced as Tc, describeJsonParseFailure as Td, buildFinalSnapshotIdentifier as Ti, splitGetAttStringForm as Tl, withUnprovenUnsettled as Tn, refStateLookupFromResource as To, constructPathOf as Tr, refuseMalformedResourceEntriesForOrphan as Ts, withResourceDeadline as Tt, parseBootstrapMarker as Tu, waitForIndexesSettled as U, s3BucketRegionalDomainName as Ua, recordedNoEchoValuesOf as Uc, DBPROXY_TAG_OPTIONS as Ui, crossPrefixDeniedWarning as Ul, inheritProducerRegions as Un, isReadableResourceEntry as Uo, replacedDeleteFailureVerdict as Ur, withheldAccountClause as Us, recordDisplacedSkips as Ut, redactedCause as Uu, maskedLogger as V, s3BucketDomainName as Va, readbackPathFor as Vc, resolveBucketRegion as Vd, markDeleteStarted as Vi, CrossPrefixScanCache as Vl, findNestedStackTypeChanges as Vn, hasReadableResources as Vo, getStackRecords as Vr, unreadableOrphanRecords as Vs, getNestedRevertRun as Vt, partitionSensitiveEnv as Vu, planVectorIndexUpdates as W, s3BucketWebsiteUrl as Wa, valueAtCoordinate as Wc, planTagDiff as Wi, isAccessDenied$1 as Wl, REDACTED_DELETE_ADDRESS_SKIP_REASON as Wn, malformedDriftResourcePropertiesWarning as Wo, bold as Wr, findActionableSilentDrops as Ws, revertNestedChildFromJournal as Wt, redactedDockerCause as Wu, isTtlRateLimited as X, recordedOutputReferenceRegions as Xa, carryLogOnlyValues as Xc, stringifyIfAssigned as Xi, describeRegionValueKind as Xl, nameGenerationCarriedFrom as Xn, malformedOrphanRecordsRefusalMessage as Xo, addSuperseded as Xr, hasNoCloudControlHandlers as Xs, deleteJournaledOrphans as Xt, Synthesizer as Xu, isTtlAlreadyDisabled as Y, outputReferenceProvenanceOf as Ya, snapshotPassProvenance as Yc, definedAttributes as Yi, acceptedCreateOnlyDropsOf as Yl, updatePartialReason as Yn, malformedLocalResourcesWarning as Yo, yellow as Yr, NO_CC_HANDLERS_REASON as Ys, withNestedStackContext as Yt, getDockerImageBySourceHash as Yu, planTimeToLive as Z, recordedReferenceRegions as Za, createUnionSecretMasker as Zc, CC_BROKEN_REASON as Zi, exportNamesCarriedFrom as Zl, nameGenerationHighWaterOf as Zn, malformedOrphanRecordsWarning as Zo, deleteSupersededEntry as Zr, findReplacedReadersOfRecreateTargets as Zs, dropFailedCommands as Zt, synthesisStatusMessage as Zu, streamMemberRefusals as _, deleteIndeterminateGuards as _a, requireConfigString as _c, decodeListingKey as _d, secretNamePrintingBag as _i, spelledKeysOf as _l, pendingMovesOutOf as _n, carriesDynamicReference as _o, noEchoParameterValueSeed as _r, refuseMalformedOutputs as _s, renderNestedTemplateTreeDefect as _t, loadPublishableAssetManifest as _u, isProtectionValueActive as a, isCustomResourceType as aa, isWarmThroughputDecrease as ac, resolveStateBucketWithDefault as ad, withoutSuperseded as ai, unionOfSecretBags as al, chunks as an, applyCallerIdentityCredentials as ao, reachableDivergentParameters as ar, malformedResourcePropertiesWarning as as, markRefusedBeforeApplying as at, orphansCarriedFrom as au, CONTRIBUTOR_INSIGHTS_KEY as b, withIndeterminateGuard as ba, describeTypeWithThrottleRetry as bc, canonicalizeRegion as bd, secretNamedRecordNeedles as bi, recordNestedStackParameterExpressions as bl, replayFailedOperations as bn, keepsSecretReferenceToken as bo, isExportAliasCollision as br, refuseMalformedResourceEntries as bs, conditionInputsFrom as bt, BOOTSTRAP_MARKER_PREFIX as bu, DynamoDBGlobalTableProvider as c, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as ca, coerceCfnBoolean as cc, stateBucketExistenceConfirmed as cd, noEchoExactEchoLeavesOf as ci, maskSecretsInError as cl, withApiLimit as cn, classifyRecordedSecretRegion as co, displayTextOrWithheld as cr, malformedStateRefusalMessage as cs, crossStackOutputProvenanceSource as ct, PhaseClock as cu, declaredStreamPolicyMember as d, CloudControlProvider as da, configIntegerRefusal as dc, CFN_TEMPLATE_BODY_LIMIT as dd, createReadOnlyAttributeHealerFactory as di, withPhysicalNameCopies as dl, refactorMarkerMovesOf as dn, regionLessSecretName as do, secretBearingStateKeyWarning as dr, refuseMalformedNestedChildOutputs as ds, findServiceTokenRefusals as dt, AssetPublisher as du, isCustomResource as ea, isStatefulRecreateTargetForReplace as ec, loadCdkJson as ed, removeSuperseded as ei, logOnlyValueCount as el, journaledOrphanLines as en, assertSendableRoleArn as eo, retiredNameGenerationsAfter as er, malformedOrphansWarning as es, ECR_AUTO_DELETE_IMAGES_TAG as et, hasUnverifiableParameterRefusal as eu, declaredStreamTagsMember as f, slowCcOperationTimeoutMs as fa, configStringRefusal as fc, CFN_TEMPLATE_URL_LIMIT as fd, completedReplayEntries as fi, withoutPhysicalNameCopies as fl, refactorMarkerRefusalMessage as fn, coerceParameterTypedValue as fo, secretSafeKeyDisplay as fr, refuseMalformedOrphanRecords as fs, serviceTokenBlockingReason as ft, isSensitiveAttributeName as fu, streamDeclaresTags as g, UNSPECIFIED_SKIP_REASON as ga, requireConfigObject as gc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gd, orphanRecordsPrintingBag as gi, pathCrossesDottedKey as gl, hasPendingMovesOut as gn, isImpossibleEmptyStoredAttribute as go, isWholeDynamicReferenceValue as gr, refuseMalformedOrphansForOrphan as gs, listNestedTemplateRows as gt, createAssetRedirectResolver as gu, streamDeclaresPolicy as h, RollbackInlinePolicyWriters as ha, requireConfigArray as hc, uploadCfnTemplate as hd, namingSecretsWithRecordedNoEcho as hi, isUncertifiedBaselineMaskPosition as hl, updateRefactorMarker as hn, getAccountInfo as ho, exportNameSecretExposure as hr, refuseMalformedOrphansForDestroy as hs, isAbsoluteAssetPath as ht, buildAssetRedirectMap as hu, PROTECTION_PROPERTY_BY_TYPE as i, readsNoEchoDeleteValues as ia, coerceWarmThroughput as ic, resolveSkipPrefix as id, supersededResourcesOf as ii, shareLogOnlyValues as il, formatResourceLine as in, AWS_CREDENTIAL_ENV_KEYS as io, namesAnyDeclaredParameter as ir, malformedResourceEntriesWarning as is, getPriorAttempts as it, orphansAfterRollback as iu, DYNAMODB_DELETE_POLL_COST_MS as j, isUsableAttemptedName as ja, canonicalCoordinates as jc, nullPrototypeRecord as jd, unsupportedFinalSnapshotError as ji, recordNoEchoParameterFreshValue as jl, isJournaledOrphan as jn, JSON_LISTING_HOLE_VALUE as jo, rollbackOrphanIds as jr, refuseMalformedResourcesForDestroy as js, makeSiblingClaimReader as jt, resolveDockerContextDirectory as ju, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as k, DiffCalculator as ka, DagBuilder as kc, hasOwnKey as kd, isFinalSnapshotError as ki, recordMaskOnlyValuesIn as kl, undeclaredEmptyObservedKeys as kn, passedParameterClassesOf as ko, hintSidesOf as kr, refuseMalformedResourcePropertiesForOrphan as ks, mergeNoChangeOutputs as kt, buildDenyExternalAccessPolicy as ku, STREAM_POLICY_KEY as l, applyCustomResourceResponseExpiration as la, coerceCfnInteger as lc, warnDeprecatedNoPrefixCliFlag as ld, noEchoParameterNamesOf as li, maskSecretsInText as ll, readRefactorMarker as ln, classifyReplaySecretRegion as lo, exportAliasCollisionScrubWarning as lr, previewableOrphanRecords as ls, inheritedProvenanceForChildDiff as lt, renderPhaseTimings as lu, reverseMapStreamPolicy as m, unchangedBehindSecretReference as ma, replayWarn as mc, findLargeInlineResources as md, maskEventTextWithBoundBags as mi, dynamicReferenceTokens as ml, sameMove as mn, parameterTypeMayLoseSecretIdentity as mo, exportNameNoEchoParameters as mr, refuseMalformedOrphans as ms, findNestedTemplateTreeDefect as mt, WorkGraph as mu, recordedProtectionEvidence as n, waitForLambdaFunctionActive as na, renderStatefulReason as nc, resolveAutoAssetStorage as nd, supersededHeldByOtherTypeWarning as ni, recordLogOnlyParameterValue as nl, makeForeignHolderScan as nn, isIamRoleArn as no, withNameGenerationReached as nr, malformedOutputsWarning as ns, hasCdkAutoDeleteTag as nt, importableOutputs as nu, perType as o, getCurrentResourceSecrets as oa, toCfnInteger as oc, resolveStateBucketWithDefaultAndSource as od, noEchoAttributeNamesOf as oi, createSecretMasker as ol, isAccessDeniedError as on, callerEnvCredentials as oo, resourcesNamingDeclaredParameter as or, malformedResourcesWarning as os, IMPLICIT_DELETE_DEPENDENCIES as ot, shouldRetainResource as ou, planStreamMemberOps as p, onlySecretReferencesDiffer as pa, readConfigString as pc, MIGRATE_TMP_PREFIX as pd, journaledOrphanPrintingBag as pi, DYNAMIC_REFERENCE_TOKEN_SCAN as pl, refuseRefactorMarker as pn, isUnboundTemplateParameter as po, carriedExportAliasExposure as pr, refuseMalformedOrphanRecordsForDestroy as ps, childTemplateLoader as pt, stringifyValue as pu, vectorIndexesSettled as q, refuseUnreadableCdkCrossAccountRefs as qa, redactForState as qc, tagMapAsList as qi, withStackInstanceIdWithheld as ql, redactedDeleteAddressSkip as qn, malformedLocalOutputsWarning as qo, green as qr, unwrittenCreateOnlyReplacement as qs, collectNestedChildUnaddressed as qt, warnFinchArgvExposure as qu, recordedProtectionNote as r, TemplateNoEchoReresolver as ra, WARM_THROUGHPUT_MEMBERS as rc, resolveCaptureObservedState as rd, supersededHolderOf as ri, recordLogOnlyValue as rl, sameJournaledOrphans as rn, sendableAssumeRoleCommand as ro, computeParameterTaint as rr, malformedRenderedContainersWarning as rs, isTruthyCfnBoolean as rt, isReadableBag as ru, readProtection as s, withPrintingSecrets as sa, toFiniteNumber as sc, resolveUseCdkBootstrapAssets as sd, noEchoComparisonForTemplate as si, errorCauseChain as sl, lookupEachName as sn, envCredentialsAreAssumedRole as so, WITHHELD_NAME_DISPLAY as sr, malformedScrubResourceEntriesRefusalMessage as ss, computeImplicitDeleteEdges as st, stackInstanceIdCarriedFrom as su, DeployEngine as t, wouldReturnToSdkProvider as ta, isStatefulRecreateTargetSync as tc, resolveApp as td, supersededAfterRollback as ti, printingCorpusOf as tl, loadJournaledOrphans as tn, explicitRoleArnOrThrow as to, retiredNameGenerationsLeaving as tr, malformedOutputsRefusalMessage as ts, S3_AUTO_DELETE_OBJECTS_TAG as tt, importableOutputKeys as tu, STREAM_TAGS_KEY as u, customResourceResponseExpirationWarning as ua, configBooleanRefusal as uc, ssmResolvedValueType as ud, withAttemptedItemsMasked as ui, scrubResourceRecord as ul, readRefactorMarkerOnce as un, producerRegionsFromState as uo, secretBearing as ur, refuseDivergentRecordRegionForDestroy as us, deferredServiceTokenWarning as ut, timePhase as uu, streamPolicyMatchesDeclared as v, deleteLeftInPlace as va, prefetchCreateOnlyPropertyPaths as vc, expectedOwnerParam as vd, secretNamePrintingBags as vi, identityKeyFor as vl, pendingMovesRefusalMessage as vn, carriesFetchableDynamicReference as vo, collectDeclaredOutputNames as vr, refuseMalformedOutputsForDestroy as vs, templateIdentity as vt, rewriteTemplateAssetReferences as vu, planIndexContributorInsightsOps as w, ec2InstanceProtectionSite as wa, ecsServiceLaunchTypeSetOrChanged as wc, processStackMessages as wd, PRE_DELETE_SNAPSHOT_TYPES as wi, recordPhysicalNameCopy as wl, settleUnsettledPrevious as wn, lacksRecordedTableArn as wo, maskingRetryLogger as wr, refuseMalformedResourceEntriesForImportSave as ws, enclosingDeadlineRemainingMs as wt, isCrossRegionRedirect as wu, contributorInsightsRefusals as x, isWaitAbandonedError as xa, withRetry as xc, derivePartitionAndUrlSuffix as xd, stateSecretNameNeedles as xi, recoverMaskedOutput as xl, replayRollback as xn, AWS_NO_VALUE as xo, bindingSkippedOutputs as xr, refuseMalformedResourceEntriesForDeploy as xs, parentSuppliedValues as xt, assertAssetBucketRegion as xu, streamTagsMatchDeclared as y, deleteSkipReason as ya, templateResourceTypes as yc, PARTITION_TABLE as yd, secretNamedAttributeNamesOf as yi, inheritNestedStackParameterAssociations as yl, refusePendingMovesOut as yn, isNamelessDynamicReferenceError as yo, collectPublishedOutputNames as yr, refuseMalformedResourceAttributesForOrphan as ys, conditionFingerprint as yt, AssetModeResolver as yu, TABLE_INDEX_NOUN as z, isSettledInstanceState as za, noEchoOutputsComparison as zc, injectedAwsRegionValue as zd, extractDeploymentEventError as zi, rebuildClientForBucketRegion as zl, seedsDeleteFirstGuard as zn, hasReadableOrphans as zo, awaitInFlightSibling as zr, repairMalformedResourcesForReadOnly as zs, displacedPhysicalIdShown as zt, isDockerClientEnvKey as zu };
-//# sourceMappingURL=deploy-engine-BiJyU4j1.js.map
+export { isTtlRateLimited as $, recordedReferenceRegions as $a, createUnionSecretMasker as $c, stringifyIfAssigned as $i, exportNamesCarriedFrom as $l, nameGenerationCarriedFrom as $n, malformedOrphanRecordsWarning as $o, addSuperseded as $r, findReplacedReadersOfRecreateTargets as $s, deleteJournaledOrphans as $t, synthesisStatusMessage as $u, resolvedResourceTimeoutMs as A, reEnableInstanceApiTermination as Aa, sameLambdaFunctionAddress as Ac, defineOwnKey as Ad, createPreDeleteFinalSnapshot as Ai, recordMaskOnlyValue as Al, equalModuloMarkedMask as An, parameterInputsFor as Ao, formatDestructiveChange as Ar, refuseMalformedResourcePropertiesForExport as As, isSecretBearingReferenceString as At, validateContainerRepoName as Au, DELETE_INDEX_WAIT_PROCEED_NOTE as B, poisonRenderedSpellingsCollidingIn as Ba, noEchoLeavesOf as Bc, injectAwsRegion as Bd, DeploymentEventsReader as Bi, S3StateBackend as Bl, replacementNeverSwapped as Bn, displayLogicalId as Bo, proposeRenames as Br, repairMalformedResourcePropertiesForReadOnly as Bs, NESTED_PENDING_PARENT_REASON as Bt, getDockerCmd as Bu, planContributorInsightsOp as C, withIndeterminateGuard as Ca, withRetry as Cc, derivePartitionAndUrlSuffix as Cd, secretNamedRecordNeedles as Ci, recoverMaskedOutput as Cl, replayFailedOperations as Cn, AWS_NO_VALUE as Co, isExportAliasCollision as Cr, refuseMalformedResourceEntriesForDeploy as Cs, conditionInputsFrom as Ct, assertAssetBucketRegion as Cu, reverseMapTableContributorInsights as D, isTerminationProtectionPropagationError as Da, emrClusterInstancesReplaced as Dc, describeJsonParseFailure as Dd, PRE_DELETE_SNAPSHOT_TYPES as Di, splitGetAttStringForm as Dl, settleUnsettledPrevious as Dn, refStateLookupFromResource as Do, maskingRetryLogger as Dr, refuseMalformedResourceEntriesForOrphan as Ds, enclosingDeadlineRemainingMs as Dt, parseBootstrapMarker as Du, reverseMapIndexContributorInsights as E, ec2InstanceProtectionSite as Ea, ecsServiceLaunchTypeSetOrChanged as Ec, processStackMessages as Ed, ATOMIC_FINAL_SNAPSHOT_TYPES as Ei, recordPhysicalNameCopy as El, recordAfterRollbackUpdate as En, lacksRecordedTableArn as Eo, DEFAULT_RESOURCE_WARN_AFTER_MS as Er, refuseMalformedResourceEntriesForImportSave as Es, enclosingDeadlineExpired as Et, isCrossRegionRedirect as Eu, beginDeleteWait as F, unsettledItemsOf as Fa, maskAtCoordinates as Fc, absoluteAssemblyPathEscape as Fd, earliestDefined as Fi, wholeStringLeavesOf as Fl, isReplacementOrphan as Fn, STATE_RESOURCES_MALFORMED as Fo, withMovedTo as Fr, refuseMalformedState as Fs, planOrphanAdoption as Ft, describeDockerExecFailure as Fu, relayedIndexBusyDelete as G, s3BucketRegionalDomainName as Ga, recordedNoEchoValuesOf as Gc, DBPROXY_TAGS_WHAT as Gi, crossPrefixDeniedWarning as Gl, getCurrentProducerRegions as Gn, isReadableResourceEntry as Go, withStackRecords as Gr, withheldAccountClause as Gs, nestedChildStackName as Gt, redactedCause as Gu, TABLE_INDEX_NOUN as H, s3BucketArn as Ha, passedNoEchoParametersOf as Hc, clearBucketRegionCache as Hd, extractDeploymentEventError as Hi, CrossPrefixReadError as Hl, seedsDeleteFirstGuard as Hn, hasReadableOutputs as Ho, awaitInFlightSibling as Hr, unpreviewableOrphanRecords as Hs, displacedPhysicalIdShown as Ht, isMalformedEnvKey as Hu, compensateRemovedDeletionProtection as I, unsettledPropertiesOf as Ia, maskReadbackAtCoordinates as Ic, describeFileReadFailure as Id, ledgerForStack as Ii, WHOLE_DYNAMIC_REFERENCE_PATTERN as Il, planFailedOps as In, UNREADABLE_ORPHANS_CONTAINER_ROW as Io, isPairableType as Ir, repairMalformedOrphanRecordsForReadOnly as Is, pendingRequestCount as It, describeDockerFailure as Iu, readbackVectorIndexes as J, producerLookupOver as Ja, markSameGenerationBag as Jc, readTagList as Ji, stackInstanceIdOf as Jl, isRedactedRecordedValue as Jn, malformedExportSourceWarning as Jo, cyan as Jr, findSilentDropProperties as Js, revertedNestedRowIds as Jt, runDockerStreaming as Ju, waitForIndexesSettled as K, s3BucketWebsiteUrl as Ka, valueAtCoordinate as Kc, DBPROXY_TAG_OPTIONS as Ki, isAccessDenied$1 as Kl, inheritProducerRegions as Kn, malformedDriftResourcePropertiesWarning as Ko, replacedDeleteFailureVerdict as Kr, findActionableSilentDrops as Ks, recordDisplacedSkips as Kt, redactedDockerCause as Ku, deleteBudgetKey as L, withUnsettledProperties as La, maskWholeValue as Lc, displayAssemblyPath as Ld, reserveStackCreateToken as Li, isSingleDynamicReferenceToken as Ll, planRollback as Ln, UNREADABLE_RESOURCES_MAP_ROW as Lo, looselyEqual as Lr, repairMalformedOrphansForReadOnly as Ls, resolvePendingCloudControlRequests as Lt, dockerSpawnEnvWithSensitive as Lu, DYNAMODB_DELETE_DEADLINE_MARGIN_MS as M, INTRINSIC_KEYS as Ma, TemplateParser as Mc, hasPlainPrototype$1 as Md, isFinalSnapshotError as Mi, recordNoEchoAttributeValues as Ml, undeclaredEmptyObservedKeys as Mn, declaresNoEcho as Mo, hintSidesOf as Mr, refuseMalformedResourcesForDeploy as Ms, mergeNoChangeOutputs as Mt, buildDockerImage as Mu, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as N, isUsableAttemptedName as Na, canonicalCoordinates as Nc, nullPrototypeRecord as Nd, refusesFinalSnapshot as Ni, recordNoEchoParameterFreshValue as Nl, demoteSupersededOrphans as Nn, JSON_LISTING_HOLE_VALUE as No, movedToHint as Nr, refuseMalformedResourcesForDestroy as Ns, makeCanonicalizePropertiesFn as Nt, resolveDockerContextDirectory as Nu, stripIndexContributorInsights as O, observeThenDisableInstanceApiTermination as Oa, canonicalLambdaFunctionName as Oc, parseFailureDebugDetail as Od, buildFinalSnapshotIdentifier as Oi, carriesSecretMask as Ol, withUnprovenUnsettled as On, parseWebACLArn as Oo, constructPathOf as Or, refuseMalformedResourcePropertiesForDestroy as Os, withResourceDeadline as Ot, readBootstrapMarkerBody as Ou, DYNAMODB_DELETE_POLL_COST_MS as P, unsettledItemsField as Pa, isMarkedCoordinate as Pc, ownValue as Pd, unsupportedFinalSnapshotError as Pi, recordProvenPublicExpression as Pl, isJournaledOrphan as Pn, STATE_REGION_DIVERGED as Po, rollbackOrphanIds as Pr, refuseMalformedResourcesForExport as Ps, makeSiblingClaimReader as Pt, describeDockerCapturedOutput as Pu, isTtlAlreadyDisabled as Q, recordedOutputReferenceRegions as Qa, carryLogOnlyValues as Qc, definedAttributes as Qi, describeRegionValueKind as Ql, updatePartialReason as Qn, malformedOrphanRecordsRefusalMessage as Qo, yellow as Qr, hasNoCloudControlHandlers as Qs, withNestedStackContext as Qt, Synthesizer as Qu, resolveDynamoDbDeleteBudgetClock as R, withoutUnsettledProperties as Ra, maskedLeafCoordinatesOf as Rc, renderAssemblyPathEscape as Rd, withCreateTokenLedger as Ri, LockManager as Rl, recheckFailedPlan as Rn, accountArgs as Ro, mappingPairs as Rr, repairMalformedOutputsForReadOnly as Rs, keptForRetainedRecord as Rt, finchSecretArgvRefusal as Ru, indexDeclaresContributorInsights as S, deleteSkipReason as Sa, describeTypeWithThrottleRetry as Sc, canonicalizeRegion as Sd, secretNamedAttributeNamesOf as Si, recordNestedStackParameterExpressions as Sl, refusePendingMovesOut as Sn, keepsSecretReferenceToken as So, collectPublishedOutputNames as Sr, refuseMalformedResourceEntries as Ss, conditionFingerprint as St, BOOTSTRAP_MARKER_PREFIX as Su, readContributorInsightsSpec as T, disableInstanceApiTermination as Ta, dbInstanceEngineChangeIsInPlace as Tc, StageLoadError as Td, storedSecretNameNeedles as Ti, recordAttributeIdCopy as Tl, removeProtectionTypeList as Tn, isStalePlaceholderArnAttribute as To, DEFAULT_RESOURCE_TIMEOUT_MS as Tr, refuseMalformedResourceEntriesForImport as Ts, readRecordedConditionVerdicts as Tt, getBootstrapMarkerKey as Tu, deleteTableWithIndexBusyRetry as U, s3BucketDomainName as Ua, readbackPathFor as Uc, resolveBucketRegion as Ud, isRefusedByName as Ui, CrossPrefixScanCache as Ul, orphanNeedsIdentity as Un, hasReadableResources as Uo, destroyStackRecordsView as Ur, unreadableOrphanRecords as Us, dropSettledNestedJournals as Ut, partitionSensitiveEnv as Uu, INDEX_SETTLE_POLL_INTERVAL_MS as V, isSettledInstanceState as Va, noEchoOutputsComparison as Vc, injectedAwsRegionValue as Vd, DeploymentEventsStore as Vi, rebuildClientForBucketRegion as Vl, resolveReplacementOldType as Vn, hasReadableOrphans as Vo, refuseRestoreFromItself as Vr, repairMalformedResourcesForReadOnly as Vs, displacedOpClause as Vt, isDockerClientEnvKey as Vu, maskedLogger as W, s3BucketDualStackDomainName as Wa, readsNoEchoSource as Wc, markDeleteStarted as Wi, applyCrossPrefixScan as Wl, findNestedStackTypeChanges as Wn, isReadableOrphanRecord as Wo, getStackRecords as Wr, unreadableResourceEntries as Ws, getNestedRevertRun as Wt, redactDockerArgvValues as Wu, vectorIndexesSettled as X, keepHeldTokenProvenance as Xa, recordReferenceProvenanceEntry as Xc, tagMapAsList as Xi, splitImportedOps as Xl, redactedDeleteAddressSkip as Xn, malformedLocalResourceEntriesWarning as Xo, green as Xr, withoutSilentDropProperties as Xs, collectNestedChildUnaddressed as Xt, AssetManifestLoader as Xu, vectorIndexesForCreate as Y, refuseUnreadableCdkCrossAccountRefs as Ya, redactForState as Yc, refuseMalformedDesiredTags as Yi, withStackInstanceIdWithheld as Yl, redactedDeleteAddressFields as Yn, malformedLocalOutputsWarning as Yo, gray as Yr, unwrittenCreateOnlyReplacement as Ys, withNestedRevertRun as Yt, warnFinchArgvExposure as Yu, vectorIndexesShapeDetail as Z, outputReferenceProvenanceOf as Za, snapshotPassProvenance as Zc, tagPlanWarning as Zi, acceptedCreateOnlyDropsOf as Zl, updatePartialMessage as Zn, malformedLocalResourcesWarning as Zo, red as Zr, NO_CC_HANDLERS_REASON as Zs, getCurrentNestedStackContext as Zt, getDockerImageBySourceHash as Zu, streamMemberRefusals as _, unchangedBehindSecretReference as _a, requireConfigArray as _c, uploadCfnTemplate as _d, maskEventTextWithBoundBags as _i, isUncertifiedBaselineMaskPosition as _l, sameMove as _n, getAccountInfo as _o, exportNameNoEchoParameters as _r, refuseMalformedOrphansForDestroy as _s, findNestedTemplateTreeDefect as _t, buildAssetRedirectMap as _u, isProtectionValueActive as a, waitForLambdaFunctionActive as aa, WARM_THROUGHPUT_MEMBERS as ac, resolveCaptureObservedState as ad, supersededHeldByOtherTypeWarning as ai, recordLogOnlyValue as al, makeForeignHolderScan as an, sendableAssumeRoleCommand as ao, withNameGenerationReached as ar, malformedRenderedContainersWarning as as, hasCdkAutoDeleteTag as at, isReadableBag as au, CONTRIBUTOR_INSIGHTS_KEY as b, deleteIndeterminateGuards as ba, prefetchCreateOnlyPropertyPaths as bc, expectedOwnerParam as bd, secretNamePrintingBag as bi, identityKeyFor as bl, pendingMovesOutOf as bn, carriesFetchableDynamicReference as bo, noEchoParameterValueSeed as br, refuseMalformedOutputsForDestroy as bs, renderNestedTemplateTreeDefect as bt, rewriteTemplateAssetReferences as bu, DynamoDBGlobalTableProvider as c, isCustomResourceType as ca, toCfnInteger as cc, resolveStateBucketWithDefaultAndSource as cd, withoutSuperseded as ci, createSecretMasker as cl, chunks as cn, callerEnvCredentials as co, reachableDivergentParameters as cr, malformedResourcesWarning as cs, markRefusedBeforeApplying as ct, shouldRetainResource as cu, declaredStreamPolicyMember as d, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as da, coerceCfnInteger as dc, warnDeprecatedNoPrefixCliFlag as dd, noEchoExactEchoLeavesOf as di, maskSecretsInText as dl, withApiLimit as dn, classifyReplaySecretRegion as do, displayTextOrWithheld as dr, previewableOrphanRecords as ds, crossStackOutputProvenanceSource as dt, renderPhaseTimings as du, CC_BROKEN_REASON as ea, shownType as ec, getDefaultStateBucketName as ed, deleteSupersededEntry as ei, hasMaskableValues as el, dropFailedCommands as en, applyRoleArnIfSet as eo, nameGenerationHighWaterOf as er, malformedOrphanRowsKeptWarning as es, planTimeToLive as et, hasReadableExportSet as eu, declaredStreamTagsMember as f, applyCustomResourceResponseExpiration as fa, configBooleanRefusal as fc, ssmResolvedValueType as fd, noEchoParameterNamesOf as fi, scrubResourceRecord as fl, readRefactorMarker as fn, producerRegionsFromState as fo, exportAliasCollisionScrubWarning as fr, refuseDivergentRecordRegionForDestroy as fs, inheritedProvenanceForChildDiff as ft, timePhase as fu, streamDeclaresTags as g, onlySecretReferencesDiffer as ga, replayWarn as gc, findLargeInlineResources as gd, journaledOrphanPrintingBag as gi, dynamicReferenceTokens as gl, refuseRefactorMarker as gn, parameterTypeMayLoseSecretIdentity as go, carriedExportAliasExposure as gr, refuseMalformedOrphans as gs, childTemplateLoader as gt, WorkGraph as gu, streamDeclaresPolicy as h, slowCcOperationTimeoutMs as ha, readConfigString as hc, MIGRATE_TMP_PREFIX as hd, completedReplayEntries as hi, DYNAMIC_REFERENCE_TOKEN_SCAN as hl, refactorMarkerRefusalMessage as hn, isUnboundTemplateParameter as ho, secretSafeKeyDisplay as hr, refuseMalformedOrphanRecordsForDestroy as hs, serviceTokenBlockingReason as ht, stringifyValue as hu, PROTECTION_PROPERTY_BY_TYPE as i, wouldReturnToSdkProvider as ia, renderStatefulReason as ic, resolveAutoAssetStorage as id, supersededAfterRollback as ii, recordLogOnlyParameterValue as il, loadJournaledOrphans as in, isIamRoleArn as io, retiredNameGenerationsLeaving as ir, malformedOutputsWarning as is, S3_AUTO_DELETE_OBJECTS_TAG as it, importableOutputs as iu, setResolvedResourceTimeouts as j, DiffCalculator as ja, DagBuilder as jc, hasOwnKey as jd, effectiveDeletionPolicy as ji, recordMaskOnlyValuesIn as jl, equalModuloMask as jn, passedParameterClassesOf as jo, findRefactorHints as jr, refuseMalformedResourcePropertiesForOrphan as js, keptWholeReasonText as jt, buildDenyExternalAccessPolicy as ju, waitForGoneAfterDelete as k, reDisableInstanceApiTermination as ka, lambdaFunctionNameForMask as kc, utf8ByteLength as kd, ccRoutedFinalSnapshotError as ki, provenPublicValue as kl, calculateResourceDrift as kn, withSharedDrainBudget as ko, findDestructiveChanges as kr, refuseMalformedResourcePropertiesForDrift as ks, diffSecurity as kt, validateAssetBucketName as ku, STREAM_POLICY_KEY as l, getCurrentResourceSecrets as la, toFiniteNumber as lc, resolveUseCdkBootstrapAssets as ld, noEchoAttributeNamesOf as li, errorCauseChain as ll, isAccessDeniedError as ln, envCredentialsAreAssumedRole as lo, resourcesNamingDeclaredParameter as lr, malformedScrubResourceEntriesRefusalMessage as ls, IMPLICIT_DELETE_DEPENDENCIES as lt, stackInstanceIdCarriedFrom as lu, reverseMapStreamPolicy as m, CloudControlProvider as ma, configStringRefusal as mc, CFN_TEMPLATE_URL_LIMIT as md, createReadOnlyAttributeHealerFactory as mi, withoutPhysicalNameCopies as ml, refactorMarkerMovesOf as mn, coerceParameterTypedValue as mo, secretBearingStateKeyWarning as mr, refuseMalformedOrphanRecords as ms, findServiceTokenRefusals as mt, isSensitiveAttributeName as mu, recordedProtectionEvidence as n, ccBrokenReason as na, isStatefulRecreateTargetForReplace as nc, loadCdkJson as nd, isSupersededResourceRecord as ni, logOnlyValueCount as nl, isHandledOrphan as nn, assertSendableRoleArn as no, retiredAfterRollback as nr, malformedOrphansWarning as ns, sendTtlWaitingOutRateLimit as nt, hasUnverifiableParameterRefusal as nu, perType as o, TemplateNoEchoReresolver as oa, coerceWarmThroughput as oc, resolveSkipPrefix as od, supersededHolderOf as oi, shareLogOnlyValues as ol, sameJournaledOrphans as on, AWS_CREDENTIAL_ENV_KEYS as oo, computeParameterTaint as or, malformedResourceEntriesWarning as os, isTruthyCfnBoolean as ot, orphansAfterRollback as ou, planStreamMemberOps as p, customResourceResponseExpirationWarning as pa, configIntegerRefusal as pc, CFN_TEMPLATE_BODY_LIMIT as pd, withAttemptedItemsMasked as pi, withPhysicalNameCopies as pl, readRefactorMarkerOnce as pn, regionLessSecretName as po, secretBearing as pr, refuseMalformedNestedChildOutputs as ps, deferredServiceTokenWarning as pt, AssetPublisher as pu, planVectorIndexUpdates as q, resolveDynamicReferences as qa, liveMatchesUnresolvedTokenFrame as qc, planTagDiff as qi, isNotImplemented as ql, REDACTED_DELETE_ADDRESS_SKIP_REASON as qn, malformedExportNamesWarning as qo, bold as qr, findHandledUnwrittenCreateOnly as qs, revertNestedChildFromJournal as qt, runDockerForeground as qu, recordedProtectionNote as r, isCustomResource as ra, isStatefulRecreateTargetSync as rc, resolveApp as rd, removeSuperseded as ri, printingCorpusOf as rl, journaledOrphanLines as rn, explicitRoleArnOrThrow as ro, retiredNameGenerationsAfter as rr, malformedOutputsRefusalMessage as rs, ECR_AUTO_DELETE_IMAGES_TAG as rt, importableOutputKeys as ru, readProtection as s, readsNoEchoDeleteValues as sa, isWarmThroughputDecrease as sc, resolveStateBucketWithDefault as sd, supersededResourcesOf as si, unionOfSecretBags as sl, formatResourceLine as sn, applyCallerIdentityCredentials as so, namesAnyDeclaredParameter as sr, malformedResourcePropertiesWarning as ss, getPriorAttempts as st, orphansCarriedFrom as su, DeployEngine as t, ProviderRegistry as ta, MULTI_REGION_RECREATE_BLOCKED_TYPES as tc, getLegacyStateBucketName as td, holdsSupersededResources as ti, literalSplitDelimitersOf as tl, dropFailedHint as tn, assertFlagRoleArn as to, nameScopeOf as tr, malformedOrphansRefusalMessage as ts, readTtlSpec as tt, hasReasonlessBaselineRefusal as tu, STREAM_TAGS_KEY as u, withPrintingSecrets as ua, coerceCfnBoolean as uc, stateBucketExistenceConfirmed as ud, noEchoComparisonForTemplate as ui, maskSecretsInError as ul, lookupEachName as un, classifyRecordedSecretRegion as uo, WITHHELD_NAME_DISPLAY as ur, malformedStateRefusalMessage as us, computeImplicitDeleteEdges as ut, PhaseClock as uu, streamPolicyMatchesDeclared as v, RollbackInlinePolicyWriters as va, requireConfigObject as vc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vd, namingSecretsWithRecordedNoEcho as vi, pathCrossesDottedKey as vl, updateRefactorMarker as vn, isImpossibleEmptyStoredAttribute as vo, exportNameSecretExposure as vr, refuseMalformedOrphansForOrphan as vs, isAbsoluteAssetPath as vt, createAssetRedirectResolver as vu, planIndexContributorInsightsOps as w, isWaitAbandonedError as wa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as wc, AssemblyReader as wd, stateSecretNameNeedles as wi, physicalNameCopiesOf as wl, replayRollback as wn, cfnRefValueFromPhysicalId as wo, bindingSkippedOutputs as wr, refuseMalformedResourceEntriesForDestroy as ws, parentSuppliedValues as wt, ensureAssetStorage as wu, contributorInsightsRefusals as x, deleteLeftInPlace as xa, templateResourceTypes as xc, PARTITION_TABLE as xd, secretNamePrintingBags as xi, inheritNestedStackParameterAssociations as xl, pendingMovesRefusalMessage as xn, isNamelessDynamicReferenceError as xo, collectDeclaredOutputNames as xr, refuseMalformedResourceAttributesForOrphan as xs, templateIdentity as xt, AssetModeResolver as xu, streamTagsMatchDeclared as y, UNSPECIFIED_SKIP_REASON as ya, requireConfigString as yc, decodeListingKey as yd, orphanRecordsPrintingBag as yi, spelledKeysOf as yl, hasPendingMovesOut as yn, carriesDynamicReference as yo, isWholeDynamicReferenceValue as yr, refuseMalformedOutputs as ys, listNestedTemplateRows as yt, loadPublishableAssetManifest as yu, resolveDynamoDbDeleteBudgetMs as z, IntrinsicFunctionResolver as za, noEchoCoordinatesOf as zc, resolveAssemblyPath as zd, acquireIdempotencyToken as zi, isLockInfoExpired as zl, recordUnderIdIsNotOwn as zn, deployRefusesOrphanRowsReason as zo, parseMappingFile as zr, repairMalformedResourceEntriesForReadOnly as zs, recordRetainedForReadoption as zt, formatDockerLoginError as zu };
+//# sourceMappingURL=deploy-engine-BC5pwkqY.js.map